ZeroTrustWraith

The monetization of OSINT tools and the transformation of social media platforms into walled gardens doesn't hinder malicious actors. Criminals generally rely on leaked data breaches and stolen source code. They aren't relying on front-end web scraping. These restrictions only lock out those trying to use OSINT for the greater good.

"We're doing this for safety" is nothing more than security theater.

I recently signed up for Trace Labs, and as an OSINT newcomer, I didn't expect to hit such an immediate, frustrating wall. For obvious opsec reasons, crowdsourced search parties discourage using your real-world identity. Yet today, standard investigative tools are locked behind invasive account creation and identity verification processes.

To make matters worse, Meta previously banned my device fingerprints simply for sharing HackTheBox content, accusing me of being a "malicious hacker" and requesting I provide them a government issued ID for "security reasons." This blatant overreach has severely limited my ability to build the research accounts needed to actively participate in these labs. Furthermore, major platforms and target web pages now aggressively block traffic from TOR and VPNs. Again, how does this stop threat actors who already have dark web access? It only hinders those trying to play by the rules.

The clamp down on open data extends everywhere, from restricted satellite imagery to locked-down public directories. When tech giants claim they are locking down data for "user safety," it is a convenient PR shield to protect corporate profits and liability. They don't care about your data. If they did, they wouldn't demand your government ID, force you to fork over a phone number, or quietly profit off your digital footprint while leaving you exposed.

They scraped our data, monetized it, and now claim to protect us. The only real solution left is collective digital self-defense: we must fight to remain anonymous and treat the web exactly as it is–a hostile environment. There is no world where these corporations can protect your information from real criminals. Those actors don't play by these rules, and an identity check means nothing to someone holding a stolen database.

https://cybernews.com/security/facebook-leak-exposes-users-hackers-claim/

#osint #opensource #surveillancecapitalism #dataprivacy #anonymous 

There's a reasonable version of my concerns, like privacy, corporate overreach, and government overreach. These are all legitimate things to push back on. But Mastodon's culture tends to attract people who've taken those valid critiques and sprinted past any nuance into "all structure is oppression."

Caring about privacy and decentralization doesn't require believing civilization is a scam. You can use Linux, GrapheneOS, etc. and still think borders serve a functional purpose. In fact, aren't these tools just borders for the internet? Those aren't contradictory positions.

I came here in good faith and I'm getting blocked for not being "pure" enough. The anti-authoritarian crowd enforcing ideological conformity is a special kind of irony.

#privacy

#civilliberty but only if you agree with my version of it (apparently).

#NoBIGTech

#BordersStillMatter

#unpopularopinion

I often hear people in tech complaining that the industry is oversaturated and they can't find a job but let's be real about this:

The entry-level resume pile is oversaturated with people who have a theoretical degree or a paper cert but have never actually touched a terminal, built a home lab, or popped a box. HR departments are flooded with thousands of identical, low-effort applications.

There is a catastrophic shortage of people who have a deeply ingrained offensive mindset, who understand networking down to the packet level, and who can look at a custom enterprise system and figure out how it fails.

Regardless of whether you love or hate AI, we are in a high-stakes tech race where our adversaries are operating with zero ethical speed brakes, and Silicon Valley’s response is to gatekeep the very tools that could turn raw tech savvy students into elite defenders at scale.

You can't even ask AI how to tweak a simple reverse shell without it panicking and saying "I can't help you hack the mAiNfRaMe and destroy the entire grid." As if the feds wouldn't be at some script kiddies door within minutes if they dared touch critical infrastructure or as if enterprise environments don't have robust EDR and network segmentation in place. They really act like APTs are asking AI how to learn ethical hacking, treating a simple Python script that is less than 10 lines of code like a piece of precision-engineered, state-sponsored cyber-weaponry designed to spin centrifuges out of control (Stuxnet 2.0).

We're really shooting ourselves in the foot. Our adversaries aren't using Anthropic, ChatGPT, Gemini, etc. to learn how to make reverse shells or priv esc exploits for sandboxed CTFs to prepare for the field. They have AI pipelines that don't have guardrails and APTs that are already hacking into our telecom companies, healthcare networks, etc. Who is big tech really helping here? Certainly not us.

Look, I am not really even the biggest fan of AI (and obviously not a fan of big tech) but if I can crunch 8 hours of learning down into 1 hour, why wouldn't I? I'll still spend the 8 hours learning some new concept without the force multiplier because this is what I am passionate about and what I am studying for but the amount of security theater I see from big tech absolutely gets on my nerves. In fact, I think because I have learned so much about cybersecurity is exactly why it annoys me that much more. Watching a multi-billion dollar AI panic over a 10-line Python socket connection feels like being treated like a child by someone who doesn't even understand basic syntax.

#givemeabreak

#securitytheater

#CorporatePR

#CorporateNannyFilters

#bigtech is #shortsighted

I guess I'll have to just #RTFM so some skript kiddie doesn't cause a catastrophic blackout ... #sarcasm 🙄

NetEase trying to poke their nose around where it doesn't belong (com.netease.g108n; Destiny Rising):

```
W libc : Access denied finding property "ro.debuggable"
```

GrapheneOS: "ACCESS DENIED!"

The ro.debuggable property is a system-level Android variable. Anti-cheat and telemetry engines check this to see if the operating system is a stock consumer build or a modified developer build.

On a standard Google or Samsung phone, the app is allowed to peek at this property completely unchecked. But because I am on GrapheneOS, the hardened libc library steps in, slaps the app's hand away, and says "Access denied."

The game engine is programmed to assume that if it can't read basic system properties, it's being run inside a hacking environment or a virtual machine. Instead of gracefully handling it, the code just panics, hangs, and dies.

#GrapheneOS #android #anticheat #privacy #NotTodayBuddy #mindyourownbusiness