Sam Bent

Agorist. Counter-economist. Privacy maximalist. Student of OPSEC. Anti-authoritarian. Free speech absolutist. Logician. Ex-Darknet Vendor. Youtuber.

[Sam Bent @DoingFedTime]

https://t.co/XHiWENfJn6

[Sam Bent @DoingFedTime]

They never touch your computer.
They never hack your network.
They listen to the sounds your machine makes
while it works and pull your data out of the air.
This is already real.
https://t.co/87bS6sowGS

[Sam Bent @DoingFedTime]

@ubuntu lmfao

[Sam Bent @DoingFedTime]

@coinbureau Look into how the income tax came about.
Karp is a POS but right in this instance.

[Sam Bent @DoingFedTime]

Army OPSEC doctrine has the OPSEC element rank vulnerabilities by operational importance while intelligence analysts rank them by collection susceptibility. Create a 2x2 grid: importance vs. ease of collection. Address the high-importance, easy-to-collect quadrant first.

[Sam Bent @DoingFedTime]

#OPSEC365 219/365

Vulnerability analysis in OPSEC doctrine ranks vulnerabilities on two axes: operational importance and susceptibility to collection. The highest-priority items are both important AND easy for your adversary to collect.

Low-importance data that's hard to collect isn't worth protecting. High-importance data that's trivially exposed is your immediate priority.

A list of vulnerabilities without ranking gives you no place to start. #OPSEC365

[Sam Bent @DoingFedTime]

@ricardoXMR https://t.co/cU0fLvtuoO

[Sam Bent @DoingFedTime]

@shotgunner101 Same.

[Sam Bent @DoingFedTime]

@KEKBONDS I like self hosted email. It's not crazy complicated. I have to make a video at some point about it.

[Sam Bent @DoingFedTime]

https://t.co/XHiWENfJn6

[Sam Bent @DoingFedTime]

@encrypted_past @solminingpunk @TheGruq @0x686967 Thank you for the shout out! I'm also glad you liked my talk. I seriously considered walking out of the room when I looked at the crowd and saw the entire room in track 1 full plus people standing up in the background. I dread (get it) going to the grocery store, so.... yea.

[Sam Bent @DoingFedTime]

@PabloSabbatella Yes I self host everything i can, when I can.

[Sam Bent @DoingFedTime]

Local password managers don't collect, store,
or sell anything.
There's no business model that needs your data.
When your vault lives on your device there's no honeypot for warrants
or national security letters to point at.
https://t.co/BJKizNqYrt

[Sam Bent @DoingFedTime]

@Codedscientist Free IB.

[Sam Bent @DoingFedTime]

On Google Drive, click Share and check whether it's set to Anyone with the link or Restricted. On Dropbox review link settings for password protection and expiration. Shared links that seem private can be found by anyone who obtains the URL, and URLs leak through many channels.

[Sam Bent @DoingFedTime]

#OPSEC365 218/365

Shared links to cloud files often don't require authentication.

That Google Drive link you shared to collaborate on a document might be accessible to anyone with the URL. Some cloud storage defaults to link access that doesn't check who's clicking. URLs can be guessed, leaked, or discovered through browser history.

Check the sharing settings on cloud files before sending links and restrict access to specific accounts.

#OPSEC365

[Sam Bent @DoingFedTime]

The darkest twitter (pitch) disables new accounts due to spam.

Quality over quantity.

[Sam Bent @DoingFedTime]

They mine your browsing like ore.
Every click and every query packaged
and monetized by companies you never agreed to.
Do it long enough and the tracking goes invisible.
You stop noticing the cage.
That doesn't make the cage acceptable.
https://t.co/Nw2orAArJ8

[Sam Bent @DoingFedTime]

@zostaff 'Privacy Maxis' use XMR.

[Sam Bent @DoingFedTime]

@nym It's so fucking depressing.

[Sam Bent @DoingFedTime]

If this was turned into a book I would read it.
My favorite line:
"Speaking of, if anyone shows up here, my 2FA becomes my 2A.
I didn't spend 550 on a Glock to get into a fist fight. ".

The only surprising part for me was that it wasn't printed but bought.

[_SiCk @encrypted_past]

None of you are entitled to an exploit which allows you to touch any target you want.

I release code because it's fun.

You blue team motherfuckers crying for now three days because exploits drop fail to see the point, without people dropping exploits, you have no job. There is no defensive without offense. Stop fucking crying, and do the job you're paid to do. I do not give a fuck about your weekend and I quite enjoy your crying. Also; just so you're aware, I've been up front. I never claimed this thing touched nginx. The fucking demo used lab env (look at the demo) + LAN addresses, FPM on 9xxx

What part of that do you not understand?

A proof of concept is just that: something that proves a concept. Most people submitting a bug for review would stop at a crash dump. If you read the readme, before I nuked the github, you'd know. proof an exploit in lab conditions is possible, and exploiting it in the wild are two different things. I read everything that comes out. Github is full of PoC's on this issue. Multiple reports PHP (patched) is still vulnerable. having fpm behind your httpd isn't a patch. There's still a double free in the code base, still a UAF that has a block to actual exploitation. Multiple serialization bugs. Swoole is also an issue. You people can eat a dick.

Show me on the doll where the PHP2SHELL CVE's show up in our code?

is php2shell php2shell2shell?

If you want a villain who's also an asshole you've got him now.

Dragging my fucking name, threatening my Life, my family, and now, telling me and people I follow you wanna wear our skin like a suit and rape our mothers while you make us watch? Now trying to reach out and touch me?

Thanks 2FA. ;)

Speaking of, if anyone shows up here, my 2FA becomes my 2A. I didn't spend 550 on a Glock to get into a fist fight.

I've been a pretty nice guy until today. You're gonna see a side of me, none of you are going to like.

You're gonna need to call LE and your boss, you fuckers are in for a long weekend.

[Sam Bent @DoingFedTime]

@Zodomo Forgejo. I like the fact I can self host on a sub 1 gb ram $4 a month droplet.
https://t.co/XL0QQbQryj

[Sam Bent @DoingFedTime]

Most Tor Docker images can't prove what's inside them.
HiddenForge 2.1.0 (my creation):
byte-for-byte reproducible builds,
zero known CVEs,
no DNS leaves the container,
seccomp + Tor's own sandbox,
self-heals with the same .onion.
Built for a state-level adversary threat model.
https://t.co/q8MIIjxAUl