/hacker

I have a stupid theory about Phrack: it is the worst-designed magazine in the history of the press and, at the same time, the best designed. Plain text, eighty columns wide, ASCII art opening every issue, not a single photograph. Any art director would have rejected it within two minutes. Yet it opened on any terminal on the planet, on any machine more than two years old, with no PDF reader, no installed font, nobody's permission. That is what hooked me first, long before I understood a line of what was written in it. 2600 is the opposite. Paper, staples, a cover with the same typography forever. I read my first Phrack issue all the way through on an old laptop someone lent me, using `less` and losing the thread every time an acronym turned up that I didn't know, which happened every second paragraph. I understood almost nothing. I went back the next day. I think most people who got hooked on these publications started that way, not understanding, feeling like they were peeking through a keyhole into a room where someone was talking seriously about things that mattered. Almost nothing is written with that assumption now, that the reader will make an effort. Everything is written to be digested in forty seconds, and I know what I'm talking about, because it's what I do for a living most days. The prehistory needs tidying, because neither of them came out of nowhere. In 1971 the Youth International Party Line, an idea of Abbie Hoffman and a guy called Al Bell, began circulating tips for making phone calls for free. Soon after it became TAP, the Technological Assistance Program, which for years was the phreakers' newsletter: colored-box schematics, test numbers, switching tricks. Before that there was the blind kid, Joe Engressia, with perfect pitch, who whistled at 2600 Hz and made the AT&T network obey him. Then John Draper and the whistle that came in a cereal box, hence the name Captain Crunch, which stuck. When TAP withered in the early eighties, it left a hole on the map. There was nowhere to read this stuff. That's the hole they both fell into. 2600 starts in January 1984, and the man behind it, Eric Corley, signs as Emmanuel Goldstein, the name of Orwell's public enemy, which sets the tone right away. It began almost as a photocopied newsletter, monthly in theory and irregular in practice, and gradually became a quarterly magazine with subscribers, mail, newsstands. Phrack arrives almost two years later, in November 1985, in a completely different place: a BBS called Metal Shop, with Taran King and Knight Lightning, who was Craig Neidorf, a student at the University of Missouri. The name is the same joke so many people made at the time, phreak plus hack. Distribution by BBS and later by email. Free. No advertising. No physical address anyone could come knocking at, or so it seemed, and I'll get to what went wrong with that. I want to stop here, because the difference in medium decided almost everything that came after, and most of what I've read on the subject skips right over it. Paper forces you to have a person. Somebody signs a contract with a printer, somebody negotiates with a distributor, somebody receives the subscribers' checks and the lawyers' letters. 2600 has a face, a P.O. box and a man who shows up on the radio. That makes it attackable in one way and protected in another: a visible editor, with a bank account and a real name, is hard to make disappear without making noise. Phrack, on the other hand, was text you copy at zero marginal cost, signed with pseudonyms, passed from machine to machine. You can't seize something like that the way you seize a print run. Except that the editors behind the pseudonyms were kids with birth names, addresses and universities. The anonymity was theater, and the theater fell down in 1990. The case is well known, but almost always badly told. In 1989 a member of the Legion of Doom, Robert Riggs, known as The Prophet, pulled an administrative document about the enhanced 911 service out of a BellSouth computer. He passed it to Neidorf, who edited it, cut what he thought he could cut, and published it in Phrack issue 24. In 1990 the feds came. BellSouth had valued the document at 79,449 dollars, and that is the figure that held up the charge of fraud and interstate transport of stolen property. The whole thing fell apart in the middle of the trial, in July, when the defense showed that the same information, in essence, could be ordered from Bellcore for 13 dollars. Thirteen. Between 79,449 and 13 there is room for a whole country's worth of ignorance about what information is and what it's worth, and I think you can still see the same valuation error today in courtrooms, in companies, on boards of directors. There was more. Operation Sundevil in May, dozens of searches, computers seized in almost a dozen and a half American cities. Steve Jackson Games raided in March, over a role-playing book about cyberpunk that the agents seemed to think was a crime manual, and one of the kids involved was Loyd Blankenship, The Mentor, the one from the manifesto. The Electronic Frontier Foundation was born in July of that year, largely as a response to this nonsense. If there's one thing I've never been able to forgive in the romanticism built around this era, it's that it forgets this was a disproportionate police sweep against teenagers, and that the concrete result was a digital rights organization that is still around. The legal legacy Phrack left is bigger than much of the technique it published. I mentioned the manifesto. The text is called The Conscience of a Hacker and it ran in Phrack, issue 7, in 1986, written by The Mentor after an arrest. Everyone knows the last line, the one about us all being the same, about how they can stop this individual but they can't stop us all. I've seen it on t-shirts, on posters, in the email signatures of people who never opened a terminal without a graphical interface. I'll confess it annoys me. It became wallpaper. And yet I go back and reread it every two years or so, and there's always a paragraph, the one about school, about the teacher explaining the same thing for the third time, that catches me off guard. So I don't quite know what to think. I think the text is good and the cult around it is bad, and that the two coexist without ever resolving. On to something drier, which is what Phrack turned into. Between the late eighties and the mid nineties it goes from a scene magazine, with news, interviews (the Pro-Phile column, which introduced one hacker per issue, almost always with arrogant and uninformative answers), and reader mail, to something closer to a serious technical bulletin. The change wasn't sudden, but one issue marks it, number 49, from 1996, with Aleph One's article, Smashing the Stack for Fun and Profit. People already knew how to exploit a stack buffer overflow, Morris's 1988 worm had done it in fingerd, but nobody had put it all in a text that a kid with Linux and a free afternoon could follow from start to finish. The article teaches you to mess with the stack, to write shellcode, to calculate the return address by hand, to accept that the result will fail the first eight or nine tries. More than two decades later it is still the introduction I recommend, and I don't do it out of nostalgia. The article has pedagogical logic, and that's rare even in expensive textbooks. The second-order effect is the one people talk about least. Once the article existed, defense had to move. StackGuard appeared in 1998, the canaries, then address randomization with PaX around 2001, the non-executable stack. Articles on the heap followed, on format strings, on everything the stack stopped allowing, and each of those articles pushed out another layer of protection. Phrack, without meaning to, worked as the security industry's unpaid research and development department. Half the mitigation mechanisms we have today exist because somebody published the attack in a text file and somebody else, somewhere, got angry enough to stop it. Whether that's a good thing or a bad thing depends on who paid the bill in the meantime, and the companies that caught the first day of a published exploit know the answer well. 2600 never had that profile, and I think that's where people treat it badly. The magazine is a social object. It has letters from readers, many of them from people asking how to do something the magazine never promised to teach. It has photographs of payphones on the back cover, sent in by subscribers from all over the world (a strange-looking payphone in Lisbon, a faded booth in Osaka). It has classifieds from other hackers. It has the meetings on the first Friday of every month, which are still happening in dozens of cities, the HOPE conferences that started in 1994 at the Hotel Pennsylvania in New York, the Off the Hook radio show on WBAI since 1988. It's more community than magazine. And honestly, when I compare it with Phrack, Phrack wins on density and 2600 wins on durability. One taught you how to do, the other taught you how to belong, and I recognize this is a convenient simplification that in five minutes I'll want to take back. 2600's most important case is from 2000. The movie studios sued the magazine for publishing DeCSS, the program that broke the DVD cipher, and then for putting links on its site to places where the program could be found. Links. Judge Lewis Kaplan ruled against the magazine, and the appeals court confirmed it in 2001. It's worth stopping a second on this, because anyone who works with the web, as I do, has to understand what it means: it was established, in an American court, that pointing at something can be treated as distributing that something. I've never looked at a hyperlink the same way since, and I don't say that as a metaphor. When I put together a page with fifty external links, somewhere in a corner of my head there's a voice reminding me of Corley talking on the radio about the matter. I also want to be unpleasant about both of them, because the literature on the subject is almost entirely adoration. A lot of what 2600 published was weak. Articles by insiders explaining to beginners things already explained ten times, letters from kids bragging, PBX tricks that were already dead by the time the issue hit the stands, because the print and distribution cycle means what you read is months old. Phrack had a news section about the scene, Phrack World News, which was basically gossip among pseudonyms, and a good part of the interviews was pure vanity. The elitism, the notion that whoever can't figure it out alone doesn't deserve an explanation, showed up in both and did damage, drove away people who could have been excellent. None of this undoes the rest. But memory is selective and it's worth remembering that for every Aleph One there were ten issues full of people trying to impress other people. And there's the hidden cost, which interests me more than the content. Making a magazine like this with no advertising and no sponsor means paying with people's free time, and free time runs out. Phrack is the textbook case. The editors kept changing, Taran King and Knight Lightning, then Crimson Death, Dispater, Erik Bloodaxe, later Route (daemon9) and others, each one leaving out of exhaustion, or college, or a job, or a lawsuit. There were interruptions, the rhythm came apart, then a long pause in the second half of the 2000s, then issues spaced years apart, and in 2016 number 69 came out, followed by eight years of silence until the return in 2024. Sometimes I look at this and see a publication surviving on collective stubbornness. Other times I see a lesson about what happens when everything depends on half a dozen people with the same passion and no contract. A small digression, not really about the subject but one that won't leave my head. A few years ago, on a night when the shared hosting where I kept a site went down for six hours and forty minutes (I remember the number because I sat there staring at the monitor's counter), I spent the whole time thinking I was losing traffic, losing rankings, losing money that wasn't even big. That's when I realized I had become exactly the kind of person Phrack never was: someone who publishes with an eye on what it will earn, on the metric, on the chart. The Phrack editors published because the article was good and because they wanted to see others read it, and the metric was a vague thing measured on the BBSes by who replied. I'm not saying they were better people. I'm saying the incentive was different, and incentive shapes text more than talent does. That leads me to what came after. Bugtraq was born in 1993, thanks to Scott Chasin, as a mailing list for security flaws, and it opened the eternal debate over full disclosure. Blogs came, conferences, then Twitter, and suddenly security research became a brand business. Today a vulnerability has a name, a logo and its own page, like Heartbleed in 2014, which got a bleeding heart before most people understood what an out-of-bounds read was. Security companies' technical reports come out with careful visual identity, executive summary, launch campaign. Some are excellent, I won't pretend otherwise, but there's a difference in spirit. A Phrack article didn't sell anything, had no client and no logo, didn't have to justify its existence. A company report exists, almost always, to prove that the company knows what it's doing. It sounds like a detail and I think it's the whole difference. Do I idealize? Of course I idealize. The magazines were made by people who stole phone service, who broke into other people's systems, who shared card numbers and access passwords in the same channels where they discussed theory. Not everything was noble, and much of what was in there was simply illegal and hurt real people, who paid phone bills that weren't theirs. When I say I miss it, I have to admit that I miss the tone, the technical care, the absence of hurry, and not the crime. But the truth is that the tone and the crime were born together, and separating them is a retrospective luxury. What's technically useful in an old Phrack issue is little. The telephone switching tricks died with the analog exchanges, the systems they talk about are gone, the addresses no longer exist. The usefulness is elsewhere: the way of explaining, the patience to show the whole reasoning, the courage to say you don't know a part and leave the space open for someone to fill. I learned more about writing on technology from reading these texts than from reading style guides. I'd even say anyone who writes technical content in Portuguese should read at least three old issues, if only to see how you can be dense without being opaque, which is a balance I fail at often myself. 2600 keeps coming out on paper, at least as far as I know, and that says a lot. A hacker magazine, printed, quarterly, with subscriptions, in the twenty-first century, with the entire web at its disposal. It could be stubbornness or anachronism. I read it as something else: the conviction that a physical object, one that doesn't update, that someone has to subscribe to and mail, creates a relationship with the reader that a feed doesn't. I don't know if I'm right. When I think of the articles I bookmarked last year, I can't remember a single one, and when I think of the three or four issues of paper magazines I still have on a shelf, I remember almost everything. There's one thing left unresolved that comes back to me when I reread the old archives, in the middle of some random Phrack issue, in the answers of the Pro-Phile interviews. They always asked the interviewees what they thought of their own activity and whether they'd ever stop. Most answered with arrogance, one or two with irony. Almost nobody answered honestly, and the few honest answers I found were almost always the shortest ones.