9 ms·

Stockfighter's Jailbreak CTF trainer is live

155 points by alt_ 10y ago

nsfmc 10y ago
I know this is a low-quality comment, but i just want to congratulate the whole stockfighter team for getting the jailbreak ctf out. it looks like it was a ton of work and looks fantastic. as somebody who was excited about it after trying my hand at microcorruption, i'm super excited to see this finally. hats off!
- tptacek 10y ago
  Thank you! This is just an early demo version. It's going to get pretty bananas in a few weeks. Noisy testers are very welcome; we're going to start spoiling the "full CTF" levels next week for beta testers.
- nsfmc 10y ago
  one comment on the trainer: when you click on the Jailbreak link, it just drops you into the debugger, if you, like me got lost, run the `tour` and then click on the little person+ head and go to the documentation and go through the quickstart. yay!
yagyu 10y ago
wow, I just found microcorruption, now it looks like there's man-months of fun ahead. Technical comment: "forgot password"-link is not wired to anything? Not working for me on FF at least.
- awesomebob 10y ago
  The forgot password link doesn't work for me in Chrome either, but I found this URL and it seems to work: https://www.stockfighter.io/ui/forgot_password https://www.stockfighter.io/ui/forgot_password
  - patio11 10y ago
    Fixed. (And yep, that is the correct URL.)
citizens 10y ago
"Starfighter is a new, weird kind of recruiting company. We detect and market underpriced programming talent. We do that by creating opportunities for programmers to casually and effectively demonstrate aptitude." Having a hard time parsing this. Do you find underpriced talent and help them get paid more?
- aphextron 10y ago
  Sounds like a brilliant business model, honestly. The world is brimming with brilliant programmers who are, for one reason or another, not able to reach their full potential due to outside constraints (third world countries, lack of tech investment, etc)
- kbenson 10y ago
  Presumably, if they are able to entice those people away from their current employment, they are offering something better, whether it be more money, more fulfilling (which can be for many reasons, such as being more challenging), or allows a better lifestyle. If nothing else, if gives those undervalued employees that have been identified a metric by which they, and their current employers, can judge their worth on the market.
- tptacek 10y ago
  Yes, that's the thesis. I mean, we're happy to represent anyone capable! But we're particularly interested in the people with no resumes.
- pchristensen 10y ago
  Susie works making crud apps for a boring insurance company. She is a brilliant programmer but due to where she lives, personal situations, she hasn't faced a challenge that lets her know the extent of her abilities, etc, she is working below her potential. Susie creates a novel solution to one of Stockfighter's games. Stockfighter uses that solution as evidence to present her to companpanies as a great engineer. She gets job offers for more money, challenge, and satisfaction than she currently has.
  - 10y ago
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
j4pe 10y ago
I rarely want to like a product more than I want to like Stockfighter, because of both the people involved and the underlying concept. But there are a million other things I want to sink time into improving. Music, my Starcraft MMR, boxing. To finish a day hacking and coding, come home, and - for months, if I want good results - do more hacking and coding feels like an exhausting prospect. Even if the scenario is fun, it feels contrived. I'm not presenting any solutions. Maybe I'm just not the target market, because I don't have the desire right now to code all day and then code some more. But I wonder how big that target market is?
- doktrin 10y ago
  > because I don't have the desire right now to code all day and then code some more Tell me about it. Speaking only for myself, I have near-constant coder's guilt - a term I just made up to describe the nagging voice in my head that keeps telling me I should be coding more in my free time. It sounds something like this : "somewhere a rockstar wizard ninja is writing a C compiler in Haskell and here you are wasting your time with Overwatch, you miserable slacker"
  - mod 10y ago
    Mine is even a little more annoying than yours. It doesn't like me doing productive things. "somewhere a rockstar wizard ninja is building a passive-income side project and here you are wasting your time tending a garden and working in your woodshop, you miserable idiot with stupid priorities."
    - toomuchtodo 10y ago
      > tending a garden and working in your woodshop After doing tech for 15 years, that sounds glorious.
      - maxerickson 10y ago
        Have you ever weeded a garden for a summer? It's quite a chore.
archimag0 10y ago
Is the server struggling again? None of my input into the UI seems to be having an effect.
- Retr0spectrum 10y ago
  Yeah, I'm getting some rather high latency on my inputs.
- tptacek 10y ago
  I'm getting crazy high latency just through the login page. Looking into it. The emulator servers (a pair of m3.mediums) are barely breaking a sweat.
  - vox_mollis 10y ago
    Is the tour supposed to end abruptly at "this is r1" ?
    - tptacek 10y ago
      It is not! You are the third person to tell me that's happened. Looking into it.
gue5t 10y ago
The user interface is appalling. Whoever designed this has managed to produce worse ergonomics than a single 1970s-style terminal, for essentially a similar set of tasks (editing text+binary files and piping data through commands). I see some discussion of "files", but seem unable to list them or explore the filesystem. I don't know if this in-game filesystem is supposed to be on the "AVR" device or an imaginary "developer machine". Where do the outputs of running commands like "compile" go? Why can't I inspect the compiler? What actually comprises the state of the system I'm interacting with? If this is notionally to find good developers, why is the UI sandboxed inside a web browser, where building and using tools (which is what good developers and reverse engineers do) is incredibly painful? Half the commands produce no output and make no visible change to any state, e.g. "load garbage". Almost all commands silently ignore extra parameters. There's no tab completion, no history search, commands don't even show up in the output log... Links and commands seem to randomly be assigned to either always open in new tabs or load in the current tab of the browser, both in the "debugger" and help pages. Moving through command history puts the cursor at the left hand side of the prompt. There's noticeable latency when single-stepping the program, which is just astounding. Did nobody try to use this shit, even a little?
- archimag0 10y ago
  - Can't have the compiler side by side with the debugger, even though there's plenty of room on the screen - When the PC jumps, the highlighted instruction doesn't follow, leaving you lost when stepping through a program - Can't hit enter on a blank line to repeat previous command - No 'finish' debugger command? - Seem to end up in random functions when stepping over simple instructions - Am I supposed to type 'flash' or 'run' to execute my compiled program? Sometimes the one I just compiled gets executed, sometimes the one I compiled previously - how can we view what's being executed? I really enjoyed microcorruption, and thought that UI was fine, but this feels like a step backwards.
  - tptacek 10y ago
    Enter on blank lines: easy enough, will do. Putting the compiler in the debugger was how it used to work. Everyone hated it. Also: it's using Ace, which really grinds Chrome. I can easily add a pure textarea tab that will let you edit code, if you _really_ want it. To run a C program, do one of two things: * Compile it in the source editor, which will generate a blob of compiler output (which is deliberately not documented) that the browser will cache. * Use the "flash" command to write it to SPI flash. * Use the "vmload" command to send a SPI message to the AVR to reload the program from the SPI flash. * Use the "vmexec" command to send a SPI message to the AVR to execute the program. OR * Compile it in the source editor * Type "run", which does all the rest of those things. I like Microcorruption's UI, too. I gave this one more to do. I agree: it's not there yet! Working on it. How elaborate do you want the web-based debugger built on this API to be? :) (I'm serious: thanks for the feedback. This section of the thread is the stuff I was hoping to get).
s3nnyy 10y ago
Dev hiring is a sourcing problem, not a filtering problem. The people behind starfighter are brilliant and I respect them big time. So, probably they know what they're doin. I am excited to see how they want to solve dev hiring since starfighter looks more like a product that does filtering, not sourcing. (I am thinking since a long time to build something that leverages Github to find and reach out to engineers; e.g., when a company looks for Angular people to just parse the Angular repo for engineers that watch / contribute to the repository and reach out to them. if you have any ideas on this or want to help, please shoot me a message).
- aphextron 10y ago
