Posts on Bobby's Headspace

Is The Customer The Enemy?

smiles@bobbysmiles.xyz (Bobby Smiles) — Wed, 02 Sep 2026 08:13:47 +0530

Background

“If buying isn’t owning, then piracy isn’t stealing.”

This phrase has gained a MASSIVE amount of popularity online, mainly due to the unpopular policies recently implemented by big tech companies. Recently, Sony announced that paying for a game doesn’t mean that you gain ownership of the game, it simply means that you buy a limited-time license to it.

There have already been similar discussions surrounding the hardware industry, especially around laptops. Many people have reported that companies actively make it harder for a user to repair their own hardware, or even get their hardware repaired by a licensed service centre, usually by charging exorbitant costs for repairing the item or straight-up denying repairs on said item, citing that it’s either outdated or that there is a shortage of parts. This has brought up discussions regarding the Right to Repair, especially in regions like the EU.

What’s really undercutting all these talks is the eroding trust in companies to safeguard the customer’s interests. But why are companies suddenly antagonizing the customer? Is this really a new pattern in businesses or is it gaining prominence only now? I think this is worth looking at a little closer before forming an opinion.

Video Game Ownership

I personally think the topic of video game ownership is what brought the seemingly spurious practices of companies to light. It all started with Ubisoft’s infamous claim “Gamers should get comfortable with the idea of not owning their games”. While at the time it didn’t cause as much of a stir as we see nowadays in the video game industry, it still had enough of an effect to sour the image of Ubisoft among the general gaming populace.

This saw a resurgence earlier this year with the recent email from Sony, that reminded players that games are "licensed, not sold" and that the license is limited, non-exclusive, non-transferable, and personal license to use the software privately on the intended system or device. This has left players fearing that Sony could revoke their license at their own discretion, because the license is revocable.

This email was sent after another unpopular announcement by Sony, which stated that they aim to phase out physical games by the year 2028. These 2 announcements, coupled with other unpopular video game policies by Sony soured their image in the eyes of people, with many people reporting switching to Xbox due to their more customer friendly approach to the video games industry.

Right to Repair

The right to repair simply refers to us, the customers, having the ability to repair the things we buy. More and more people are becoming aware of the fact that companies do in fact make it intentionally difficult for users to repair their own items. This practice is seen in almost every industry ranging from farming equipment all the way to the consumer electronics industry.

In brief, the movement demands that consumers and independent repair shops must be provided with access to various provisions to repair the things they buy. This includes design schematics, parts and manufacturing of the product such that it is easy to repair. They also argue that this plays into preserving the environment by promoting sustainable development through a "circular economy" and reducing e-waste. It also helps in saving costs, because instead of buying a whole new item in case it is damaged, we can just replace the damaged components.

But where am I going with all this?

But Why Does This Happen?

A business is, at the end of the day, incentivized to make a profit. So it is not surprising when we see businesses look at multiple options to maximize their profit margins. One of these tactics is cutting costs. But what I believe made businesses provide better services back in the day was one simple thing - “competition”.

Declining competition in the modern era is one of the primary factors due to which businesses have the leeway to get away with a lot more than they did previously. And it makes sense, since the businesses which dominate the markets now, beat their previous competition by providing superior products and better customer acquisition and retention. Just look at the console wars. I don’t think it is a stretch for me to say that the PlayStation beat out all of its competition in the end, with a majority of console gamers opting for a PS5 over an Xbox Series X.

But with the slew of unpopular policies that Sony introduced, Xbox has managed to make something of a comeback, under their current CEO Asha Sharma. They’ve implemented policies and features that keep gamers at the forefront such as the Disc to Digital program, which allows gamers to convert their physical discs into a digital license for free.

The EU has also fined multiple companies like Apple, Google, YouTube, Meta and Amazon for their “anti-competitive” practices, demonstrating governments’ increasing concern over the excessive market power wielded by some businesses. Now I’ll be real here, I am not quite sure why the EU had suddenly gone after these companies with no precursor when they seemed completely fine with the same companies and the same practices just a couple of years back, but I’ll take the win I guess 😂.

The Norwegian Consumer Council put out a video trolling the enshittification of products, taking jabs at big tech companies like google, apple, etc. In the same vein, businesses like steam have always provided excellent services, therefore keeping their customers happy. Steam’s customer support has gained great reputation because it has consistently shown that it genuinely helps customers out in any way they can.

Companies like Framework have also started gaining momentum due to the modularity of their laptops and their inherent adherence to the Right to Repair movement. It allows customers the freedom to customize their hardware and upgrade it as they see fit. This modularity and customizability offer a great competitive advantage, because it genuinely does cost less than just switching out the entire device.

