Earlier this week, news of a massive hacking operation — likely Russia-sponsored — rippled through the tech community.

At the center of the storm is SolarWinds, a $5B+ IT company that manages the network infrastructure for **checks notes** everyone:

• 425 of the US Fortune 500
• All 10 of the top US telecom companies
• Key US government bodies: Pentagon, State, Treasury, Commerce, NSA, DOJ, etc.

18k SolarWinds customers installed a malicious upgrade…

… sometime between March and June.

According to ThreatPost, SolarWinds was the “perfect target” because its network management software (Orion) has full visibility into an organization’s network.

SolarWinds made some comically bad mistakes in securing its critical tools:

• Passwords: “solarwinds123” was one password for access to update servers
• Antivirus: to make the installation process easier, the company advised customers to disable antivirus scanning

It’s not clear what was taken

But with the target list and level of access, the data — which we can only assume is more than family photos — is incredibly valuable.

Security analyst Brian Krebs writes that this breach could be an “existential event” for SolarWinds depending on how customers react.

The aforementioned Orion product accounts for ~45% of SolarWinds’ revenue, and lawsuits are almost certain.

SolarWinds’ stock has shed 20%+ this week

Additional losses will be dependent on how much the company knew. Per Krebs, researchers have told SolarWinds about its vulnerabilities for years (in fact, another tech firm — FireEye — broke the hacking news).

Further, in what can only be described as “interesting,” key SolarWinds investors unloaded $286m of stock prior to the hack disclosure.

Facebook’s former security chief Alex Stamos believes government-level change is needed to “create a mechanism to handle cyberattacks the same way [the US] reacts to failures in other complex industries.”

His suggestion: the creation of a cyber equivalent to the National Transportation Safety Board to find root causes and make recommendations on future prevention (e.g., literally any other password).

We’ve mentioned the California-to-Texas tech migration a few times here, as we ourselves have moved HQ from San Francisco to Austin.

Others that keenly observed us and followed suit include: Oracle, Hewlett-Packard Enterprise, and Elon Musk’s Twitter account. 

So, what’s behind the corporate movement between the country’s 2 most populous states?

The most cited reason is taxes 

While this is certainly true, there is a bit of nuance as explained by the Wall Street Journal.

Here are key considerations: 

• California has higher income taxes (up to 13.3% vs. 0%) and an active regulatory structure 
• Texas has more regressive property and sales taxes but is much more hands-off on the regulatory side 

Business-level taxation is a wash, with Texas actually collecting a higher % of private sector economic activity (5%) — more than the national average (4.5%) — while California takes 4.3% per the WSJ.

Housing costs could be the X-factor 

Due to looser land-use regulations, Texas is a comparatively cheaper place to own a home. And, per one tax expert, home ownership costs are a key variable in payrolls costs.

Combine that with no state-level income tax, and wooing talent for the long-term may be easier.

The rise of remote work does make the difference a bit moot for mobile white-collar workers. Either way, come say “hi” when the world’s normal again. 👋

Trends member Bilal Zaidi is the man behind Creator Lab, a business podcast that dives inside the minds of leading entrepreneurs & creators.

Zaidi recently had a convo with Tim Urban, author of Wait But Why and one of the internet’s most popular writers (check it out on your favorite podcast app or watch on YouTube).

Just for The Hustle readers, he asked Urban the following questions:

Do you have a request for a startup?

My wife is doing a startup in an area that I think is critically needed: innovation on what a doctor’s office should be, which hasn’t really changed since 1985.

Another: connecting supply and demand — like Uber and Airbnb — in surprising places.

Take cooking. There are people who love home cooking meals for their family, but their kids are out of the house. They can be connected to other people who want to eat home-cooked food but don’t want to cook.

What business would you launch if you were 20?

At 20, you have 2 superpowers:

• You really have time
• You have the freshest eyes

You can be fearless. You can dive into something that is likely to fail, which is — of course — one of the ways to create something great.

You’re on the bleeding edge of what is new and what’s possible. Zuckerberg started Facebook at 19, that’s not a coincidence.

I’d go after the 2 areas I mentioned and also probably social media. People have such a hunger to connect but no one wants to be in a toxic place.

What are your favorite Wait But Why posts?

Ones where I’m having fun and really nerding out: “Putting Time In Perspective and “7.3B People, One House.”

(Read the full Q&A here)

Bug bounties are programs where large corporations pay hackers to find vulnerabilities in their code. Netscape launched the first bug bounty program in 1995, to find issues in its browser.

Since then, companies with gnarly code bases — Google, Facebook, Tesla, Microsoft, Uber, Verizon, etc. — have paid millions of dollars to “ethical” hackers.

One of the top “ethical hackers” is Santiago Lopez, who became the first person to earn $1m on HackerOne, a platform that connects hackers with bounties.

The 20-year-old Lopez lives in Buenos Aires and got interested in hacking after watching Hackers (thank god he wasn’t inspired by Breaking Bad).

He is completely self-taught via YouTube and blogs; also, it’s a full-time job, with Lopez clocking 6-7 hours a day.

Other good tidbits:

• His first bounty was $50
• His largest bounty was $9k
• He’s found 1,670+ bugs in his time

Damn, SolarWinds really coulda used this guy.