Your website lists 'Services' team-members as being required to work on a physical site, what other teams do you have? I am under the impression from your website that Services includes most Consultant and Penetration-Testing type positions; would you say that's correct?
A couple years ago, in our old office at the top of the Monadnock building, I'm working on code for a product we're doing while Vitaly is working on a pentest for a big Rails client, and, like, 5 other people in the office are working on 5 other things.
I'm procrastinating while noodling through some stupid Riak thing and so I hear Vitaly say something about how some request he sent to the app produced binary gibberish in the response.
It turns out I'd rather noodle around with Vitaly's app than figure out how to make Riak do whatever basic thing I want it to do, so I walk over and look at the response. Vitaly has already noticed that the "binary gibberish" is actually corrupted in the response headers; the response is corrupt.
We both agree out loud that this is unusual and bad. A couple other team members walk over. In the span of about 4 minutes we figure out that the bug is triggered by inputs that include NUL bytes, and responses appear to be corrupted at the point where the input is, in the headers, echoed in the output. And a few reloads show that what looks like gibberish is actually stale server memory.
This is that nginx bug that came out back when. It's approximately as bad as Heartbleed, except that it only affects nginx (and it has a more complicated trigger condition, albeit one that applies to virtually every web application). And because we were all together in the same room when Vitaly found it, we isolated, analyzed, and weaponized it in minutes, rather than in hours or days.
(Ironically, someone else had noticed the same bug on the same day, and [fair enough!] got the reporting credit.)
Stuff like that happened all the time at Matasano. The in-person requirement is one the company is unlikely to let go of --- not that I have any say in it anymore. ;)
It wasn't because you were all together in the same room, it's because you were communicating effectively and you're assuming there is no way to replicate that level of effective communication without being in the same room.
With proper tools and training, everything you did in that room could have been done over the internet instead. There are communal whiteboarding apps, collaborative code editing apps, amazingly expressive chat apps like Slack, not to mention good old fashioned audio/video chat tools.
It can be done. It is done frequently, every day. It makes me sad to see so many people on a place like Hackers News, dedicated to building the internet's Next Big Thing repeatedly claim that it's not possible to collaborate as effectively on the internet.
It's truly ironic.
It is nearly impossible to just throw a new toolkit at a company and expect them to be able to thereby switch from an in person culture to a remote one.
It requires a transition of culture, which in turn requires both vision and support of the switch from the leadership of an organization.
Certainly remote collaboration works. But there is more to it than just flipping a switch or adding some tools.
Working remotely is a skill unto itself like any other and it must be developed and honed across an organization.
I guess what frustrates me is so few people see a need to develop and hone that skill. Some even actively argue against doing so.
Most of us like working in an office close to home, and don't like traveling a lot. It works for us.
That's too bad, since this is a place that looks like it'd be very interesting to work at, but with no degree there's no chance in hell I'd be allowed to work in the US (at least so previous attempts have told me), and it looks like remote is a no-go.
All I can really say is that we have a culture of cooperation and interaction that relies, in part, on physical proximity. It may change in the future, but for now we prefer folks to be in the office where they can interact with others with less friction.
We're a lean company, so 'Services' encompasses all positions for which we're hiring.
If you see remote as something that causes friction, I'd recommend looking at teams that swear by it reducing friction (like the friction of noisy offices and unnecessary commutes) and checking out the techniques they use to make it work so well.
Gingerly, I'm going to go ahead and suggest that "incompatible with HN user 'kethinov" is not quite the dealbreaking deficit you're giving the impression that it is.
If you'd like to do appsec work remote, let me suggest Accuvant, Leviathan, and IOActive as alternatives. All three have remote teams. In fact, I believe everyone on the pentest team at Accuvant is remote. You never have to interact with your coworkers in person there at all.
It's entirely reasonable that some people prefer proximity over remote arrangements. People who don't aren't likely to enjoy working at Matasano. That doesn't negate the existence of other perfectly good options for them, as tptacek pointed out.
It saddens me that you chose to ignore the substance of my argument and focus on visiting my intentions instead.