Imagine being on the team involved in the development and reading through this write up - I'm sure it would bring a smile to their face. "Got this right, got that wrong."
There was a hackers forum where daily discoveries were discussed.
It was indeed exhilarating, and exactly that way you describe it: on one hand, we didn't really want the thing to be cracked, but on the other it was impossible not to be rooting for those scrappy hackers going down the wrong path at first before figuring out the right one, one step at a time. Every morning, we'd log in to that forum to check their overnight progress.
Still, we were confident that our bank-strength crypto algorithm would prevail.
It did not. :-)
While we had done our due diligence, an external implementation partner had decided to change the audited code later in the process, which broke things completely, in the most embarrassing way.
In the end, it didn't matter, and we probably sold a few more units that what we would have sold without the broken crypto.
Fun times.
It was summer 2001. The 3Com Audrey internet appliance wasn't quite canceled yet, but it wasn't thriving in the marketplace, either. I picked one up for $50 from uBid and started poking at it, blogging about my discoveries along the way. I figured out that the OTA image checksum was relatively simple to generate (something like two's-complement addition of running 32-bit integers that needed to sum to a specific constant). This enabled me to alter the next OTA image that came off the wire, which allowed me to begin replacing resources and binary components in the system.
By this point people were following the blog, occasionally linking to it on Slashdot. But then something strange happened: I started receiving anonymous emails from individuals who knew a lot about the Audrey OS's internals. They gave me hints about where the more vulnerably coded parts of the system were; they suggested hard-to-stumble-upon but valuable URLs in the Marimba OTA system; and one day when I foolishly overwrote the bootloader with a malformed image, just a couple days later a brand-new Audrey motherboard mysteriously appeared on my doorstep (at the time I didn't live very far from 3Com, and this was an age of the internet when nobody had much reason to hide their identities).
Thus, with the help of numerous knowledgeable individuals, I was able to bootstrap the Audrey modding community. The focus of the world changed soon thereafter, one Tuesday in September, but it was otherwise a similarly exhilarating experience to the one TomVDB describes. The difference was that I was the hacker, and the opposing team -- the one that had built this amazing machine (which I still have two of, by the way, both unopened) -- actually wanted me to succeed, hopefully giving the Audrey a better chance than it got during its initial, ill-fated, mid-dot-com-bust launch.
I wonder what the "most embarrassing way" would mean in this context -- I'm thinking timing attack or padding oracles, but it sounds like it might have been even more trivial.
There was a CAPTCHA used to prevent bot spam on a contest entry portal. The code that randomized the image displayed was modified to be stored in an application cache that persisted across sessions (meaning every "user" saw the same image and could use the same answer). Guess how useful that was in preventing bot spam?
(The fix was to delete one or two lines of code that were not only not helpful, but obviously harmful!)
There really is an XKCD for everything...
One of my favorites was when a reaction wheel failed on the Kepler spacecraft in 2013. Someone on Reddit declared that the mission was over with no chance of recovery. I kept my mouth shut. But I knew people down the hall from me were working on a solution. Kepler ended up observing for 6 more years.
Which forums would you say are worth lurking in? This one? The Stack Overflow family? Are any specific subreddits not-terrible?
I've seen some good discussion on Stack Overflow, but I don't regularly lurk. I do lurk on satobs.org - occasionally there is very interesting discussion there.
The most click-baity "ten reasons why you should use my favorite JS framework" posts seem to win, and it's troubling. We will soon be a world full of dumbed down workers, who can't experiment and think for ourselves, but instead get advice from whatever click-bait article included enough buzzwords to get recommended by an algorithm. What ever happened to tinkering and figuring it out on your own?
I work in automotive software development and the same holds true there. ;)
edit: sounds like efforts shifted to pirating internet streams. Found this neat story: https://www.fiercevideo.com/cable/nagravision-wins-101m-pira...
I remember showing a couple friends of mine how to flash cards with a DB9 serial port card programmer. You could get every channel, including PPV and porn. I never wanted to do anything illegal except watch TV and movies, but a couple friends of mine had highly successful "satellite TV installation businesses" where they would install for legitimate DirecTV customers, then say "you know, for a couple hundred bucks I can unlock all the channels..."
It was a fun time, and what made it interesting was the cat and mouse game that DirecTV played with the hackers. We had cards working for months, but at some points in time you had to get new updates every few days to keep it working. Eventually it became impossible, but it's been over a decade so I can't remember what the final event was.