Comment by busterarm | Hacker News Reader

Comment by busterarm | Hacker News Reader

As someone who has grown up around and knows many of the world's most notable hackers, it never fails to surprise me about the ignorance of the law demonstrated by "hacktivists" and other so-called "white hats".

The hero worship of MalwareTech, despite the fact that he absolutely committed crimes _which he plead guilty to_ is often the biggest clue.

As much as you can think you're on Team GoodGuy, if you commit crimes there are consequences for it. The feigned surprise and rallycrying needs to end. grugq's talk on OPSEC is step one. You're not a brand, don't sell fucking merch!

If you're doing "research" or "freedom-fighting" and it runs afoul of local laws, don't be surprised that the fuzz breaks your door in one night just because you couldn't stop yourself from chasing a bit of personal fame in the process. And as someone who knows most of these people, the vast majority are ego-driven.

At least the black hats are honest about who they are and what they do. And you don't hear about most of them because constantly seeking attention hurts their wallet.

Maybe I'm missing something about the MalwareTech story, but I don't think it's surprising people celebrate him. When I read some large feature on him (I'm sorry, I don't remember where) my impression was that he had royally screwed up as a young person, but that he was trying to turn his life around and did a serious good deed for the internet as a whole with his contribution to the wannacry thing. Many people make mistakes at any phase of life, and it's not surprising to me that people might celebrate people who try to move past that and do good.

edit: I believe [0] was the feature I read.

[0]: https://www.wired.com/story/confessions-marcus-hutchins-hack...

He lied to investigators when he was arrested and continued to do so until they laid out all the evidence that they had against him. The timeline of his turnaround is also absurdly short (he continued to sell his malware until a couple of months before he "turned hero") and the malware he took down was literally his competition.

What you posted is a good story to tell though. Turning your life around after doing dumb shit in your real name and getting caught is plenty convenient but not worthy of hero worship.

The only reason MalwareTech served no time is because Ollam and his wife used their influence, political connections and their bank accounts to lobby aggressively on his behalf.

> but that he was trying to turn his life around

He realized that he sucked at making money by developing malware and decided to pivot to working for other people.

100%. The amount of people chasing SCENE cred is crazy.

It's so much worse on the professional side of things. The number of glamorous security jobs is extremely tiny compared to all of the "SOC2 Compliance" checklist jobs out there. They've created the same kind of status economy that plagues academia to the point where you're on the "publish or die"/"be somebody on twitter or die" treadmill.

As a result, I've seen so much recycled research trying to be passed around as new work by people trying to make a name for themselves it's unbearable.

This especially happens in the crypto space, where you can take any basic concept like "Basic XSS Vulnerabilities", but applied to popular crypto exchanges and conferences will book your talk.

The number of people out there doing genuine cool shit (the kinda stuff you see in PoC||GTFO) are few and far between these days.

Yep, as someone that first attended Defcon 6 (at the Plaza), things have gone from keeping it quiet and underground to blast it on twitter for cred. Crazy thing is there are a lot of these Twit-iots that barely work in the industry and as you said, repeat others work.

I know a large number of them personally, some of them are nice people, but most of them are pretty insecure and constantly looking for acknowledgement. To a degree I guess we all are.

The number of people that want to skip working in IT / understanding other parts of business and go directly to their Offensive Security Cert and be called a hacker is numbing. Theres a reason most of the training programs within the leading firms / govt agencies, require following the apprentice / journeyman process much like other trades. It takes time and a deep understanding.

But nah.. i'll skip all that because check out mah tweeets.

Reply on news.ycombinator.com