12.18 — "Villains but not Monsters", DEF CON, “live as a white hat or die as a black hat”, and Ocarina’s ideology#
Ocarina is neither an aesthetic whim nor an out-of-the-blue UFO. It’s the technical expression of a coherent ideology inherited from the hacker movement: the Villain, but not a monster ethic, the tribal culture of the conferences (DEF CON foremost), and YTCracker’s stage motto: “live as a white hat, or die as a black hat”.
1. “Villains”#
Why this word#
The word villain (English; vilain in French) is neither an insult nor a compliment stricto sensu. It’s a reclaimed identity:
| Institutional reading | Hacker reading |
|---|---|
| Villain = outlaw character in the story | Villain = one who refuses the role assigned to him |
| Villain = bad guy | Villain = one who acts while others wait for an authorization that never arrives |
| Villain = to be neutralized | Villain = one who produces real change the system doesn’t |
| Villain = bad example | Villain = intelligence-agency model |
The classic stigma flip: take the insult and turn it into a name worn with pride — same mechanic as queer reclaimed by the LGBT community, punk reclaimed by the 1976-78 scene, ghetto reclaimed by 1990s hip-hop.
Why this identification#
- Hackers were penalized by default as soon as they acted technically.
- Institutions refused to acknowledge the value of their warnings, so acting outside institutions became necessary.
- The identity “passive good citizen” is on offer for normies. For hackers, that’s an unacceptable behavior.
- The identity “villain” is honest: you are what the system identifies as threat, and you accept that label.
2. “Villains but not Monsters”#
The ethic#
There’s a morally non-negotiable boundary:
| Villain | Monster |
|---|---|
| Breaks a system to reveal it | Breaks a system to destroy a person |
| Steals data to expose wrongdoing | Steals data to profit at victims’ expense |
| Hacks a powerful corporation | Harasses a vulnerable individual |
| Confronts a powerful actor | Persecutes a weak one |
| Targets an abuse of power | Enjoys an abuse of vulnerability |
| Takes personal risks | Makes others carry the risk |
| Codes out of ethics | Codes out of cynicism |
This distinction structures the scene. True enthusiasts hate monsters, even more than normies do.
Why harassers are hated by real hackers#
- They themselves were harassed. The 1985-2005 hacker cohort was massively victim of school harassment. Reproducing harassment on someone else, especially vulnerable, is the behavior they swore to fight.
- Harassers damage the whole scene. When a swatting causes a death, the whole scene gets blowback.
- Villain ethics include honor. The villain picks his targets with rigor. The monster doesn’t make this distinction. He acts for the pleasure of harm, by pathological sadism.
How far the scene detects monsters#
Hackers developed a whole range of tools and reflexes to spot infiltrated monsters:
| Tool / reflex | Application |
|---|---|
| Honeypots | Fake servers / fake accounts / fake data leaks that bait opportunists. If someone bites and uses it, that’s a signal. |
| Social engineering | Testing newcomers. |
| Deepfakes | Today, using generated artifacts to trap fraudsters (deepfake of oneself to see who tries to use it). |
| Malwares | Markers planted in shared tools to trace who passes them to whom. |
| Phishing | Build a fake phishing to trap aspiring scammers. |
| Snitches / Feds detection | Compulsive reading. |
Extreme tribal loyalty#
The real-hacker scene is fiercely loyal to its verified members and fiercely distrustful of every newcomer.
| Trait | Manifestation |
|---|---|
| Long admission tests | A new member can stay lurking for 2-3 years. |
| Vouching system | To be introduced to a circle, you need a vouch (endorsement) from an established member. |
| Absolute loyalty | Once admitted, you cover your brothers. |
| Brutal excommunication | A betrayal earns a permanent ban. |
| Tribalism | My crew above all. |
It’s exactly the mechanic of post-traumatic communities: scene veterans operate with an emotional intensity reminiscent of military veterans’. Strong internal cohesion + extreme external suspicion.
3. The tooling culture#
The tool as fundamental product#
| Tool | Made by | Distribution |
|---|---|---|
| Nmap (Fyodor, 1997) | 1 person (Gordon Lyon) | Free, GPL, clear docs, rigorous man pages |
| Metasploit (HD Moore, 2003) | Small team, Rapid7 acquisition but OSS core | Free |
| Wireshark (Gerald Combs, 1997-98) | Small team, then large community | Free, GPL |
| John the Ripper (Alexander Peslyak, 1996) | 1 person | Free |
| Hashcat (Jens Steube, 2009) | 1 person, then small team (Gristina) | Free, MIT (open source since 2015) |
| sqlmap (Daniele Bellucci, 2006) | Small team | Free |
| Burp Suite (Dafydd Stuttard, 2003) | Stuttard’s personal tool, then PortSwigger | Free + paid pro version |
| Aircrack (Christophe Devine, 2004) | 1 person | Free, GPL |
| Aircrack-ng (T. D’Otreppe, fork 2006) | Fork of Aircrack, small team | Free, GPL |
| theHarvester, recon-ng, Maltego CE | Small teams | Free or freemium |
| OllyDbg, IDA Free, Ghidra (NSA, 2019) | Various | Free / open source |
| … | … | … |
- Small team or single author at the start.
- OSS or freemium.
- Detailed technical documentation.
- Reputation built on quality, not promotion.
- Peer-to-peer distribution (conferences, forums, GitHub, IRC).
What’s called the tooling culture is the conviction that good technical tools make good hackers, and that a good, well-written tool is worth a thousand PowerPoint presentations.
Why this is central for Ocarina#
Ocarina is a tool in that sense:
- Single author.
- MIT, technical documentation.
- GitHub distribution + free Holy Book.