Essentially, what I am trying to say is that businesses have no inherent incentive to be anti-customer, many businesses have had these so-called “anti-customer” practices for ages, but now we are noticing it better. We notice because there aren’t as many options to choose from, so we notice the shortcomings of the options we do have a lot more.

Before we Conclude

A few things we should note about competition between businesses and the lack of options is that, it is not entirely about competition alone. See as consumers, we get locked into certain product ecosystems, which makes switching out of it a pricey affair. Let’s take an example here. Say that I own the entire collection of apple products, from the mac to the iphone to all the peripherals that apple provides. One thing that this does, is that it gives us a buttload of convenience. The ecosystem is centralized, all the products integrate well with one another and our workflows are consistent.

random meme lol

Now if we want to switch out to something like android, it will inevitably take a lot of time and money to do so, since we’ve worked with a certain ecosystem with its set of conveniences, which ends up discouraging the switch from apple. This is pretty much what happens with other products as well. We have switching costs, network effects and our own digital artifacts that we’ve gathered up, some of which might be transferable from one ecosystem to another, making switching impractical. This is where the Right to Repair movement and other similar talks come in, so that we can save money there, rather than spend more to stay within the same ecosystem.

One other thing we have to address is the convenience of digital libraries. It is pretty much the same argument as streaming vs physical movies. Digital libraries offer convenience, better portability and accessibility. And it can be argued that it is MUCH easier to have digital copies of hundreds of games instead of a whole treasure trove of physical discs.

There are many more arguments to be made as such but to keep this article from becoming a huge wall of text I have listed out one or two important ones. But what I am getting at here is not the fact that digitizing something is inherently bad, but rather that we are losing reason to trust that it will be handled well by the people managing these digital libraries for us.

Conclusion

At the end of the day businesses have been and always will be profit centric. They are going to optimize their spendings in any way they can, because it will contribute to the growth of their profit margins. This is the same reason why AI seemed appealing initially and also why businesses are silently re-hiring human engineers. What we should be aiming for is not for businesses to suddenly become charitable saints, but rather we should aim for businesses to have to compete for our money.

Hope you enjoyed the article :)

Is This The End of Cybersecurity?

smiles@bobbysmiles.xyz (Bobby Smiles) — Sat, 18 Jul 2026 07:41:05 +0530

Background

Ever since the promotion of Claude Mythos and Opus before it (if my memory serves me right), AI has been hyped up to be able to compete with cybersecurity researchers and even surpassing them in some areas. Exploits like the copy-fail exploit were discovered through the AI and recently DirtyFrag exploit are all discovered with the help of AI. But what does this really mean? Does it mean that manual vulnerability analysis, and cybersecurity at large is finally obsolete? Do we even need humans in this field anymore? I think the picture isn’t all that it seems.

CTFs and Automation

One of the major areas in cybersecurity that has seen a drastic shift due to the rise of AI are CTFs. AI has completely changed the game, by allowing players and researchers to find exploits easier and faster than ever. CTF creators and the wider cybersecurity community at large is quite split on how exactly one should be handling this sudden shift in the game.

In my time playing CTFs this year, I’ve seen 3 common approaches. The first one is a more extremist one, with AI being almost completely banned from the competition. Frankly, I think this is a pretty impractical approach because people are going to use AI whether you like it or not. It is, in many ways VERY convenient. Which leads me to the second approach.

The second approach, allows AI to be used, but by segregating those who use AI from those who do not use AI. This is done in many ways, for example in DEFCON Quals 2026, I saw a pledge system, where you brand yourself as a team who uses AI or not. I think this is a balanced approach compared to the first one considering that we’re leaving it up to the historically good nature of the CTFers to clarify whether they’re using AI or not. However people also tend to have 2 separate divisions for the non-AI users and the AI users, which I think is quite a faithful leap to take, considering that I can just use AI in the human division and win big 😂.

The third approach, and one that is gaining widespread traction is to just use AI as you please. HackTheBox had conducted a CTF where AI agent teams were pitted against human teams to compete for the top spot. What they found is that AI tends to be a more general type of problem solver, whereas humans tend to achieve high levels of skill in specialized domains. The AI teams started by taking the lead but soon, were just short of top 20 due to them not solving 1 question out of the 20 that were presented. What this study did find out is that, AI is just as competent as humans when it comes to problem solving, and definitely quite faster (initially at least).

