#SPAM AND CHEESE

[hypehaerin]

therapist trying to shame me for having not "moved on" yet from something that happen a year ago, crazy how idgaf #BLOCKED

[mostlysignssomeportents]

How the world's leading breach expert got phished

I'm on a 20+ city book tour for my new novel PICKS AND SHOVELS. Catch me in PITTSBURGH on May 15 at WHITE WHALE BOOKS, and in PDX on Jun 20 at BARNES AND NOBLE. More tour dates here.

If you can't spot the sucker at the poker table, you're the sucker. Also, if you think you can't get phished, you're the sucker.

I've been successfully scammed six times in my life. Each time, the scam relied on the confluence of several factors that yielded a fleeting moment of vulnerability that some scammer was able to exploit by being in the right place at the right time. I had to be lucky always, they only had to be lucky once.

The first time I got scammed was in 2008, on my first trip to India. As I walked toward the Mumbai airport taxi queue at 2AM, I was approached by two uniformed airport security guards who told me that the taxi rank had been moved in the wake of a recent terrorist bombing in Islamabad, which had resulted in all the regional airports going on high alert. The bombing was real, the airport high alerts were real. The security guards – not real. They were scammers, working with a fake cab that charged me $200 for a $20 taxi ride.

I got scammed again this way in Shanghai, at the Pudong taxi-rank. I was with my wife, daughter and parents and we split into two cabs and the drivers colluded to turn off their meters and charge us extremely high cash fares, dropping us across the street from our hotel so we couldn't enlist the doorman to interpret. Again, it was very late at night, things were confusing, and we'd had to wait for more than an hour for the cab, so we were exhausted and sweaty and divided into two groups so we couldn't coordinate strategy.

Then there was the time I got successfully phished by a Twitter account takeover worm:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That was also a miracle of timing – for the scammers. I got hit on a day when I was running late, when I'd just reinstalled my phone's OS and was being prompted for my passwords all over again, when I had just done a bunch of major publishing and was getting a lot of messages about my new articles. When a friend got infected by a worm that took over his account and messaged me, "Is this you?" with a link that took me to a webpage that asked me to log back into Twitter, I re-entered my password. If I'd been five minutes later in getting to that DM, I would have seen three more identical messages from other infected friends and twigged to the scam. But I just happened to look at my phone in the two-minute window when the scam wasn't self-evident, and I just happened to be distracted and flustered about running late, and I just happened to have had some life circumstances that made the generic phishing lure seem plausible.

In 2023, I got scammed by a fake restaurant. I was on the couch with a friend from out of town who'd come by to watch a movie. We were chatting and decided to order from our local Thai restaurant. The top result on Google was a paid ad (marked out with the word "ad" in 8-point, grey-on-white type) that had a plausible domain name, which led to a replica of my local place's menu, only with the prices set 15% higher. I didn't even notice – not until the restaurant called me to say that they'd had a flood of orders from these scammers, who charged their customers' credit cards 15% over the odds, then placed an order for delivery using their own credit card numbers. I ended up contesting the charge with Amex, getting the scammers' Wix and credit card accounts canceled, and shaming Google into blocking their ads:

https://nypost.com/2023/02/25/cory-doctorow-duped-by-fake-thai-restaurant-scam/

Then there's the guy who used leaked data from my credit union to impersonate their fraud department, calling me up and social-engineering me out of the last seven digits of my card number (not the last four, as is common – most banks use the same nine-digit prefix, so the final seven digits are all you need to derive the whole card number). The scammer called right after I used two dodgy ATMs in New Orleans, during my last hour in town when I was rushing around to get my most favorite sandwich in the world before leaving. It was the day that a Boeing 737 Max lost its door-plug so the airport was a zoo and we barely made the flight, so I lost the hour I'd planned to use to call the bank's fraud department back. Again: if, if, if. If he'd called an hour earlier – or later. If there hadn't been a giant aviation disaster. If I hadn't been traveling. The scammer had to get lucky once, I had to be lucky every time:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I got scammed again last Christmas week. I was in NYC with my wife and daughter and I'd gotten great tickets to see The Outsiders on Broadway. It was my kid's first musical and to her surprise, she loved it. In the cab back to the friend's place we were staying at, we talked about what other musicals she might want to see. She loves South Park, and I'd seen banners advertising The Book of Mormon (which was created by the same people) in LA. So I looked up "book of mormon tickets los angeles" on my phone in the cab and found the production's website and ordered the tickets, working quickly in the cab because it was one of those websites that has a countdown timer so you have to finish your transaction in five minutes.

It wasn't the real Book of Mormon website. It was a scam website, reselling Book of Mormon tickets at a 200%+ markup. That fact was noted in infinitesimal writing on the main screen, which I missed in the crowded taxi backseat while I raced the countdown timer. I figured it out about 20 seconds after the transaction cleared, and immediately emailed the vendor to cancel it. All I got was a series of smug "all transactions final" emails from outsource customer service reps (in the end, I was able to get my credit card issuer to reverse the transaction, but it took months). But yeah, I got scammed by a sleazy company called "Bigstub." Fuck those guys.

