Attrition.org
attrition.org · Group blog · on HN since 2009
A security site that documents hacking-related fraud and misinformation, including dossiers on charlatans, security company gaffes, and IRC jokes.
What HN saysHN commenters cite its dossiers exposing people like Ankit Fadia and Kim Schmitz, plus its list of security company blunders and IPv6 jokes.
75HN people shared it
56linked it in comments
20stories submitted
124story points
10 months agolast shared
2009people per year2026
Most-shared posts
- 1Steve gibson19 people · first shared 2011
- 2Kim Schmitz (aka Kimble)6 people · 5 points · first shared 2012 · 1 comments on HN
- 3Ankit Fadia, “young hacker”, “genius”, and “author”6 people · 2 points · first shared 2012 · 1 comments on HN
- 4List of hacking related charlatans from attrition website4 people · 3 points · first shared 2012 · discussion on HN
- 5Protolol: An IRC Log of Protocol Puns (2011)4 people · 2 points · first shared 2011 · discussion on HN
- 6Thehackernews4 people · first shared 2012
- 7Legal Threats Against Security Researchers3 people · 2 points · first shared 2015 · discussion on HN
- 8Rebuttal: LulzSec Ups The Ante2 people · 31 points · first shared 2011 · 12 comments on HN
- 9A concise history of recent Sony hacks2 people · 7 points · first shared 2011 · discussion on HN
- 10A concise history of recent Sony hacks (2011-2014)2 people · 2 points · first shared 2014 · discussion on HN
- 11Attrition.org2 people · 2 points · first shared 2018 · discussion on HN
- 12Keywords2 people · first shared 2018
- 13Mirror2 people · first shared 2017
- 14Ec council2 people · first shared 2014
- 15Rahul Tyagi: Jericho Emails1 people · 51 points · first shared 2012 · 49 comments on HN
What HN people wrote when they linked it
gadnuk · 2020-11-22
Thanks for mentioning this fraudster. That dude legit conned everybody at the time because Internet was fairly new to India. Here's one of my favorite pages on the internet exposing the charlatan that he is:
http://attrition.org/errata/charlatan/ankit_fadia/
tempuser24 · 2018-09-11
http://attrition.org/ does this, though it doesn't look like they've kept up with companies.
kragen · 2014-10-16
The canonical collection of five hundred jokes of this genre is at http://attrition.org/misc/ee/protolol.txt:
@mckeay The sad thing about IPv6 jokes is that almost no one understands them and no one is using them yet.
@dildog What's up with the jokes... Give it a REST, guys...
@ChrisJohnRiley: The worst thing about #protolol is that you get the broadcast even if you really don't give a shit!
@mdreid: The best thing about proprietary protocol jokes is REDACTED.
@maradydd: The bad thing about Turing machine jokes is you never can tell when they're over #protolol
...
jagermo · 2014-01-20
i always recommend the dossier at attriton.org: http://attrition.org/errata/charlatan/kimble/
vezzy-fnord · 2013-10-27
For other similar gaffes, see: http://attrition.org/errata/sec-co/
It's amazing what kind of things slip by.
DanBC · 2012-04-11
Steve Gibson is pretty much clueless. (http://attrition.org/errata/charlatan/steve_gibson/)
SpinRite was great. Spinrite stopped being any use sometime in the early 90s.
lawnchair_larry · 2012-01-24
It's hard to say this without sounding like one of those condescending security people, but I highly recommend avoiding that guy.
http://attrition.org/errata/charlatan/steve_gibson/
To balance that with something constructive, if you are already comfortable with software development, I'd suggest checking out these to get started with playing around:
https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-p… - Part 1, they go to 11.
https://google-gruyere.appspot.com/ - for web app sec
zamadatix · 2026-01-11
This may not be the exact one you were thinking of but very similar kind of collection: https://attrition.org/misc/ee/protolol.txt
solarpunk · 2024-05-26
aspenmayer · 2024-05-12
> That's the IT sec version of placing your CV on their server to apply :)
Has this actually ever happened or been solicited? That’s an interesting thought experiment.
https://en.wikipedia.org/wiki/Calling_card_(crime)
https://en.wikipedia.org/wiki/Website_defacement
https://attrition.org/mirror/
https://www.zone-h.org/archive
mike_d · 2023-02-08
Please don't use unrelated posts to help peddle snake oil.
https://attrition.org/errata/charlatan/steve_gibson/
gowld · 2021-10-07
That list is a list of words chosen by William Knowles to taunt any NSA who may be listening.
It's not a list of words used by the NSA or any spies.
https://attrition.org/misc/keywords.html
swatkat · 2021-09-20
Yes, we do see these "prodigies" pop up from time to time in India. Reminds me of Ankit Fadia[0] from the 2000s and more recently of "Drone" Prathap[1]. These charlatans get their airtime mostly because of severe lack of due diligence by media.
