Silicon Graphics Declares Bankruptcy and Sells Itself For $25 Million - <AUTHOR> http://www.techcrunchit.com/2009/04/01/silicon-graphics-declares-bankruptcy-and-sold-for-25-million/ <comment><USER3> There's probably young-uns here who don't know who Silicon Graphics is or what they did.

Silicon Graphics sold proprietary unix systems that were very heavily optimized for doing graphics rendering. Their workstations sold from $10,000 on the low end to hundreds of thousands of dollars. They were expensive, but if you wanted to do real time 3D stuff for animation, visual effects, CAD applications, or any type of graphics modelling, they were the only game in town, and you pretty much _had_ to use their boxes.

Their products were amazing in their time, and they pushed the state of the art in computer graphics hardware for years. But, between the ability to create relatively cheap linux based render farms with commodity hardware on the server side, and ATI/NVidia creating great plug in graphics cards for PC's/Workstations, SGI wasn't able to compete. They slowly died and faded away into obsolescence. Some of the last remnants of their technology that people interact with frequently is the OpenGL api.

Silicon Graphics, you will be missed.

<comment><USER4> They also bought Cray.

<comment><USER5> And sold it for a LOT less than they paid for it. That couldn't have helped their financial situation any.

</comment></comment></comment><comment> patrickg-zill SGI killed themselves, just took a long time to die.

They had geniuses working in their graphics side, and when they decided some 15 years ago that "Unix was dead" and WinNT was the future, those geniuses left for Nvidia and other places. SGI never recovered and ended up reselling supercomputers with ATI cards in them.

<comment><USER6> For what it's worth, MS bought the companies that made a lot of the killer apps for SGI and ported them to Windows-only.

It wasn't pure suicide, Microsoft helped.

<comment><USER7> Which companies/products were those?

<comment><USER8> Softimage for example - once they have done the port to WINNT and showed the world it can be done on that platform they have sold Softimage to AVID - <USER2> recently sold it to, where all good applications die, Autodesk (Microsoft in shadows)

</comment></comment></comment></comment><comment><USER9> <http://en.wikipedia.org/wiki/Standard_Template_Library>

<comment><USER10> Thanks for the link. Can you add some context for why you think this is relevant ot the topic?

<comment><USER11> the C++ STL library was based off of the header based standard developed at SGI. So if you've used STL before in C++, you're building off the work that came out of SGI.

<comment><USER12> Oh memories, I remember spending a lot of time here:

<http://www.sgi.com/tech/stl> (SGI's STL documentation)

</comment></comment></comment></comment><comment><USER13> Damn, SGI is right there with Digital in the category of amazing companies that brought us amazing advances and didn't deserver the fate that befell them.

...looks like Sun might be the next member of that club...

</comment><comment><USER14> I worked there as an intern back in 2000. I did chip circuit verification, and saw that they had roadmaps for their future products up to around 2006. The group I was in was designing server chips and their interconnects to make clusters of high performance super computers.

I recall that they knew Intel was making dual and quadcore chips that would kill what they were doing, but had no solution how to turn the ship around.

It's too bad. There were some solid engineers there, especially the ones that came from Cray.

</comment><comment><USER15> I assume the 25MM value is in the patents and research?

<comment><USER16> Not really. It looks like they are carrying a considerably amount of debt (half a billion). They list their assets at some $100 million below that.

I'd be surprised if a lot of the core patents/IP hasn't already been sold off.

</comment></comment><comment><USER17> Anyone know WHY? What are they paying 600m for?

</comment><comment><USER10> Giving up IRIX for WinNT? Well. Death to the unbelievers I say. I never forgot the shock when they had those ads with ther PeeCees in the computer magazines. Up until that point SGI and SUN where kind of the good guys to me.

Now, how could they have done it differently? I'd say: build up the lead in gaming consoles and developer workstations they had ad the time. IRIX/MIPS had also some technical advantages over Linux-Clusters in some niches like military simulations. They could have become some sort of NVidia in our days. Does any one has a more qualified strategy / commentary about SGI's demise in the markets to offer? Thanks.

<comment><USER18> SGI clearly had the cutting edge graphics technology and hardware - In my mind, the 3D video cards killed them very quickly and made SGI obsolete. As you may recall, when the 3Dfx Voodoo's were hitting the market, SGI did nothing at all, thinking that they still had the market cornered. Then came ATI, Creative, Nvidia etc. Back then there was the delineation between 'gaming' video cards and 'workstation' video cards, the latter having the premium price. SGI could have positioned themselves in both areas, especially the workstation cards.

It was a classic case of a large, entrenched, slow moving company getting thwarted by startups. Too slow or unwilling to act / react...

<comment><USER19> It seems a pretty good example of how important talent is vs. the shingle outside the door.

3dfx was founded by ex. SGI talent - Gary Tarolli, Ross Smith and Scott Sellers. (Garry Tarolli wrote dogfight)

</comment></comment></comment><comment><USER20> And Jim Clark 'marries' while ROM burns.</comment>


A Mathematician Who Decodes the Patterns Stamped Out by Life - <AUTHOR> https://www.quantamagazine.org/a-mathematician-who-decodes-the-patterns-stamped-out-by-life-20171220/ <comment><USER2> A good video of her work [https://www.youtube.com/watch?v=nJGpABrEatc](https://www.youtube.com/watch?v=nJGpABrEatc)

<comment><USER3> Nice followup on how termite mounds support biodiversity and fit into the larger Savannah ecosystem: [https://www.youtube.com/watch?v=8eH6X2rAQEs](https://www.youtube.com/watch?v=8eH6X2rAQEs)

</comment></comment><comment><USER4> Somewhat ambiguous headline - I thought maybe she had died.

</comment><comment><USER5> To me, the title meant that she understood subtle relations between apparently unrelated facts in life and how to make the best of them. Did not expect that she studied fairy circles on a Namibian landscape.

"Instead of office chair package contained bobcat. Would not buy again." [https://www.explainxkcd.com/wiki/index.php/325:_A-Minus- Minu...](https://www.explainxkcd.com/wiki/index.php/325:_A-Minus-Minus)</comment>


Death by Database: a short story of how a bad schema can hurt you company - <AUTHOR> https://ovid.github.io/articles/death-by-database.html <comment><USER2> Is that really "bad database design"? Sounds a lot more like "perfectly fine design for the original use case".

Re/Abusing a customer database based mass mailing tool to send non-customer mass mailings is a new use case, so requires changes either a) on the database side - or b) in the mass mailing tool (to use another database table that is not connected to the customer side of things). I would have preferred b) for many reasons.

<comment><AUTHOR> Did you catch the part about duplicate/misspelled addresses? The design wasn't even fit for the original use case.

<comment><USER2> Yes, but that is an unrelated mess (and another reason not to reuse anything of that db for non customer mailings).

The simplest fix for the "duplicate/misspelled addresses" indeed was to remove the "unique address" requirement and just let each customer have its own set of addresses that are only connected to that customer.

Letting an address be connected to multiple customers (many to many) sounds great in theory, but is a disaster waiting to happen in practice.

Also, is a couple actually one customer or two separate customers? What about the customer's "friend"'s address in the system?

Of course this is all from the outside, knowing nothing about anything on the inside - so there might have been good reasons for why it all was how it was.</comment></comment></comment>


Have kids (or are YOU a big one)? Kindly draw on our startup X-Worlds - <AUTHOR> http://x-worlds.com/?s_id=hn X-Worlds is a new hang-out for kids which let's them bring creatures to life!
We've just launched a sneak peak of whats going to be a very cool business model.
For now I'd love to ask any Hackers with kids to let them loose on the site and let us know how they react!
Drawings and donuts appreciated! :)
Thanks a million.
http://x-worlds.com/?s_id=hn http://twitter.com/x_worlds http://www.facebook.com/X.Worlds <comment><USER2> Nice work there guys!

Can't wait to see my creature come to life!! :)</comment>


Getting Started with Robots for kids and children - <AUTHOR> http://www.hanselman.com/blog/GettingStartedWithRobotsForKidsAndChildrenInSTEMThisHolidaySeason.aspx

<comment><USER2> The OWI arm takes a couple hours to assemble. A bunch of injection molded parts you have to pop out and snap together, along with a few screws in some places. The motors are just plain DC motors, no feedback or anything like that. My kids love playing with it.

I created a very simple Node API for working with the OWI Robot Arm + USB kit, you can get it from npm or from github.

[https://www.npmjs.com/package/owi-robot- arm](https://www.npmjs.com/package/owi-robot-arm)

[https://github.com/bigbang/owi-robot-arm](https://github.com/bigbang/owi- robot-arm)

I also had some fun with a project this summer turning LEGO Mindstorms EV3 kits into connected devices. They can send realtime telemetry to your mobile device, browser or other robots. We have done a couple pilots with them in classrooms as well as taking them to places like Maker Faire and Mozilla Hive events.

[http://thegigabots.com/](http://thegigabots.com/)

The Mirobots look really interesting, I definitely will check those out. I can also confirm the Snap Circuits kits are tons of fun, and my kids love playing with them as well.

<comment><USER3> Gigabots seems really interesting. I find the EV3 programming environment really confusing and would love to see it improved in some way. I don't see a lot of info on Gigabots since summer, is it alive?

<comment><USER2> The current incarnation of the bots are programmable with JavaScript. We would like to potentially extend them to include some visual programming as well, like MIT Scratch or Blockly. The lack of updates on the site is just a bit of laziness on my part, we have done events with the robots a few times in the last couple of months. If you have an EV3 kit and are interested in trying it out, let me know.

<comment><USER3> Yes please. First name @ last name .com

</comment></comment></comment></comment><comment><USER4> My kids have been doing LEGO WeDo robots [1]. They're targeted at a younger audience than the Mindstorms. They're kind of expensive, but both my six year old and my three year old love them!

The big reason I originally targeted WeDo was their programming interface didn't require reading, so both of my kids were programming before they could read :)

[1] -- [https://shop.education.lego.com/legoed/en- US/search/navSearc...](https://shop.education.lego.com/legoed/en- US/search/navSearchResults.jsp?topicName=Robotics)

<comment><USER4> I forgot to mention that we also have MOSS robots [1]. These are really fun and great for kids, but I have a couple of warnings on them:

1\. We have hardwood floors. When one of these robots falls apart, it is a _mess_. Handling them requires a bit of care too.

2\. I've had some trouble with what I think are bad blocks, but I haven't taken the time to troubleshoot them to make sure.