Bug Bounty and Vulnerability Assessment

I had previously made a post around one year back, speaking of AI and its usage in finding bugs and other cybersecurity related activies. Since then however, AI has evolved to the point where it can find bugs in modern software that were otherwise not uncovered by cybersecurity engineers. As I had already mentioned above, 2 popular bugs are the Copy-Fail bug and the DirtyFrag exploit.

The reason these gained so much traction is that they are not recently added bugs, but rather bugs that were overlooked for many years that were hidden in the Linux Kernel. Other bugs in many other popular pieces of software have been discovered and this number only continues to rise. It’s even getting to the point where large companies like Microsoft are using AI to fix bugs in their own code.

There are, however, statements put out about these being able to hack stuff like the pentagon or break out of its own servers and things. I’d take those with a MASSIVE grain of salt considering that they are unverified claims coming from companies that stand to gain A LOT of benefits from people believing these things.

Bug Bounty has seen a similar situation as described in this article where AI is finding a lot of valid bugs and reporting them at a very high rate, to the point where it’s getting very difficult for maintainers to keep up.

However tempting it might seem to assign this to the so-called smartness of AI, I think there’s a more technical reason for this.

AI and its Strengths

I recently came across this video by Low Level that explains the increased proficiency of AI quite well. Essentially he boils the strengths of AI down to three things:

Static Analysis
Vulnerability Research
General Automation

Static Analysis

Static Analysis simply refers to analysing a piece of software to find a bug, without actually running it. This can be done via code reviews, data flow analysis, etc. At its core, AI is a text predictor. This means that it has the ability to take a piece of text and output some data with respect to it. It also can ingest MASSIVE amounts of code as opposed to a human being. This allows it to be way faster than a human when it comes to understanding an underlying codebase.

Another thing that has to be factored in here, is the training data of the AI. This data contains countless codebases and its associated issues or vulnerabilities, which allows AI to also easily detect these patterns. Combined with the fact that it already ingests large amounts of code and understands it at a very high speed, it stands to reason that it’ll be able to detect bugs quicker than humans can.

Vulnerability Research

This is pretty much an off-shoot of the capabilities of AI in static analysis. When people write code, they focus on getting the task done with a reasonable amount of efficiency. In this process, a common thing that can occur is that a few edge-cases are not accounted for. This results in bugs popping up, which the AI is very good at detecting, because of the data it is trained on, as I mentioned in the Static Analysis section.

General Automation

AI agents are also capable of automating tasks through the use of internal tools and MCP servers, as seen with the rise of Agentic AI. This allows the AI to automatically analyse code, decide the best course of action, and proceed to test further. This has resulted in massive increases in productivity and the ability to test and analyse code. This increased security capability became apparent with the release of tools like Ghidra MCP, Snyk Code, etc.

Do We Need Humans Then?

Yes. Yes humans are still required for cybersecurity, and if anything, now more than ever. Humans still possess the ability to discover novel types of bugs and very convoluted zero-days. While AI is very good at cybersecurity, it is still not the pinnacle of what it can be. As different studies have shown, AI does things faster, but humans still are better at the job.

With all this said, it would be insensible to pretend that AI is not going to be stealing jobs or anything. In fact, it already has automated most of the low level jobs in the industry. But this is not a “loss-of-jobs” issue, rather it is that the skill ceiling has increased, and now more than ever, companies are asking the question, “Can I automate what this person is offering to a good degree of effectiveness?”. This is what we must focus on, upskilling and using the tools at hand.

Closing Thoughts

So, we do require humans in cybersecurity and humans still do play an integral role, not just in cybersecurity, but also tech jobs in general. So the point from my previous post on ai in cybersecurity still stands. If we don’t update our skillset with respect to the current market, or if we rely too much on tools that are ultimately meant to enhance our workflow (like AI), we will be left behind.

Where Did All the Humans Go?

smiles@bobbysmiles.xyz (Bobby Smiles) — Wed, 24 Jun 2026 13:59:40 +0530

Background

The internet has come a long way since its inception as the ARPANET in the year 1969. The modern internet we know today is powered primarily by algorithms, on one hand allowing us to curate our feeds with content that we prefer, and on the other allowing apps to have longer user engagement. But what if this was taken one step further? What if all our interactions on the internet are in some way curated for us? What if more than half of our interactions online are not with humans, but with AI bots? This is what the Dead Internet Theory proposes.

The Dead Internet Theory

Originally posted in Agora Road’s Macintosh Cafe, the Dead Internet Theory proposes that most of the internet activity is automated. That is, it says that most of the activity on the current iteration of the internet is not organic, but rather consists of automated content and bot activity, further pushed by curation algorithms.

