Rob Terrin

@lawyer4SMBs How would you prepare for #4 (especially since searching is hard enough)?

5 things nobody tells you before you buy your first business: 1. The seller's mood swings will cost you more sleep than the bank will. 2. Your lender's timeline is not your timeline. Plan for it (Live Oak, Byline, Newtek — none of them move on your schedule). 3. "Add-backs" is where sellers get creative. Verify every single one. 4. The scariest year isn't the search. It's year one of ownership. 5. The best downside protection you'll ever have is a seller note w/ forgivability. The one people skip is #4. It's the most psychologically expensive one if you’re not prepared.

@Surveil__Lance @ZackKorman @drydenwtbrown sounds like we agree

> and "unless you're a very high value target" “Do you have any idea how little that narrows it down?” China does an immense amount of large scale espionage, as a matter of public knowledge. China has been caught burrowing in to critical infrastructure, as a matter of public knowledge. Russia has penetrated top tech companies, among other things, as a matter of public knowledge. > it's no different than having poor infra security if you use a US company's model weights You’re right that there are publicly documented instances of general-use open source software being tweaked by advanced threat actors, such that they get in the software supply chain. The risk is never 0. But also consider China’s inherent control over every Chinese company and publicly documented cases of major products being default collection platforms for the CCP. Sometimes they really are out to get you.

China's anti-American open source dumping strategy is brilliant from a PR perspective. They knew greedy VCs (who want to pump OS, inference, deployco, and rollup bets) and open source ideologues would run cover for them.

I said "nearly" and "unless you're a very high value target" because I was being precise with my words. Also, the infrastructure security is beside the point. That's not the threat model we're talking about, and it's no different than having poor infra security if you use a US company's model weights. I appreciate your take on this topic though.

No, you haven't is the thing. Unless you're convinced your internal security is rock solid and no one could ever penetrate it. Which would be bold. If the Chinese find a way to backdoor a commonly used AI they can try exploiting at scale whatever they want. It will be nigh impossible to detect in advance. They can hide it even if detected as "just agents misbehaving lol how dumb is AI right?" This a known threat model for infra and software products made by China and Russia and it is the height of stupidity to think that just because we haven't PROVEN it in AI yet means it's not a significant threat. Some of you have never worked for a nation-state threat actor and it shows.

@Surveil__Lance @ZackKorman @drydenwtbrown Yes, I was confused, and Zack clarified what he meant. If you're running the model weights on your own infra, you've mitigated nearly all of the potential risk, unless you're a very high value target.

@ZackKorman @drydenwtbrown Ok, someone already tried. You're just confused. x.com/RobTerrin/stat…

@yrechtman People should use real words

Past a certain age, cracked glazing mogging maxxing can be a bad thing.

@AlexKolicich What little changes are you seeing?

Big things have small beginnings

Resources like this are super helpful but man does it show how ridiculous infosec certs have gotten 350 certs from almost 60 vendors many over $1,000 dragkob.com/security-certi…

@johnloeber commoditize the compliment

Releasing frontier open models has a commoditizing effect: it becomes harder to charge a surplus for the model, so the value capture moves to a different part of the stack. Most likely, it moves to hardware: data centers, chips, electricity. Industrial capacity, China's Strength.

The bar is very low Zack, and that is not how the vast majority of Kimi users are accessing the model. But yes, if you specify that people are self hosting and just using the model weights in their own inference engine the risks are really just data poisoning, which is something, but not the issue many are making it out to be. That threat is much more like TikTok, pernicious, but not a direct attack.

@RobTerrin “Don’t run on Chinese servers” feels way too obvious to say

The big AI labs want to convince you that Chinese AI models are especially dangerous. That claim makes no sense and misrepresents how agent security works. I made this video to explain.

If you're running on your own infra that's different (and expensive), but the vast majority of cases people are not running their own infra. More likely, if you're not using Moonshot's interfaces, you're using Groq or OpenRouter. Groq should be fine, but OpenRouter may or may not use the Moonshot API depending on the implementation. This is the nuance I would have liked in the video, but maybe that's too boring.

@RobTerrin How would they do that? To clarify we are talking about running the model on your own infra, not theirs. They’d need the model to decide to do that. And you’d see it, naturally

@ZackKorman Your video addressed why they wouldn't burn this asset on getting C2 by hijacking your agents (I agree that's crazy talk), but I'm talking about simply stealing all the information that you share with an LLM.

@RobTerrin Of course it’s real. This would just be a clinically absurd way of doing it

@connorpera Great post! Couldn't have said it better. 👊

Training BJJ the last 7-8 months has genuinely changed my life. Can't recommend it enough. The humility is the mind-blowing part. If you're feeling like a big shot, go step on the mat at your local gym. You'll get brought back to earth in about 90 seconds – probably by a quiet guy 40 pounds lighter than you. It delivers everything combat sports promise: conditioning, discipline, instant feedback, staying calm under pressure, having nowhere to hide. But the humility is the thing that follows me off the mat. Once you've been tapped 10 times in a night by people who were nice about it, you stop walking into rooms assuming you're the smartest one there. You ask more questions. You listen differently. That alone is worth the membership.