What I really like about them, though, is that it teaches programming concepts by clicking blocks together. There is also a C api as well that I am planning on playing with.

[1] -- [http://www.modrobotics.com/moss/](http://www.modrobotics.com/moss/)

</comment></comment><comment><USER5> Another robot for kids is called Riq [1]. It was on HN a few weeks ago [2] and one of the comments has a bunch of links to other robot kits.

[1] [http://riq.edventureslab.com/](http://riq.edventureslab.com/)

[2] [https://news.ycombinator.com/item?id=8748342](https://news.ycombinator.com/item?id=8748342)

</comment><comment><USER6> Also: [http://www.banggood.com/Wholesale-New-6-In-1-Educational- Sol...](http://www.banggood.com/Wholesale-New-6-In-1-Educational-Solar-Toys- Kit-Robot-Chameleon-p-13220.html)

Though beware BangGood takes a LONG time to stuff to the US from the China Warehouse.

</comment><comment><USER7> Missing the Sphero. Limited sensors I do admit, (though the motion sensors are damn good!) but its a ball you can program through macros or code. I really like it.</comment>


Humans.lol, the opposite of robots.txt, at SeatGeek.com - <AUTHOR> http://seatgeek.com/humans.lol

<comment><USER2> The entire site is inaccessible to me as I don't have Flash installed. Haven't tested it in Shumway yet.</comment>


Brandable domain names for sale - <AUTHOR> http://www.brandbucket.com/ <comment><USER2> Two interesting things hit me: 1\. Will this affect prices for brand-able names not listed here? 2\. Great resource for just brainstorming ideas.</comment>


The NSA, Germany, and journalism - <AUTHOR> http://buzzmachine.com/2013/08/20/the-nsa-germany-and-journalism/

<comment><USER2> I am surprised the author did not discuss Herman and Chomsky's propaganda model: [http://en.wikipedia.org/wiki/Propaganda_model](http://en.wikipedia.org/wiki/Propaganda_model)

I believe it accurately predicts mass media's biases in this situation.

The propaganda model says that propaganda is an emergent phenomenon in democratic societies. Similar to how macro ant-colony behavior emerges when individual ants follow simple pheremonal rules --- propaganda emerges when journalists, managers, PR agents, government officials, etc. each optimize for their local objective functions.

The relationships between all the agents in the system are complex, but ultimately, according to the propaganda model, mass media's incentives align with business and government incentives.

<comment><USER3> >The propaganda model says that propaganda is an emergent phenomenon in democratic societies.

This looks like almost exactly what Hilaire Belloc proposed in his 1918 book "The Free Press."

<comment><USER2> I just read a review for "The Free Press." [http://www.nytimes.com/2006/04/18/opinion/18tue4.html](http://www.nytimes.com/2006/04/18/opinion/18tue4.html)

To me it seems like they share some commonalities, but also have significant differences.

Belloc's main thesis seems to be that the Mass Media is "the true governing power in the political machinery of the State, superior to the officials in the State, nominating ministers and dismissing them, imposing policies, and, in general, usurping sovereignty — all this secretly and without responsibility."

I believe Manufacturing Consent somewhat agrees with that thesis, but Manufacturing Consent goes further by explaining how business interests align with mass media and government, and how it results in propaganda.

I haven't read "The Free Press" so perhaps there are greater similarities than what I could glean from the short NYT book review. After all, both "The Free Press" and the Propaganda Model predict that NYT aren't incentivized to give a fair review of "The Free Press."

</comment></comment></comment><comment><USER4> A micro statistic (in the languages I can somewhat understand):

On which rank is any NSA/Prism?Snowden story currently on the websites, where rank is either "most read" or "most commented"?

sueddeutsche.de: no. 1

lemonde.fr: no. 3

spiegel.de: no.2

nytimes.com

-most emailed: outside of top20 -most blogged: no. 1 -most viewed: outside of top20

washingtonpost.com: outside top5

foxnews.com: outside top5

usatoday.com: outside top5

latimes.com: outside top10

www.telegraph.co.uk

-most viewed: no. 1 -most shared: no. 10 -most commented: outside top10

Dagens Nyheter: no. 6

Berlingske: outside top5

NZZ.ch

-most read: no. 1 -most commented: outside top10 -most recommended: no. 8

Sydney Morning Herald: outside top5

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

Not really a scientific endeavour, but might provide some additional data points. I should probably do that more systematically when the next story hits. Maybe someone that knows some Eastern European, Asian or South American newspapers could add their data points, then we might be able to identify some trends. It indeed looks like the anglosaxons are more interested in other stuff.

(edit: changed some formatting)

</comment><comment><USER5> I can confirm this, even my 65 year old mom, who can barely use her iPad to Facebook started talking about this and was worried. And among the people aged Gen-Y, this is a huge and important topic.

Understandably, my worldview is totally skewed: I consume HN, Guardian, and German media.. In my little world, literally every site I visit and person I know talks about NSA/Prism/UK. It is weird feeling, then, visiting other media

<comment><USER6> Do you not beleive the Germans are in on it?

<comment><USER7> Do you mean the German government is in on the NSA spying? Certainly, they are in. The BND(1) is currently trying to state that it didn't know anything about the NSA practices _and_ delivered data to the NSA at the same time. So, they are either incompetent or lie to us. Take your pick. And the government is stating every day that everything is known by now, the NSA didn't do anything wrong and we should stop asking so much questions.

(1) The Bundesnachrichtendienst is the German foreign intelligence agency. A mix of NSA/CIA.

</comment></comment></comment><comment><USER8> I can't help to feel quite disappointed about the lack of integrity in modern media. It used to be the tool with which governments were torn down with, and ruthlessly skinning the politics to the bone.

Nowadays, it's more of a indirectly controlled propaganda machine, only with an interest in bottom-line profit, and pleasing the people above you.

The HBO tv-series 'The Newsroom' seems incredibly accurate, and relevant to the lacking quality of the media. To the point where i'd wish Will McAvoy was real.

<comment><USER6> There is no need for conspiracy, if media companies thought they could sell more advertisements you can be goddamn sure they would. They'll print anything to sell papers. The demographic really interested in the details of this are probably not who they are selling ads to.

<comment><USER8> It really isn't a conspiracy anymore. It's more like a statement of fact. Media in the traditional sense, just pure and simple, isn't what it used to be in more than one way. Maybe it's the people tweeting the news instead of articles that change governements now (not that i'd want that, but meant as in the expression).

I'm pretty certain the watergate scandal would never have ended the way it did, if it happened in 2013. It would just be dusted under the rug, and a retroactive law passed through to legalize the offense.

<comment><USER6> This story os everywhere BBC, NYT etc. Pretending there is a media blackout undermines credibility.

<comment><USER9> BBC has been very silent about all this compared to some other UK media.

<comment><USER6> As long as you define very silent as running stories every other day.

</comment></comment></comment></comment></comment></comment><comment><USER10> The article forgets to mention it is close to the Bundestagswahl (see [http://en.wikipedia.org/wiki/German_federal_election,_2013](http://en.wikipedia.org/wiki/German_federal_election,_2013)), on September 22nd. Some major news outlets confront the german government open in a very aggressive way, especially when it comes to intelligence agencies, and how the chancellor tries to play the problems down.

The freedom of press which is part if the german grundrecht (see [http://en.wikipedia.org/wiki/Basic_Law_for_the_Federal_Repub...](http://en.wikipedia.org/wiki/Basic_Law_for_the_Federal_Republic_of_Germany)) would be violated in very harsh way, if something like the guardian story would happen in germany. It adds fuel to the whole discussion how the uk and us treat their citizens and their allies.

Just for the record, the german government disapproves the usage of windows 8 for government usage, and has approved bitcoin as an currency-derivative.

</comment><comment><USER11> And the moment you enter the world of main stream media. This topic vanish into thin air and does not exist at all.

As many respectable people said so far all western countries are in a post democratic state.

</comment><comment><USER10> A different, very cynic approach would be that germany had a history of involving journalism into politics and the uk and the us trying to have it exactly that way nowadays.

Germany achieved it once with Gleichschaltung (see [http://en.wikipedia.org/wiki/Gleichschaltung](http://en.wikipedia.org/wiki/Gleichschaltung)) and the us seem to achieve similar results with it's 9/11 nationalism and advertising.

</comment><comment><USER12> Edward Bernays wasn't paid for nothing!

Contemporary society is a mess because we institutionalized the legitimacy of a voice in the form of for-profit journalists. Has anyone considered how long the journalist career has existed in its recent history form?

Before Guttenberg did we have for-profit journalists? I will indulge semantics here, but I suspect no one will argue that organized society existed for a long time before we delegitimized the primary sources of information--the person a journalist investigates--to legitimize professional secondary and tertiary sources of information(aka journalists).

In other words, complaining about the evolution of public information dissemination is utterly fruitless as it isn't actionable. I've made the bet that most career journalists are already marginalized and that the common person is and will continue to marginalize the career journalist and the institutions that legitimize them.

Primary sources disseminating public information if the future.

You are the journalist now!

<comment><USER10> s/journalist/editor/g

<comment><USER12> The individual certainly takes on more of those responsibilities today, but the community has a lot of input on the process that they didn't have before.</comment></comment></comment>


Show HN: Panther v1.0 – Open Source, Cloud-Native SIEM - <AUTHOR> Hey HN,
My name is Jack Naglieri. I'm the founder of Panther Labs - an SF-based cybersecurity startup. Prior to Panther, I was an engineering manager at Airbnb. Before that a security engineer/analyst/forensic analyst.
Today, I'm excited to announce Panther v1.0, an open source, cloud-native SIEM:
http://github.com/panther-labs/panther
Teams can use Panther as an alternative to traditional SIEMs like Splunk.
Panther is the culmination of our team's experience building security tools at scale, including StreamAlert at Airbnb and critical internal monitoring systems at Amazon.
Panther runs entirely on serverless to enable small teams to detect threats at scale. Our backend is Golang and our frontend is React/Typescript. Panther is also self-hosted and uses Python3 for flexible detections.
At a high level:
- Panther receives security logs
- Panther baseline scans cloud infra and determines security posture
- All data is saved to your data warehouse (powered by Athena/Glue/S3)
- Alerts are dispatched to your team via Slack, PagerDuty, etc
- Automatic remediations can also be applied to fix infrastructure
Panther v1.0 includes support for:
- Analyzing logs from AWS, OSS tools such as Osquery, OSSEC, Suricata, and more
- Threat hunting on all your security data with standardized fields (IPs, domains, etc)
- Real-time cloud configuration monitoring
- 150+ built-in detections
- A UI for creating, updating and tuning detections
To get started:
- Quick-start: https://docs.runpanther.io/quick-start
- Read our v1.0 announcement: https://blog.runpanther.io/panther-v1-open-source-siem/
- Register for our webinar tomorrow: https://webinars.runpanther.io/panther-101
You can also find us on Slack (https://panther-labs-oss-slackin.herokuapp.com/), Twitter (@panther__labs), and Github (github.com/panther-labs/panther).
We're happy to answer your questions. Just drop a message here.
Thanks!
We also send our best wishes to those affected by COVID-19 <comment><USER2> For those of us that didn't know: SIEM = security information and event management. Things like analyzing security logs, failed logins, audits, and much more, I'm sure.

