Are you serious or was that just a clever joke?

He's serious. These people actually sell computing services powered by their network of cracked computers. They'll even manage their fleet by patchinf the vulnerabilities they exploited. Network proxies, redundant distributed storage... Compromised machines could be turned into storage for CSAM, proxies for scrapers or spammers, whatever people want.

> turned into storage for CSAM

FFS.

I never want to know anything about CSAM and related. But it seems none of us can escape it.

I fear that if I ever make one of my hobby projects public, I'll be forced to learn all the security stuff.

Alas, I suck at security stuff. I left networking and admin for building CRUD apps, so many years ago, because I have no aptitude or interest. (Whereas I love solving customer use cases.)

What are noobs like me supposed to do?

To me it seems ISP CGNAT is the only thing keeping people relatively safe on the internet.

> What are noobs like me supposed to do?

I'm not about to claim I'm some kind of expert on security but...

Don't let your computers talk to strangers. Your computers should only be talking or listening to you really and maybe other people who you trust and have authorized. If someone is not in that group, they should not even send back an error page, they should not even answer pings.

So set up single packet authorization so that your machines literally drop all network packets unless you send a cryptographically signed packet first. To these bots, it will be like the servers are not even there.

Or better, only use a VPN to connect to your home network. Ideally one like Wireguard that doesn't respond to unauthenticated requests, so from a hacker's perspective is impossible to discern whether it even exists or not.

About five years ago I know they are used for social media boosting like followers and likes. Maybe they are still doing that kind of service.

Totally serious. Botnets for hire are rented by spammers, DDoS extortionists and other scum, for much the same reason legitimate enterprises outsource to specialists so they can focus on their core competencies. Not sure how payment is brokered but I'm sure cryptocurrencies are involved.