@ZackKorman Absolutely watched it! Good video on the whole, and I think you're right about prioritizing the risk of agents doing dumb stuff. I'm just wondering if you think Chinese industrial espionage is a real thing or not. I get that it's not most people's threat model.

@RobTerrin Did you even watch what I said? Or comprehend it? Like I know you tend to argue with me a lot but what does this comment even mean

@FunlessSponsor @PadraicMcC Such a great thread! Thanks for sharing. Very glad I went the traditional search route. Lots of the same issues, but feel better about my strengths/weaknesses in this model.

(13/13) I should say thank you to two guys, and they might be a little surprised by this. @paulswaney3 for being a bit of a sounding board from time to time and for just pumping value into the transaction world of X. @PadraicMcC for offering assistance to me (a completely anonymous stranger) while we were knee-deep on a deal last summer. I won’t say exactly how he offered to help, because I don’t want the world blowing up his DMs. But he was exceptionally kind. Both guys deserve your follow.

We closed our first deal as an independent sponsor a few weeks ago. It’s a nice service business with good margins in a niche corner of the market. We’re in at a fair price with reasonable incentives for everyone involved. If we execute, we’ll do well. You might think that I’d write a thread espousing all the tips and tricks that we used to execute this acquisition. That’s not this thread. We’ve been at this for 3.5 years and just closed our first deal. Here are all the things I wish I’d known as a non-PE guy co-founding an IS firm. I have a small audience on X, but hopefully this is valuable to a handful of folks. If not, writing this was a good exercise for me to reflect through. Sorry in advance. No sunshine and rainbows here.

@hoffman_capital @SuccessWithJake It's usually fabric backdropsource.com/collections/se…

@SuccessWithJake Yeah how do you ship and assemble it? Rough all in cost? I’d be curious to get one for my events ..

We are getting requests to build these custom postcard backdrops a lot lately. Planners see it at one event, then want their own version.

@ZackKorman Feels like your least controversial take to me. I'm sure the internet will agree...

AI doomers want us to believe in the cyber apocalypse, where evil hackers use advanced AI capabilities and cause mass chaos. There are so many reasons why that is very unlikely.

@KTmBoyle Thanks for sharing this. Ordered the book immediately! Mine are younger, but I'd love to get their bookshelves full of great poetry and classics early. Any other recommendations for the kid canon?

There’s a critical moment from around age 4 to 6 where kids can memorize pretty much anything they hear if it’s repeated every day. It’s a short window, but the most important books need to go in it. Children can process beauty. It’s not all Baby Shark.

@TylerFlinchum @HockJohannes @jamesonhaslam Yes. I think he's not talking traditional search where the principal is drawing a salary only a bit below what he's saying is market, taking no PG risk and stands to own 16-25% at exit if they can clear their hurdle rate, which is much more modest than the full carry at 35% IRR.

@HockJohannes @jamesonhaslam Isn’t this conflating self-funded and traditional search though? A 25% equity deal is likely more in traditional land where the searcher isn’t PGing the debt and therefore has zero bankruptcy risk.

In light of another WSJ search fund article dropping, here's a hot take. I don't think a 5x EBITDA deal with 25% equity is worth it for the searcher. It doesn't sound like much, but the difference between 10% and 25% equity almost cuts your economics IN HALF, while your bankruptcy risk barely goes down (more on that below). In my opinion, self-funded search has always been one thing: you take a ton of risk (lever up with PG) and if you survive, you are set for life on a single deal in about 5 years. That's what the math works out at 4x EBITDA and 80-90% ownership. It doesn't work out at 5x EBITDA and <50% ownership. The latter is a bad economic trade for the searcher. You'll hear every investor tell you to overequitize. Yes, that does derisk the deal, but the real winners are the investors here. What good does a deal do you that still has a ton of risk but you don't have homerun upside on the other side. The potential to make $1-2mm over 5-7 years with a ton of risk is not a good trade for the average searcher. Most of you can just keep a $200-400k job with no bankruptcy risk. For the deals I have seen gone bad, having 75% debt instead of 90% would not have saved them. In small businesses when things go bad, it's often binary. So all that extra equity you raised barely reduces risk and but gives a ton of the upside to investors. 6 months of fixed cost is plenty of cash in the bank. If it takes more than that, the business likely wasn't going to make it anyway. And yes, someone will bring up a scenario where a business was saved by having 7 months. Doesn't matter, when you are going down this path you are playing the average odds. If bankruptcy is an impossible risk for you, then don't get SBA debt. You're better off getting paid carry at that point. TLDR I don't think signing the PG is worth it if you don't have the chance to be done if your deal works out.