[https://en.wikipedia.org/wiki/Security_information_and_event...](https://en.wikipedia.org/wiki/Security_information_and_event_management)

<comment><USER3> Thanks! That expansion should really be at the very beginning of the GitHub README, and as early as possible on the runpanther.io page. Don't drive away potential customers who don't know your magic phrase.

<comment><USER4> For what it's worth, the target market for this will all know what SIEM means, and anyone who doesn't know what SIEM means isn't the target market. To a certain extent if you explain what it stands for you might have to explain what it's for and then how to use it... that's probably just beyond the scope of what they intend in the README.

<comment><USER3> Okay, you're clearly not a marketer, but maybe try to think like one for a moment.

What you've said, in effect, is, "Gee, someone came to the site with some interest (say, from a Hacker News link) but no idea what this secret sauce is. Screw 'em! Gem them out of here!"

Alternatively, if you give them an idea of what they're looking at (and no, I don't think you have to drill down to every tiny detail on the front page), maybe they'll realize, "Hey, that's something I should at least look into."

<comment><USER5> They shouldn't look into it though, is the point. He's not being elitist or gatekeeping. He's saying that because managing a SIEM is going to be a huge waste of resources for anyone but a dedicated incident response team.

I suspect that a layperson, they might be getting the impression that this will alert them to security incidents. It will not really do that. It is not an intrusion detection system (which also are not very useful, but I digress). It will be 99.9999999% noise, and an experienced team will have a sense of what they should bother paying attention to, and still spend most of their time chasing dead ends.

It would be like if someone announced the release of a compiler, without explaining what a compiler is. Someone might reasonably say, if you don't know what a compiler is, this isn't solving a problem that you're worried about.

</comment></comment></comment></comment></comment><comment><USER6> Congratulations on the launch! Glad to see more options for SIEMs, my experience is that most of them exist for a compliance checklist rather than to provide any value for security teams (alert fatigue being the biggest offender).

<comment><USER7> For a checklist, you are better off contracting out a MSSP. If you pay for and maintain a SIEM, I hope you are extracting value from it.

</comment></comment><comment><AUTHOR> For those who had a pre-release of Panther deployed, check out our release notes: [https://github.com/panther- labs/panther/releases/tag/v1.0.0](https://github.com/panther- labs/panther/releases/tag/v1.0.0)

We are also available on Slack to help out!

</comment><comment><USER8> Nice work ! I wonder how this compares to Graylog which is another open- source(quite mature) project. Graylog SIEM looks and feels exactly like enterprise SIEM Splunk.

<comment><AUTHOR> Thank you! I'd say the biggest difference is that Panther uses Python3 for detections and SQL/Presto for searching the data. This gives analysts/engineers more freedom and flexibility to find what they're looking for.

We also utilize open source or cloud-native transport mechanisms like fluentd/s3/etc, verses rolling our own.

</comment></comment><comment><USER7> The bane of any SIEM is data ingestion costs. I need to put every log in it but with cloud, not only do I have to worry about resource costs but also data bases pricing models for the SIEM license. Imagine I need to ingest data from 500K endpoints including 500k users and their web,ip,dns,authentication and endpoint event logs (Sysmon for example). Can I do this for under $6/user ($3M) including support costs? Edit: just a thought here, perhaps onprem agents to summarize logs before shipping to cloud storage might help?

Also, since this seems fairly new, do you have SOAR platform integration already? That's a major selling point these days, I need it to play well with automation.

Lastly,many have tried and failed to compete with Splunk's query language.Does this have a query langauge that can compete? I don't need it to detect threats out of the box, if I need a SIEM then I also need to rapidly change correlation logic and for that I need a good query language which is very rare even with top dollar traditional SIEMs.

<comment><USER9> It's Apache licenced, so presumably ingest / transit, compute, and storage costs are whatever you normally pay for them.

<comment><USER10> The source licensing here is a mess, AGPL, commercial, etc. [https://github.com/panther- labs/panther/blob/master/LICENSE](https://github.com/panther- labs/panther/blob/master/LICENSE)

My read of the license file, is there seems to be some purposefully introduced license confusion and mixing of proprietary/commercial non oss files into the same repo, which makes it really unclear if this is OSS per OSI definition, if running git log will taint a contributor.

The compiled binaries assets are available under Apache 2.0, which appears to be a marketing tactic to capitalize on the name, while being completely unrelated to the actual source license, aka this is closer to free to use binary. IANAL but afaics most orgs should talk to a lawyer if they want to use this as OSS.

moreover this line in the readme also appears to be purposefully sowing confusion, "Panther is dual-licensed under the AGPLv3 and Apache-2.0 licenses." except they actually appear to redefine the common usage of dual license, to mean that parts of the code base are selectively licensed one or the other.

<comment><USER9> This is great insight, thank you.

I'd originally just looked at the LICENCE.txt file in the top level, thinking this was presented as a standalone application suite from a single author / company - so I approached it with certain (perhaps naive) expectations.

</comment></comment></comment></comment><comment><USER11> Nice to see an Open-Source Project in this area. But I don't see the point of "just another" SIEM. Why is everyone trying to collect, normalize and and trigger on log data?

Logs are probably the worst source one can have. And its faulty by design. Why not think of something new? A better source for your data would be something to start with. Maybe an intelligent infrastructure for data collection could make it more useful with more relevant data. Only ship relevant data from relevant sources if additional info is required. Maybe that would be a great solution. It would at least be something new.

</comment><comment><USER12> Clickable repo link here:

[https://github.com/panther-labs/panther](https://github.com/panther- labs/panther)

</comment><comment><USER13> Congrats Jack. Really excited to see where Panther is headed - code based detection is the future!

<comment><AUTHOR> Thank you!! It definitely is the future.

</comment></comment><comment><USER14> Great to see an open-source alternative to Splunk SIEM!! Thanks for making this and all the best.

<comment><AUTHOR> I'm sure a lot of teams will be excited about something new. We are taking a more cloud-centric, automation-first, and big data approach that should alleviate most of the overhead/cost.

</comment></comment><comment><USER15> Hi Jack! I worked with you a long time ago. Congrats on the launch!

<comment><AUTHOR> Hey! Thank you :)

</comment></comment><comment><USER16> Congratulations on the launch and the product looks great! Are there plans for allowing 3rd-party integrations?

<comment><AUTHOR> Thanks! What type of integrations? On the input or output side?

</comment></comment><comment> rob-olmos Is calling a custom script for an alert notification going to be an Enterprise level feature?

<comment><AUTHOR> Nope, that's available in OSS!

Alerts can deliver to SNS/SQS, which can invoke a Lambda function running your custom script:

\- [https://docs.runpanther.io/setup/sqs](https://docs.runpanther.io/setup/sqs)

\- [https://docs.runpanther.io/setup/sns](https://docs.runpanther.io/setup/sns)

</comment></comment><comment><USER17> Is this a spinoff of StreamAlert? Any differences between the 2?

<comment><AUTHOR> Yes, I was the original core dev of StreamAlert during my time at Airbnb.

I'd say the biggest differences are that Panther:

\- Has a UI-driven workflow (vs CLI)

\- Has an improved design to be more scalable and cost-effective

\- Is written almost entirely in Golang

\- Made a larger investment in the Athena side, allowing data pivoting and correlation across types

\- Has first-class support for monitoring infrastructure as "resources", opening up more compliance use cases

We applied a lot of lessons learned from running StreamAlert and from my team's experiences at Amazon.

<comment><USER17> Thank you!

</comment></comment></comment><comment><USER18> congrats for the launch. Based on the documentation Panther operates only in an AWS environment at this point. Are there plans to include also deployments on GCP?

Thanks!

<comment><AUTHOR> Thank you! We are planning to go multi-cloud by either integrating with Snowflake or pulling the data into a hosted Panther environment.

<comment><USER18> thanks for the quick reply, the choice of Snowflake is interested. Would you like sharing the reasoning behind it?

<comment><AUTHOR> I really like the idea of integrating with shared data-stores! It is a quick win for going multi-cloud since it's quite challenging to run a complex arch on multiple clouds. There also isn't great parity yet across them.

</comment></comment></comment></comment><comment><USER19> Congrats on the launch Jack & team!

<comment><AUTHOR> Thank you!!

</comment></comment><comment><USER20> Congratulations on the launch!

</comment><comment><USER21> All the best

</comment><comment><USER22> Epic!</comment>


Meteor Devshop 0: share knowledge, not germs - <AUTHOR> http://meteor.com/blog/2013/02/06/meteor-devshop-0-share-knowledge-not-germs

<comment><USER2> If you are in Vancouver, BC, the next Meteor event is in one week: <http://www.meetup.com/Meteor-Vancouver/events/102031952/>

</comment><comment><USER3> It's off-topic, but I'd like to point out that there is no connection between being vaccinated against the influenza virus and spreading germs.

<comment><USER3> Okay I get it, the above post has a mistake in it: pointing out a flaw in the article isn't actually off-topic. Thanks for pointing that out so eloquently.</comment></comment>


Picnik Acquired by Google - <AUTHOR> http://blog.picnik.com/2010/03/google-acquires-picnik/ <comment><USER2> Maybe the picnik acquisition has a purpose, possibly to ship it with chromeOS considering it _is_ based on the cloud.

</comment><comment><USER3> It's notable that Google is promoting HTML5 quite heavily but just acquired a product that is tied heavily to proprietary technology.

Edit: How feasible is it to build Picnik using HTML5 stuff (SVG, background image grinding, etc.)?

