5 ms·

I have no intention of trying to find out voidnull, but here are some thoughts on what we know: 1. We have a little bit of text we can be reasonably sure voidn

by loumf 14y ago

I have no intention of trying to find out voidnull, but here are some thoughts on what we know: 1. We have a little bit of text we can be reasonably sure voidnull wrote -- some sort of text-likeness algorithm might be able to give us some candidates -- pointed at newsgroups/forums/etc where SDF users might hang out. 2. Using the above, I would note that there are some grammar/typos/mistakes from possibly careless writing. That might be something to specifically try to isolate 3. The HTML on the page is very simple, but malformed -- perhaps look for pages like that (some missing tags) 4. adnam made a comment that showed some familiarity with voidnull and SDF -- adnam might be easier to locate and an association might be discovered. 5. If I believe #4, voidnull is possibly a handle that has been used before (seems really dumb, though) -- perhaps it's a very recognizable alteration. Anything else?

DanBC 14y ago
3a. The HTML is formatted in a specific way, with indents and white space.
- TheCapn 14y ago
  Just going to point out that matches HTML code style to a person that shares traits with "voidnull" means nothing. Silly HTML pages I've written in vi over puTTY terminals look practically identical to that page. Additionally, I would assume if he is to write something going "find me" he will likely purposefully change his styling or attempt to remove any styles he uses. Such a simple page devoid of any CSS or unique traits really shows that it could be written by a seasoned vet or a highschool kid with a good idea. Its the html equivalent of notepad file if you ask me.
  - jarek 14y ago
    > Silly HTML pages I've written in vi over puTTY terminals look practically identical to that page. Sure, but it's a hint that the person might have written it in vi. Only some people would write HTML in vi. Sure that group overlaps quite strongly with group of people that would put out such a challenge, but it's still a couple bits of information.
benmanns 14y ago
Assuming malicious intent on the part of the provider, the envelope sent to SDF will have a post office stamp from the city from which he sent it. Intersect the IP subnets for the area with the IPs used to connect to SDF to find a connection he made to a non-anonymous account. Second, the command `ssh -o ProxyCommand="nc -X 4 -x localhost:9050 %h %p" sdf.org` seems to be unique (to Google), and may be in a script he has written previously.
- jarek 14y ago
  > Assuming malicious intent on the part of the provider, the envelope sent to SDF will have a post office stamp from the city from which he sent it. Unless they got someone to remail it from the other side of the country.
  - chris_mahan 14y ago
    Then there is an accomplice. Two people are easier to find than one.
    - jarek 14y ago
      Mail something to a friend in New York, ask them to remail via a super-busy mail box and destroy the original envelope. Sure it'll technically be possible to review CCTV around the mail box, but then the investigators have to find out who asked the remailer to do this. More difficult than just cross-checking IP addresses to find potential matches for one person. Daisy-chain the remails a couple of times and it gets ridiculously complicated for all but highest security purposes. Get the accomplices to each wait some semi-random amount of days before remailing to help improve chances that one of the CCTVs will roll-over and write over footage of a remailer... Or mail it yourself while travelling without connecting to the server while in the area. Sure, you can technically cross-check CCTV from mailbox with transport centres footage with transport records, but... Do U.S. stamps have identifying features like printers these days? Shown a stamp or three stamps, can you tell e.g. which store chain sold them?
      - 14y ago
loumf 14y ago
voidnull claimed the page was legal, but it is not legal in Germany (according to other comments here). voidnull appears to be a native English writer and uses $ when referring to monetary amounts in a few contexts.
ggchappell 14y ago
> 3. The HTML on the page is very simple, but malformed -- perhaps look for pages like that (some missing tags) The w3.org validator says it's okay. http://validator.w3.org/check?uri=http%3A//voidnull.sdf.org/ http://validator.w3.org/check?uri=http%3A//voidnull.sdf.org/
- loumf 14y ago
 That might be so, but it's still a possibly identifying fingerprint.
 - btilly 14y ago
 Sorry, but only people who have never written HTML by hand could think that omitted tags are a useful identifying fingerprint. It can fit in with word choice, indentation, line length, etc as part of a personal pattern. But by itself it is as meaningful as saying "and".
- cocoflunchy 14y ago
 I have 4 errors, 5 warnings...
 - ggchappell 14y ago
 So, do I, now. But it's the ISP's over-quote page, not the page originally posted.
 - cocoflunchy 14y ago
 Ok, my bad.
mistercow 14y ago
Regarding #5, I doubt that the name is a useful lead. It seems to me that "voidnull" is just a play on the concept of anonymity and not something that you could tie personally to the OP.
- loumf 14y ago
  It was adnam's recognition that made me think it was used before. Also voidnull appears to have a long standing interest in this concept, and so might have used a variant of it before. Again, just a data-point -- the idea is to sort a giant list, not necessarily filter it.
chjj 14y ago
Omitted tags have always been perfectly conforming in HTML, just not XHTML. The same goes for </li> tags. It's more common than you think for people to omit closing tags for those elements.
sspiff 14y ago
> 1. We have a little bit of text we can be reasonably sure voidnull wrote -- some sort of text-likeness algorithm might be able to give us some candidates -- pointed at newsgroups/forums/etc where SDF users might hang out. People call me extremely paranoid for this, but I've seen how effective author-analyzing software is. I would almost certainly try to learn a new language if I want to stay anonymous, and only use that language for my anonymous alter-ego. There are plenty of non-English communities out there, and if you're data is sufficiently interesting, people will translate it for you.

by loumf 14y ago

DanBC 14y ago

3a. The HTML is formatted in a specific way, with indents and white space.