Every time I got scammed, the con that got me was nearly identical to a con that I'd avoided on numerous occasions. The fact that I'm actually pretty good at spotting this kind of hustle, 99.9% of the time, didn't mean I was immune it it. It just meant that I was vulnerable under very special circumstances, and those very special circumstances do crop up from time to time.

This is the most important lesson of scams: that no matter how well-attuned you are to cons, you can still be conned. The belief that you are immune to a con actually makes you a mark. It's for that reason that I recount the tales of how I got scammed – to help other people understand that being sophisticated, alert and even paranoid is no guarantee that you will be safe.

I'm not the only person for whom a detailed knowledge of scams created immunity from being scammed. Troy Hunt is the proprietor of HaveIBeenPwned.com, the internet's most comprehensive and reliable breach notification site. Hunt pretty much invented the practice of tracking breaches, and he is steeped – saturated – in up-to-the-minute, nitty-gritty details of how internet scams work.

Guess who got phished?

https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/

Hunt had just gotten off a long-haul flight. He was jetlagged. He got a well-constructed, plausible counterfeit email from Mailchimp telling him that his mailing-list – which he absolutely relies upon – had been frozen after a spam complaint, and advising him to click on a link to contest the suspension. He was taken to a fake login screen that his password manager didn't autopopulate, so he manually pasted the password in (Mailchimp doesn't have 2FA). It was only when the login session hung that he realized he'd been scammed – and by then, it was too late. Within minutes, his mailing list had been exported by the scammers.

In his postmortem of the scam, Hunt identifies the overlapping factors that made him vulnerable. He was jetlagged. The mailing list was important. Bogus spam complaints are common. Big corporate sites like Mailchimp often redirect their logins through different domains, which causes password manager autofill to fail. Hunt had experienced near-identical phishing attempts before and spotted them, but this one just happened to land at the very moment that he was vulnerable. Plus – as with my credit union scam – it seems likely that Mailchimp itself had been breached (or has an insider threat), which allowed the scammers to pad out the scam with plausible details that made it seem legit.

Hunt's forensics on the scam are very interesting. Of especial note is the fact that Mailchimp had retained the email addresses of thousands of former subscribers who had already unsubscribed, meaning that their data was exposed as well. It's not clear why Mailchimp would do this, but I will note that the company is extraordinarily spammer-friendly and goes to great lengths to make it easy for spammers to add you to their lists, and impossible to get off of all those lists;

https://pluralistic.net/2024/07/22/degoogled/#kafka-as-a-service

Getting scammed doesn't mean you were stupid, or careless. Frequently, it just means you were distracted, upset, or distraught. We're living through a moment of total, all-consuming chaos, and the scammers are sharpening their blades – not least because the people running the show are unabashed grifters who openly boast that when they get one over on you, "that makes me smart":

https://pluralistic.net/2024/12/04/its-not-a-lie/#its-a-premature-truth

Buyer beware – it's ugly out there, and it's gonna get a lot worse before it gets better.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2025/04/05/troy-hunt/#teach-a-man-to-phish

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecomms.org/licenses/by/3.0/deed.en

[the-messhall]

Mac & Cheese Ramen —

[tiny-planet-13]

risking wasting my data to come on here just to say I FINISHED THE SUNSHINE COURT WHAT THE FUCK WHAT THE FUCK WHAT THE FUCK!??????? (I'm really normal about this and I read it in one sitting because I literally couldn't put it down and I'm crying over jean and so mystified by Jeremy and I love all the characters and I'm desperate for the next one holy shit)

[zlataisawsome]

Suuuuper old but this is like my 2nd RCH fanart piece I ever did in honor of Carrot and Robin’s anniversary

[foodcreation101]

Scallion Ramen 🍜

[burningcheese-merchant]

The fankid designs look sooooo good and adoooorable! They are very pretty!

Say. Does Burning Spice train his kids to fight and be the strongest? Does Pepper Jack or Matar Paneer enjoy fighting as much as their dad? How does Golden Cheese deal with this kind of sheganigans? Do the parents favor a kid more over the other?

I'm very excited for them sorry for all the questions in one ask.

No, don't apologize, ask away! Ask a thousand questions if you want, I probably have an answer for them all because I genuinely did go way too hard crafting these little critters lol (and thank you so much for the compliment, level 0 artist here but I tried)

Spice absolutely trains them to fight lol. Him and Golden both make an effort to build them up as capable warriors. Everyone does, tbh: they train with the Golden Cheese Kingdom's army, they train with the Wild Spices, they train with the other Ancients and Beasts (although they're not Beasts anymore at this point, they all reformed alongside Spice in my canon here). Pepper Jack starts training a little extra with those who also use polearms like he does, while Matar Paneer trains more with melee fighters (the specific katar she uses were a gift from Cilantro Cobra, who is also responsible for training her to use them). But they're encouraged to learn a bit of everything alongside their respective specialties. The best warrior is a well-rounded one.

