Monthly Archives: July 2021

News: Carlyle to acquire live broadcasting and streaming tech outfit LiveU for over $400M, say sources

Streaming is the name of the content game these days, and now one of the companies that builds tech to do this from anywhere in the world is getting acquired. LiveU — whose satellite/cellular hardware and software for capturing and delivering live streaming and broadcasting video is used by over 3,000 large media organizations —

Streaming is the name of the content game these days, and now one of the companies that builds tech to do this from anywhere in the world is getting acquired. LiveU — whose satellite/cellular hardware and software for capturing and delivering live streaming and broadcasting video is used by over 3,000 large media organizations — is going to be acquired by private equity firm Carlyle, multiple sources tell TechCrunch, for a value of over $400 million.

LiveU is based in Israel, and the deal was reported to be in the works by local press. Our sources say that the acquisition is in the final stages of closing and could be announced as soon as today or tomorrow. A LiveU spokesperson declined to comment on the story, and a Carlyle spokesperson did not respond to a request for comment.

What is notable is that this is the second time that LiveU has changed hands in the space of two years: the company was previously acquired by Francisco Partners, another PE firm, for at $200 million.

The quick jump in valuation, more than doubling in 25 months, is due in part to the huge surge of interest we’ve seen for video content.

It was not that long ago that you only watched live video on television, using a limited set of broadcast channels. Now, we have live, or near-live, or on-demand moving pictures coming at us from everywhere. On-demand and live streamed video can be found on apps (both those dedicated to broadcasting, and those that offer it alongside other content like YouTube, Facebook, and more) and websites; and not just TVs but phones, tablets and computers. It has become the primary medium for informing and entertaining people today and accounts for more than 80% of all IP traffic.

So it makes sense that a company building technology to make the process of capturing and delivering that video easier, cheaper and at a better level of quality would catch attention. (LiveU has been used for a lot of high-profile coverage, from tennis championships through to the Derek Chauvin trial.)

The other reason for the hike, it seems, is that LiveU itself has grown in size through an acquisition of its own. Earlier this year it snapped up its channel partner in the UK market, Garland Partners, for an undisclosed sum, to get closer to its customers in the region. One of our sources noted that this consolidation helped set the course both for LiveU to get acquired itself, and for its valuation.

It’s not clear whether there were other bidders interested in the company at the same time as Carlyle but the PE firm has been a pretty active buyer and growth-stage investor in the last year, which has been a heady one for funding in the wake of the Covid-19 pandemic and the resulting shifts in consumer and business behavior.

Other acquisitions in Europe (specifically the UK) have included 1e, a hybrid working startup based out of the UK, in deal that valued 1e at $270 million; and gaming company Jagex for around $530 million. Investments meanwhile have included a $200 million stake in South Korean mobility-as-a-service startup Kakao Mobility. LiveU would appear to be its first deal in Israel.

Israel has been a big benefactor of that activity. Avihai Michaeli, a Tel Aviv-based senior investment banker and startup advisor. estimates that startups in the country collectively raised $11 billion in the first six months of 2021, and that has already grown to $12 billion as of today. PE firms are a regular shopper when it comes to Israeli exits, he said, “to improve them from within, and then sell them for an even higher value.” Other examples have included Francisco Partners acquiring MyHeritage in February for around $600 million.

We’ll update this story as we learn more.

News: India’s GlobalBees raises $150 million to build Thrasio-like house of brands

The universe of Indian firms attempting to replicate Thrasio’s success in the world’s second largest internet market just got bigger. Three-month-old GlobalBees said on Monday it has raised $150 million in a Series A financing round led by FirstCry. Lightspeed Venture Partners also invested in the new financing round, which is $75 million in equity

The universe of Indian firms attempting to replicate Thrasio’s success in the world’s second largest internet market just got bigger. Three-month-old GlobalBees said on Monday it has raised $150 million in a Series A financing round led by FirstCry.

Lightspeed Venture Partners also invested in the new financing round, which is $75 million in equity and $75 million in debt. Even with a $75 million equity raise, Monday’s announcement makes GlobalBees’ round the largest Series A funding in India.

Founded by Nitin Agarwal, formerly of Edelweiss Financial, and Supam Maheshwari, a founder of FirstCry, GlobalBees acquires and partners with digitally native brands across categories such as beauty, personal care, home and kitchen, food and nutrition, and sports and lifestyle with a revenue rate of $1 million to $20 million.