One of the banners I really liked on the Agora Road's forum

With the rise of AI in recent years, this theory has seen a kind of resurgence, with many popular creators talking about it. Personally I believe there is some truth to this theory, but there are important caveats to this that I also want to point out, because it’s easy to tread past the facts, into the realm of conspiracy.

AI Generated Content

One thing that I am sure of, and evidence being there for, is that AI generated content is more likely to be recommended to the average consumer compared to human-created content. Almost all platforms use complex ranking systems to recommend the content that is most likely to be consumed. Ironically, this is EXACTLY why AI generated content is more likely to rank higher, because AI is also trained on highly ranked content from the internet.

But does this mean human generated searches are never encountered? No, not quite. Human generated content can still rank high on search rankings. It is just that AI generated content ranks high consistently, which makes it harder to find organic content on the web.

AI Bot activity

This one is a little harder to quantify. In all honesty, there is some good evidence indicating that a lot of activity on the internet is in fact bot activity. For example, a cybersecurity company called Imperva found that almost 30% of all website visits on the internet are bot visits. They also found that over half of all internet activity was performed by bots or automated software applications. Many of these actions came from malicious bots, designed to steal information or compromise systems.

One thing that must be kept in mind, however, is that this accounts for the internet as a whole, so it’s not like every single forum is just a wasteland of bot activity. It’s just that across a majority of the internet, bots do indeed contribute to a majority of the activity.

Are Higher Powers Controlling Us Through This?

There is an aspect of this theory I haven’t mentioned yet, and that is the fact that many interpretations of this theory tread into conspiratorial waters. It alleges that governments and big tech try to control us through this bot traffic by intentionally soliciting our feeds with certain types of content. One of the drivers of this solicitation is the bot activity in certain forums. It also alleges that this has been the case since 2016 (frankly, I don’t know how they arrived at this exact year).

Looking at it objectively, I would say that we don’t have any evidence. From recent events, it IS most likely that we are under constant surveillance but I am not sure how much of this aspect of the theory can be proven, if at all it is true. Many comment sections and social platforms have caught bots posing as humans, and in some extreme cases even posting political opinions. But how much of this is just some random person being too lazy to type out his own stuff vs it actually being a political power trying to steer public opinion remains to be seen.

Also there are in fact many places which are still mostly composed of human activity. Sites like Reddit and other small internet forums still are composed mostly of organic, human activity. Of course these sites have their fair share of AI slop content but it is low for now. Even Agora Road’s Macintosh Cafe is still home to quite a bit of organic activity when I last checked.

So what can we conclude from this? While the conspiracy theories do seem outlandish, I wouldn’t entirely dismiss them, mostly considering recent events. I can only say that there is no convincing evidence from either side for me to form an actual opinion.

But What Can We Do?

Unfortunately here, I can’t provide a possible solution. The maximum we can do is try and verify our sources the best we can, but really how far can we go? How much can we verify each and every source for what is possibly a simple online interaction? It would be very difficult, and dare I say, kind of tedious.

The best we can do in the end, is to curate our own knowledge, maintain a few trusted sources that we know have minimal bot interaction, and do our best to bring these sources out to the mainstream. As I mentioned in my article on privacy, we can try and switch to smaller providers and platforms in order to reduce the impact of an increasingly artificial internet.

Conclusion

AI is unfortunately making it harder to distinguish between automated and organic interactions online, whether this is online content, or a random thread on X or a simple Instagram comments section. In the coming future, it remains to be seen how much of our activity online will be with real humans, and how much will be just algorithmic AI slop that is served to us, creating a personalized echo chamber online.

Privacy in the Modern Digital Landscape

smiles@bobbysmiles.xyz (Bobby Smiles) — Thu, 21 May 2026 12:53:04 +0530

The Current Scenario

The modern internet feels like a mess. From the overly enshittified quality of products to AI being stuffed down our throat at every turn, the internet has, in many ways, lost its initial charm and simplicity. Lately a LOT of privacy violations have come our way too, from AI crawlers indiscriminately taking online content without consent, to sites like LinkedIn literally tracking user activity and selling it off to cybersecurity companies, the list just doesn’t end.

In light of such situations, it becomes more crucial than ever to secure our own data and not let these companies have their way. In this article, I want to highlight the current landscape and talk about some of the things I personally do to ensure I am not being tracked through every step of my internet activity.

The LinkedIn Debacle

I’ll start this off with the recent LinkedIn controversy that was making the rounds on the internet. Basically, LinkedIn users found out that they are being tracked by the site, for the use of over 6000 common extensions, ranging from job-search extensions to productivity software. This was dubbed BrowserGate, and you can get a lot of the information I’m about to detail from the official site.

The thing is, its already a known fact that LinkedIn tracks browser extensions. So why is this causing so much outrage? It is the simple fact that LinkedIn actually never mentions ANY OF THIS in its privacy policy. They just run the embedded JS that does the tracking, and just track.

This is blatantly illegal under laws and regulations. To keep it brief, most laws and regulations state that it is fine to take data like the name, email and other basic information, but beyond that the company MUST ask for consent. This is absolutely not done by the site and worse, the data is transmitted to third-party companies, again without the consent of the user.

But which browsers are affected? It was reported that all chromium based engines were especially susceptible to this script but firefox and Firefox-based browsers weren’t.

So just use Firefox :)

Telemetry and Data Collection in Big Tech

Data collection in major applications has existed for a long time. By now its a known fact that products like the Google Search Engine, Windows, Amazon, Instagram, and other popular services all collect user data either for advertising purposes or for monetization. What’s worse is that many of these services are taking our data to train their proprietary AI models, which runs a very real risk of leaking said data through jailbreak or prompt-injection attacks. This is compounded by the use of AI agents like OpenClaw, which poses a major security risk to data privacy as AI models are just prone to leaking data under certain conditions, as observed in the Vercel Data Breach.

But where am I going with all this?

Privacy Focused Tooling

There are quite a few alternative services that we can make use of to improve our privacy. I’ll be talking about some of the tools that I commonly use, for web browsing, emails, cloud storage and more. I want to mention beforehand that I am not going to be talking about self-hosting services here, just the already existing online services that you can use.

Web Browsing

This might be the easiest and most simple switch to make. Just yesterday, Google held Google I/O, where they announced that Google Search will be pushing AI generated content higher on the search results. What brought them to cook-up this “amazing” idea I don’t know, but I think it’s all the more reason to start switching.

Personally, I recommend either Brave Search or DuckDuckGo. Brave tends to deliver slightly better search results since it ranks pages based on popularity, but its index size is smaller than DuckDuckGo.

Index Size here simply means the amount of pages the search engine indexes. It requires a lot of computing power so really only the Tech Giants actually have the entire internet indexed.

DuckDuckGo, on the other hand uses a combination of multiple indices. So its index size is way bigger and it delivers a pretty decent search result quality. But it is slightly worse than Brave at delivering results and sometimes you’ll have to be a bit more specific with your search to get what you want. For absolute privacy though, DuckDuckGo search seems to be a bit better than Brave. I use DuckDuckGo a bit more frequently than Brave because of a couple of features it offers which you’ll see as you read on :)

Cloud Storage

Proton Drive and Mega.nz are good options in this space. Proton drive is slightly better if you want an experience as close to google drive as possible, with its free tier offering 5GB of storage. Mega.nz offers 20GB of storage in its free tier and if you’re willing to learn the slightly different interface, it’s probably the better option, in terms of pure storage capacity.

However, Proton is much more generous when you hit the limits on the free tier account, while Mega is reported to just freeze your account with no warning. So if you’re good at managing and tracking your storage well, use Mega otherwise I’d recommend Proton.

Web Browsers

This is a popular topic in many mainstream forums so I’d imagine if you’re reading this article, you’d be aware of the options I present here. Brave Browser is a very accessible, privacy-focused browser to use. It features a built-in adblocker and a TOR mode to browse the web using onion routing.

DuckDuckGo browser is also one that I quite like though I personally feel features-wise it lags a little bit behind Brave. The real selling point for me with the DuckDuckGo browser is the fire button. It deletes all open tabs, sessions, web caches and other data the website or browser may store. This helps ensure that our digital footprint is erased with pretty much no ambiguity.

Emails

This is the part I had the most fun setting up. I use a less well-known email called cock.li (hilarious name I know 😂) paired with DuckDuckGo Email Protection for forwarding emails. It is quite easy to setup and DuckDuckGo also allows you to reply through the @duck.com email address you setup for forwarding which is just crazy 😨. One thing I have observed from time-to-time though is that messages sent through the forwarding address can take an unusually long time to reach the recipient. It’s not frequent whatsoever but it could happen.