They train for real, but they also spar just because. It's one of the ways Spice likes to try to bond with them lol (he never loses his love of battle, even as a better man). Pepper Jack spars more to blow off steam/seek some form of catharsis than to have fun (not that he doesn't have fun most of the time), while Matar Paneer is all in on the fun lol. She's got the same destructive tendencies Spice has and sometimes she needs that outlet to unleash them, and Spice is happy to help (he's so proud, honestly). Golden is ok with this, she likes to spar with her husband and their children, too... but they MUST do it either in the colosseum or outside the kingdom. She will not tolerate any damage to anything. (Paneer has gotten in trouble multiple times for damaging or destroying things lol. She doesn't MEAN to, it's never done out of malice, she just... she's kind of reckless and gets caught up in the excitement, that's all)

I wouldn't say either Spice or Golden favor one kid over the other. They love them both very, very much, and equally. It's more like... they relate to/understand one a bit more than they do the other. Paneer is basically a Mini Burning Spice, so Spice naturally relates to her better. Same deal with Jack and Golden tbh. (Jack is kind of a mama's boy and Paneer is a daddy's girl lol. It's the opposite thing here, it's the kids that seem to favor one parent lol).

Not to say that they don't get along with the other kid, they do. Paneer adores her mother and vice versa. They like to have girl time and girls' days out together (with Auntie Mozzarella, too). But they can really clash/butt heads sometimes; Golden kind of has an issue with wanting to impose her wants/will on her (not maliciously, it's just the way that she is, she doesn't even really notice half the time), and Paneer is crazy stubborn and can be extremely difficult and resistant to authority, or anything that opposes her own will/wants in general. That sort of conflict that you see with mothers and their daughters. They both think they know best and they bicker a lot. It's Golden's greed VS Paneer's greed, and boy is that a tough battle lol. But they still love each other without a doubt.

It's a little tougher with Spice and Jack. They're quite different from each other, in both looks and personality, so being at odds in some way isn't that uncommon. There's an insecurity on Jack's part that Spice doesn't like him, that he's disappointed in him, and that he's not good enough to be his son (which is NOT TRUE in any way, Spice loves his son to death and both of his children are his pride and joy). There will also come a time where they come into HUGE conflict over Spice's past (nobody ever hid the truth from the kids, they told them that their father used to be a bad person who did bad things and hurt people... but they never told them the WHOLE truth, they just left it at "he was a bad guy once" because they wanted to wait until they were older to give them the full explanation. This turned out to be a huge mistake, because Jack found out the whole story on his own and in a very unfortunate way, and his relationship with Spice takes a massive nosedive for a while because of it), so that won't really help anything... The main issue between them overall is communication, really. They often don't know what to say to each other or how. Not for lack of interest, they both want to get along and understand one another, it's just... not always knowing how to go about it. They BOTH often end up going to Golden for advice about how to approach each other, because... you know. When in doubt, defer to wife/mom lol

[canon-gabriel-quotes]

I randomly get inspired to write weird stuff with Gabriel that I'm usually not even into and a lot of the time I get comments that amount to I'm not into this. Am I? or being surprised they were into it. Gabriel is just randomly inflicting this sort of thing on everyone I suppose

Gabriel Ultrakill has been reclassified as a gateway drug. Please keep an eye out for any suspicious activity.

[artscheese]

Okay I gotta close the ask box for now sorry!! 😭 I wasn’t expecting by how much people are in my ask box and most are curious about their pregnancy LMAO

Uh anyways I’ll ask the ones that I’m interested in uh don’t expect me to answer all of them ;w;

[superjail-opinions]

Pt. 2) (I'm so sorry if this is counted as spam, I'd send them all together if it didn't max out at 10 photos 😭...)

here's part one!

here's part three!

[mildmayfoxe]

i made a pretty good breakfast burrito but wasn’t as blown away with it as i expected and then realized i was so focused on getting my timing right while simultaneously steaming my tortilla & scrambling my eggs that i forgot to put salt in it 😑 rookie mistake. i should be killed for this

[morethansalad]

Vegan Luncheon Meat Rice Roll

[sumbluespruce]

Skillet supper

4/13/25

[zlataisawsome]

ANYWAYS chuck e cheesers come get yo GRUB (rings dinner bell)

[c-kiddo]

since the ui update xkit blacklist no longer works on usernames fuck my lifeeeeee i love banishing people forever noooooooo

[verytiredhyena]

I wish Weird Al would parody the national anthem