  Please don't unleash another method of spamming developers on the internet. We already get 10 linkedin requests a day for the hottest coolest new idea.
- lj3 10y ago
  It's both. They're focusing on the sourcing part, which is commendable, but I'd still like companies to engage a better filter. The one most have now is the equivalent to trying to hammer square pegs into round holes with bit of wood they happened to find. Unfortunately, changing that appears to be a very tricky social problem. It's going to take a recruiter (or recruiting company) with such a great reputation and track record that companies trust that recruiter's judgement in personnel implicitly. But how?
tptacek 10y ago
You all have great timing. It's very likely that something will melt down soon, but I'm not going to notice, because I'll be in a chair getting my arm inked up. It's going to be a nine-fives kind of day! Mean feedback about the UI, especially if accompanied by an even meaner summary of what you'd rather the UI does instead, is most welcome. Later (Erin's Calcifer tattoo is taking longer than expected, so if you want to wait like another 15 minutes before doing whatever unforeseen sequence of things in the UI that will hard-panic all the servers, your timing will be perfect).
- nathas 10y ago
  I was actually going to say I like the UI quite a bit at first glance. I haven't bit in yet, but overall I really dug the layout.
  - tptacek 10y ago
    There are things I want to do with this UI that we couldn't do in Microcorruption --- ways to make assembly a little more accessible to programmers who aren't already from security or game development, where the people who crushed Microcorruption came from --- because the assembly was a flat marked-up blob of text. But there are definitely ways in which it's a step back.
  - deleted 10y ago
    [deleted]
- weaksauce 10y ago
  Can you make enter repeat the last command? s<enter> is kinda annoying. iirc microcorruption let you repeat the last command. edit: also, the password reset link doesn't go anywhere.
  - tptacek 10y ago
    Yep!
- tzs 10y ago
lifeisstillgood 10y ago
I am a bit worried that stock fighter is the wrong approach. If Susie wants a better job inwould recommend my path: - if you want to find a better paying job, take each lunchtime and call every job advert you qualify for that pays 20k more than you earn. Do this for three months. You will get the raise. - even better is to supplement this with LinkedIN, blog posts, network maintenance (when did you last have call or have coffee with your previous boss?) - do this for the next three jobs. You are now at the pay ceiling for your skill set. Well done. Now ... err ... Start your own business, preferably selling something that scales (your time does not scale and you are selling it at pretty much the max - say 100-150k)
dcw303 10y ago
I was lucky enough to beta test this so I've had time to clear the trainer levels. And let me just say, wow. The tricks and turns you have to navigate to get through this are some of the best fun I've had sitting in front of a computer. I like that people are evaluating this against things like Overwatch, because for me, Stockfighter is a form of entertainment. I still play video games occasionally, but in my growing adult years, I'm not able capture that same rush from winning. Not so with CTFs. Maybe it's because I'm a relative newbie, but the dopamine rush I get from winning a level is incomparable. There is something about a solve, when you get that brainfeel where you just understand completely what is going on, that is unique. Perhaps that's what black hat hackers feel when they p0wn a system. The closest recollection for me is when I smashed through that top level brick in World 1-2 of Super Mario Bros, and I could run across the roof to win the level.
- unknownkadath 10y ago
  Brainfeel...I like that word. I'm going to keep it.
mcphilip 10y ago
Question: are frequency, consistency, and productivity important metrics for bubbling up users that get noticed as really good candidates? I poke around every now and then on stockfighter but am definitely not looking for a job change in the near term. Is this use case something y'all support? Thanks!
rando289 10y ago
So it's proprietary?
solutions16 10y ago
Have you been a victim of any online scam ? Bank account hack and you want to get your funds back as much as possible,Gather enough evidence to prosecute ? want to check on your partners Criminal records or Investigate a cheating spouse ? Basically (consultanthackers@outlook.com)he just helps you out with whatever hack or spying activity,Fix your credit and clean your debts , Change your Uni grades or transcripts, anything ! Stay classified stay certified, call (302) 365-0294 Thank me later..

155 points by alt_ 10y ago

nsfmc 10y ago

I know this is a low-quality comment, but i just want to congratulate the whole stockfighter team for getting the jailbreak ctf out. it looks like it was a ton of work and looks fantastic. as somebody who was excited about it after trying my hand at microcorruption, i'm super excited to see this finally. hats off!

tptacek 10y ago
Thank you! This is just an early demo version. It's going to get pretty bananas in a few weeks. Noisy testers are very welcome; we're going to start spoiling the "full CTF" levels next week for beta testers.
nsfmc 10y ago
one comment on the trainer: when you click on the Jailbreak link, it just drops you into the debugger, if you, like me got lost, run the `tour` and then click on the little person+ head and go to the documentation and go through the quickstart. yay!

yagyu 10y ago

wow, I just found microcorruption, now it looks like there's man-months of fun ahead. Technical comment: "forgot password"-link is not wired to anything? Not working for me on FF at least.

awesomebob 10y ago
The forgot password link doesn't work for me in Chrome either, but I found this URL and it seems to work: https://www.stockfighter.io/ui/forgot_password https://www.stockfighter.io/ui/forgot_password
- patio11 10y ago
  Fixed. (And yep, that is the correct URL.)

citizens 10y ago

"Starfighter is a new, weird kind of recruiting company. We detect and market underpriced programming talent. We do that by creating opportunities for programmers to casually and effectively demonstrate aptitude." Having a hard time parsing this. Do you find underpriced talent and help them get paid more?

aphextron 10y ago
Sounds like a brilliant business model, honestly. The world is brimming with brilliant programmers who are, for one reason or another, not able to reach their full potential due to outside constraints (third world countries, lack of tech investment, etc)
kbenson 10y ago
Presumably, if they are able to entice those people away from their current employment, they are offering something better, whether it be more money, more fulfilling (which can be for many reasons, such as being more challenging), or allows a better lifestyle. If nothing else, if gives those undervalued employees that have been identified a metric by which they, and their current employers, can judge their worth on the market.
tptacek 10y ago
Yes, that's the thesis. I mean, we're happy to represent anyone capable! But we're particularly interested in the people with no resumes.
pchristensen 10y ago
Susie works making crud apps for a boring insurance company. She is a brilliant programmer but due to where she lives, personal situations, she hasn't faced a challenge that lets her know the extent of her abilities, etc, she is working below her potential. Susie creates a novel solution to one of Stockfighter's games. Stockfighter uses that solution as evidence to present her to companpanies as a great engineer. She gets job offers for more money, challenge, and satisfaction than she currently has.
- 10y ago

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

j4pe 10y ago

I rarely want to like a product more than I want to like Stockfighter, because of both the people involved and the underlying concept. But there are a million other things I want to sink time into improving. Music, my Starcraft MMR, boxing. To finish a day hacking and coding, come home, and - for months, if I want good results - do more hacking and coding feels like an exhausting prospect. Even if the scenario is fun, it feels contrived. I'm not presenting any solutions. Maybe I'm just not the target market, because I don't have the desire right now to code all day and then code some more. But I wonder how big that target market is?

doktrin 10y ago
> because I don't have the desire right now to code all day and then code some more Tell me about it. Speaking only for myself, I have near-constant coder's guilt - a term I just made up to describe the nagging voice in my head that keeps telling me I should be coding more in my free time. It sounds something like this : "somewhere a rockstar wizard ninja is writing a C compiler in Haskell and here you are wasting your time with Overwatch, you miserable slacker"
- mod 10y ago
  Mine is even a little more annoying than yours. It doesn't like me doing productive things. "somewhere a rockstar wizard ninja is building a passive-income side project and here you are wasting your time tending a garden and working in your woodshop, you miserable idiot with stupid priorities."
  - toomuchtodo 10y ago
    > tending a garden and working in your woodshop After doing tech for 15 years, that sounds glorious.
    - maxerickson 10y ago
      Have you ever weeded a garden for a summer? It's quite a chore.

archimag0 10y ago

Is the server struggling again? None of my input into the UI seems to be having an effect.

