Sammai's blog

the age of weaponized kindness

i've noticed the current lax nature of data security consciousness and it's incredibly scary. obviously, i'm not the first early 2010s nerd to write a blog or vlog script about this madness and the apocalyptic disaster that's coming. but i feel it's essential i register my name to that list. i need to show my kids, decades from now, that i saw it coming. maybe this will be one of thousands of artifacts referenced in the near and distant future.

something very evil is going on and we are all feeding it unknowingly.

welcome to the age of weaponized kindness.

this is the narrative for the free, appealing interfaces we love, support, and build, masking the malicious activity enabled by them. in this era, the user feels they are being given something—free entertainment, convenience, sticking it to the "greedy" corporations—when in reality, they are being farmed.

to understand the core issue, let's peel back the layers of the threat model. the person who fixes this has to penetrate technology, psychology, and economics.

the hardware trojan

yeah, i'm sure you thought "software" first. me too. but criminality has always dominated the physical layer. hardware.

there's a massive, ongoing phenomenon where cheap android tv boxes sold on major e-commerce sites arrive pre-infected at the firmware level. go search amazon or aliexpress for a "t95" or "allwinner" box. it’s $30. it works faster than a chromecast. it has everything unlocked. it feels like a steal.

the reality? the firmware contains a backdoor (often a variant of the android.vo1d or badbox malware). before you even type your wifi password, that box is hardwired to reach out to a command & control (c2) server.

your home network just became a "residential proxy." criminals are now renting your ip address to route traffic for credit card fraud or attacks on government sites. to the police, the attack looks like it came from your house.

the technical "cat and mouse"

isps don't have the ultimate dominant power anymore. remember when they could just block a pirate site and it stayed blocked? that world is dead.

how did this happen? domain fronting.

this is the big gun. isp view: "user is talking to google.com. allow." reality: user is pulling a 4k stream of dune: part two from a pirate server hiding behind google’s infrastructure.

the pirate app tells the isp it's visiting a safe cloud provider, but once the secure tunnel is open, it connects to the illegal server. to block the pirate, the isp would have to block google or cloudflare, which would break the internet.

you get it now.

the culture change: pcdn

this is the infrastructure pirates use to deliver you 4k videos that only proprietary companies could manage a few years back. it's called pcdn (peer content delivery networks).

the core infrastructural philosophy here is the decentralization of risk and cost.

in the old model (megaupload, napster), there was a "head of the snake." you cut off the head (seize the servers), and the snake dies. in the pcdn model, you are the infrastructure. there is no head. only a swarm of millions of ants.

this philosophy drives two things:

1. bandwidth vampirism legal streaming (netflix, youtube) is expensive because bandwidth costs money. pirates can't afford that. their solution is bandwidth vampirism.

instead of a central server sending the movie to 1,000 people, the server sends it to one person (seed), and that person’s device automatically forwards it to 5 others, who forward it to 25 others. the pirate operator’s bandwidth bill goes to near-zero. you are paying the bill. your home internet plan is the engine running their business.

you're not watching for free. you are bartering your upload speed and electricity for access to content.

2. jit swarming modern browsers and android apps support webrtc (web real-time communication). this protocol was designed for zoom calls, allowing two browsers to talk directly without a server. pirate apps hijack this.

when you open a stream, the app silently spins up a background process. it opens webrtc channels to 30 other users watching the same stream. to get through your router’s firewall without you noticing, the software uses "udp hole punching." it tricks your router into thinking you requested data from these 30 strangers, so the router opens the door.

the "swarm" only exists for the duration of the live match. once the game ends, the swarm evaporates. it is "ghost infrastructure."

the human shield

congratulations. by watching that free premier league game, you are now a "human shield."

if the fbi or intelligence agencies want to shut down the stream, they technically have to shut down you. but they can't arrest 50,000 ordinary people watching a football game. the scale of the user base paralyzes enforcement.

worse, criminals route attack traffic through the pcdn network. the attack doesn't come from a russian server; it comes from your ipad while you're watching house of the dragon. you are the laundering proxy washing their traffic clean.

we are already seeing the legal shift. in 2024, a court in spain (juzgado de lo mercantil de barcelona) ruled that isps must provide the ip addresses of users—not admins, users—who connect to pirate servers to stream la liga matches.

the internet slum

we are witnessing the death of the "neutral" internet, killed not by government censorship, but by our own desire for free entertainment.

the decentralization of risk adds a new parasitic layer to the osi model:

this is an encrypted, un-policeable overlay network that uses layer 1 and 2 resources without paying for them, effectively degrading the service for everyone else in the neighborhood.

we opened the gates to the "weaponized kindness," and now we can't close them.