New Delhi-based startup then helps these firms scale and sell to marketplaces (such as Amazon and Flipkart) and through other channels in India and outside the South Asian market, Agarwal told TechCrunch in an interview. He said GlobalBees has already acquired or partnered with over a dozen brands and they are selling both in India and outside of the country.

“At FirstCry, we created a lot of brands and realized that most of these brands reach a scale after which it becomes too difficult to scale them,” he said. “Supam and I have been talking about this for several years, trying to find ways to disrupt this market. We think there’s an opportunity to create a new house of brands that is digital native.”

Agarwal said GlobalBees will attempt to build a distribution and enterprise ecosystem in the online space similar to how traditional firms have established those connections in the offline world. (Not all brands GlobalBees engages with will get acquired on day one, Agarwal said. Typically, some brands get acquired in a span of three years or so, he said.)

“The time it takes for D2C brands to go from 0 – 100Cr (about $13 million) in revenue has more than halved over the past few years,” said Harsha Kumar, Partner at Lightspeed Venture, in a statement.

“We believe that this creates a unique opportunity to create a brand house much faster as well. With their past entrepreneurial stints together and their experience in building one of the largest ecommerce platforms in India, the duo of Supam and Nitin is the perfect team to go after this idea. Lightspeed is thrilled to be part of this journey!” said Kumar, who is joining the board of GlobalBees.

Scores of startups in India today are trying to replicate what is popularly known as the Thrasio-model. Mensa Brands, a similar venture by former fashion e-commerce Myntra chief executive, recently raised $50 million in equity and debt. 10club, another similar startup, recently raised $40 million — though much of it is in debt. TechCrunch reported last month that UpScale, another prominent player in this space, is in advanced talks with Germany’s Razor Group to raise capital.

Like Thrasio, several of these firms are trying to acquire brands that sell midrange to high-end products in categories where competition is limited. In fact, some of the categories that are common among these brands are so underappreciated that even Amazon and other e-commerce firms have not explored them through their private label ecosystems.

GlobalBees’ Agarwal agreed with this assessment, though he added that not all brands are operating in niche categories.

New York-headquartered Thrasio, which has raised over $1.3 billion in equity and debt since December last year, had acquired or otherwise consolidated about 6,000 third-party sellers on Amazon as of earlier this year.

“India is at the cusp of a D2C revolution with an estimated market size of $200 billion in the next 5 years. Indian brands have shown great promise in the recent years, and we believe that GlobalBees is building great assets to accelerate the growth of digitally native brands in the country,” said Vikas Agnihotri, Operating Partner, SoftBank Investment Advisers, in a statement.

Agnihotri, alongside Atul Gupta of Premji Invest, Sudhir Sethi of Chiratae Ventures and Kshitij Sheth of Chrys Capital are also joining GlobalBees’ board.

News: Nigerian investment platform Chaka secures $1.5M pre-seed after bagging country’s first SEC license

When Robinhood raised its $3 million seed round in 2013, it was a couple of months old with huge ambitions of democratizing securities access to the underserved and unserved. Robinhood has since taken the world by storm and grown to serve more than 30 million users with its zero-commission trading.  In the past, we’ve seen

When Robinhood raised its $3 million seed round in 2013, it was a couple of months old with huge ambitions of democratizing securities access to the underserved and unserved. Robinhood has since taken the world by storm and grown to serve more than 30 million users with its zero-commission trading

In the past, we’ve seen such growth trickle down to other regions across the world, inspiring similar businesses. Robinhood is no exception. Several platforms have sprung forth to bring stock trading opportunities in their respective markets. In Nigeria, at least four platforms offer both local and foreign stocks to individuals. Chaka is one such platform. Today, it is announcing the close of its $1.5 million pre-seed round to power digital investments for individuals and businesses.

The pre-seed round was led by Breyer Capital, while 4DX Ventures, Golden Palm Investments, Future Africa, Seedstars, and Musha Ventures participated. It’s the second joint deal for 4DX Ventures and Breyer Capital in the space of two weeks, the first in Egyptian social e-commerce platform Taager.

It is a well-known fact that even before Robinhood, the average American actively participated in stock trading. According to a survey by Gallup, about 60% of Americans owned some form of stock in 2000; that number was down to 55% in 2020. This was partly due to the global financial crisis that occurred in 2008.

The crash also affected the Nigerian capital market and because Nigerians lost a lot of money during that period, stock trading is mostly frowned upon by most of the public. Yet for the average Nigerian interested, participating in trading local stocks is hard; and practically impossible for foreign ones.