<comment><USER4> It would be more notable if they didn't diversify and bet the whole company on HTML 5.

<comment><USER3> They have a great opportunity to twist Microsoft's arm with HTML5. Chrome's the fastest browser out there now, and it will be the only option on some devices (ChromeOS/Android). Also, if the Firefox folks don't have the manpower/funding for a good HTML5 implementation, it will be no skin off Google's back to help them out. So, if MSFT doesn't come up with a good implementation in IE9/10/whatever, they risk being the odd man out ["For best results, use Firefox, Chrome, or another HTML5-compliant browser for this site."] Microsoft would have no choice but to completely concede the user experience to an abstraction layer built on top of its cash cow.

And, what chips has Google actually put on the table? One thing might be that they aren't putting out a set of Open Source but non-standard plugins for Chrome/Firefox/IE to replace Flash. Google is implicitly taking the risk that Adobe will implicitly own the web if more and more sites standardize on Flash- based stuff. Perhaps, since it's more likely that the world will rally around HTML5 than around Google's Flash competitor (or Silverlight), Google is actually adopting a least-risk strategy?

Also, for all we know, Google has a set of plugins waiting in the wings should HTML5 die on the vine. It was rumored that Microsoft had a version of Office for Linux ready to go should the desktop market tip so heavily out of its favor that it risked losing its Office semi-monopoly if it didn't support Linux.

<comment><USER5> Don't forget Chrome Frame.

</comment></comment></comment></comment><comment><USER6> To sit and chat with the gents who plan strategic acquisitions at Google would be a fun day. Great buyers market. Hope the exit was HUGE.

<comment><USER7> i still wonder why acquisition prices are so secretive

<comment><USER8> From the acquirer's side, I'd guess competitive reasons. The amount they were willing to pay sends a signal to their competition about how important that particular product is to them (and if they paid a lot, that message is often very loud and clear).

From the seller's side there's the issue of respect for the acquirer's preferences as well as the fact that broadcasting your payday is kinda like broadcasting your salary: It can create some awkward situations. Especially if you're trying to keep some non-owner employees around.

</comment></comment></comment><comment><USER9> Flash and Flex based app, interesting acquisition. They are getting integrated into many online photo services and it is a very well done usable app for all skill levels. I also wonder if aviary.com is going to be acquired as they are just about as good and have many apps.

</comment><comment><USER10> i wonder if yahoo will keep using picnik for flickr's integrated photo editor.

<comment><USER11> That's the first thing I thought too. I wonder the deal will be some clauses, if it includes something about exclusivity (to later become some sort of 'Google Docs Photo Editor') I guess Yahoo! will need to dump it or change for another like Aviary (which went free last week).

Why didn't Yahoo! bought it? I really would like to know

Edit:

 _4\. Will I still be able to access other social networking and photo storage sites from Picnik, or access Picnik from those social networking and photo storage sites? Yes!_

It seems so

</comment></comment><comment><USER12> Ugh. I groan every time pone more service I like gets herded into the horrible "attached to your Google Account" profile management hell. I wish Google would find a better way to integrate this stuff. Or just let them stand alone.

<comment><USER5> They did let it stand alone. And what's wrong with attaching it to a google account anyway?

<comment><USER13> Well for one thing, anonymity. If you are very free with your opinions on e.g. youtube, but use your real name with gmail it can be really annoying when a purchase fuses these two.

</comment></comment></comment><comment><USER14> I had the joy of doing one of the very first picnik integrations before their API was public. I got to work directly with Darrin and it was a joy all around. Super sharp and overwhelmingly nice guy.

</comment><comment><USER15> And they're not summarily killing the product. What a pleasant surprise.

<comment><USER16> That is yet to be seen. But generally, Google mainly used to screw up the social applications, so this one should be ok. ;-) And, as it was mentioned, this one is probably needed for Chrome OS.

</comment></comment><comment><AUTHOR> ...and so Google entered Adobe's turf.

<comment><USER17> Picnik is built on Adobe Flex, so I'd say there was a bit of turf gained by both Google and Adobe

<comment><AUTHOR> A small victory for Flex, a bigger problem for Photoshop.

<comment><USER18> How many people are buying (not pirating) Photoshop to make basic changes to their photos? Maybe Photoshop Elements (if it still exists), but other than that I don't think this would really damage the Creative Suite all that much as they're quite different markets.

All the people I know who might use a web-based image editor have either been struggling along with Paint or pirated Photoshop at some point.

<comment><USER10> adobe already has photoshop.com for web-based image editing, so i doubt picnik changing hands has any affect on them.

<comment><USER19> But how many people knew of it, or use photoshop.com? I had never heard of it until now. Adobe's doing a pretty piss-poor job of marketing it if it is supposed to be a stand-in free web-based version of photoshop for people to do basic touch-ups on their pictures ...

</comment></comment></comment></comment></comment></comment><comment><USER20> To be honest, I had no idea what Picnik was. Is it very popular?

</comment><comment><USER21> I thought this happened two years ago? Or was that Picasa? Maybe there's someone in Google's M&A department that really likes companies with 6-letter names that start with P?</comment>


Sun's galactic journey linked to mass extinctions (2013) - <AUTHOR> http://www.abc.net.au/science/articles/2013/10/02/3857090.htm <comment><USER2> I remember Stephyen Jay Gould wrote an essay caleed the "cosmic dance of Shiva" where he talked about how the fossil record suggests that mass extinction events at regular intervals of 20 something million years. He wrote that since it would be difficult to find a terrestrial explanation for an extinction event at regular intervals, so it made sense to look at factors from outer space. This could be the sort of missling link in Gould's theory.

I can't find a non-paywalled version of Goud's article but here is another one talking about mass extinctions at regular intervals

[http://www.theatlantic.com/science/archive/2015/11/the- next-...](http://www.theatlantic.com/science/archive/2015/11/the-next-mass- extinction/413884/)

</comment><comment><AUTHOR> Full paper, with some illustrations (free):

[http://saj.matf.bg.ac.rs/187/pdf/043-052.pdf](http://saj.matf.bg.ac.rs/187/pdf/043-052.pdf)

</comment><comment><USER3> The authors seem to assume that there's a spiral arm pattern that rotates coherently. What's the evidence for that?

<comment><USER4> It's believed that the spiral arms are quasi-static and that the stars move in and out of these regions of higher density.

See: [https://en.wikipedia.org/wiki/Density_wave_theory](https://en.wikipedia.org/wiki/Density_wave_theory)

<comment><USER3> Yes, that's what I vaguely recalled. But we don't have enough observations to test that hypothesis. I wonder, through, whether alternate-path gravitational lensing could provide enough snapshots of some other galaxy to be useful.

</comment></comment></comment><comment><USER5> I really don't understand how the solar system can orbit the galaxy faster than the spiral arms and be in accordance with Kepler's 2nd law?

<comment><USER6> It is better to view the spiral arms as 'transient' in the same way you would view a momentary queue in traffic - although the jam itself moves slowly or not at all, the individual cars that make it up move through the jam and eventually exit on the other side.

<comment><USER5> Interesting: "Measurements in the late 1960s showed that the orbital velocity of stars in spiral galaxies with respect to their distance from the galactic center is indeed higher than expected from Newtonian dynamics but still cannot explain the stability of the spiral structure."

[https://en.wikipedia.org/wiki/Spiral_galaxy#Origin_of_the_sp...](https://en.wikipedia.org/wiki/Spiral_galaxy#Origin_of_the_spiral_structure)

<comment><USER7> Wasn't the higher than expected orbital velocity among the first evidence of dark matter?

<comment><USER8> Rubin-Ford effect

[https://en.wikipedia.org/wiki/Vera_Rubin#Galaxy_rotation_pro...](https://en.wikipedia.org/wiki/Vera_Rubin#Galaxy_rotation_problem_and_Dark_matter)

</comment></comment></comment></comment></comment><comment><USER9> Welp, we're about to enter one of the arms.

It's been nice knowing you guys.

<comment><USER10> > _Summed over the entirety of its orbital path over the last 500 Myr, based > on the new weighted symmetrical model, we find that the Sun has spent ∼60% > of its time in the spiral arms_

This is a statistical observation. In any case, do you have a source for your assertion?

[http://saj.matf.bg.ac.rs/187/pdf/043-052.pdf](http://saj.matf.bg.ac.rs/187/pdf/043-052.pdf)

<comment><USER9> My prediction is based on their newly weighted symmetrical model given at figure 2.

All previous extinction events are when the sun is in the galaxy arms, and we are currently entering one of them.

<comment><USER10> Pardon me. Could you point me to a source showing we are entering one of them?

<comment><USER9> [http://i.imgur.com/u69Qd6Y.png](http://i.imgur.com/u69Qd6Y.png)

Yellow dot is where we are right now, as you can see we are entering one of the black lines.

6 blue dots represent the known mass extinctions, they all lie on black lines.

5 orange dots represent proposed new mass extinction events proposed in the paper.

</comment></comment></comment></comment></comment><comment><AUTHOR> Here's a great interview by John Batchelor (free podcast):

[https://audioboom.com/boos/4073570-mass-extinction-and- the-s...](https://audioboom.com/boos/4073570-mass-extinction-and-the- structure-of-the-milky-way-jonti-horner-m-d-filipovic-e-j-crawford-n-f-h- tothill)

</comment><comment><USER11> not sure this is new... if I remember correctly our galaxies arms rotate along their length and cross each other every (approx) 140 million years which disturbs our kuiper belt which dislodges numerous items which rain down destruction on earth approx 70 million years later, so Jupiter mops up most but not all.</comment>


EXploit X: "Give Me Root" [video] - <AUTHOR> https://www.youtube.com/watch?v=3vCpYgaZpiw <comment><USER2> One way I got root recently, aside from pivoting on a setuid 0 binary, was calling seteuid(0). The vendor's program manager on the device forgot to setuid(user_id), it only seteuid(user_id). So going back to root was as easy as seteuid(0). The joy of real and effective process user. :)

Other easy way, if you have a way to provide your own filesystem to the device (via SD card for example), is to just put an Ext filesystem on it, and add your own setuid 0 binary there. Device makers sometimes don't know what they're doing, so they don't mount untrusted removable devices with -o nosuid,noexec,nodev ...

That works even if there's no usable setuid 0 binary on the rootfs.