TheCapn 14y ago
Just going to point out that matches HTML code style to a person that shares traits with "voidnull" means nothing. Silly HTML pages I've written in vi over puTTY terminals look practically identical to that page. Additionally, I would assume if he is to write something going "find me" he will likely purposefully change his styling or attempt to remove any styles he uses. Such a simple page devoid of any CSS or unique traits really shows that it could be written by a seasoned vet or a highschool kid with a good idea. Its the html equivalent of notepad file if you ask me.
- jarek 14y ago
  > Silly HTML pages I've written in vi over puTTY terminals look practically identical to that page. Sure, but it's a hint that the person might have written it in vi. Only some people would write HTML in vi. Sure that group overlaps quite strongly with group of people that would put out such a challenge, but it's still a couple bits of information.

benmanns 14y ago

Assuming malicious intent on the part of the provider, the envelope sent to SDF will have a post office stamp from the city from which he sent it. Intersect the IP subnets for the area with the IPs used to connect to SDF to find a connection he made to a non-anonymous account. Second, the command `ssh -o ProxyCommand="nc -X 4 -x localhost:9050 %h %p" sdf.org` seems to be unique (to Google), and may be in a script he has written previously.

jarek 14y ago
> Assuming malicious intent on the part of the provider, the envelope sent to SDF will have a post office stamp from the city from which he sent it. Unless they got someone to remail it from the other side of the country.
- chris_mahan 14y ago
  Then there is an accomplice. Two people are easier to find than one.
  - jarek 14y ago
    Mail something to a friend in New York, ask them to remail via a super-busy mail box and destroy the original envelope. Sure it'll technically be possible to review CCTV around the mail box, but then the investigators have to find out who asked the remailer to do this. More difficult than just cross-checking IP addresses to find potential matches for one person. Daisy-chain the remails a couple of times and it gets ridiculously complicated for all but highest security purposes. Get the accomplices to each wait some semi-random amount of days before remailing to help improve chances that one of the CCTVs will roll-over and write over footage of a remailer... Or mail it yourself while travelling without connecting to the server while in the area. Sure, you can technically cross-check CCTV from mailbox with transport centres footage with transport records, but... Do U.S. stamps have identifying features like printers these days? Shown a stamp or three stamps, can you tell e.g. which store chain sold them?
    - 14y ago

loumf 14y ago

voidnull claimed the page was legal, but it is not legal in Germany (according to other comments here). voidnull appears to be a native English writer and uses $ when referring to monetary amounts in a few contexts.

ggchappell 14y ago

> 3. The HTML on the page is very simple, but malformed -- perhaps look for pages like that (some missing tags) The w3.org validator says it's okay. http://validator.w3.org/check?uri=http%3A//voidnull.sdf.org/ http://validator.w3.org/check?uri=http%3A//voidnull.sdf.org/

loumf 14y ago
That might be so, but it's still a possibly identifying fingerprint.
- btilly 14y ago
 Sorry, but only people who have never written HTML by hand could think that omitted tags are a useful identifying fingerprint. It can fit in with word choice, indentation, line length, etc as part of a personal pattern. But by itself it is as meaningful as saying "and".
cocoflunchy 14y ago
I have 4 errors, 5 warnings...
- ggchappell 14y ago
  So, do I, now. But it's the ISP's over-quote page, not the page originally posted.
  - cocoflunchy 14y ago
    Ok, my bad.

mistercow 14y ago

Regarding #5, I doubt that the name is a useful lead. It seems to me that "voidnull" is just a play on the concept of anonymity and not something that you could tie personally to the OP.

loumf 14y ago
It was adnam's recognition that made me think it was used before. Also voidnull appears to have a long standing interest in this concept, and so might have used a variant of it before. Again, just a data-point -- the idea is to sort a giant list, not necessarily filter it.

chjj 14y ago

Omitted tags have always been perfectly conforming in HTML, just not XHTML. The same goes for </li> tags. It's more common than you think for people to omit closing tags for those elements.

sspiff 14y ago

> 1. We have a little bit of text we can be reasonably sure voidnull wrote -- some sort of text-likeness algorithm might be able to give us some candidates -- pointed at newsgroups/forums/etc where SDF users might hang out. People call me extremely paranoid for this, but I've seen how effective author-analyzing software is. I would almost certainly try to learn a new language if I want to stay anonymous, and only use that language for my anonymous alter-ego. There are plenty of non-English communities out there, and if you're data is sufficiently interesting, people will translate it for you.