Tosin Osibodu, while in the U.S., recognised this problem and came back to Nigeria to start Chaka officially launching the company in 2019. According to Osibodu, Chaka wanted to create opportunities for Nigerians to invest in foreign assets and at the same time allow foreigners to invest in Nigerian assets.

“If there’s more demand in the market, over time, we expect there’ll be more supply. If you fast forward over a long period of time, we expect that our local capital markets will continue to grow,” he said to TechCrunch in an interview. “We will provide borderless digital access to multiple solutions, and so it’s not just about Nigerians investing in the market, it’s about making the markets accessible for people locally and globally.”

For the most part, Chaka has executed on one front. The platform Nigerians access to more than 10,000 stocks and ETFs trading on local and foreign capital markets. The CEO maintains that the platform has levelled entry barriers for borderless investments in Nigeria by providing customers with compliant access to the capital market.

“The thing about markets is that they have demand and supply with barriers to entry. We’re committed to lowering those barriers in local markets and by lowering barriers to investing for retail, more people will come to the market. In fact, more people came into the Nigerian stock market through us last year than any other broker. It’s like a demand-supply flywheel,” the CEO added.

Chaka’s local assets are registered with the Nigerian Stock Exchange (NSE) Central Securities Clearing System (CSCS) and regulated by the Securities Exchange Commission of Nigeria (SEC). Dollar assets, on the other hand, are regulated by the US FINRA and the US SEC.

In April this year, digital investment platforms were caught in crosshairs with Nigeria’s SEC. The regulator declared their activities illegal and warned capital market operators working with them to renege on providing brokerage services for foreign securities. Unlike Robinhood which offers online brokerages, Nigerian investment platforms do not. Chaka, for instance, partners with Citi Investment Capital in Nigeria and DriveWealth LLC in the U.S. to issue stocks and securities.

According to Nigeria’s SEC, the bottom line was to bring the activities of these platforms under its purview as part of its efforts to safeguard the investing public. Although Osibodu claims Chaka had always engaged the SEC since the company was formed in 2019, it did not seem that way last December when the regulator singled out the two-year-old company for “selling and advertising stocks.”

The event set the precedence for the regulator’s all-out attack on other digital investment platforms, giving Chaka enough time to engage and conclude talks in about half a year. And last month, Chaka acquired the first fintech license issued by the SEC, making it the only investment platform operating as a digital sub-broker.

“When we launched, we kept SEC in the loop. But now, over the last six months, we’ve engaged with them, showed them our business models, the benefits, the markets. Now we’re proud to have SEC’s first fintech license. We believe that the most important thing is that the market has clarity and understands the regulations required to be registered. And we’re thrilled to have broken new ground and cleared up what it takes to be able to offer services in the market,” he said.

With the new license, the company can swiftly focus on what lies ahead. Osibodu says the license expands the scope of what Chaka can achieve. He asserts that Chaka can power multiple brokers and provide access to different digital investment offerings in addition to being a digital sub-broker.

Chaka

Image Credits: Chaka

Asides from Chaka’s traditional stock trading app for retail investors, it also offers Chaka SDK which allows asset managers and financial institutions to offer digital investments and Chaka for Business for direct business onboarding and trading tools for institutional investors.

Jim Breyer of Breyer Capital, commenting on the investment said,  “We are proud to combine efforts with a company that is levelling the investment playing field for Nigerians [and Africans at large]. We’re confident in the value Chaka provides through its digital tools, and we look forward to playing our part in supporting Chaka’s team on their mission to drive borderless investments in Africa.” 

Osibodu says the company will use its pre-seed investment to expand footprints to Ghana and other West African markets. Improving its technology and services and securing partnerships with major financial institutions, including apex ones, is also a priority.

“As we advance, I think something that we’re just very focused on is how do we continually reduce access barriers, and we are proud of the initiatives that we’ve brought and are to come. Watch this space for more partnerships, even with apex institutions in our markets as well.”

News: Blackstone acquires majority stake in Simplilearn for $250 million

Blackstone is acquiring a majority stake in Bangalore and San Francisco-headquartered edtech startup Simplilearn for $250 million. Simplilearn operates an eponymous online bootcamp to help people learn data science, AI, machine learning, cloud computing and other skills that are in demand in the market. The startup has partnerships with several universities and colleges including IIT

Blackstone is acquiring a majority stake in Bangalore and San Francisco-headquartered edtech startup Simplilearn for $250 million.

