RIP hacking
did hacking die, or was it murdered?
so, is that it? "hacker" became a marketing product, sec confs turned into nothing but storefronts for cybersec startups, and everyone is just cool with that?
the other question that keeps popping up is: "is h2hc 2026 happening?". a state secret locked down under a pki digital cert inside a dynamo hsm... whatever. at this point i don't think even bsdaemon knows if anything is going down. trying to get hold of balestra in 2026 is worse than sending a physical telegram from the post office counter, and i'm not talking about the russian messaging app, i mean actual letterhead paper delivered by a postal worker.
what nobody tells you is that there's a massive difference between hacking died and hacking was murdered. are you riding with us on this, or are you surrendering to the thing you always claimed to fight against?
we need to step back in time, understand the past, and only then look at the present to truly grasp where we are and what the fuck we're dealing with.
hacking didn't die. well, at least not of natural causes. it was murdered in cold blood by complacency, greed, and the cowardly silence imposed on everyone who watched the whole shitshow unfold and ended up silenced. but who's to blame?
this scene has been hijacked by a bunch of braindead suits for a long time now. the word "hacker" was chewed up, ruminated, pasteurized, and spat back out as an off-the-shelf product to sell miracle fixes and sham consultancies. they took an entire culture built around breaking code, pushing boundaries, and understanding the machine down to the bare metal, and turned it into pathetic corporate theater with gourmet badges and cringe gratitude posts on linkedisney.
the people who built the foundation didn't just vanish or walk away on their own. do you really think it went down like: "yo man i'm leaving the field, gonna go raise ducks on a farm somewhere outside curitiba so i can enjoy my family more. peace #!tmj"? fuck that, you're missing some street sense in that juvenile head of yours. people were dragged out by force. the scene got beaten, stomped on, incinerated, gagged, reduced to ashes, and whoever's still breathing had to make a fucked-up choice: filter what they said so they could keep speaking, or starve to death under the mafia-style political squeeze that took over everything.
recently i stumbled across a repo of brazilian zines packed with insane material, and i cloned it out of pure desperation and fear that it'd vanish off the map, just like everything else vanished over the last 20 years: github.com/extencil/zines (it's not mine, i just cloned it to preserve it). most of the classic groups and the people who produced that material were broken up. you think they wanted that? is that the little story they told you? did it ever cross your mind that it was corporatism pulling the classic mob play: "dude, i make two phone calls and turn your life upside down... i'll make sure you can't even get a job as an it assistant in some fucked-up public school in the middle of nowhere in sao paulo, one of those towns that hasn't seen basic sanitation since the sarney era"?
these people were held hostage. we have families, friends, relatives, wives, kids, all that shit. people who didn't ask to carry the consequences of our choices, but who are still right there, exposed to the risk of walking an impossibly thin line. of course some marketer will try to spin this as paranoia, delusion, or exaggeration. just use your brain and do your research.
they always targeted innocent people, technical heavyweights, people who drove the scene forward, and brilliant minds to make an example out of them and send a message to the rest of the community: "take a good look at what's happening to this legend that nobody's gonna remember 10 years from now".
this goes back to 1990 with operation sundevil, run by the us secret service along with the fbi and cia: mass raids on bbs operators, seized computers, destroyed independent companies, and phrack editors prosecuted just to spread psychological terror. why do you think they zeroed in on those people?
https://en.wikipedia.org/wiki/Operation_Sundevil
https://www.cybereason.com/blog/malicious-life-podcast-operation-sundevil-and-the-birth-of-the-eff
https://korben.info/en/operation-sundevil-americas-war-on-hackers.html
https://malicious.life/operation-sundevil-and-the-birth-of-the-eff/
the exact same thing happened to thc.org (the hacker's choice). between 2010 and 2015, just pull the site history for that period at thehackerschoice.com and thc.org. taking hits from every angle under state persecution and insane laws in europe, the group split into the "free world division" and the "german division". before 2015 hit, the "german division" page was frozen with a notice right in everyone's face: see the content from the free world division; we no longer have the motivation to update this.
when the state apparatus and corporatism decide to crush free research, they don't debate code... don't be naive. they knock out the main pieces on this dirty chessboard we're forced to play on: they destroy the personal lives of anyone who dares to share information without asking for a blessing first.
these actions left deep scars: fear, paranoia, and rage. almost nobody speaks openly about this today because nobody wants to relive the terror of that era. but here's the thing: i have way too much free time, had to learn osint the hard way, and since 2020 i've been digging up all these records, zines, forums, and logs from the darkest archives on the web. and, unfortunately for anyone who'd rather let it all be forgotten, i'm cursed with a damn good memory that won't let me forget a single thing.
greed, consulting lobby, or both? for fuck's sake
the truth behind the current scene is spelled out in plain sight between the lines of certain sec conferences. just look at it:
they turned into nothing more than vendor showcases for cybersec startups.
most of this garbage only exists so scumbag organizers can squeeze fat stacks of cash out of companies for booth space, then turn around and post on linkedisney to promote the cybersecurity consultancies they own. it's always the exact same script.
here's a challenge for you:
- look up the main organizers of any sec conference
- pull up their profiles on linkedin
- check their latest posts
you will find the exact same pattern across every single one of them.
want to know who really gets fucked over by this? the community. the people coming in now who no longer have strong technical reference points to guide them and sharpen their critical thinking. for fuck's sake, this thing turned into a trade fair with gourmet badges, 20-minute vendor talks pushing miracle edrs, and stages full of "leadership panels" with people who have never opened a disassembler in their lives.
our only stroke of luck is that these bastards haven't realized they're feeding the rage that will end in their own downfall down the road. the generation they keep force-feeding bullshit is the exact same one that in 5, 10, 15, 20 years will remember what it felt like to have these "reference figures" selling smoke and bullshitting everywhere.
twitter gatekeepers / generic sec experts vs gen-z
none of this shit is the fault of the newcomers, fuck off. i've heard so much garbage from a clique in the old guard whining about gen-z at recent events that if i tried to flush it, it'd clog my toilet.
fake "old-schoolers" who never produced a single thing, never contributed to the community, much less to sec, whining like underpaid hookers because some kid under 20 was ethically pulling high payouts from x's bug bounty program. i forgot his handle, so i can't cite it here, but the author of this post is dealing with an infernal nightmare in his personal life that you reading this can't even begin to imagine.
but let me remind you: every generation has its idiots. people who never took any risk always make it through the field unscathed, exactly because they spent their whole lives quietly leeching scraps from other people's work. then when those people survive and grow old, they think they have some kind of right, respect, or authority to lecture the new generation.
want a concrete example? look at the bunch of idiots who farmed a fortune off thc.org's work for years, using the tools in "pentests" and then using them to justify their own "work". do you know anyone who doesn't talk about hydra in those pentest courses you're forced to take so the market will accept you?
it's not because they actually know shit. it's just like akbar used to say:
"these guys run purely on intuition and technical freestyle" lmaooooo stfu
complaints and crying can be forwarded via email:
- to:
extencil@proton.thc.org - cc:
members@proton.thc.org
\_(ツ)_/¯
these guys went twenty years without shipping a public commit, without documenting a protocol, and without writing one miserable decent exploit. and before the whining starts: i've got nothing against python. my problem is with what this sums up right here:
and these exact same guys swear they're the sacred guardians of cyber ethics just because they carry a "senior specialist" badge at some failing multinational.
funny how some of these multinationals keep getting breached by 14-year-olds, isn't it? you think that's a coincidence? that's the direct result of pure technical ignorance.
course sellers and the goat, "fracas, the wizard"
i haven't even brought up that other guy with the weird hair who loves running his mouth against fracas, the wizard. everyone knows he's a fraud, brazilians already know course sellers are all the same. getting back on track: this dude was saying so much bullshit that i went to his instagram to see if he produced or contributed anything to the community, and every single story of his was: "i cover more on this in my course, currently 50% off".
like, wtf? does anyone see a real difference between these guys and fracas, the wizard? do you see anything beyond the same shitty excuse they always use:
"he said you don't need to study, and i'm saying you do need to study, but only through my course"?
and no, i'm not defending that bastard with the best-selling book about techniques for that thing, sold on the e-commerce site owned by that bald guy with the rocket company in the united states. especially because he's part of the exact same crowd that kicked hacking to the curb.
he even sent a cute little extrajudicial notice to a certain hardware hacking instructor from solyd a while back. not dropping names to avoid exposure, but the guy even filmed a hardware hacking video with rato borrachudo. they silenced the guy the same way the other groups did: a suit shutting down a technical person who was spreading knowledge for free.