For the email client, you either have the option of self-hosting a webmail client like RoundCube (I know that I said I wouldn’t talk about self hosting, but in this case it would be remiss of me not to mention it since this is a VERY popular option), or using a desktop client like Eppie. I personally use a terminal-based client that I built myself using Go. If you guys like, I could show you how to build one yourself :)

Conclusion

At the end of the day, privacy is taking a backseat on the internet, especially in the hands of many of the major tech providers. It isn’t in our hands to control the decisions that are taken at the very top, but what we can do is take preventative and mitigative steps to ensure that we, as users, stay in control of our data.

Hope you enjoyed reading this article :)

Bellingcat Open Source Challenge: Back In Time - Walkthrough

smiles@bobbysmiles.xyz (Bobby Smiles) — Fri, 09 May 2025 22:23:16 +0530

Bellingcat - Back In Time walkthroughs

Bellingcat recently released their Back In Time series of challenges authored by Sofia Santos. I had a lot of fun solving these and I hope you did too. Here’s a walkthrough of how I tackled each of these challenges.

Hope you learn through these walkthroughs as much as I did solving these challenges.

Fresh Faced: Finding the Founder

Problem Image

So the question tells us that the founder of Bellingcat, Eliot Higgins, was featured on many news outlets for his groundbreaking discoveries in the year 2013. We need to find the YouTube video from which the newspaper clipping was taken.

The first and most obvious lead we have is the caption in the image. Let’s put this into Google Translate to see what language it is.

Google translate for the caption in the image

We can see that the language was detected as Croatian. Now from here, I didn’t find any leads, so I looked into the Wikipedia page on Eliot Higgins. Reading this page, we can see that Wikipedia mentions some non-English sources. Let’s check this page out and see what’s in it

Non-English sources listed in brown-moses

Over here, we can see a Croatian news article, which aligns with our earlier finding of the language on the news clipping. The site didn’t contain any sort of link to a YouTube video, just the same picture as we were given in the question.

So the next thing I did was to check the journalist who interviewed Eliot Higgins. His name was Tomislav Krasnec. So I just searched Tomislav Krasnec Eliot Higgins in the Google videos section and got the interview.

The answer is simply the video code.

Search result for Tomislav Krasnec's interview with Higgins

Training Time: There’s a lot to learn.

Problem Image

So we’re asked to do some cool indoor geolocation on this image. We have to find the room in which this picture was taken. Another hint is that the image is credited to ARIJ network. We are also told that this workshop was conducted in 2017 so that’s gonna be a cool lead as well.

So just googling, Christiaan Triebert Workshop 2017 yielded this post on X.

Searching for Christiaan Higgins workshop in 2017

This didn’t give much information. So instead I tried using Google Dorks to find the workshop.

By Google dorking this intext:"December" intext:"2017" intext:"Christiaan Triebert" intext:"workshop" I found that the event was ARIJ 10th Annual Forum and in their website we had an address of Mövenpick Resort & Spa Dead Sea | Dead Sea Road, 11180

https://arij10thannualforum2017.sched.com/list/simple

So from finding this I looked at the rooms available in the hotel in this part of their website. Through that I found the answer to be The Grand Ball room.

Creating Community: A new place to connect.

Problem Image

Ok, so here we will have to do a little bit of scripting, nothing too complicated, just some copying and pasting.

By just using this Google dork intext:'We finally got around to creating a bellingcat Discord server" we can find the post on X. get this time: 7:42 PM · May 12, 2020. Note that this time will be displayed differently based on what timezone you fall under.

Twitter post containing the bellingcat server announcement

So once I found the post, I joined the Discord and used this method to get the age of the server.

So, this method has the following steps:

Enable developer mode on your Discord.
Open Discord in your browser and open the Inspector tab on your browser.
Paste the following code snippet in your browser.

new Date("709752884257882135"/4194304) + 1420070400000

Result of the js code

This gives us this timestamp: Tue May 13 1975 18:34:34 GMT+0530 (India Standard Time)1420070400000 Now, this will be different according to your timezone, but on doing the math we get the time to be 68.

Future Plans: A timely document.

So we’re told that Bellingcat published a document nearly 2 years after they registered.

So I found the pdf by using this Google Dork: intext:"bellingcat" intext:"future plans". Since bellingcat was registered in 2018, it tracks that this result was the right one.

Now there is no author explicitly listed in the pdf, neither do I wanna read the whole pdf. So, I decided to take a look at the pdf metadata, which revealed that the author was Aric Toler.

Great, so we have one part of the challenge solved. Now let’s see if we can get all the articles he published around 2019-2020.

So on searching bellingcat.com aric toler I found this link. I scoured every article until I got this one. The last word of this article is the answer.

Toolkit Tracing: Tool tips new and old.