Simplilearn operates an eponymous online bootcamp to help people learn data science, AI, machine learning, cloud computing and other skills that are in demand in the market.

The startup has partnerships with several universities and colleges including IIT Kanpur, Caltech, and Purdue University and students enrolling and completing these courses get a certificate from these institutes.

The 11-year-old startup, which runs 1,000 live classes each month, says it has helped over 2 million professionals and 2,000 companies including Facebook, Microsoft, Amazon across 150 countries.

The startup, which was last valued at $80 million in its 2016 Series C funding round, counts Brand Capital, Kalaari Capital, Helion Venture Partners, and Mayfield among its early backers. It had raised about $34.4 million prior to today’s deal, according to insight platform Tracxn.

Kalaari Capital, Helion Venture Partners and Mayfield Fund have taken exit as part of the new transaction but the leadership team of Simplilearn haven’t sold their stakes, according to a person familiar with the matter.

“The pandemic has only accelerated the need for digital skills and the industry has demonstrated absolute readiness for upskilling online. Hence, this is the most opportune time to take the next big leap in our journey to build the world’s largest digital skilling company,” said Krishna Kumar, founder and chief executive of Simplilearn, in a statement.

“We believe Blackstone can add significant value to our company because of their scale, commitment to building businesses, and global network, which will enable us to develop partnerships with businesses and universities as Simplilearn continues to expand around the world.”

The acquisition comes months after Blackstone-backed Aakash Education Services, which runs coaching centres across the country, was acquired by Byju’s — India’s most valuable startup — for nearly $1 billion. Blackstone has since also made an investment in Byju’s.

“This is Blackstone’s first private equity investment in Asia in a consumer technology company. […] We are excited to partner with Krishna Kumar and Simplilearn’s top-notch management team to accelerate growth and build the world’s pre-eminent digital learning company, and we expect this to be the first of many such investments in Asia,” said Amit Dixit, head of Asia for Blackstone, in a statement.

News: Lenskart valued at $2.5 billion following $220 million investment from Temasek and Falcon Edge Capital

Temasek and Falcon Edge Capital have led a $220 million investment in Indian omni-channel eyewear retailer Lenskart, valuing the Bangalore-based startup at $2.5 billion. The new investment, which includes primary and secondary transactions, is part of a new round Lenskart unveiled a month ago when it raised $95 million from global investment fund KKR. Bay

Temasek and Falcon Edge Capital have led a $220 million investment in Indian omni-channel eyewear retailer Lenskart, valuing the Bangalore-based startup at $2.5 billion.

The new investment, which includes primary and secondary transactions, is part of a new round Lenskart unveiled a month ago when it raised $95 million from global investment fund KKR. Bay Capital and Chiratae also participated in the new round.

Peyush Bansal, founder and chief executive of Lenskart, said the profitable startup — which sells eyeglasses and contact lenses online and through about 750 physical retail outlets across the country — has seen a surge in sales of eyewear products in the pandemic year.

The startup, which counts SoftBank among its investors, sold about 8 million pairs of eyewear last year.

Now the firm, which claims to lead the market in India, plans to scale its operations in Southeast Asia and Middle East. The combined market opportunity for eyewear in these regions will be about $15 billion by 2025, the startup said, citing its own projections.

“We’re already the largest eyewear player in India and in the top 3 in Singapore. Lenskart envisions to have 50% of India wearing its specs over the next 5 years and become the #1 eyewear platform in Southeast Asia and Middle East over the next 18 to 24 months through organic and inorganic expansion,” he said.

According to industry estimates, more than half a billion people in India are affected by poor vision and need eyeglasses, but only 170 million of them have opted to get their vision corrected.

The firm also plans to deploy some capital to broaden its technology stack to create a more personalized experience for its customers. The startup, which recently launched ‘Lenskart Vision Fund,’ said it is also looking to invest in other younger firms that are operating in eyewear, eyecare and omnichannel retail spaces.

“We are thrilled to join Peyush and his team in this journey and look forward to working closely with Lenskart’s team in helping them scale their business internationally, especially in the MENA region” said Navroz Udwadia, co-founder and partner at Falcon Edge Capital, in a statement.

The new investment comes at a time when Indian startups are raising record capital and a handful of mature firms are beginning to explore the public markets. Zomato raised $1.3 billion last week in the South Asian market’s first consumer tech IPO in a decade.

Paytm, the pioneer digital payments startup, as well as its rival Mobikwik also filed for IPOs last week.