the illusion-selling machine just changed its packaging. back in the day, it was some guy promising to hack your neighbor's wi-fi with three clicks in kali linux. now it's the influencer in a punk jacket taking money from anyone who can pay, and whoever can't can get fucked. same scam, same lack of shame.
duplicates in bug bounty,
the field has turned into a schizophrenic ecosystem propped up by three rotten pillars:
- duplicates in bug hunting, bug hunting inside vibecoded claude-code copies: people frustrated on linkedin because their report generated by deepseek v4 free on opencode got marked as duplicate. seriously, it's you and how many thousands of others trying the exact same shit with a ready-made prompt?
- expensive, outdated certifications: the corporate market demanding stamped papers from foreign institutes instead of checking whether someone can read a packet dump in tcpdump or write 10 lines of code to automate a test. whoever sells the cert charges 20k for the package. you enter the field as a young apprentice making 740 reais, or at most 1800 as an intern. how the fuck are you supposed to pay 20k for a cert?
- stage cybersecurity: people who live by spreading panic on podcasts and TV news, yelling that "brazil is under attack" just to push proprietary security solutions that get bypassed in 2 minutes of analysis.
in case it wasn't clear: the "proprietary solution" in point 1 refers to this whole sea of saas patched together on top of big tech and ai apis (anthropic, openai, google, meta...). the biggest joke is that not even the guy who typed the prompt has any real ownership or merit over that code, especially because almost nobody in this wave can explain two lines of what was generated without opening an ai tool to ask for help.
the present is a loop of the past
whoever doesn't know history is condemned to become cannon fodder for bad marketers. when the marketer talks slick and earns respect on stage, anyone starved of context because they decided to bury the whole damn thing gets treated like a lunatic. and the reason nobody talks about the past is obvious: the same people wearing navy blazers on linkedin today and posing as "ciso of the year" were breaking infrastructure, defacing city hall websites, and trading exploits in private irc channels back in the 90s and 2000s. today they wiped their history clean, put on the corporate act, locked the door behind them, and would rather charge 5 thousand reais for a consulting gig than explain the roots of the whole thing to the younger crowd.
how the hell is an 18-year-old kid supposed to understand the culture when the only reference points on his timeline are: video of the dev hacking an online casino, course ad promising a 15k salary, podcast sponsored by proprietary software?
and the case of that classic "dev hacking an online casino" video is the spitting image of this circus. the guy records sensationalist content to farm views and hands a monumental free marketing gift to a certain traditional pentest school in the scene. the hypocrisy is so blatant it borders on ridiculous: the guy sells himself as the owner of a "cybersecurity platform", puts an affiliate link and discount coupon in his bio for a famous competing training program so he can skim a commission from beginners, but when it's time to sit down and study, he doesn't even consume what he recommends. he runs off to take classes from that other traditional school, preferring pirated / cracked, rigid, outdated content over the illusion he pushes to his audience every single day.
that's the rotten level of the timeline: the influencer outsources knowledge he never tested deeply, monetizes the naivety of people entering the field, and behind the scenes makes it obvious he doesn't trust one bit of the product he sells.
as letodie once put it in the track espólios (give it a spin: youtube or spotify):
"i come from where your dreams are painted targets and constantly looked down upon
the present is a loop of the past
it doesn't repeat, but it rhymes
one slip and you're marked
if you're not guilty, they frame you"
and that's exactly it: the current scene is a fucking reheated loop of the 2000s. it's not identical, but it rhymes perfectly. the young crowd that genuinely wants to learn is underestimated by the old guard that no longer produces anything; if someone finds a bug and reports it, they try to incriminate or sue the researcher; if you slip once on the journey, you become a linkedin cancellation target for people who have never put their neck on the line. and that's when the h1 triager isn't stealing your report, right?