- Reputation to be built on quality, not promotion (no marketing site, no landing page with CTA).
- Not a product, not an offer.
That’s the metaphysical distinction Ocarina carries. All modern e2e frameworks (Cypress, Playwright, Robot Framework) are sold as products. Ocarina is given. The morality is different.
4. DEF CON — the annual shrine#
Description#
| Field | Value |
|---|---|
| Name | DEF CON |
| Founder | Jeff Moss (alias The Dark Tangent) |
| First edition | 1993, Las Vegas |
| Festival name | DEF CON 1, DEF CON 2, … DEF CON 32 (August 2024), DEF CON 33 (August 2025) |
| Current venue | Las Vegas Convention Center (LVCC), summer |
| Volume | ~30,000 attendees (DEF CON 32) |
| Entry fee | Cash only at the door, ~$460 (DEF CON 32) — no online ticketing, anti-tracking |
| Anonymity | No name badge. The badge is an electronic object with hardware puzzle (#badgelife) |
| Tracks | Talks, villages (Car Hacking, ICS, Bio Hacking, Lockpicking, AI, etc.), CTF, wargames, parties |
DEF CON is the annual global meet of the hacker scene. It’s:
- A scientific production venue: many 0day presentations happen there (sometimes after responsible disclosure delay, sometimes not).
- An interpersonal identification venue: it’s where you put a face on pseudos.
- A rite of passage venue: a first DEF CON is an initiatory rite for many.
- A balance venue between corporate white hat and underground black hat: each rubs shoulders with the other openly.
- A tribal validation venue: elders recognize elders.
DEF CON codes#
- No photos of others without explicit permission: doxing prevention is cultural.
- No shop talk in monitored open spaces.
- Cash only: no banking trail.
- Anti-Feds chant: historic, partly humorous, partly serious. Spot the Fed is an unofficial game where attendees try to identify undercover federal agents.
- CTF (Capture The Flag): hacking competitions.
- Badgelife: each edition produces an electronic badge with hardware puzzle, hackers turn it into a collectible and modding object.
YTCracker at DEF CON#
YTCracker has been performing regularly at DEF CON since at least 2011. His sets are iconic moments.
5. “Live as a white hat, or die as a black hat”#
- White hat: ethical hacker, working with institutions (bug bounty, authorized pentests, responsible disclosure, defensive security).
- Black hat: offensive hacker without an ethical framework, who exploits for profit, vengeance, or lulz, without consideration for victims.
- Grey hat: intermediate zone, acting outside legal bounds for ethically defensible ends.
At some point in a hacker’s trajectory, you have to choose — persisting as black hat statistically ends in prison, dead, or broken.
Biographical meaning#
YTCracker lived it:
- 1999: NASA hack (black hat, around 17).
- 2005-2017: Digital Gangster (grey zone).
- 2015+: corporate cybersec consulting, DEF CON conferences, Darknet Diaries, Shawn Ryan Show (white hat).
His own trajectory embodies this motto. He survived because he made the turn in time. Others in the same cohort didn’t and are dead or imprisoned.
6. Why all this is an ideology, not a whim#
Definition of ideology#
An ideology is a coherent system:
- of axioms (about humans, power, technique, value),
- of values (what to defend, what to fight),
- of practices (how to act daily),
- of institutions (the structures one builds or refuses),
- of narratives (founding myths, heroes, enemies).
Values#
| Defends | Fights |
|---|---|
| Small auditor-friendly repos | Opaque megamachines |
| MIT + gift | Vendor lock-in |
| ISTQB / business vocabulary | Jargon, bullshit |
| Sovereign author | Design committees |
| Underground community | Corporate influencer |
| Veterans | Slipologues |
Practices in Ocarina#
| Practice | Justification |
|---|---|
| No SaaS | Auditability + survival |
| 1 single dep | Surface reduction |
| mypy –strict | Static analysis, mathematical proofs |
| ROP everywhere | No silent exceptions |
| AI-first documentation | Future preparation |
| Refusal of personal branding | Stay underground |
Founding narratives#
- Church’s λ-calculus (technical myth).
- ML / Haskell / F# (lineage).
- Wlaschin / ROP (contemporary formalization).
- LulzSec / YTCracker / Yung Innanet (underground scene).
- Antoine de Saint-Exupéry / Lao-Tzu (wisdom).
- DHH / Paul Graham (pamphlet models).
- Terry Davis (genius with a tragic end, largely due to cyber-harassment).
Heroes and enemies#
| Heroes | Enemies |
|---|---|
| Technical veterans | Narcissistic slipologues |
| Sovereign founders (DHH) | Careerist VCs |
| FP academics (Wadler, Milner) | Industry with its mental models |
| Underground community | Extractive SaaS platforms |
Conclusions#
It’s a complete system. Not an aesthetic whim, not diffuse paranoia, not a UFO.
The UFO appearance comes from the fact that the combination strict typing + ISTQB vocabulary + pamphlet aesthetic + SaaS refusal + AI-first + LulzSec quotes exists nowhere else. It’s unique because it derives from a deep identity, a specific trajectory.
The ideology behind Ocarina is the sum of this heritage.
7. Related reading#
16-underground-internet-2000s.md— why monsters exist and why the scene hates them.17-survivor-psyche-programming.md— the survivor’s psyche as Ocarina’s engine.13-lambda-calculus-rop-origins.md— the formal FP-academic lineage.03-ytcracker-nerdcore-digital-gangster.md— YTCracker, source of the white hat / black hat motto.
Chapter 12 is now complete: it documents a rigorous, sourced, traced ideology. It’s neither paranoia nor a UFO. It’s the operational synthesis of half a century of technical and cultural history, delivered as a Python framework under MIT.