News: Zoom buys cloud call center firm Five9 for $14.7 billion

Zoom is taking advantage of the impressive rise in its stock price in the past year to make its first major acquisition. The popular video conferencing firm, which was valued at about $9 billion at its IPO two years ago, said Sunday evening it has agreed a deal to buy cloud call centre service provider

Zoom is taking advantage of the impressive rise in its stock price in the past year to make its first major acquisition. The popular video conferencing firm, which was valued at about $9 billion at its IPO two years ago, said Sunday evening it has agreed a deal to buy cloud call centre service provider Five9 for about $14.7 billion in an all-stock transaction.

20-year-old Five9 will become an operating unit of Zoom after the deal, which is expected to close in the first half of 2022, the two firms said.

The proposed acquisition is Zoom’s latest attempt to expand its offerings. In the past year, the video conferencing software has added several office collaboration products, a cloud phone system, and an all-in-one home communications appliance.

The acquisition of Five9 — which has amassed over 2,000 customers worldwide including Citrix and Under Armour and processes over 7 billion minutes of calls annually — will help Zoom enter the “$24 billion” market for contact centers, the company said.

“We are continuously looking for ways to enhance our platform, and the addition of Five9 is a natural fit that will deliver even more happiness and value to our customers,” said Eric S. Yuan, founder and chief executive of Zoom, in a statement.

Joining forces will offer both firms “significant” cross-selling opportunities in each other’s respective customer bases, the two firms said.

“Businesses spend significant resources annually on their contact centers, but still struggle to deliver a seamless experience for their customers,” said Rowan Trollope, chief executive of Five9.

“It has always been Five9’s mission to make it easy for businesses to fix that problem and engage with their customers in a more meaningful and efficient way. Joining forces with Zoom will provide Five9’s business customers access to best-of-breed solutions, particularly Zoom Phone, that will enable them to realize more value and deliver real results for their business. This, combined with Zoom’s ‘ease-of use’ philosophy and broad communication portfolio, will truly enable customers to engage via their preferred channel of choice.”

The two firms will do a joint Zoom call Monday to share more about the transaction.

News: Kamereo gets $4.6M to connect farmers and F&B businesses in Vietnam

While working as the chief operating officer of a pizza chain in Vietnam, Taku Tanaka saw how difficult it is for restaurants to connect with farmers. Many small F&B businesses can’t buy in large volumes, so they rely on nearby markets or multiple suppliers who only sell one category. In turn, this means farmers are

While working as the chief operating officer of a pizza chain in Vietnam, Taku Tanaka saw how difficult it is for restaurants to connect with farmers. Many small F&B businesses can’t buy in large volumes, so they rely on nearby markets or multiple suppliers who only sell one category. In turn, this means farmers are disconnected from the end customers of their products, making it hard to predict selling prices or plan their crops. Tanaka founded Kamereo, B2B platform with its own warehouse and last-mile delivery network, to focus on those problems.

Based in Ho Chi Minh City, the company announced today that it has raised $4.6 million co-led by food conglomerate CPF Group, Quest Ventures and Genesia Ventures. The capital will be used for hiring, building a new warehouse management system, user interface upgrades and expanding into Hanoi next year.

Before founding Kamereo in 2018, Tanaka was COO of Pizza 4Ps, which grew from one location in Ho Chi Minh City when he joined to 10 stores three years later (it now has more than 30 locations in Vietnam).

Kamereo works with about 15 farmers, including cooperatives, and serves more than 400 active customers, ranging in size from family-owned restaurants to chains with more than 20 locations. Despite COVID-19 related movement restrictions and temporary business closures, Kamereo says it has grown by 15% every month over the last 12 months. It currently has about 100 employees.

F&B businesses use the platform to order from multiple farmers. Kamereo handles supplier negotiations, order processing and management, and fulfillment. Tanaka told TechCrunch that the company operates its own warehouses and last-mile delivery network because it is cheaper than working with third-party providers.

One of Kamereo's warehouses for fresh farm products

One of Kamereo’s warehouses for fresh farm products

Most of Kamereo’s last-mile deliveries are done by motorbikes since Vietnam has many small roads that are inaccessible to trucks. Tanaka said one drawback is how many goods can be delivered in one trip. Since drivers need to make multiple trips each day, Kamereo plans to expand its micro-warehouse network in Ho Chi Minh City so they don’t need to travel long distances. Its tech team is also building an internal system to manage inventory, fulfillment and last-mile deliveries with the goal of minimizing variable costs.

