Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.
United States
Joined May 2021
- Tweets11.1K
- Following446
- Followers20.8K
- Likes82K
They mine your browsing like ore.
Every click and every query packaged
and monetized by companies you never agreed to.
Do it long enough and the tracking goes invisible.
You stop noticing the cage.
That doesn't make the cage acceptable.
youtu.be/V5ad6y5sixU
If this was turned into a book I would read it.
My favorite line:
"Speaking of, if anyone shows up here, my 2FA becomes my 2A.
I didn't spend 550 on a Glock to get into a fist fight. ".
The only surprising part for me was that it wasn't printed but bought.
None of you are entitled to an exploit which allows you to touch any target you want.
I release code because it's fun.
You blue team motherfuckers crying for now three days because exploits drop fail to see the point, without people dropping exploits, you have no job. There is no defensive without offense. Stop fucking crying, and do the job you're paid to do. I do not give a fuck about your weekend and I quite enjoy your crying. Also; just so you're aware, I've been up front. I never claimed this thing touched nginx. The fucking demo used lab env (look at the demo) + LAN addresses, FPM on 9xxx
What part of that do you not understand?
A proof of concept is just that: something that proves a concept. Most people submitting a bug for review would stop at a crash dump. If you read the readme, before I nuked the github, you'd know. proof an exploit in lab conditions is possible, and exploiting it in the wild are two different things. I read everything that comes out. Github is full of PoC's on this issue. Multiple reports PHP (patched) is still vulnerable. having fpm behind your httpd isn't a patch. There's still a double free in the code base, still a UAF that has a block to actual exploitation. Multiple serialization bugs. Swoole is also an issue. You people can eat a dick.
Show me on the doll where the PHP2SHELL CVE's show up in our code?
is php2shell php2shell2shell?
If you want a villain who's also an asshole you've got him now.
Dragging my fucking name, threatening my Life, my family, and now, telling me and people I follow you wanna wear our skin like a suit and rape our mothers while you make us watch? Now trying to reach out and touch me?
Thanks 2FA. ;)
Speaking of, if anyone shows up here, my 2FA becomes my 2A. I didn't spend 550 on a Glock to get into a fist fight.
I've been a pretty nice guy until today. You're gonna see a side of me, none of you are going to like.
You're gonna need to call LE and your boss, you fuckers are in for a long weekend.
#OPSEC365 217/365
Customer support is a backdoor for social engineers.
Attackers call support lines pretending to be you, using info gathered from social media and data breaches to pass security questions. They request password resets, account changes, or info that helps compromise your accounts.
Add extra security to accounts that allow it and expect that attackers will target support channels.
#OPSEC365
Most Tor Docker images can't prove what's inside them.
HiddenForge 2.1.0 (my creation):
byte-for-byte reproducible builds,
zero known CVEs,
no DNS leaves the container,
seccomp + Tor's own sandbox,
self-heals with the same .onion.
Built for a state-level adversary threat model.
sambent.dev/sam/HiddenForge/…
People imagine breaking Tor takes a supercomputer.
It takes an ISP and a lie about which routes you own.
Every state already runs one.
So do the companies and the criminals.
That is the whole cost of admission.
youtu.be/XDsLDhKG8Cs
#OPSEC365 216/365
Temporary email services aren't as anonymous as they seem.
10minutemail, Guerrilla Mail, and similar services let you create throwaway addresses, but the services themselves log IP addresses and usage. Anyone with access to the service's logs can correlate your temporary address with your real identity through connection data.
For truly anonymous email, temporary services require additional layers of protection like Tor.
#OPSEC365
Chainalysis head of investigations admitted under oath she knew of zero scientific evidence for their forensic tool.
How do they check accuracy?
Customer feedback.
youtu.be/oFioqVeNGGg
#OPSEC365 215/365
Counter-surveillance starts with awareness of who might be watching.
Professional surveillance involves multiple people, vehicle switches, and careful tradecraft. But most surveillance you'll encounter is amateur. A car that appears too often, someone who shows up at multiple places you go, or patterns that feel off deserve attention.
Practice being aware of your surroundings without being paranoid.
#OPSEC365
They told you seizing assets protects the public.
Then they hired a clown with the proceeds.
When the people who get to keep what they steal also decide who to steal from,
the outcome writes itself.
youtu.be/-HGCGivMSUs
#OPSEC365 214/365
Granting contact access doesn't expose your data. It exposes everyone else's.
Your address book is a social graph belonging to people who never consented. WhatsApp, LinkedIn, and TikTok have all used contact uploads to build graphs of non-users.
Cronk's aggregation problem: the app now knows your network position without you ever posting publicly.
A photo editor, a game, or a flashlight has no functional need for your contacts. Audit the permissions and revoke them. #OPSEC365
When a corporation gets attacked, it loses money, so it patches overnight.
When Tor gets a bug that endangers dissidents, it sits for years.
youtu.be/4Gry4U6L7l8
#OPSEC365 213/365
Your notification center is a summary of your digital life visible on your lock screen.
Banking alerts, message previews, calendar reminders, and app notifications all appear where anyone glancing at your phone can see them. The locked screen shows a feed of your recent activity.
Review your notification settings and limit what shows when your phone is locked.
#OPSEC365
Searching an entire zip code with zero suspicion is the exact general warrant the founders fought a revolution over.
Sacramento turned it into a revenue machine
and billed 94 million in fines.
Surveillance pays for itself.
youtu.be/onYWQJsWFpk
#OPSEC365 212/365
Gait recognition is being marketed as a way to identify you by how you walk.
Your stride length, pace, arm swing, and posture create a signature that does not change when you cover your face. Watrix, a Chinese vendor, has publicly claimed 50-meter identification at 94% accuracy with the face fully covered. That figure comes from the company itself and has not been independently validated in peer-reviewed research.
#OPSEC365
China has deployed gait recognition into surveillance systems. Western academic work continues to advance the underlying technology, but published results in the open literature trail vendor marketing. The deployed-and-perfect framing deserves skepticism even though the underlying capability is moving forward.