838: Incident

Explain xkcd: It's 'cause you're dumb.
(Redirected from 838)
Jump to: navigation, search
He sees you when you're sleeping, he knows when you're awake, he's copied on /var/spool/mail/root, so be good for goodness' sake.
Title text: He sees you when you're sleeping, he knows when you're awake, he's copied on /var/spool/mail/root, so be good for goodness' sake.

[edit] Explanation

This comic was posted on Christmas Eve in the United States. While Christmas is principally a Christian holiday celebrating the birth of Jesus on December 25, there are many tradition around the holiday, among them a tradition in United States that in Christmas Eve Santa Claus will make his round delivering gifts to good children.

Rob sits behind a Linux computer and tried to change his user account from his normal access to the access of a super user by using the command "sudo su". Sudo is a famous phrase in xkcd lore, made famous by comic 149: Sandwich. When Rob is unable to use "sudo" because his account is not authorized, the system says that the incident "will be reported" (usually to the system administrator, so he can see if someone is making repeated attempts at accessing administrator privileges).

In the comic, however, Sudo and the system report the incidents to Santa Claus, who in Christmas lore makes a list of who is naughty and who is nice. If you are nice, you get presents, if you are naughty, you get a lump of coal. When sudo reports to Santa that Rob's account is not authorized, he puts Rob on the naughty list.

In the title text, which is a parody of the famous Christmas song, "Santa Claus Is Coming To Town", /var/spool/mail/root is the root (superuser) mailbox on a Linux system, where the incident described in the comic would commonly be reported to.

[edit] Transcript

[Rob is sitting at a computer. The computer's prompt is shown.]
robm@homebox~$ sudo su
robm is not in the sudoers file. This incident will be reported.
robm@homebox~$ █
[Megan approaches.]
Rob: Hey — who does sudo report these "incidents" to?
Megan: You know, I've never checked.
[Santa Claus is sitting at a desk supported by candy canes, with a red monitor. On the wall are two lists labeled 'naughty' and 'nice'. He is adding a name to the 'naughty' list.]
comment.png add a comment! ⋅ Icons-mini-action refresh blue.gif refresh comments!


And so the entire list of naughty and nice children fits into a single A1 poster by Santa's computer. Davidy²²[talk] 09:59, 9 March 2013 (UTC)

Presumably it's a delta encoding; he writes down changes to the lists and then later writes them into his records and gets a new poster. 16:19, 10 March 2013 (UTC)


Seeing as the username is robm, should this be attributed to Rob and not Cueball? Mark Hurd (talk) 16:27, 18 April 2013 (UTC)

Yup, changed that. Xyz (talk) 14:32, 14 May 2013 (UTC)


Real Linux does say "this incident will be reported," but does *NOT* report it to Santa Claus. Xyz (talk) 14:49, 14 May 2013 (UTC)

Actually the title text kind of explains this! The incident is reported to root, by email (by default, anyway). So if Santa is somehow "copied" there, he will see the message. Durka42 (talk) 08:11, 17 November 2013 (UTC)


So all we need now is an Ubuntu distro that reports failed sudo attempts to Santa Claus. Santabuntu anyone?

Zyxuvius (talk) 05:37, 16 October 2013 (UTC)
Personal tools


It seems you are using noscript, which is stopping our project wonderful ads from working. Explain xkcd uses ads to pay for bandwidth, and we manually approve all our advertisers, and our ads are restricted to unobtrusive images and slow animated GIFs. If you found this site helpful, please consider whitelisting us.

Want to advertise with us, or donate to us with Paypal or Bitcoin?