In a statement about the investment, Quest Ventures partner Goh Yiping said, “Kamereo sites in one of the largest food production hubs of Southeast Asia, and there is much room to grow in solving many of the inefficiencies of the supply chain today, improving farmers’ livelihood outcomes and procuring the best products for businesses and homes.”

News: Gillmor Gang: Catching Up

As the pandemic dwindled enough to get in our car with dogs, SiriusXM, and our children in the rear view mirror, we drove to South Carolina. Tina had endured the last year and almost another half while her mother languished with aging pets, her husband in a facility, and eventually his death. As the miles

As the pandemic dwindled enough to get in our car with dogs, SiriusXM, and our children in the rear view mirror, we drove to South Carolina. Tina had endured the last year and almost another half while her mother languished with aging pets, her husband in a facility, and eventually his death. As the miles melted away, we alternated between MSNBC, the Beatles channel, and a mixtape of soul, Steely Dan, and Bill Withers.

For years, we’d dreamed of a way to live from anywhere, and now the pandemic had made our reality a shared one. We’ll see how much this sticks as companies try to find a way to mix this digital acceleration with some semblance of business life as we knew it. But as we reached the driveway in Charleston, we were tired enough to not care much how the captains of industry would work things out.

We’d calculated the journey to leave on a Monday and arrive on a Thursday, three 16 hour days and then a day to rest before recording the next Gang session. Instead we left on Tuesday and arrived the night before the session. Surprisingly, the combination. of a three hour time zone shift and the ease of recording on Zoom, two M1 Macs, and enough WiFi to get away with it added up to a relaxed session. I’ve been using blur mode on Zoom for some months now, so everything felt just about normal. I even got to joke with a few of the guys who could not quite tell which coast we were on.

The dogs locked in to their summer digs with alacrity, roaming the fenced in back yard for a quick check and then settling into strategic spots surrounding us on our bed. Our daughters heated up the Facetime video link with tales of boyfriends and babies (our oldest is in her six month) and extended life seemed possible. When reality intruded, it somehow arrived with a gentleness we hope to get used to. Dinner with our youngest’s godparents was careful — no masks but no hugs either— as we ease our way into the new next.

Our first show here was followed by a train wreck of dueling agendas and uncomfortable management parries. The show started in a jocular fashion as Brent Leary tried to apologize (sort of) for his comments on one of his shows about the Gillmor Gang. It seems, he joked, that our show was rudderless and frequently a good opportunity to nap on air.

But then Brent said he hoped neither Tina nor I was watching this unspooling in realtime, which of course I was. Now I was both pissed off and actually more amused. Brent’s instincts fall somewhere between Harpo Marx’s brilliant silence and an unerring ability to bat back a question designed to prove he wasn’t engaged with a comment that proved not only that he was but that he chose not to say anything. Brilliant, devastating, and kind all at once. So I seized the moment to call him and say of course I was watching.

The next Gang recording session featured Brent’s repeated attempts at an apology or at least an explanation, but I kept interrupting him. The result was a funny but diffuse beginning to the show that devolved into a debate about social media and the First Amendment that we often can’t seem to avoid. As usual, no light was shed, and the show remains unreleased.

from the Gillmor Gang Newsletter

__________________

The Gillmor Gang — Frank Radice, Michael Markman, Keith Teare, Denis Pombriant, Brent Leary and Steve Gillmor. Recorded live Friday, June 25, 2021.

Produced and directed by Tina Chase Gillmor @tinagillmor

@fradice, @mickeleh, @denispombriant, @kteare, @brentleary, @stevegillmor, @gillmorgang

Subscribe to the new Gillmor Gang Newsletter and join the backchannel here on Telegram.

The Gillmor Gang on Facebook … and here’s our sister show G3 on Facebook.

News: The end of open source?

Though exploit development and disclosure is often messy, running technically complex “red team” programs against the world’s biggest and most important open-source project feels a little extra.

Shaun O’Meara
Contributor

Shaun O’Meara, global field CTO at Mirantis, has worked with customers designing and building enterprise IT infrastructure for 20 years.

Several weeks ago, the Linux community was rocked by the disturbing news that University of Minnesota researchers had developed (but, as it turned out, not fully executed) a method for introducing what they called “hypocrite commits” to the Linux kernel — the idea being to distribute hard-to-detect behaviors, meaningless in themselves, that could later be aligned by attackers to manifest vulnerabilities.

This was quickly followed by the — in some senses, equally disturbing — announcement that the university had been banned, at least temporarily, from contributing to kernel development. A public apology from the researchers followed.

Though exploit development and disclosure is often messy, running technically complex “red team” programs against the world’s biggest and most important open-source project feels a little extra. It’s hard to imagine researchers and institutions so naive or derelict as not to understand the potentially huge blast radius of such behavior.

Equally certain, maintainers and project governance are duty bound to enforce policy and avoid having their time wasted. Common sense suggests (and users demand) they strive to produce kernel releases that don’t contain exploits. But killing the messenger seems to miss at least some of the point — that this was research rather than pure malice, and that it casts light on a kind of software (and organizational) vulnerability that begs for technical and systemic mitigation.

Projects of the scale and utter criticality of the Linux kernel aren’t prepared to contend with game-changing, hyperscale threat models.

I think the “hypocrite commits” contretemps is symptomatic, on every side, of related trends that threaten the entire extended open-source ecosystem and its users. That ecosystem has long wrestled with problems of scale, complexity and free and open-source software’s (FOSS) increasingly critical importance to every kind of human undertaking. Let’s look at that complex of problems:

  • The biggest open-source projects now present big targets.
  • Their complexity and pace have grown beyond the scale where traditional “commons” approaches or even more evolved governance models can cope.
  • They are evolving to commodify each other. For example, it’s becoming increasingly hard to state, categorically, whether “Linux” or “Kubernetes” should be treated as the “operating system” for distributed applications. For-profit organizations have taken note of this and have begun reorganizing around “full-stack” portfolios and narratives.
  • In so doing, some for-profit organizations have begun distorting traditional patterns of FOSS participation. Many experiments are underway. Meanwhile, funding, headcount commitments to FOSS and other metrics seem in decline.
  • OSS projects and ecosystems are adapting in diverse ways, sometimes making it difficult for for-profit organizations to feel at home or see benefit from participation.

Meanwhile, the threat landscape keeps evolving:

  • Attackers are bigger, smarter, faster and more patient, leading to long games, supply-chain subversion and so on.
  • Attacks are more financially, economically and politically profitable than ever.
  • Users are more vulnerable, exposed to more vectors than ever before.
  • The increasing use of public clouds creates new layers of technical and organizational monocultures that may enable and justify attacks.
  • Complex commercial off-the-shelf (COTS) solutions assembled partly or wholly from open-source software create elaborate attack surfaces whose components (and interactions) are accessible and well understood by bad actors.
  • Software componentization enables new kinds of supply-chain attacks.
  • Meanwhile, all this is happening as organizations seek to shed nonstrategic expertise, shift capital expenditures to operating expenses and evolve to depend on cloud vendors and other entities to do the hard work of security.

The net result is that projects of the scale and utter criticality of the Linux kernel aren’t prepared to contend with game-changing, hyperscale threat models. In the specific case we’re examining here, the researchers were able to target candidate incursion sites with relatively low effort (using static analysis tools to assess units of code already identified as requiring contributor attention), propose “fixes” informally via email, and leverage many factors, including their own established reputation as reliable and frequent contributors, to bring exploit code to the verge of being committed.

This was a serious betrayal, effectively by “insiders” of a trust system that’s historically worked very well to produce robust and secure kernel releases. The abuse of trust itself changes the game, and the implied follow-on requirement — to bolster mutual human trust with systematic mitigations — looms large.

But how do you contend with threats like this? Formal verification is effectively impossible in most cases. Static analysis may not reveal cleverly engineered incursions. Project paces must be maintained (there are known bugs to fix, after all). And the threat is asymmetrical: As the classic line goes — blue team needs to protect against everything, red team only needs to succeed once.

I see a few opportunities for remediation:

  • Limit the spread of monocultures. Stuff like Alva Linux and AWS’ Open Distribution of ElasticSearch are good, partly because they keep widely used FOSS solutions free and open source, but also because they inject technical diversity.
  • Reevaluate project governance, organization and funding with an eye toward mitigating complete reliance on the human factor, as well as incentivizing for-profit companies to contribute their expertise and other resources. Most for-profit companies would be happy to contribute to open source because of its openness, and not despite it, but within many communities, this may require a culture change for existing contributors.
  • Accelerate commodification by simplifying the stack and verifying the components. Push appropriate responsibility for security up into the application layers.

Basically, what I’m advocating here is that orchestrators like Kubernetes should matter less, and Linux should have less impact. Finally, we should proceed as fast as we can toward formalizing the use of things like unikernels.

Regardless, we need to ensure that both companies and individuals provide the resources open source needs to continue.

News: All eyes are on India’s brightest Zomato

Relevance is often tied to rarity. As a result, the first anything — whether a birthday, scientific feat or female vice president — comes with its own weight. Whether that pressure is warranted is a discussion in and of itself, but today, we’ll focus on the ripple effects of India’s first unicorn IPO: Zomato. Food

Relevance is often tied to rarity. As a result, the first anything — whether a birthday, scientific feat or female vice president — comes with its own weight. Whether that pressure is warranted is a discussion in and of itself, but today, we’ll focus on the ripple effects of India’s first unicorn IPO: Zomato.

Food delivery startup Zomato, set to start trading public shares next week, has been labeled by journalists and industry experts as India’s biggest tech public offering to date. The company could be valued at up to $8.6 billion in its public debut, and early indications of investor interest were strong. 

As my colleagues Alex Wilhelm and Anna Heim put it in their column, the eventual performance of Zomato will be watched by Paytm and MobiKwik, two Indian fintech unicorns also looking to go public soon, the some 100 Indian unicorns, and, of course, returns-focused venture capitalists. The success of the startup could lead to more venture funding, exits down the road, and overall, highlight a milestone for growth investments amid legislative and regulatory tension. 

While the pressure is on for Zomato not to get squashed by the public markets, it’s not simply baseless, anticipatory energy. Our on-the-ground reporter Manish Singh has religiously reported on all the signs that India has been building toward this event, from the early-stage startup fundraising frenzy to how engineers suddenly feel empowered to ask for more money thanks to an increase in demand.

A Zomato success may turn more investors to pay attention to the startup scene, but they will be playing catch-up: Indian startups have raised a record $10.46 billion in the first half of 2021, up from $4 billion during the same period last year, and $5.4 billion in the first half of 2019, data insight platform Tracxn told TechCrunch. For comparison, Indian startups had raised $11.6 billion in all of 2020.

The takeaway here, both in life and in startups, is that the first anything is rarely a result of a single decision. Often, if you look closely, a massive milestone is due to an amalgamation of different wins, successes, failures, and tinier milestones along the way. This doesn’t take away its title as the biggest tech startup to go public in India (relevant, and rare!) but it does suggest that ripple effects aren’t just a side effect of a financing event, but maybe the impetus of the IPO in the first place.

In the rest of this newsletter, we’ll get into emerging fund manager trends, as well as funding round advice that has nothing to do with closing a round. You can find me on Twitter @nmasc_ or listen to me as a co-host on Equity.

Emerge, then converge

unicorn

Image Credits: Bryce Durbin/TechCrunch

The clip of closed funds led by diverse, emerging fund managers is unlike anything I’ve seen before. In the last week, Female Founders Fund closed $57 million for Fund III, Nasir Quadree announced one of the largest solo GP funds, Peter Boyce II is nearing a $40 million close for Stellation Capital and H Ventures landed a $10 million debut fund.

Here’s what to know: More and more established venture firms are turning to emerging managers for deal flow, and frankly, new partners, per my colleague Connie Loizos. Just this week, Initialized Partner scooped up Parul Singh from Founder Collective, making her a new partner at the firm. Don’t expect the trend to slow down anytime soon.

Your funding round isn’t special, but you may be

It may be easier to fundraise than it is to secure fundraising coverage. As we talked about in our recent Equity podcast, featuring special guest Forbes Senior Editor Alex Konrad, the bar for “the funding round story” has never been higher.

Here’s what to know: In order to stand out, founders need to be transparent about competition, their industry and leave those godforsaken preapproved quotes and talking points. We get into specific advice on the show, and how a numbing effect could hurt historically overlooked individuals.

For more fundraising advice:

Around TC

  • The TechCrunch Disrupt Agenda just went live. It’s a must-read line up and a must-attend event.
  • Have you ever taken a cohort-based course from an edtech platform? I’m writing a story, so please e-mail if you’re open to chatting about your experience at one.
  • Shout out to Christine Hall for recently joining the TechCrunch team. Follow her on Twitter. I’ll wait!

Across the week

Seen on TechCrunch

Seen on Extra Crunch

Thanks for reading along, everyone. Have a good weekend, and if you liked this newsletter, make sure to share it with at least one friend!

N

WordPress Image Lightbox Plugin