<comment><USER2> It doesn't help my confidence in the world, that this was a PoS terminal device from a self described "Leader in Payment Terminals". But hey, they even read random files on the filesystem from a kernel USB device driver, and they probably got to the market first, so that's what matters.

Thankfully, AFAIK, this particular device is not sold anymore.

<comment><USER3> > _a self described "Leader in Payment Terminals"_

In a marathon, the leader is not so much the _healthiest_ of the bunch.

Also, this is a PoS terminal, if there's any wonder left in you for how they could mess this up so bad, I'm guessing this is the first one you've seen. ;- )

<comment><USER2> Yes, the first one. One thing I liked about it though is that the vendor uses uniform ioctl calling convention for pretty much everything they implement in the kernel, so I have modified strace to decode their ioctl payload, and I was able to rewrite most of their library code with my implementation, with the help of traces of their demo app. Now I can drop their complicated and buggy userspace code completely and use my own rootfs.

The kernel is harder, since they also violate GPL and don't provide kernel source code along with their terminal, and neither does their SoC vendor.

</comment></comment></comment></comment><comment><USER4> The exploit is overwriting /etc/shadow with the log of Xorg. If you pass the right string somehow you overwrite the root password. The trick is setting the font path and the font path appears in the log. Of course this fills /etc/shadow with a lot of bogus data, but one line in the log which describes the root password is enough. Xorg can overwrite /etc/shadow when it is setuid root.

Attention: don't attempt it on a system you need. The exploit is destroying all user's passwords. Or at least make a copy of /etc/shadow before trying.

<comment><USER5> > The exploit is overwriting /etc/shadow with the log of Xorg.

That took me couple of seconds to read and I got virtually the same information as the 11 minute video. I think there's no question about which way of doing things is more efficient.

</comment></comment><comment><USER6> # get root:

       cd /etc; Xorg -fp "root::<passwd>::" -logfile shadow :1;su

<comment><USER7> How many linux servers have Xorg installed? Certainly none of mine, though I mainly work with web & db servers.

<comment><USER8> Lots of RHEL servers do, but I would guess that selinux stops this exploit, I see no reason for X to have write permission in /etc.

<comment><USER9> Redhat ships with a targeted policy. Most of the non-network programs are put in a very permissive domain to avoid breakage.

I just checked the CentOS policy[0] (not at work and don't have easy access to the Redhat repos).

It appears that xserver_t does have write access to both etc_t and shadow_t [1].

More specifically, xserver_t is part of the selinux_unconfined_type attribute, which means that it can do pretty much anything. (Even more specifically, it is part of the files_unconfined_type attribute, which gives it write permissions to everything in file_type):

      > sesearch --allow -s xserver_t -t shadow_t -c file policy.31
      allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True
      allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write };

[0] [https://centos.pkgs.org/7/centos-updates-x86_64/selinux- poli...](https://centos.pkgs.org/7/centos-updates-x86_64/selinux-policy- targeted-3.13.1-192.el7_5.6.noarch.rpm.html)

[1] Because of its sensitive nature, /etc/shadow has its own SELinux label

</comment></comment></comment></comment><comment><USER10> Why video? It's not about fashion or architecture, please people use text.

<comment><AUTHOR> Some people (like me) are visual learners / auditory learners and Computerphile caters to that niche of learners. This is why I prefer videos/audio over tangible books that you can hold. It is also common to see me putting blogposts into text-to-speech programs and then I listen to them at night or on the train.

<comment><USER10> Well.. I knew about visual learners, I didn't know how strong is this effect. At least I learned today :) Sorry.

<comment><USER11> Both of you may be interested in this research from last year:

No evidence to back idea of learning styles

[https://www.theguardian.com/education/2017/mar/12/no- evidenc...](https://www.theguardian.com/education/2017/mar/12/no-evidence-to- back-idea-of-learning-styles)

<comment><USER10> It's not research, it's just a manifest.

<comment><AUTHOR> We are naturally inclined to have certain biases towards different learning styles. It's really a psychology issue. What bothers me about these studies that claim we should 'work harder' on our weaknesses (i.e visual learners should read more books/text) - is that we should also build on strength.

When you bolster one learning style and neglect the other, but learn more in the process of the preferred learning style, then why not see it to the end, and understand / digest the knowledge gained?

I guess it is about balance. If I am a pure visual (or auditory) learner, then surely I would have learned that books/text have their place. I imagine that the greatest learners out there use _all_ the learning styles but still have a bias towards their learning style. How pronounced that bias is, is still unknown.

</comment></comment></comment></comment></comment></comment><comment><USER12> Looks like it was patched in Ubuntu 18.04 just two weeks ago, see "apt changelog xserver-xorg-core":

xorg-server (2:1.19.6-1ubuntu4.2) bionic-security; urgency=medium

      * SECURITY UPDATE: Privilege escalation and file overwrite
        - debian/patches/CVE-2018-14665.patch: disable -logfile and -modulepath
          when running with elevated privileges in
          hw/xfree86/common/xf86Init.c.
        - CVE-2018-14665

     -- Marc Deslauriers <email@example.com>  Thu, 25 Oct 2018 11:18:32 -0400

</comment><comment><USER4> Xorg might not be the only exploitable software. Here the approach to search for other exploits:

1\. Is the software setuid-root?

2\. Does the software stay as root?

3\. Can you make it write a user description line like as in /etc/shadow?

4\. Can you direct it to write to /etc/shadow?

An example: Xorg is setuid-root and stays as root. Pass it the root's description line as a (bogus) font path and it will write an error message. Redirect the error message to /etc/shadow and your exploit is finished.

I am afraid that other setuid-root programs could be exploitable.

setuid-root is extremely dangerous.

<comment><USER12> find other setuid binaries on your system using: find / -user root -perm -4000 -print 2>&1 | grep -v "Permission denied"

</comment></comment><comment><USER13> Wouldn't it be far safer to use cron? Or authorized_keys? Why passwd?

<comment><USER14> I am not sure I quite got your question, and had a very succinct look at the video, but passwd is being used here as a way to check whether the user has root access.

It is important to note that this exploit is an old one, has been known for a while, and is one of the things being addressed by switching to Wayland.

That said, a lot of work has been done towards running X11 rootless (Arch for instance [1]). That should be possible as long as you use DRI, as far as I know (which is the case if you use a graphics card less than about ~10-20 years old, depending on the brand).

[1] [https://wiki.archlinux.org/index.php/Xorg#General](https://wiki.archlinux.org/index.php/Xorg#General)</comment></comment>


Using hashtags to organize your bash history - <AUTHOR> http://vignesh.foamsnet.com/2013/06/using-hash-tags-to-organize-bash-history.html

<comment><USER2> Or you could stick the command in a shell script.

      #!/bin/sh
      find . -iname '*.php' -print0 | xargs -0 -n1 php -l

Save it to ~/bin/phplint (you do have ~/bin in your PATH, right?), chmod +x it, check it in, and you have a new phplint command. No need to mess about with hashtags in your shell history.

Am I missing something?

<comment><USER3> What you may be missing is the difference in length between:

      Create a file ~/bin/phplint
      Type out the shebang
      Copy the command from the terminal into the file
      Save the file
      chmod +x the file

And:

      type #phplint

I'm sure Mr Venkat wouldn't claim that he has rendered script directories overnight. But he has come up with a way to make your shell history a little more usable.

I observe that people vary a lot in how hard they lean on their history. I live and die by mine; it serves as a combination of replacement short-term memory and treasury of tricks. Some of my colleagues don't really use it at all, using scripts or aliases, or even just retyping commands every time, like savages. If you're not a heavy user of history, then this idea won't help you. If you are, it might.

<comment><USER2> You're right, the first alternative is disgustingly long-winded. Let's automate it.

Create a new shell script called `empty` somewhere on your PATH:

      #!/bin/bash
      set -e
      exec >"$1"
      printf '#!'
      which "$2"
      chmod +x "$1"
      cat

Next, add a new shell function to your ~/.bashrc:

      save-history() {
        history -p "$1" | empty ~/bin/"$2" bash
      }

To save the most recent command in your history to a shell script called ~/bin/phplint, run

      save-history '!!' phplint

You have to single-quote the '!!'; sorry about that. I'm using bash; maybe zsh has some way of making this easier to use.

Having said that, if you're happy (I'm speaking generically here, not specifically to twic) relying on your history, then more power to you. It doesn't work for me because I haven't worked out yet how to keep my shell history straight between several shell sessions on the same PC, let alone syncing it between different PCs.

<comment><USER4> In the spirit of the OP, I did a similar thing, but using a tag to initiate writing the script file. [https://github.com/thatjpk/bashtag- save](https://github.com/thatjpk/bashtag-save)

So, tagging a command line with "#save:scriptname" will save the command to ~/scripts/saved/scriptname.sh That way you can get the history search token and a script on disk in one fell swoop.

</comment></comment></comment></comment><comment><USER5> The phplint example isn't a great one. If you use phplint enough you should either:

1) Create a generic shell script as others have stated.

2) Create a Makefile for your projects with a 'lint' target. If you create many different PHP projects, consider a project template directory with a Makefile that already has this, so that every new project automatically has the functionality:

      make lint

This idea has been around though. I can't recall if I've seen tagging used before, but saving an unexecuted commandline in the shell history by commenting it out is another useful hack that's been around a while.

<comment><USER6> The technique might have been around for a while, but it's the first time it made the connection in my head between twitter hashtags and bash comments, so +1 to the OP.

</comment></comment><comment><USER7> For stuff like the example where you know you will be reusing the command, it's better to use an alias or script. Even if it's just a command you plan to run in a couple times in a row you can add a temporay alias with: alias foo = "!!" \- that way you don't have to hit ctrl+r each time.

Still, it's a good tip in terms of adding comments to unusual/confusing commands so when you go through your history you're not like "wtf was I doing here?" or if you unexpectedly need to recall it.

</comment><comment><USER8> This response explains how I use Acme to store (and later modify) commands in files in each directory.

[https://news.ycombinator.com/item?id=5566567](https://news.ycombinator.com/item?id=5566567)

In addition, I wrote a generic tag-indexing tool (in Plan 9's rc and Inferno's sh) to find random bits of information (including commands) without caring where they live in my file hierarchy.

[https://github.com/catenate/notabene](https://github.com/catenate/notabene)

[http://swtools.wordpress.com/2010/03/05/nb%E2%80%94search- an...](http://swtools.wordpress.com/2010/03/05/nb%E2%80%94search-and-index- notes-in-files-by-keyword/)

</comment><comment><USER9> This is neat! I appreciate using something like hashtags in an unexpected, but useful way. And as for the comments saying the example should just be put in a shell script, that's not really relevant at all. The article has nothing to do with the merits of simple shell scripts versus a fun and useful hack.

