L0pht Heavy Industries

» see l0pht.com as it lived, on the wayback machine

~ the obituary ~

It started as storage. Two people who went by Brian Oblivion and Count Zero were renting loft space on Waltham Street in Boston's South End around 1992 to keep hardware their partners would not have in the apartment, and the room accumulated people. By the late nineties there were ten of them, all working under handles, with day jobs, running a research operation out of a room full of salvaged equipment.

The work was vulnerability research at a time when the phrase barely existed as a job. They published advisories on commercial software, sometimes after telling the vendor and sometimes after the vendor ignored them, and their stated position was that a bug nobody knows about is not the same as a bug that is not there. L0phtCrack, a password cracker for Windows NT, was the group's most famous output and its business model at the same time: the command line version was free, the graphical one cost money, and the money paid for the room.

On 19 may 1998 all seven active members sat in front of the Senate Committee on Governmental Affairs and testified under their handles, which the committee allowed. They said that they could make the internet unusable for the entire country inside thirty minutes. The claim was about BGP, and it was not really disputed by anyone qualified to dispute it. What made the hearing matter was less the thirty minutes than the sight of a legislature asking anonymous hackers to explain the infrastructure, because nobody official could.

In may 1998 I was fourteen, in Turkey, a few months into having a modem at home. The English-language security scene existed somewhere on the other side of a 33.6k connection and a monthly phone bill, and it was not a place a teenager on dial-up was going to turn up in. I read about the testimony years after it happened, which is the normal way to encounter it if you were not American and not already in that world.

~ the case file ~

~ the day it died ~

In january 2000 L0pht merged into @stake, a venture-funded security consultancy, and the loft became a company with a payroll and clients who paid for assessments. Everyone involved has described this as the sensible move, and it was. It was also the end of the thing itself, because a collective whose entire method was publishing what vendors did not want published cannot keep doing that once vendors are the customers.

@stake lasted four and a half years on its own. Symantec announced the acquisition on 16 september 2004 and closed it on 8 october. The name disappeared into a company that sold antivirus subscriptions to consumers, which is about as far from a loft on Waltham Street as the industry could get in six years.

~ what came after ~

The people scattered into the field they had helped invent. Chris Wysopal went on to co-found Veracode. Peiter Zatko ended up running research at DARPA and then doing security at some of the largest technology companies in the country, which is a strange career arc for someone who testified as Mudge. L0phtCrack itself changed owners several times with the companies around it and was still being sold two decades after it was written.

The idea that outlived them is full disclosure, which was a contested position in 1998 and is now the default assumption of the entire industry. Disclosure timelines and bug bounty programs exist because it stopped being possible to pretend that quiet bugs were absent bugs. That argument was won in public by people who would not give a committee their legal names.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »