gdb

31 ms·

271.
by gdb 13y ago
We have images for the first CTF: https://stripe.com/blog/capture-the-flag-wrap-up . The second CTF had a more complicated architecture, which we never ended up packaging. It's possible we'll get to it at some
272.
by gdb 13y ago
Thanks for the kind words! As a note, this CTF is going to be a different angle — rather than being about security, this will focus on distributed systems engineering.
273.
by gdb 13y ago
Absolutely -- though experience will definitely help you if you want to compete, we've tried to make the levels educational too. There'll be plenty of pointers and hints, and there will be lots of people around IRC. There are also
274.
Coming soon: Stripe CTF3, distributed systems edition(stripe.com)
181 points by gdb 13y ago|44 comments
275.
Stripe adds multiple account support(stripe.com)
133 points by gdb 13y ago|87 comments
276.
by gdb 13y ago
Stripe. We're hiring engineers in San Francisco, remotely within US timezones, and in London. INTERN, REMOTE, H1B all welcome. We have a lot of awesome stuff in flight (not the least of which is our third Capture the Flag, which I&#x27
277.
by gdb 13y ago
(I work at Stripe.) As a lot of people have noted, the test has nothing to whether you'll actually work on a Sunday (most people don't). Instead, it's about whether you'd go out of your way to be around that person. Like
278.
by gdb 13y ago
Yep, we're working on this as well! :)
279.
Card management API(stripe.com)
83 points by gdb 13y ago|17 comments
280.
by gdb 14y ago
(I work at Stripe.) As an API author, I think your goal should be to make interacting with your API as simple and robust as possible. The downside with just recommending off-the-shelf HTTP clients is that there's always a ton of logic (whet
281.
by gdb 14y ago
Fair enough, though I'm not sure such a team exists in any case :).
282.
by gdb 14y ago
We have a unique set of technical challenges. We care about availability and durability to extremes that most others don't have to, and as a result we often end up having to build systems in novel ways. Fraud requires defending against acti
283.
by gdb 14y ago
Heh, indeed it is a bit muffled. What I'm talking about there is casually telling someone you'll be in town, when really you're just going to meet up with them.
284.
by gdb 14y ago
It depends on the candidate. Ultimately the Sunday test is just a formalized test for "cultural fit", which most people understand as a reason for rejection. I think not passing our Sunday test really just means this person did not gel with
285.
by gdb 14y ago
Yes, we have -- I talk about this a bit in the video (skip to 14:48). We care about building an environment where we all want to work. To some extent, we're making a bet that building a happy culture will ultimately lead to a higher-quality
286.
by gdb 14y ago
Stripe is not a First Round company. FWIW, I make no claims that we have the best team (I don't think teams are totally ordered, in any case), but I am very happy with the team we've built so far.
287.
by gdb 14y ago
To be clear, the point of the Sunday test isn't so much "we want people to come in on Sundays". While many people (myself included) will come in on weekends, many people stick to a more standard 5-day schedule. The point is really just, is
288.
by gdb 14y ago
We've tried Yammer, and it's never really taken off. The nice thing about just copying an email to a list is the barrier to entry is so low -- the sender doesn't have to open a new tab, or create any additional content.
289.
by gdb 14y ago
We don't. People end up choosing the various lists they want to be on, so it wouldn't make much sense to do so.
290.
by gdb 14y ago
It's been great -- setup was a bit of work (we're on Ubuntu, so had to build from source), but once up and running it's allowed us to do lots of ad-hoc analysis that would have been too hard otherwise. I've been meaning to write a MoSQL equ
291.
by gdb 14y ago
(I work at Stripe.) Where we use MongoDB, it's not because of speed. PostgreSQL is certainly capable of fast performance. MongoDB is useful for its ability to log freeform data as well as for its replication model. (We use sharded MongoDB i
292.
by gdb 14y ago
You shouldn't have to sanitize if you quote your variables properly. If general, the rules for "$foo" are "parse first, expand afterwards" while those for $foo are "parse, expand, parse again", so foo="hello world" echo $foo # prin
293.
by gdb 14y ago
I wrote this level on my Ubuntu laptop. I was inspired by the idea of TCP idle scans ( http://nmap.org/book/idlescan.html ), and spent a lot of time trying to find other ways to do connection counting before I realized that this worked. One
294.
by gdb 14y ago
So, as far as we could tell, there is actually no way to turn off sequential source port assignment. We reproduced the vulnerability in a number of environments in the wild (including several shared hosting providers and a Mac OSX system),
295.
by gdb 14y ago
I'd say probably 80% of the company is at lunch on any given day. Sometimes people will go and grab food from food trucks or restaurants in the area, though they'll also often bring it back and eat with everyone else.
296.
by gdb 14y ago
Answer: I am currently skipping group lunch :).
297.
by gdb 14y ago
Actually, it wasn't supposed to be there in any of the levels :).
298.
by gdb 14y ago
Glad you enjoyed :). We have a few places linked on https://stripe-ctf.com/about (namely http://google-gruyere.appspot.com/ and http://www.hackthissite.org/ ).
299.
by gdb 14y ago
I'll avoid posting spoilers here, but feel free to shoot me an email (gdb@stripe.com) if you want to discuss more. We will indeed send out confirmation emails for the shirts -- you'd be surprised by how many people typo their addresses.
300.
by gdb 14y ago
We fixed it as soon as it was reported, and have probably gotten four or five independent reports at this point. Feel free to post away!

More ›