</comment><comment><USER10> hee hee, "bashtags."

</comment><comment><USER3> This is a cute hack.</comment>


Ask HN:  End of IT Venture Capital? - <AUTHOR>

Here I make an observation somewhat familiar on HN, draw a conclusion, and seek reactions.
Currently for a first equity investment in a project in Internet Web site information technology (IT), it is nearly universal for the investors to assume that (1) the software is easy and can be done in a few weeks and (2) the investment decision is to be based on a working prototype.
Another more explicit criterion for a Series A is a Web site with at least 100,000 unique visitors a month.
Mostly such projects plan to get revenue from ads on the Web site.
So, suppose that the software is done and goes live.  Suppose the 'business idea' is good and is 'promoted' well and the number of pages served start to grow.
Now the founders can seek equity funding.  The usual stories are months of contacting some dozens of investors, giving demonstrations, studying term sheet details, forming a C corporation, etc.
But, as is reasonable for a good project, suppose during those months the number of users of the Web site continues to grow.  Suppose there is just one ad on each Web page sent, and suppose, from whatever ad targeting is available from the ad networks, etc., the result is $2 of ad revenue for each 1000 ads displayed.  So, that would be $2 CPM (charge per thousand).
Suppose the project has a server that can serve 10 pages a second 24 x 7. Then the monthly revenue would be
2 * 10 * 3600 * 24 * 30 / 1000 = 51,840
dollars.  For the computing, that might be just a 4 core server with 16 GB of main memory and some RAID disks with an Internet connection with, maybe, 30 Mbps of upload bandwidth.  So we're talking a tower case on the floor next to the knee of one of the founder programmers.  Ten months of that, with no further growth, would be $518,400 in revenue, more than a usual seed round.
So that revenue would be plenty to buy more servers and bandwidth, move to the cloud, a hosting site, a colocation site, or just build a server farm in a few hundred square feet of commercial space and get a 1 GbE Internet connection.
For 1 GbE half filled 24 x 7 with Web pages with, say, 2 Mb per page, that would be
(0.5 * 109) * (1 / (2 * 106)) = 250
pages per second or
250 * 3600 * 24 * 365 / 1000 = 7,884,000
dollars a year.  So, a 1 GbE connection can support a nice stream of revenue.
If the project is good, then in a few months usage should increase by a factor of 10 to
2 * 100 * 3600 * 24 * 365 / 1000 = 6,307,200
dollars a year in revenue, and that is more than most Series A rounds.  And, yes, that would fit in a 1 GbE Internet connection.
So, the "observation" is that a few servers in tower cases and a good Internet connection have the capacity to generate some significant revenue.  Indeed the revenue should arrive so fast that, in the months it would take to get equity funding, the revenue would exceed the usual amounts for a seed or Series A round.
So, the conclusion is, a good project should just remain 100% owned by its founders and f'get about equity funding.
Yes, it is true that so far all the famous Web startups did get equity funding, but maybe this situation is about to change.  If so, then we will see some successful projects that remain 100% owned by the founders, or maybe just one founder?
Are we about to see the death of equity funding for such projects?
Reactions? <comment><USER2> where does the $2 CPM come from?

<comment><AUTHOR> Not from a good source, just from various claims that $1 to $5 CPM are common, some rough calculations starting with some summary data for Google, etc. I'd very much like a good source.

But if the $2 CPM is within a factor of several of reality, then the broad conclusion still holds: By the time a project is live and has users and, thus, qualifies for equity investment, if it is a good project with usage growing rapidly, then it should throw off enough cash to make equity investment unattractive due to how long it takes to get a check and the chances that after a year the revenue and pre-tax earnings will be larger than the check.

But, if cut the CPM by a factor of 10 to $0.20 and assume 5 ads per page sent, then the revenue per page sent is only cut in half and so are the monthly and annual revenue figures. Then the broad conclusion still holds: By the time the project is ready for equity funding, if it is a good project, that is, with usage growing quickly, then it should soon no longer need and maybe not want equity funding. And with some irony, here "soon" means in time about the same as that required to raise equity funding. So, the founders can sit there and ask,

"For the next six months, what do we do? Do we use the time to jerk the chains of a few hundred investors, pitch to a few dozen, and get a check or just keep working on our project, help the usage keep growing, and at the end of the six months have more in cash in pre-tax earnings than we would get from an equity investment check and still own 100% of our business and not worry about a Board. Also, now we just own the business outright, but the day after an equity investment we will own none of the business and, instead, have to work for about four years on a 'vesting schedule' to get back our fraction of the business, and we will never get it all back. So, what do we do for the next six months?"

So, broadly we have to ask, will there soon be some really successful Web sites that never took equity funding? So, for this part of investing, is venture capital dead?

<comment><USER2> my research seems to indicate you start off low, plateau at around a quarter and then once you have a niche you can see these high values. I've heard that $1-$5 are common in the sense that you see them, not in the sense that they are within a small number * standard deviations from the mean.

overall the principle holds but the investment is an accelerator, once you have users you have competition.

<comment><AUTHOR> Okay, to 'out do' the competition.

But that is a relatively new reason or emphasis if only because in the past 'venture capital' could invest in something on the back of a napkin and was needed for a lot in buying hardware and software, office furniture, recruiting, salaries, doing the development, building a marketing organization, starting the selling cycle, etc. before any revenue.

Now a motherboard for a 4 core processor with a 3 GHz clock is about $100; a server farm style 1 TB disk drive is about the same; Unix style software is not very expensive, and the Microsoft BizSpark program will let a startup use Microsoft software for free for a while, etc. The venture people want the development done, the site live, users, and, thus, likely revenue, and users and revenue growing rapidly. So, the situation now is much different than before.

So, before there were a lot of strong reasons to take equity funding, and now the reasons are much weaker.</comment></comment></comment></comment>


Heroku Status Uptime Calculation (99.28% June 2012) - <AUTHOR> https://devcenter.heroku.com/articles/heroku-status-uptime-calculation

<comment><AUTHOR> I'm not sure how I feel about this method of calculating uptime. If you have a site with 100k users, and 10k are down for an hour, is that a 6 minute outage?

The most useful thing is probably to be internally consistent month to month -- you really can't depend on self-reported uptime stats from multiple providers which might not use the same methodology. There are also other performance metrics which matter -- if a site takes 3 minutes to respond, but does so with 100%, that is "down" for some purposes but not down for others.

Just adding up the numbers is 487 minutes out of 43200 minutes in June, or 98.87% uptime. I'm not sure if this was calculated the new way to be more accurate or to avoid the psychologically bad "one nine of uptime".

If a provider outage costs you recovery time yourself after an outage, though, it's also not really useful to just use the provider's uptime. If your EBS volumes come back dirty on EC2 and fscking them takes another few hours (due to size or contention), your total outage can be longer, and that's all time where you wouldn't have been out on a different platform.

<comment><USER2> _Just adding up the numbers is 487 minutes out of 43200 minutes in June, or 98.87% uptime._

The number of minutes an issue was being tracked on our status site is not the same as the number of minutes things were actually broken. Also, very few incidents affect all apps at any point. And when things are being fixed it's typical to see a long tail, especially for database failures with corrupt volumes.

 _I'm not sure if this was calculated the new way to be more accurate or to avoid the psychologically bad "one nine of uptime"._

This is the same way we've always done it, but we never explained it before this month. We also couldn't find any other providers explaining how they calculate aggregate availability, so we thought it was worth explaining.

The is the most realistic method we're aware of for a distributed platform with millions of apps and non-total failure modes.

<comment><AUTHOR> Seems fair (this is a good argument).

I don't think there's a huge amount of precedent. There are systems which are tightly coupled and thus all-or-nothing (most hosting pre-cloud, power generation facilities, etc.), and systems which are highly distributed (networks). Generally for the distributed systems, no one reports a global uptime percentage, but a per-link uptime target and percentage.</comment></comment></comment>


Ask HN: Is whitelabeling your software a good idea? - <AUTHOR> I've been getting a handful of requests of people who loved http://upstart.me and asked if I was planning to whitelabel it. Has anyone here whitelabeled their project?.<p>What are the pros and cons? <comment><USER2> How / why do they want to white label it? Do they already have sales/marketing channels established?

If it's a good fit for your business, white labeling is a fantastic business model.

The largest benefit is having other people investing their time and dollars selling and marketing your product for you.

You have to think carefully about what you decide to offer though, for example someone else in this thread mentioned custom domains.

It's very easy to get sucked into custom development for someone over promises but ultimately doesn't execute on distribution well enough to justify your time building the feature.

</comment><comment><USER3> I did it a couple of times. The pros are that you're in a better position to sell to businesses. The cons are that the implementation can get a little bit tricky if you want to enable custom domains.

</comment><comment><USER4> What is whitelabeling?

<comment><USER5> White labeling is when you take your product and slap a label for another company on it, and the company sells it as their own. So I could buy 40,000 Bluetooth speakers from BlamCo in China and get them labeled as "BLEATS PILL" and sell them as if they were my own. My company is in the process of selling some white label stuff which means we can charge more (in our case at least) than if we retain our labeling on the hardware.</comment></comment>


Stanford Reported to Have Admitted Jailed Man Expelled from Harvard - <AUTHOR> http://wbztv.com/local/adam.wheeler.harvard.2.1741496.html

<comment><AUTHOR> In September 2007, pg posted his essay "News from the Front,"

<http://www.paulgraham.com/colleges.html>

in which he wrote, "A few weeks ago I had a thought so heretical that it really surprised me. It may not matter all that much where you go to college."

Apparently one man now in jail in Boston still thinks it matters a great deal where you go to college.</comment>


The Semicolon Is the Perfect Punctuation for the Digital Age - <AUTHOR> http://observer.com/2014/02/why-semicolons-are-the-perfect-punctuation-for-the-digital-age/?utm_content=buffer0ca8f&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> What the hell? Semicolons are great and all, but this author completely abuses them. It sounds like they are arguing that it should take the place of the period in text communication, because the period now conveys anger (intentionally or not). In fact, the examples given (in which I agree it does so) show the period used at the _end_ of the message, not between disparate messages for which it's perfectly appropriate.