Retr0spectrum 10y ago
Yeah, I'm getting some rather high latency on my inputs.
tptacek 10y ago
I'm getting crazy high latency just through the login page. Looking into it. The emulator servers (a pair of m3.mediums) are barely breaking a sweat.
- vox_mollis 10y ago
  Is the tour supposed to end abruptly at "this is r1" ?
  - tptacek 10y ago
    It is not! You are the third person to tell me that's happened. Looking into it.

gue5t 10y ago

The user interface is appalling. Whoever designed this has managed to produce worse ergonomics than a single 1970s-style terminal, for essentially a similar set of tasks (editing text+binary files and piping data through commands). I see some discussion of "files", but seem unable to list them or explore the filesystem. I don't know if this in-game filesystem is supposed to be on the "AVR" device or an imaginary "developer machine". Where do the outputs of running commands like "compile" go? Why can't I inspect the compiler? What actually comprises the state of the system I'm interacting with? If this is notionally to find good developers, why is the UI sandboxed inside a web browser, where building and using tools (which is what good developers and reverse engineers do) is incredibly painful? Half the commands produce no output and make no visible change to any state, e.g. "load garbage". Almost all commands silently ignore extra parameters. There's no tab completion, no history search, commands don't even show up in the output log... Links and commands seem to randomly be assigned to either always open in new tabs or load in the current tab of the browser, both in the "debugger" and help pages. Moving through command history puts the cursor at the left hand side of the prompt. There's noticeable latency when single-stepping the program, which is just astounding. Did nobody try to use this shit, even a little?

archimag0 10y ago
- Can't have the compiler side by side with the debugger, even though there's plenty of room on the screen - When the PC jumps, the highlighted instruction doesn't follow, leaving you lost when stepping through a program - Can't hit enter on a blank line to repeat previous command - No 'finish' debugger command? - Seem to end up in random functions when stepping over simple instructions - Am I supposed to type 'flash' or 'run' to execute my compiled program? Sometimes the one I just compiled gets executed, sometimes the one I compiled previously - how can we view what's being executed? I really enjoyed microcorruption, and thought that UI was fine, but this feels like a step backwards.
- tptacek 10y ago
  Enter on blank lines: easy enough, will do. Putting the compiler in the debugger was how it used to work. Everyone hated it. Also: it's using Ace, which really grinds Chrome. I can easily add a pure textarea tab that will let you edit code, if you _really_ want it. To run a C program, do one of two things: * Compile it in the source editor, which will generate a blob of compiler output (which is deliberately not documented) that the browser will cache. * Use the "flash" command to write it to SPI flash. * Use the "vmload" command to send a SPI message to the AVR to reload the program from the SPI flash. * Use the "vmexec" command to send a SPI message to the AVR to execute the program. OR * Compile it in the source editor * Type "run", which does all the rest of those things. I like Microcorruption's UI, too. I gave this one more to do. I agree: it's not there yet! Working on it. How elaborate do you want the web-based debugger built on this API to be? :) (I'm serious: thanks for the feedback. This section of the thread is the stuff I was hoping to get).

s3nnyy 10y ago

Dev hiring is a sourcing problem, not a filtering problem. The people behind starfighter are brilliant and I respect them big time. So, probably they know what they're doin. I am excited to see how they want to solve dev hiring since starfighter looks more like a product that does filtering, not sourcing. (I am thinking since a long time to build something that leverages Github to find and reach out to engineers; e.g., when a company looks for Angular people to just parse the Angular repo for engineers that watch / contribute to the repository and reach out to them. if you have any ideas on this or want to help, please shoot me a message).

aphextron 10y ago
Please don't unleash another method of spamming developers on the internet. We already get 10 linkedin requests a day for the hottest coolest new idea.
lj3 10y ago
It's both. They're focusing on the sourcing part, which is commendable, but I'd still like companies to engage a better filter. The one most have now is the equivalent to trying to hammer square pegs into round holes with bit of wood they happened to find. Unfortunately, changing that appears to be a very tricky social problem. It's going to take a recruiter (or recruiting company) with such a great reputation and track record that companies trust that recruiter's judgement in personnel implicitly. But how?

tptacek 10y ago

You all have great timing. It's very likely that something will melt down soon, but I'm not going to notice, because I'll be in a chair getting my arm inked up. It's going to be a nine-fives kind of day! Mean feedback about the UI, especially if accompanied by an even meaner summary of what you'd rather the UI does instead, is most welcome. Later (Erin's Calcifer tattoo is taking longer than expected, so if you want to wait like another 15 minutes before doing whatever unforeseen sequence of things in the UI that will hard-panic all the servers, your timing will be perfect).

nathas 10y ago
I was actually going to say I like the UI quite a bit at first glance. I haven't bit in yet, but overall I really dug the layout.
- tptacek 10y ago
  There are things I want to do with this UI that we couldn't do in Microcorruption --- ways to make assembly a little more accessible to programmers who aren't already from security or game development, where the people who crushed Microcorruption came from --- because the assembly was a flat marked-up blob of text. But there are definitely ways in which it's a step back.
- deleted 10y ago
  [deleted]
weaksauce 10y ago
Can you make enter repeat the last command? s<enter> is kinda annoying. iirc microcorruption let you repeat the last command. edit: also, the password reset link doesn't go anywhere.
- tptacek 10y ago
  Yep!
tzs 10y ago

lifeisstillgood 10y ago

I am a bit worried that stock fighter is the wrong approach. If Susie wants a better job inwould recommend my path: - if you want to find a better paying job, take each lunchtime and call every job advert you qualify for that pays 20k more than you earn. Do this for three months. You will get the raise. - even better is to supplement this with LinkedIN, blog posts, network maintenance (when did you last have call or have coffee with your previous boss?) - do this for the next three jobs. You are now at the pay ceiling for your skill set. Well done. Now ... err ... Start your own business, preferably selling something that scales (your time does not scale and you are selling it at pretty much the max - say 100-150k)

dcw303 10y ago

I was lucky enough to beta test this so I've had time to clear the trainer levels. And let me just say, wow. The tricks and turns you have to navigate to get through this are some of the best fun I've had sitting in front of a computer. I like that people are evaluating this against things like Overwatch, because for me, Stockfighter is a form of entertainment. I still play video games occasionally, but in my growing adult years, I'm not able capture that same rush from winning. Not so with CTFs. Maybe it's because I'm a relative newbie, but the dopamine rush I get from winning a level is incomparable. There is something about a solve, when you get that brainfeel where you just understand completely what is going on, that is unique. Perhaps that's what black hat hackers feel when they p0wn a system. The closest recollection for me is when I smashed through that top level brick in World 1-2 of Super Mario Bros, and I could run across the roof to win the level.

unknownkadath 10y ago
Brainfeel...I like that word. I'm going to keep it.

mcphilip 10y ago

Question: are frequency, consistency, and productivity important metrics for bubbling up users that get noticed as really good candidates? I poke around every now and then on stockfighter but am definitely not looking for a job change in the near term. Is this use case something y'all support? Thanks!

rando289 10y ago

So it's proprietary?

solutions16 10y ago

Have you been a victim of any online scam ? Bank account hack and you want to get your funds back as much as possible,Gather enough evidence to prosecute ? want to check on your partners Criminal records or Investigate a cheating spouse ? Basically (consultanthackers@outlook.com)he just helps you out with whatever hack or spying activity,Fix your credit and clean your debts , Change your Uni grades or transcripts, anything ! Stay classified stay certified, call (302) 365-0294 Thank me later..