https://www.darkreading.com/vulnerabilities-threats/hackerone-employee-fired-for-stealing-and-selling-bug-reports-for-personal-gain
https://www.malwarebytes.com/blog/news/2022/07/hackerone-insider-fired-for-trying-to-claim-other-peoples-bounties
https://www.scworld.com/brief/vulnerability-disclosures-stolen-by-hackerone-employee
https://www.vice.com/en/article/bug-bounty-platforms-employee-abused-internal-access-to-steal-bounties/
phrack ≠ phrack high council ≠ #phrack
the lack of information breeds rejection because people know less and less. there is no depth left, not even enough to know where things came from and defend yourself in a debate when this bunch of marketers open their mouths to talk shit, and that lack of foundation fuels even more revolt. unless i've gone insane, this is the same thing that happened in the early 2000s between phrack and the phrack high council and almost killed both, in the war between those who went corporate white-hat and those who stayed black-hat.
at the turn of the 90s into the 2000s, that exact seismic split happened in the underground: on one side, the people who believed in unrestricted full disclosure, plaintext (.txt) ezines, and knowledge as a common good (the tradition of phrack, l0pht, cdc, and 2600); on the other, a wave that realized they could package 0days, sign million-dollar ndas with governments, and create boutique consultancies (@stake, guardent, iss) to sell fear to corporations.
https://openai.com/collective-cyberdefense/
"a call for collective action on cyber defense"
we have a limited window to strengthen cyber defenses.
see the connection? think it's a coincidence? lmao, anyway
when the phrack high council (phc) and the crews of that era started going at each other's throats, that was exactly what was at stake: would knowledge stay open in the hands of people who study, or would it be locked away in confidential corporate audit reports? the ones who went corporate white-hat started calling everyone who stayed underground criminals; the underground accused the new "consultants" of being sellout traitors who privatized hacker culture to get rich.
everyone saw the result of that shit: years of stagnation, segregation, gatekeeping, and an entire generation that lost its bridge to root knowledge because technical papers gave way to ndas and 50-page pdf reports full of useless pie charts.
that made the people still standing today go after knowledge on their own, since the classic sources were tearing each other apart. didn't h2hc emerge around that time? didn't most of the reference figures in the field appear in that same exact window, from the 2000s onward?
unfortunately, today we're watching the same horror movie, just with much worse actors. instead of the brilliant minds who founded modern offensive security, we've got discord raid influencers on tiktok and linkedin coaches selling the "ultimate hacker method" in 12 installments on a credit card. information is passed along, diluted, and hidden behind the paywall of shitty courses.
the lack of open, honest technical documentation dumbs down the community. newcomers end up thinking hacking is running ready-made scripts from github or buying a 5-thousand-dollar tool from a startup, because nobody sits their ass down anymore to explain how a fucking pointer overflows on the stack or how a malformed packet gets parsed in the kernel.
why we are here
nobody here is posing as some savior or martyr for hacking. the truth is much simpler: we just got sick of this whole circus and decided to do things our own way.
if third-party platforms (medium, hashnode, or any other crap) decide to take down technical content, we create our own blog and host it ourselves. if we need vps boxes, we rent them and split the costs. if the tool doesn't exist, we create it; if it isn't ready, we finish it. i'm tired of watching great groups die over the years simply because they depended on someone else's platform and corporate crumbs.
there are no investors here, no sponsor booths, no lead forms, and nobody wants to push mentorship on you. there are no anointed leaders, no admission test for you to prove you're "worthy", and no private priv8 discord clique gatekeeping knowledge.
the structure is horizontal and driven by a single criterion: output. commits, "talk is cheap, show me the code", sharing the stuff, and letting the community deliver the verdict. fuck gourmet badges, fuck the blue consulting blazer, and fuck anyone trying to lock information behind a paywall or ego.
by the way, this text was supposed to have come out earlier, but today at 3 am, while i was writing this shit, clonazepunk pops into the chat with the ip of a machine running an http server open to the world, right in the directory of some genius who was trying to "hack with ai" and left a shitload of his targets' data exposed. fuck, i was trying to finish the text, but i'm only human: the post took a little longer to come out because we stopped to explore the idiot's infrastructure lmaoooooooooooo.
hacking didn't die. the machine doesn't care about corporate titles, the stack has zero respect for authority, and silicon always tells the truth.
personally, i'm sick of this wave of reinventing the wheel. i open twitter and see 300 new ai tools built on top of the fucking opencode. or some nodejs and electrum bullshit that could easily be solved with TMUX and shell scripting.
we're here to bring the focus back to what actually matters: code in the terminal, packets on the wire, binaries in the debugger, and technical knowledge shared the hard way without asking for anything in return.
and fuck the rest.