</comment><comment><USER3> I definitely agree! In my writing, semicolons are a sign that I wrote too fast and didn't go back to edit my ideas into separate sentences.

</comment><comment><USER4> uh. there is a use for semicolons. just use semicolons as they were intended. i don't think the medium nor the age matters. and if you don't know how to use them, then either look it up or don't use them, please.

<comment><USER5> Or rather:

Uh, there is a use for semicolons; just use semicolons as they were intended. I don't think the medium nor the age matters; and if you don't know how to use them, then either look it up or don't use them, please.

FTFY. :-)

<comment><USER6> Bonus marks for the colon which is the endangered punctuation in modern writing.

</comment></comment></comment><comment><USER7> I have to leave this here: [http://youtu.be/M94ii6MVilw](http://youtu.be/M94ii6MVilw)</comment>


Lego Block Structures as a Sub-Kelvin Thermal Insulator - <AUTHOR> https://www.nature.com/articles/s41598-019-55616-7 <comment><USER2> I can't help but wonder what the R value of a house sized wall built out of LEGO would be. Now it just so happens... I don't think the local council would approve but screw it, it's for science.

<comment><USER3> You'd have to coat it with something UV resistant since ABS degrades in the sun but sure why not. There's a variant of this using foam and concrete.

[https://www.deseret.com/2000/4/9/19500764/concrete-foam- lego...](https://www.deseret.com/2000/4/9/19500764/concrete-foam-lego-houses- are-efficient-wind-resistant)

<comment><USER4> ICF (insulated concrete forms) are pretty common depending on where you live. You have to build the formwork to pour the concrete walls anyways, so building it to stay in place and act as insulation is just smart provided you can reliably get concrete everywhere you want.

I like them, although for larger structures the formwork gets re-used so generally if they're insulated its after.

</comment></comment></comment><comment><USER5> I'm disappointed that there's not an acknowledgment of the (speculating here) 6 yr old who donated legos to the cause after one of the investigators stepped on them barefoot at 4am.

<comment><USER6> That's what they get for not picking up their toys.</comment></comment>


Simon Cowell & Will.i.am to debut X Factor for Entrepreneurs... - <AUTHOR> http://venturebeat.com/2012/09/30/will-i-am-simon-cowell-to-debut-tv-show-to-find-the-next-steve-jobs/

<comment><USER2> Nothing new... there already is a similar show: Shark Tank/Dragons Den. Also, Cowell and will.i.am are good in show business. Tech business... I doubt it. But, I'm gonna watch the premiere and let them prove me wrong.

</comment><comment><USER3> Does Simon Cowell know anything about entrepreneurship? Can't wait to see him berate tons of super hard working people on things he knows nothing about.

<comment> k-mcgrady I hate to stick up for Simon Cowell but with his successful TV show (X Factor) throughout the world and his record label I think he knows a bit about entrepreneurship.

<http://en.wikipedia.org/wiki/Syco>

</comment></comment><comment><USER4> pg should just webcast a sample of ycombinator presentations.

The "search for the next Steve Jobs" is a pretty active market. I predict competition for this show.

</comment><comment><USER5> I'm curious as to how companies believe Will.I.Am is a voice in the tech scene?

</comment><comment><USER6> being on the tv adds little to entrepreneurs success, compared to being a musician featured on tv is everything. So I am afraid that this show wont attract the right people.

<comment><USER7> If you've got a product ready to roll that is targeted to "mass" consumers being on TV does ad value, I'd think having several million people see your idea might be fairly valauble to some, but not all, companies.

</comment></comment><comment><USER8> oh good god no</comment>


3.5x Increase In Performance with One Line Change - <AUTHOR> http://www.neo.com/2013/10/07/3-5x-increase-in-performance-with-one-line-change

<comment><USER2> I would be curious the speed with Typhoeus for the adapter...

<comment><USER3> In this specific case we're using Unicorn on MRI, so I wouldn't really expect Typhoeus to do a whole lot since it wouldn't really be parallel. That being said, we didn't try it.</comment></comment>


How the Pandemic Will End - <AUTHOR> https://www.theatlantic.com/health/archive/2020/03/how-will-coronavirus-end/608719/ <comment><USER2> Good piece by the great Ed Yong. The Atlantic seems to be doing some of the best reporting and analysis on covid19</comment>


Facebook Co-Founder Saverin Gives Up U.S. Citizenship Before IPO - <AUTHOR> http://www.bloomberg.com/news/2012-05-11/facebook-co-founder-saverin-gives-up-u-s-citizenship-before-ipo.html

<comment><USER2> My knee-jerk reaction is: What an ass. He comes here, gets an education, co- founds a company, and gets rich from it. And yes, he's spending money and creating jobs -- but he's also benefiting from the infrastructure, the business climate, the population, and more. And when it comes time to pay his tax bill, he skips out. Not cool.

<comment><USER3> It's legal to give up your citizenship - he plans to live in Singapore and he must still pay the exit tax. This is what the law says and he doesn't break it.

If you want to discuss this emotionally, try to see his point of view as well: US is the only nation in the world (ok, maybe with 1-2 other exceptions from Africa) where residency doesn't determine the tax authority you're subject to. He plans to live and have his residency in Singapore and pay taxes there but US would still like to have his tax money, who's the ass?

<comment><USER4> There are usually tax agreements with countries to avoid double taxation.

<comment><USER5> The US is one of the few countries that doesn't allow its citizens to avoid double taxation. You are still liable for US taxes on foreign-earned income above $80,000 per year.

<comment><USER6> You can deduct taxes paid to your country of residence, so it's more max- taxation than double-taxation.

<comment><USER7> I can confirm this.

Americans living in Denmark don't seem to worry too much about US tax. This is due to the insane taxation level we have here, which blows all other levels out of the water and makes calculating US tax very easy.

</comment></comment></comment></comment></comment></comment><comment><USER8> So let me get this straight: rich kid at Harvard gives his bright friend some money to rent servers to run a service that gets popular. Rich kid doesn't contribute any more. Rich kid gets cut out of company because he's not doing shit any more, then sues the company. Company sucks it up and pays him off. Then rich kid renounces citizenship and splits for a tax haven with all of that money, completely avoiding contributing anything further to the environment that made him billions of dollars.

And the popular narrative is that Zuckerberg is the asshole? Huh.

<comment><USER9> You're assuming he is leaving for tax purposes. If he doesn't live in the United States why would he retain his citizenship? He could be denouncing it for entirely unrelated reasons, someone stated below that to get citizenship in Singapore you must be a citizen of _only_ Singapore. Nowhere has it been confirmed, this is all speculation. He hasn't just suddenly "split", he left the US almost 2 years ago. He already paid taxes on hundreds of millions, I really doubt that he hasn't paid his "fair share".

<comment><USER10> If you are a US Citizen, you have to pay taxes, regardless of where you live, so I am guessing taxes paid a role in his decision.

<comment><USER11> Would he also have to pay taxes in Singapore? If so, I can see how this move would be acceptable.

Even if not, I don't think many would find this unacceptable if he had done this before the mention of the IPO. It's possible that he has been considering the move for a while, and hasn't bothered to go through with it until a significant chunk of his income became at risk.

<comment><USER12> I'm not a lawyer, but this seems plausible. Singapore doesn't have a comprehensive tax treaty for the USA[1], which would otherwise prevent double taxation.

[1] <http://www.iras.gov.sg/irasHome/page.aspx?id=812>

</comment></comment></comment></comment></comment><comment><USER13> Let's see, he's 30 so maybe he has 50 years to live. If he got $3.84 billion and got a conservative 5% interest on that my back of the envelope calculation says he could spend $115 million a year for the rest of his life. Now spending $115 mill per year doesn't count buying assets like mansions or fancy art, those are investments. It would be $115 million on apparel or personal employees or the depreciation of cars, yachts and private jets. It would actually be hard to do and take a lot of work to spend it all every year.

If he paid the american taxes, which are 15% for cap gains but let's say he loses a third so he's left with $2.56 billion. He would be able to spend $77 million per year.

A $38 million per year difference seems like a lot of money, but is their any difference between a $115 million a year lifestyle and a $77 million a year lifestyle? In both cases you have more money than you can spend year in and year out. You're really getting diminishing lifestyle returns the more money you make. Maybe at the $115 mill level you'd feel more comfortable buying another private jet or having an extra 100 personal employees to take care of your stuff, but it really wouldn't be that much of a difference. I bet if he had a talk with some older billionaires they would tell him that it's not worth the hassle.

<comment><USER14> It is a huge difference, however, if you think: I could give that money to the government, without any control over it, _or_ I could donate it to specific charities, or even fund my own charitable organization, and have complete control over how it was used.

I'm not necessarily saying that one is better than the other (private charity might have the potential to be more effective, but is certainly less democratic). But the choice is not merely between private hedonism and government coffers. You can do good with money outside of taxes.

Plus, if it's invested in other companies (as one would assume it will be), then it helps grow those companies, which if successful, will presumably pay taxes themselves. I'm not arguing against capital-gains taxes in general, but the question of _where_ taxes are collected along the chain is purely practical, not moral. If Saverin isn't paying additional taxes now, it's not like that money is disappearing forever.

<comment><USER15> If you give it to charity, you get to deduct that amount from the taxable total, so that's an invalid point.

<comment><USER14> It's not the same thing at all. If you pay 20% in taxes, and we're considering $1,000 of earnings, then I'm talking about paying $200 to charity instead of paying $200 in taxes.

You're talking about paying the full $1,000 to charity to avoid $200 in taxes. Totally different thing, and vastly more expensive.

Plus, his taxes are all in one year. To spend that kind of money effectively on charity would take many, many years, so it's _still_ not a viable alternative.

<comment><USER16> You could donate it to a charity, but they wouldnt have to spend it. This is what gates and soros do. Its basically a charity that funds other charities as they see fit.

A charitable trust with pretax dollars would be an even better idea however.

</comment></comment></comment></comment></comment><comment><USER17> I am not sure anyone noted yet that his Facebook earnings will fall entirely under capital gains income, which only gets taxed at 15% in the United States ([http://en.wikipedia.org/wiki/Capital_gains_tax_in_the_United...](http://en.wikipedia.org/wiki/Capital_gains_tax_in_the_United_States)). Singapore has ZERO capital gain tax, so he may be trying to avoid any tax burden on this income. Still, 15% remain quite low (The go up a bit in 2013.), and I suspect he would not have to pay it until actually selling his shares. Some reports say he has already sold over half his stake, so I am not sure this Singaporean move does that much for him.

