Attrition.org

Hello everyone – I'm the creator of Enlist.

I recently discovered TrackMeNot[0], an addon that fights tracking by polluting metadata. It doesn't make you anonymous, but creates "noise" to hide behind.

We know that the NSA tracks us through it's XKeyScore program. Various sites showcase an interesting, but possibly vacuous list of tracked keywords[0].

My addon makes random Google searches using these tracked keywords -- this puts you on the NSA's list.

Realistically, the addon is pretty weak. It doesn't make "normal" searches, so it's trivial to filter out the "noise".

If people find this interesting, I'll consider making the searches more realistic, and harder to identify. Maybe I'll mix normal & incriminating searches with a random walk through a markov chain.

Thanks for your interest.

[0]http://attrition.org/misc/keywords.html

He's also made a fool out of himself in very unashamed and public ways, and spread a lot of FUD. Windows XP raw sockets and Windows meta file come to mind. He's also said that Metasploit is a controversial piece of software that's main use is to develop malware.

Steve Gibson is a talker, even if he doesn't know what he's talking about. He will say whatever he wants and issue corrections later when he's been proven wrong. It's not a cheap shot. It's well documented, he's been called out on it for years, but he's still calling himself a security expert while simeltaneuously spewing bullshit, for 15 years now.

And "not current" in security means "useless", or sometimes "actively harmful". There is no way to call yourself a security expert if you're out of date.

http://attrition.org/errata/charlatan/steve_gibson/

The canonical collection of five hundred jokes of this genre is at http://attrition.org/misc/ee/protolol.txt:

@mckeay The sad thing about IPv6 jokes is that almost no one understands them and no one is using them yet.

@dildog What's up with the jokes... Give it a REST, guys...

@ChrisJohnRiley: The worst thing about #protolol is that you get the broadcast even if you really don't give a shit!

@mdreid: The best thing about proprietary protocol jokes is REDACTED.

@maradydd: The bad thing about Turing machine jokes is you never can tell when they're over #protolol

...

It's hard to say this without sounding like one of those condescending security people, but I highly recommend avoiding that guy.

http://attrition.org/errata/charlatan/steve_gibson/

To balance that with something constructive, if you are already comfortable with software development, I'd suggest checking out these to get started with playing around:

https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ - Part 1, they go to 11.

https://google-gruyere.appspot.com/ - for web app sec

- "requires payment" and "completely anonymously" seem at odds; especially when the person you're communicating with will likely have purchased it from an app store. i understand that there is a way to purchase it with btc at their own site, but that doesn't really help with licencing and GCM

- proper implementation of e2e means where the servers are shouldn't matter

- threema uses GCM too -> whole google play services framework

- this steve gibson? http://attrition.org/errata/charlatan/steve_gibson/