This was the easiest question of this release. We are asked to find a missing document in an older edition of the Bellingcat Online Investigations toolkit released in the year 2020.

I used this Google dork to search it up: intext:"Guides & Handbooks" intext:"2020" intext:"Bellingcat"

Result of the Google dork

You can find the actual document mentioned in the question here.

In this document, in the Guides & Handbooks section, you can find this document. As it turns out, it is inaccessible. So the obvious first step was to simply check for a snapshot of this document in the WayBack Machine.

Result of the wayback machine search

Once I got to the wayback machine, I simply entered the URL and voila! there it was. So we’ll simply navigate to page 39 of the document and get the first hazard listed.

Hope you found this as useful as I did.

Have a nice day! :)

The Rising use of AI in Cybersecurity

smiles@bobbysmiles.xyz (Bobby Smiles) — Thu, 08 May 2025 16:31:48 +0530

AI in Cybersecurity

Ever since the ChatGPT was released on the 30th of November 2022, it was inevitable that AI would become a crucial part of our lives. Nowadays (even though its been only 3 years since it came out), we see AI used everywhere. We write code with AI, generate images and videos with AI, summarize our meetings with AI, and with the recent introduction of tools like Ghidra MCP, we are seeing its increased use in Cybersecurity. But is this entirely as evil as the recent situation on HackerOne makes it out to be? I wouldn’t be too quick to judge.

The HackerOne Bug Report

Before I continue, I recommend checking out the actual bug report here. To quickly summarize, there is a critical bug in HTTP/3 capabilities of curl, which can be leveraged to corrupt the memory, hence leading to Remote Code Execution, or RCE in short.

In the initial stages of reading this report, all seems normal and it seems like a standard report for a high severity bug. But reading further, it begins to seem more and more suspicious (to say the least). Firstly the curl staff member mentions that the patch is not applicable here and asks a question, to which the reply looks SUSPICIOUSLY like it’s AI generated markdown. The user provides the steps to APPLY a patch, without actually providing the patch in question.

Some more discourse later, one of the other curl staff members drops a banger about this part of the report:

Analysis shows:
- Return address overwritten
- Stack recursion at ngtcp2_http3_handle_priority_frame

Staff comments:

There is no function named like this in current ngtcp2 or nghttp3.
Please clarify what you talk about. Which versions of ngtcp2 and nghttp3
did you find the problem in?

The function he was talking about, ngtcp2_http3_handle_priority_frame does not exist. This, reveals the fundamental problem with relying completely on AI to do the heavy lifting on a high-skill job.

So What’s the Issue?

AI generated reports are nothing new. There have been many reports, made using AI over the years and so far, according to the founder of the curl project, Daniel Stenberg, no valid bugs have been reported by these so-called AI generated slop reports (read his full linkedin post here). It is not uncommon to run into situations where the AI hallucinates things that do not exist in order to fulfill the task given to it by a user.

Generic AI concept art I randomly found online

This is a worrying trend as in the recent years, the number of these reports have only been increasing. The problem is that the people behind triaging and validating a submission are human, and, it takes time. Triaging a submission is no simple task and people put a lot of time into this. Simply spamming AI-generated reports on these platforms only makes this job harder, as:

The report cannot be ignored in the off-chance that it reports an actual exploit.
Producing these kinds of reports takes very little time and the staff will not be able to keep up with the speed of incoming reports, resulting in lesser security.

The curl founder called it a DDoS Attack against curl due to this. And, he’s not wrong.

What Causes this Issue?

I think the major problem with all this, is rooted in the fact that many people, beginners and professionals alike, have begun to SUBSTITUTE their workflow with AI, as opposed to AUGMENTING their workflow with AI.

AI is not 100% accurate, it never has been nor will it ever be, as it stands. AI is trained to give answers that SEEM correct. Obviously, this is not intentional, rather it is a consequence of how the current methods of training these AI models work. At the end of the day, the AI is only doing it’s job. It is us, as humans, whose job it is to validate this before making a submission.

But is AI completely Evil?

No, absolutely not. I am not going to pretend that I never use AI for my tasks. I do, and I think the benefits to having something like an LLM enhancing your workflow shouldn’t be slept on. However, the key distinction is that AI ENHANCES my workflow, it is not my ENTIRE workflow. What I mean is that say, for example, in a project, I won’t be vibe coding that whole project using some random LLM, I would rather be using it to write boilerplate code, find resources online, or as a last resort, suggest fixes to bugs in the code.

And I feel that a similar approach must be adopted by the wider community at large. I am not saying my approach to this is perfect, not at all, but rather the knowledge of Enhancement vs Substitution must be more widespread.

The classic AI villain, AUTO from WALL-E

It is due to this same pitfall, that vibe coding (a term which I absolutely hate by the way), is gaining more and more traction, when in reality, you can simply learn to code, put in the hours, and write FAR better applications than an AI ever could. Even better, you could double that productivity, by then finally using AI to enhance your already existing workflow, making this endeavour all the more worth it.

Closing Thoughts

This situation on HackerOne clearly demonstrates the flawed mindset that many people have started to adopt with regards to the usage of AI and a shift in this mindset is necessary if the usage of AI in high-skill fields is to be a net-positive. However, not all of this is bad, and if anything, we should learn from the pitfalls clearly demonstrated by this incident and continue to improve in our respective disciplines.

Have a nice day! :)

The Recent Resurgence of Linux

smiles@bobbysmiles.xyz (Bobby Smiles) — Sat, 03 May 2025 17:33:45 +0530

The OS Disillusionment

A major sentiment among general audiences and tech enthusiasts alike is that popular operating systems like Windows are becoming more and more inaccessible as the days go by. Higher hardware requirements, lack of support for older OS versions and an overall decrease in quality are opening the masses to open source alternatives.

With the end of support for Windows 10 fast approaching, many older devices will be rendered seemingly useless, and upgradation to a more modern piece of hardware might not be an option. In such cases, open-source comes to the rescue.

Linux and its Benefits

Linux needs no introduction. Almost all low level hardware runs some form of linux. Servers, wifi routers, smartphones, all are powered by a Linux distribution.

Nintendo switch running Ubuntu

Linux comes with many more benefits as well, like being less prone to cyberattacks, being fast and performant, high customizability, and a HUGE and passionate community behind it.

So where am I going with all this?

The Recent Resurgence of Linux

Recently I have observed that many big Content Creators are making the switch to Linux AND encouraging their community to give it a shot. For example, PewDiePie (in this video) recently switched to Linux, detailing his reasons for doing so (please watch the video it’s excellent).

Even before this video came out, my YouTube feed was already dotted with tech content titled something like “I switched to Linux and I could never look at Windows the same again”, all of them detailing similar reasons for switching to Linux.

Customizability
Performance
Stability (ok this one’s a little debatable)
Control

A fully customized GNOME desktop

A Linux nerd myself, seeing regular people start to give Linux a shot sort of surprised me, considering that many times (coming from personal experience) I was told that Linux is too hard because it’s quite terminal centric and that’s intimidating for a guy who is not a “basement-dwelling” nerd. Little did they know about Linux Mint, Ubuntu or Fedora.

Personal Anecdote

Due to the video made by PewDiePie, one of my friends (completely not into tech, has an age-old computer used only for watching movies and TV shows) asked me about switching over to Linux and was surprisingly open even to try Arch Linux. Now, to preserve both their sanity and mine, I told them to switch to something like Linux Mint first, to get a feel for the OS and it’s workflow, and to ease into the new ecosystem, and they were surprisingly receptive.

As it stands, I am yet to hear back from them regarding how the switch went, but considering they seemed pretty satisfied with the computer last we spoke, I suspect it went quite well.

Don’t Fully Believe the Hype

Now, it might seem VERY appealing to immediately switch to Linux after all the newfound buzz regarding the topic, but I would still ask that one consider this decision carefully. Despite its caveats, almost all software in the world is supported by Windows and Microsoft still provides some of the best tools in the market.

The Ms Office suite, boasting some of the best software for tasks like spreadsheets, text editing and presentations, for example, is not natively supported on Linux. It has to be run through a compatibility layer like wine, which does provide support for SOME Windows applications, not to mention that wine in and of itself can be a little hard to setup.

GNOME Desktop environment configured in Garuda Linux

There is also the issue with stability of certain distributions of Linux like Arch Linux, which follows a rolling-release model. While you can always stay up-to-date with the latest updates and security patches, this can also cause instability in a system, affecting your workflow and productivity. In such cases, I would still recommend that you stick to Windows, or at least try a Linux distro on a VM or live boot before switching completely.

Closing Thoughts

Linux has always been, and continues to be, a viable operating system to switch to—provided you know what you’re getting into. It is not like Windows, nor is it meant to be. Both operating systems serve their purpose, and both do it well.

With Linux, you get speed, control, stability, and customizability. With Windows, you benefit from familiarity, broader software support, and ease of use.

Whether or not you choose to switch to Linux is entirely up to you—but make sure to do your homework before making a decision.

Have a nice day! :)