There are plenty of ways to shelter money in the United States ([http://www.forbes.com/sites/deborahljacobs/2012/03/20/how- fa...](http://www.forbes.com/sites/deborahljacobs/2012/03/20/how-facebook- billionaires-dodge-mega-millions-in-taxes/)) and pay basically nothing. Everyone here likes to make the tax burden on US citizens outside of the US sound so horrendous, but my experience is that it is a worst of taxation situation. One gets to exclude the first 95k of income from US, but I think you also can run money through a housing allowance of around $100k depending on the cost of living.

Yes, the US tax system sucks, but the weather and disney-like atmosphere in Singapore suck more in my opinion. I think I could have fun living there for a few years, but a lifetime would be hard. The US will definitely consider this a move to avoid taxation. He will probably never be welcome again in the US, and essentially becomes a pawn in international extradition should some US administration in the future have a point to prove. If it were me, I would just dump a ton of money behind Ron Paul.

</comment><comment><USER18> The reaction of commenters who gleefully explain he may not be able to become a citizen again is pretty amusing. What makes you think he wants to reapply? Billions of people live fulfilling lives without ever stepping foot in the United States.

<comment><USER19> Well his bank account would probably be less fulfilled if he hadn't stepped foot in the United States.

<comment><USER20> This anecdote does nothing to detract from the central point, stated again: "Billions of people live fulfilling lives without ever stepping foot in the United States."

<comment><USER19> How many billions and who defines "fulfilling"? Much of the world actually lives in poverty.

It's also kind of a silly point to make when we're talking about a guy who already set foot in the United States. Why did he come to the United States if he was perfectly fulfilled in his home country where he was facing the threat of being kidnapped? I think it's unlikely he'll want to visit again, but it's not like his initial visit was really under what some would consider voluntary circumstances.

</comment></comment></comment></comment><comment><USER21> Good for him. I fully support higher taxes on the rich, but this notion that the US can tax you anywhere in the world is downright offensive. He hasn't been in the US since the company started, so I have trouble seeing a case for him owing the US anything.

</comment><comment><USER22> The tax reporting implications and liabilities of becoming US citizen are a clear turnoff for many people. Cash is king.

<comment><USER23> Yep.. it's becoming increasingly hard to do any business with overseas banks if you have US Citizenship. Foreign banks don't want the liability.

<comment><USER22> Very good point. In Switzerland, if you have a US passport, it is pretty difficult to open a bank account and/or get financial advice. Apparently bank/advisors can get into trouble for reasons I am not well up to date.

<comment><USER24> Yup. People with dual citizenship ("American" and "Swiss") living and working in Switzerland, have a hard time opening a bank account due to their American citizenship.

</comment></comment></comment></comment><comment><USER25> The catch here is: good luck getting back in. The US gov't takes notice of this stuff, and it's just good to be aware of the implications for if you ever want to come back to the US. Not saying it's wrong or right (by all means, the less tax the better), but it's important to be aware of the consequences.

<comment><USER23> Apparently it depends on if you are deemed to have renounced US Citizenship for tax purposes or for some other lawful reason:

"8 USC § 1182: (E) Former citizens who renounced citizenship to avoid taxation

Any alien who is a former citizen of the United States who officially renounces United States citizenship and who is determined by the Attorney General to have renounced United States citizenship for the purpose of avoiding taxation by the United States is inadmissible."

<comment><USER26> Judging from the statement he released, he's certainly aiming for a non-tax reason.

If he did it for tax reasons, it would make a lot more sense for him to do it pre-IPO announcement, or really as early as possible, as the amount of exit tax he's liable for is based on an estimate of the value of his assets. As the article mentions, it's easier to argue that number down when it's a private company.

</comment></comment></comment><comment><USER27> Just curious, how hard is it to regain US citizenship -- impossible?

<comment><USER28> Essentially, yes. A person who renounces U.S. citizenship is generally not able to take advantage of the special visa programs (like the EB5 investor program) to regain residency. Furthermore, their applications for visas, etc., are also (informally) put in the lowest-priority bracket unless they pony up to be placed in the priority queue.

Moreover, any attempt to renounce their renunciation of citizenship results in a hefty tax bill for the period they were not a citizen, as the initial renunciation will be treated (by the IRS) as an attempt to evade taxation. Indeed, merely returning to the U.S. for a period of more than 183 days (one of the tests for residence for taxation purposes) could trigger this result. EDIT: Also note, as discussed below, he would be deemed "inadmissible" for re- entry if he was deemed to have a tax avoidance motive for renouncing his citizenship. The consequence would be a permanent ban from the U.S. (and the hefty tax bill would remain intact).

<comment><USER29> A billion dollars is powerful. If he wants to; I'll bet that Saverin will find a way to live in the U.S. again.

<comment><USER28> I think you greatly overestimate how much power a billion dollars provides...especially since the IRS would lay claim to that billion if he ever tried to return to the U.S. Why would they work out a deal when they could get their hands on the billion _and_ have an example for future tax evaders?

 _Note: I use the term tax evader in this context because if Saverin attempts to return to the U.S. in the future (as a resident or citizen), it will be clear that his renunciation of citizenship was primarily for the purpose of evading taxes._

</comment></comment></comment></comment><comment><USER30> I like hearing about sociopaths that utilize the infrastructure provided by the U.S. but don't want to pay back. Contrast that to the evil poor that utilize the infrastructure, have nothing but are demonized for not paying.

<comment><USER31> If he'd actually continued to live in the US, I might have sympathy for this argument. But he's moved out. The US tax regime where expat US citizens still have to pay full tax to the US (except where there's a tax treaty that limits double taxation) is exceptionally harsh - almost no other countries do that.

<comment><USER32> > The US tax regime where expat US citizens still have to pay full tax to the > US (except where there's a tax treaty that limits double taxation) is > exceptionally harsh - almost no other countries do that.

This.

The US keeps taxing you _after you leave_. And for citizens, it is for life.

<comment><USER33> That's pretty hostile. I came here and now have a green card, with the intention of eventually gaining citizenship.

Now I'm wondering how much I've harmed my future mobility (should I choose to return to my birth country).

<comment><USER34> Why do you want citizenship? What do you think it gives you over having the Green Card. When I was going through the process to get my Green Card, my lawyer pretty plainly said that unless I really wanted to vote, getting citizenship gives you nothing but ads many liabilities.

The only real benefit I could have seen for myself was if I lived outside of the US for more than six months of the year from time to time.

<comment><USER33> > _The only real benefit I could have seen for myself was if I lived outside > of the US for more than six months of the year from time to time._

Pretty much this. Should I choose to move back home, it'd be nice not to have to go through the whole green card process over again.

Maybe I'm hedging my bets too much.

</comment></comment></comment></comment></comment></comment><comment><USER23> Interesting that Saverin only became a US citizen in 1998.

</comment><comment><USER35> Given the exit tax, am I the only one who sees this as a risky move?

From what I can tell, he's going to have to pay 30% taxes on his unrealized facebook gains. As opposed to 15% long term capital gains. Yeah, it's not publicly traded so they can screw with the valuation, but how will the government take that given liquidity is just around the corner? I'm not an accountant, but this seems like type of scheme that fortunes are lost on. Anyone else more informed have an opinion on the likelihood of him getting screwed over this?

</comment><comment><USER36> Saverin's other business ventures make his renunciation of US Citizenship far more palatable than many billionaires who jump ship for Monaco or some similar tax-shield country

</comment><comment><USER37> This is becoming increasingly common in recent years. [http://online.wsj.com/article/SB1000142405270230359240457736...](http://online.wsj.com/article/SB10001424052702303592404577362050670738024.html) It's not just having to pay extra tax every year, the mere act of filing a return abroad is headache enough and if you make a mistake you might see jail time.

</comment><comment><USER38> Wikipedia says his middle initial is 'P', but the USCIS site says a Eduardo Luiz Saverin renounces citizenship. Anyone know which is correct?

<comment><USER22> Middle name is with "L":

[http://www.thecrimson.com/image/2005/2/24/connectu- founders-...](http://www.thecrimson.com/image/2005/2/24/connectu-founders- cameron-sh-winklevoss/)

</comment></comment><comment><USER39> I wonder if the negative reaction to this is just a result of scale.

Most people I know do everything they can, both legally and questionably, in order to minimize their tax liability.

(And they actually live in the United States.)

</comment><comment><USER40> This thread is full of misinformed, judgemental, jingoistic BS.

What this guy does is none of your business, and I don't think he gives a damn what you think.

</comment><comment><USER41> Never heard of him here in Brazil. He probably gave up his Brazilian citizenship as well.

I wouldn't be surprised though, taxes here are 3x those in the USA.

</comment><comment><USER42> I predict the soon-to-be-enacted "International Tax Fairness" law, for which I would say to congress: Whoosh.

</comment><comment><USER43> See also <http://news.ycombinator.com/item?id=3960028> .

</comment><comment><USER44> So he does NOT support the Warren Buffet Rule?

</comment><comment><USER45> Saverin's case is potentially misleading. Many American citizens living abroad are under great hardship caused by the US tax system following them around the globe. The United States is the only developed country in the world that harasses its citizens for taxes on wages earned in foreign jurisdictions.

E.g.: ""It makes absolutely no sense," said Senator Jim DeMint, Republican of South Carolina, of a system that makes the United States the sole developed country to tax income earned by its citizens abroad."

[http://www.nytimes.com/2008/04/01/world/americas/01iht- expat...](http://www.nytimes.com/2008/04/01/world/americas/01iht- expats.4.11594315.html)

<comment><USER8> You can exclude $92,900 worth of foreign income from U.S. taxation (and another $92,900 for your spouse).

<comment><USER45> So?

</comment></comment></comment><comment><USER46> Guys, there is such as a thing as a US Visa for Foreign Investors: [http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b...](http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543f6d1a/?vgnextoid=facb83453d4a3210VgnVCM100000b92ca60aRCRD&vgnextchannel=facb83453d4a3210VgnVCM100000b92ca60aRCRD) He'll basically throw half a million at any cash-hungry startup and get a visa in no time, that'll be pocket change for him in few months. Getting back into the US will be no problem this dude. There's always the rafting option from Cuba too :P (I'm going to hell lol).

<comment><USER28> He is not eligible for that program (the EB5 visa), as a result of renouncing his citizenship.</comment></comment>