[0]https://attrition.org/errata/charlatan/ankit_fadia/
[1]https://www.opindia.com/2020/07/drone-boy-scientist-prathap-nm-600-dro…
twayback · 2018-12-29
On Why this site was banned? http://attrition.org/errata/plagiarism/thehackernews/ Plagiarism to begin with!
hazz99 · 2018-08-27
Hello everyone – I'm the creator of Enlist.
I recently discovered TrackMeNot[0], an addon that fights tracking by polluting metadata. It doesn't make you anonymous, but creates "noise" to hide behind.
We know that the NSA tracks us through it's XKeyScore program. Various sites showcase an interesting, but possibly vacuous list of tracked keywords[0].
My addon makes random Google searches using these tracked keywords -- this puts you on the NSA's list.
Realistically, the addon is pretty weak. It doesn't make "normal" searches, so it's trivial to filter out the "noise".
If people find this interesting, I'll consider making the searches more realistic, and harder to identify. Maybe I'll mix normal & incriminating searches with a random walk through a markov chain.
Thanks for your interest.
[0]http://attrition.org/misc/keywords.html
jlgaddis · 2017-11-30
Any time someone mentions Steve Gibson, the "Security Now" podcast, or any of his "work" I feel obligated to point them to http://attrition.org/errata/charlatan/steve_gibson/
b3lvedere · 2017-08-02
Yep. He has been for years and years.
http://attrition.org/errata/charlatan/kimble/
daveio · 2017-06-02
This can be instantly disregarded because Steve Gibson is a charlatan. He's got a history of getting things wrong as loudly as possible in order to generate reputation. http://attrition.org/errata/charlatan/steve_gibson/
Something1234 · 2016-12-20
Probably should. The logs have some pretty interesting details in them.
http://attrition.org/postal/logs/2006/logs.001.html
dylz · 2016-11-15
- "requires payment" and "completely anonymously" seem at odds; especially when the person you're communicating with will likely have purchased it from an app store. i understand that there is a way to purchase it with btc at their own site, but that doesn't really help with licencing and GCM
- proper implementation of e2e means where the servers are shouldn't matter
- threema uses GCM too -> whole google play services framework
- this steve gibson? http://attrition.org/errata/charlatan/steve_gibson/
gnu8 · 2016-05-24
Gibson isn't a reputable programmer, he's a noted Infoseek charlatan [1]. The proper tool for preventing Windows 10 upgrades is Ultimate Outsider's GWX control panel [2], not Gibson's poor me-too gimmick.
[1] http://attrition.org/errata/charlatan/steve_gibson/
[2] http://ultimateoutsider.com/downloads/
freehunter · 2016-05-15
He's also made a fool out of himself in very unashamed and public ways, and spread a lot of FUD. Windows XP raw sockets and Windows meta file come to mind. He's also said that Metasploit is a controversial piece of software that's main use is to develop malware.
Steve Gibson is a talker, even if he doesn't know what he's talking about. He will say whatever he wants and issue corrections later when he's been proven wrong. It's not a cheap shot. It's well documented, he's been called out on it for years, but he's still calling himself a security expert while simeltaneuously spewing bullshit, for 15 years now.
And "not current" in security means "useless", or sometimes "actively harmful". There is no way to call yourself a security expert if you're out of date.
http://attrition.org/errata/charlatan/steve_gibson/
oneloop · 2016-05-03
bascule · 2016-01-23
See also his Security Charlatans page on Attrition.org:
http://attrition.org/errata/charlatan/kimble/
chris_wot · 2015-09-28
Attrition.org has done an interesting biography of Oracle CSO Mary Ann Davidson here: http://attrition.org/security/rant/oracle01/
It only goes to 2008, but it really shows nothing has changed! How did this self-admitted "closet-Luddite" become the most important security person within Oracle?
snowpolar · 2015-08-08
At your own risks.
http://attrition.org/errata/charlatan/steve_gibson/
joepie91_ · 2015-07-22
Do people need to be reminded of what happens when these kind of issues are not disclosed out-of-the-blue?
Well, here you go (search for 'Volkswagen'): http://attrition.org/errata/legal_threats/
desouzt · 2014-12-08
I do read the news, and I am aware of the hacks on other companies.
Specifically I meaning this - http://attrition.org/security/rant/sony_aka_sownage.html and the table at the bottom. Over 30-40 high profile attacks on a regular basis (every couple of months). And more recently hacks on the PS network, Sony pictures, customer details etc that were so high profile.
xSwag · 2014-08-18
Why is this website not banned yet? They're very well known plagiarists.
http://attrition.org/errata/charlatan/infosec_institute/
hyyypr · 2014-07-14
That may be the most convicing bit in this article : http://attrition.org/errata/charlatan/steve_gibson/