TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.

To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control.

SSH MitM attacks are nothing new, and very easy to pull off. To secure yourself, use key authentication instead of passwords, and don't ignore the warning that SSH will give you saying "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED".

If you are using something like Tails, you will need to make sure to persist the ssh hosts key file (~/.ssh/known_hosts), or else you will not not be warned when a MitM attack is being performed.

More discussion here: https://news.ycombinator.com/item?id=50166257

I've been hearing that Reddit is requiring an account now. But there's still a workaround. Use old.reddit.com + Tor Browser in the "Safest" security setting (aka Javascript disabled). This is the most private way to browse Reddit, and somehow, it still works. If it's not working, try clicking the menu and click "New Tor circuit for this site".

Unfortunately, as of just a few days ago, all the Stack Exchange sites now needs Javascript to view, because they use Cloudflare (and the workaround I was using stopped working). So I have to keep switching between Javascript enabled or disabled, depending on if I want to view a Reddit or StackExchange post. Annoying.

Edit: Redlib is also a great way to access Reddit anonymously. And even if Reddit ends up blocking the Tor workaround, I'm confident that Redlib will continue to work.

Edit2: ok looks like old.reddit.com isn't working anymore, you have to use the onion link. Still working as of 2026-08-22 8:00 UTC. Or just use RedLib.

We've all heard the "my 100TB NAS is full of Linux ISOs" joke but how many of you actually hoard ISOs? I just noticed I have ~100GB, so not that many though definitely way more than I need (I just like to try new distros on my VMs and I never delete them after).

I have a theory that as AI gets better and better at mimicking humans, the only way to differentiate humans from bots, is to identify the human. This may not even be a conscious development from the company.

For example, Google's Recaptcha might be a big black box of AI models, that gets data about the user and spits out "human" or "bot". These AI models already get a ton of data about the user, like mouse movements, scrolling behavior, and keyboard strokes (afaik Recaptcha tracks all of this, and Cloudflare will soon). What if at some point, Google realizes that the AI has evolved to identify users, tying them to long-standing Google accounts or government IDs, because it's the most effective way to distinguish them from bots?

Google is already releasing the captcha that requires a Google-approved phone. That is also a privacy dead-end. But I wonder if Recaptcha and Cloudflare's new Precursor captcha, are already deanonymizing people.

And even open source projects and websites are starting to adopt Anubis, and complaining about AI contributions and slop. It seems like even the open source world is crawling towards human verification. The future of privacy does not look bright.

I feel like this is a hack that is rarely talked about. And it's the most reliable method I've found for getting an email account that I can use for signing up to other websites.

Imagine you want to create a completely anonymous account on some website. Most websites require an email account to sign up. if you're lucky you can use one of those a temporary email services, but many websites block those nowadays. They only accept trusted email providers like Gmail, Protonmail, etc. And trying to make an anonymous account on those providers is difficult. Even Protonmail, surprisingly. If you try to sign up for Protonmail using a VPN or Tor, they will ask for a phone number or a second email account. So now you have to get a phone number anonymously (very difficult), or get another email account anonymously, back to square one.

Darknet markets solve this problem. Pay a bit of Monero, and you get an account. Completely anonymous. Now I won't pretend it's easy. Even just signing up for a darknet market often requires learning how to PGP encrypt/decrypt messages. But it only takes an 30 min or so to figure it out and sign up, and it opens up a new world of tools to use for privacy. There are many other types of accounts that you can buy aside from Protonmail, and many other products in general that you can buy.

I don't get why Protonmail doesn't just accept anonymous crypto as an option during signup, but until they do this is honestly the most reliable option I've found. I really wish more websites just accepted crypto for account creation. It's understandable that in order to prevent spam accounts, account creation has to cost something, and crypto allows it to cost something without costing your privacy.

Anyways, here's a quick guide to get started. I'll avoid direct links since I don't know if those are allowed.

1. install Tor Browser Bundle, and use it for the following steps
2. search for websites like Daunt, Dread forums, and Tor Taxi. Darknet markets change all the time so use those websites to figure out which ones are currently active. Cross-check links across multiple websites to make sure they are trustworthy, since often scam websites will try to pose as legitimate ones
3. look for markets that let you search for the product you're interested in before signing up, to save you time
4. some markets require you to load funds into the market and then pay using those funds. Avoid loading more than you need, since some markets have "rugpulled" before (aka taken everybody's funds and disappeared. This is the risk of an anonymous market).

Edit: also if for some reason a seller doesn't accept Monero, you can use a crypto swap. Basically you send the swap service some Monero, tell them what crypto to convert it to (like Bitcoin or Ethereum), and where to send it to. Many can be used anonymously, without signup

The information is spread out across various articles, but from what I gather, a supply chain attack compromised the VS Code extension nx-console, which was then used to compromise Github. This all happened within two days.

Info on the Github attack:

• https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/
• https://www.bleepingcomputer.com/news/security/github-confirms-breach-of-3-800-repos-via-malicious-vscode-extension/

Info about the nx-console attack:

• https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised