Every day is 0-day Now

What is your threat model?

For 99.99999% of humanity, throughout 99.9999% of human history, the simple answer has in general been "I'm not important enough." The most historically accurate security by obscurity. And that was usually good enough. You had your regular layer of asshats who are looking for easy victims - usually chosen as the low hanging fruit - and there is always the pure rotten fluke chance that fate plays a role when the wrong person crosses your path, but for the most part just regular people could lock their doors when they left the house - literally and metaphorically speaking - and chances were very good that everything would be there when they got back.

I use this historic analogy because we carried it forward into the internet age and it worked about as well for the vast, vast majority of people up until fairly recently. I remember a time when people just plugged their computers directly into the WAN. 

Not even a software firewall. Trumpet winsock. Then later XP SP1. 

Just absolutely raw dogging their NIC piped into Windows XP onto the WAN.

I remember sniffing traffic and being astounded at what was flying around in cleartext - actual passwords just sprayed into the network pipes wrapped in nary more TCP packets to hide their nakedness. 

At the time, I was doing Tier 2 tech support for a major American ISP that rhymes with Lode Bunner. XPSP3 came out and introduced an OS level firewall - which was desperately needed - but what nobody seems to remember (and I swear to fucking god this happened and do not gaslight me about it) is that for the first couple of days at least, it shipped defaulted to block EVERYTHING - including DHCP requests. Which is a problem when people are raw-dogging WAN connections with their network assignments.

This was the same era where everyone upgraded their corded phones to cordless handsets that broadcast private conversations at 49MHz - receivable by any common scanner, and even that service itself was carried by a single pair of twisted copper wires that could easily be tapped into at the side of the house with a standard phone that had gator clips soldered on to the stripped red and green wires.

But, unless you lived in my neighborhood (or one belonging to someone like me), the chances of someone tapping your phone or catching your Geocities login were extremely low. The simple fact of the matter is that unless you were up to some nefarious shit (ie the government or/aka bigtime baddies is out to get you), or you were overly sloppy with your basic opsec (ie leaving your password on a sticky note stuck to your monitor at work), your chances of getting pwned were pretty low. 

In the past few years however, as AI has advanced, it has become clear to me and I think many who tend to keep an eye on this space that the average person's security posture of "I'm not important enough for anyone to want to try to hack me" is becoming less and less relevant.

The success of that posture necessarily relies upon the scarcity of resources - the limited number of threat actors who would victimize ordinary people, the computing resources necessary to run password crackers and scanning scripts, the amount of time a spear fisher would have to invest to research and then target... the economics of it meant that the rich and powerful were the targets and us lowly plebs got to walk around in relative safety barring randomness and edge cases.

Not so anymore.

A couple of years ago now, my mother got a call from my son - except it wasn't her grandson, it was someone who had trained an AI (presumably on his Instagram) and were calling trying to scam her with some story about how he'd been arrested and needed bail money. By now you've heard of this kind of thing but at the time it was a revelation to me, because it was still relatively new technology, and also because my family are nobodies. We like it like that. My mom is a retired school teacher. I was a photocopier salesman. My son was in college at the time. I'd made a few songs and known a few fancy people over the years, but have deliberately chosen to avoid public life and in so doing being an obvious target. Yet here someone had taken the time to train a voice model on my son and then tracked down his grandma to try to scam her for a few hundred bucks.

That was when I started hardening my own posture - if Nana Marney is getting spear phished then something has changed.

Normies aren't protected by the economics of obscurity anymore.

Where previously, if you recycled passwords and your recycled password got leaked in a breach, you had to wait for that data to get sold and then picked up and then scraped through and triaged and if you are truly a nobody then you were way down on the list of people to try to hack. Even using scripts to parse the dumps, processing such huge volumes and then going through the motion of identifying the most profitable targets would usually mean that you would still never get targeted.

But now, all that repetitive motion and logical inference can be done at breakneck speed using consumer hardware or rented cloud processing, let alone whatever it is the alphabet bois are up to (there is a reason they are building all these datacenters and it isn't to crank out slopcore reels, we will get to that in a different post). 

A single bad actor with no scruples and an abliterated LLM can target thousands or hundreds of thousands of victims a day. 

Having potential target returns of $100 or less used to be a deterrent - that is to say, "the poors don't tend to get targeted because the amount of effort necessary to scam them doesn't scale with how much they can be scammed for".

But now, getting $20 out of each victim sounds pretty good if you can do 10,000 a day. What if you only get a $50 payout from every 10,000 attempts, but you can do a million attempts a week?

Now couple this with the fact that even skiddies ("script kiddies", 90s diminutive term for wanna-be hackers who don't really know what they were doing but had gotten their hands on scripts over IRC) can act like really skilled elite hackers with the help of abliterated (de-censored) LLMs and all of the sudden you have a world where what ten years ago would have been considered "elite hackers" are targeting regular people.

Now couple this with the fact that not only are these freshly minted elite hackers finding the time to target regular people, but they are also working on finding all new exploits.. and boy howdy holy fuckin moley are there a lot of them.

We used to get a really critical CVE exceedingly rarely. Really, only every few years was a vulnerability disclosed that raised eyebrows outside of the cybersecurity community. Now, we are getting multiple a week. 

Vulnerabilities in the Linux kernel that have been there for years. Supply chain attacks targeting node and package managers and my god, we used to say "keep your computer updated to keep from getting pwned" and now you get fucking pwned by doing your updates.

*unplugs ethernet cable*

My tinfoil hat goes on and tells me that most of these are likely intentionally planted by the alphabet bois, deeply set supply chain attacks in all the major software projects to ensure that the secret  backdoors are there for when they want to use them. 

Things like the Intel Management Engine that essentially turns every desktop computer into a type 1 hypervisor so no matter how hardened your operating environment, you will always be compromised at a hardware level.

Now add onto this the fact that every government seems to have chosen 2026 to be the year that they go masks off on the surveillence, with Canada's C-2, Europe's "chat control" on the menu (it has now passed), the fucking flock situation in the US... seems like 2026 is the new 1984, everything that all the oldhead hacker dudes were warning everyone about in the 90s and everyone said "oh that's silly we would never allow that" ... well it's here.

There has never been a better time to harden your security posture, because a fundamental principle of self defence is adapting to changing circumstances.

The Electronic Frontier Foundation (EFF) has a great site dedicated to Security Self Defence.