I would guess some are just jealous of his age, but some do find the claim of de anonymizing to simply be overblown given it doesn't tell you nearly enough to find anyone except in very niche cases. This "attack" is easily defeated with a VPN or living in any major city.
You don't need to live in a major city. Cloudflare is never going to set up a caching proxy for a hamlet in the desert; you'll always be part of a huge group that a given caching proxy serves. The attacker can be happy if they can narrow the recipient's location down as much as to a single country
Posters are missing the point by projecting themselves into the scenario. Yes, it probably isn't a concern for someone living in the US or the EU. The calculus is different if you live in a smaller country, a politically sensitive area or are involved in activism against an authoritarian state.
Even for individuals in those large, developed suprastates, it opens the door for catfishing and other social engineering approaches.
Interesting you touched on his age. I got extremely curious, why did the OP did such a flex?(assumming they are telling the truth). The first sentence is such a weird brag that it felt suspicious. The report is highly technical and extremely well written. We're either dealing with a pure genious or a fraud. But why would a genious flex? Doesn't make sense.
I don't know what you think is genius about any of this, but you're right, the flex is odd. It's something I've been seeing more and more of lately, and I find it off-putting, because, Back In My Day, I never had such a phase, where I felt like I should be given more credit for my 1337 h4xx0r skillz, because I was in high school or whatever—and I don't remember anyone else doing it, either.
I can only assume this is a consequence of modern social media having shifted the Internet from being a bunch of pseudonymous people making and sharing stuff, to everything being myopically focused on one's identity first, and what they do second (as is literally the case here).
And it looks like it works to achieve its desired effect, too—a significant portion of the comments here are congratulating the guy for doing such a thorough technical write-up, given his age. Maybe this is just me being a grumpy “old” man now, but I would've found that condescending when I was his age, and would've rather concealed my age than be condescended to as such. But, to each his own, I suppose.
I find genius being 15 and being in a state to find this issue and write this report. For my understanding there is a ton of context and knowledge packed in this write-up which i can't possibly imagine myself being able to grasp it at the age of 15. That is not to say it's not possible, but it goes to say it is very hard, that's why i characterise it as genius
I can believe a very talented 15yo pulling this off. But the number of anonymous "I'm 15 and this is my impressive feat" posts on HN made me wonder if it's just a joke.
The flex is probably because they are 15 and a bit immature.
An anecdote - I used to be the lead for an infotainment security program for a well known manufacturer. They would send me to a lot of small security meetups and training. One in specific was a security training event for some HS students, which I would define as gifted. There were roughly 40 of them, from 14 to 17 years old, and they were all extremely impressive in things ranging from reverse engineering applications to assembly code all the way Linux systems stuff.
Something like this would have been easy for them - I mean the basics of this is that the attacker sends a message to a discord/signal user and then sends a request to a Cloudfare server. Not exactly splitting atoms IMO. What I think is special about this 15 year old in question is the epiphany that it might be possible and then giving it a go. This is the true hacker spirit.
Someone on GitHub called him out for making a Twitter account in 2017, since he'd have to be 8 years old at the time... I don't see what's so unbelievable about an 8yo making a Twitter account.
It's common in our community to be jealous of youth, especially youth with genius, but I believe the github user in TFA is lying. Something about it is off. It also happens in posts here on HN, though.
I think after being exposed to so much internet, you realize how many are simply living a fantasy. In me it provokes a sense of disgust, I see it as part of a broader groomer problem on the internet, but this is a distantly minority take.
