3 ms·
The metaphor is a bit stretched for the purposes of content marketing a startup. The major difference between vulnerability researchers and the speedrunning com
by minimaxir 2y ago
The metaphor is a bit stretched for the purposes of content marketing a startup. The major difference between vulnerability researchers and the speedrunning community is that speedrunning is highly collaborative and open. There are massive speedrunning Discord communities for each game, and even before Discord existed, tricks and hacks were discovered iteratively just by many people watching other people do them often unintentionally and trying to figure out how they work (a common trend in every Summoning Salt video).
Nintendo doesn't care if people find ACE in decade-old games (usually) and post decompiled versions of games on GitHub so people can find out how they tick, but vulnerability researchers can't do that unless they want to risk causing a legal shitstorm.
- qwery 2y agoYes, the differences are substantial. It's also worth noting that although some speedrunning may be akin to vulnerability research, the vast majority of speedrunners are "only" practicing and replicating exploits demonstrated by others. They're in different columns.
- rfoo 2y ago> the vast majority of speedrunners are "only" practicing and replicating exploits demonstrated by others So they are red teamers :p
- ajuc 2y agoThey are script kiddies ;)
- jmcgough 2y agoKind of, but even an average runner can experience a bug or refine a strategy through repeat practice, which they often share with the community through streamed runs or discords. You tend to have certain people who are more interested in glitch finding and spend most of their focus on that over actually running the game. Then you have TAS runners (often overlap with glitch hunters) who make TAS-only runs to determine what the absolute limit is in a game. Finally, you have the remaining 95% of the community, runners grinding the game over and over. Strategies from TAS often are repurposed by speedrunners, perhaps most famously in Mario 1 any%, where several strats used by top runners were once considered infeasible for humans.
- lotrjohn 2y agoI knew that TAS meant “a computer” but for those, like me, who forgot/ didn’t know, TAS stands for “tool-assisted speedrun”.
- jmcgough 2y agoCorrect. TAS usually means to use a tool that lets them painstakingly play the game on a frame-by-frame basis (usually 1/60th of a second), each frame making the theoretically optimal input.
- eru 2y agoYes, and even for TAS you usually have a division of labour between people who find the exploits and people who create the TAS itself.
- saagarjha 2y agoI take it that you are unfamiliar with the average jailbreak enjoyer
- badhistorian 2y agoAlso speedrunners are really bad historians. Their documentation is usually loose google docs links, placed on a discord channel. IF that sounds like there's little to none versioning and little to none searchability - precisely. I am reminded of the top Super Mario players all congregating for a run on GDQ, only for a complete random fan to come to them and ask "So... if you were all stuck trying to optimize this one pipelfor over half a decade... Why didn't any of you just do the Devil's Spell?" To which the speedrunner's reaction is: "Wtf is the Devil's Spell". It happened to be a trick that was documented nearly 2 decades prior.
- easterncalculus 2y ago> the vast majority of speedrunners are "only" practicing and replicating exploits demonstrated by others. Which ironically is more like pentesting than VR.
- frosting1337 2y agoVulnerability research, in my experience, has been pretty collaborative and open - especially in the bug bounty space.
- fooker 2y agoThe bug bounty space is incredibly hostile because of the money involved. Just about every project has a bug bounty, but you'll be hard pressed to find any online discussion about works in progress towards a reportable bug.
- poincaredisk 2y agoProbably because vulnerability research is binary - you either have an exploitable bug out not. The fact that people write in depth about things they've found means a culture of openness, IMO.
- frosting1337 2y agoThis is true if you're not really known. (Un)fortunately you need a reputation: need to be able to walk the walk if you can talk the talk. Once you get over that hurdle, collaborating on targets is pretty common. Made $10k USD last month collaborating with someone in another country, in fact.