How we recovered $300k of Bitcoin
reperiendi.wordpress.com
reperiendi.wordpress.com
That is probably the best CV I've ever read by accident.
You should broaden your job hunt criteria to technical content marketing - seriously!
Very rare to possess the skill to tell a story in an entertaining, approachable and detailed technical fashion.
FYI, not sure if english is your first language or not but this should be "If you have interesting technical analysis..."
Still, pretty minor thing to nitpick about.
I'm not sure if English is your first language, but this should be, "if you have interesting technical analysis..."
Everyone can pick apart the mistakes of others, find mine!
The soccer thing is pretty funny though. :)
That's another thing I distinctively remember from English class in Germany, being taught the British pronunciation that, at that young age, was much less familiar to me than American pronunciation, and some slight confusion around that.
I’m a native (non-American) English speaker and the American pronunciation, to me, doesn’t sound like keht at all. (German was technically my first language, although English became my main language at an early age, so I’m quite used to German accents, so it’s definitely not caused by the native accents imho)
I once (when I was ~15 or so) had an argument with a kid who simply would not believe me that the letters C-A-T aren’t pronounced keht
It's also definitely not the case that the "a" in American English "cat" is pronounced like "a" usually is in German. In that case, the "a" sounds much closer to a German "e" then a German "a". The IPA for AE "cat" is kæt, not kat (where in some parts of Britain it actually is kat).
I wouldn't write this, but I would absolutely say it, and it doesn't carry the rough affect of something like ain't.
> Where have expresses a state rather than an event it is replaceable by the idiom have got.
The Cambridge Grammar of the English Language, 2.5.6(c).
Exactly what I was thinking.
In any case, dear author, thanks for the write up, it makes for great reading, and I hope you receive offers for endeavors that give you as much intellectual stimulation as it is useful to society at large, and a large enough paycheck.
The following CV line stands out however:
Google: Software Engineer, Ads Review. June 2014– March 2016.
Angular / Java developer on the internal tool used by contractors to review Google ads for policy violations.
How did that saying about "brightest minds working on ads" go?
I am not blaming the author as I would have done the same(and I imagine author was not told when hired that he'd be working on Java/Angular ad tool).
Again it is not that Java or Angular are bad per se, but working on ad CRUD seems completely orthogonal to author's talents.
Whether that's the particular mechanism or not, I think this bears investigation.
1) I generally take the higher paying gigs but mostly so I can accelerate retirement 2) Even in the crappiness of high paying jobs (I often think I'm essentially being bribed to put up with all the BS) I can generally maneuver myself into doing interesting work. It takes about 1.5 years of concerted effort, but once I understand how stuff works, I can generally start nudging stuff in the right direction, and can eventually find some form of fulfillment amongst the BS.
> I generally take the higher paying gigs but mostly so I can accelerate retirement
My problem with this outlook is that sacrificing my current well-being for increased future well-being is risky. I don't know how long I will live or what my health will be like. I have to make the best of the time I have now (without sacrificing too much future well-being, of course!)
Not that I don't do the same, just, it feels risky, on its own. I think the rest of your comment is super important for this reason.
Entire industries are taking the "best and the brightest", and wasting them on some of the most menial jobs imaginable.
I couldn’t agree with this sentiment more. My current job isn’t the highest paying job I’ve ever had (or could currently get). But the value in what I’m learning and exposed to keeps increasing over time. I am not the smartest person in the room and super happy about that
Unlikely OP earned only $300K/yr
Reads the news
I will stay where I live.
I think it goes something like the Open Source saying "that person doesn't owe anyone their intelligence to work on so-called important problems for free, just because it might be nice if they did".
Want smart people to solve important problems? Find a way to pay more for that, than for ads, or find a way they don't need to earn money to live at the standard they want.
Ethically?
It's a rather reductive and defeatist view. There's nothing more harmful than looking at a specific state of affairs and going "eh, that's just the way the world works", as if our current economic system was an immutable law of nature.
The brightest minds are working on ad-tech, not as an immutable law of nature, but because that's where the incentives are, and if the parent commenter wants that to change, whining about how the OP isn't more charitable won't solve it, like whining that open source developers don't work on what users want instead of what they want won't change it; If it's all about incentives, we [1] should look towards finding a way to incentivise the more desired outcome.
[1] parent commenter alone, or society generally.
This is essentially the Nuremburg Defense, but it's "just following money" rather than "just following orders".
Unless we reach some magical Utopia, we will always have the choice between making money through ethical or unethical means, with the former being beneficial to society, and latter being more lucrative to the individual.
And yes, everyone in the industry knows that ads don't work, you have all the ad blockers, etc.
Including the fact that it might make its practitioners rich, while creating nothing of social value.
I would love to see ads that are only relevant to my life instead of penis pills.
I don't really think so in the general case. Personally I've eaten a lot of food I found out about from ads and wouldn't have known I wanted otherwise, and I'm glad iit happened.
But if ads convince you to try 47 different restaurants and that otherwise you would have been perfectly happy to eat at home, then the ads did a disservice to society.
And you must remember that for every local food ad there are 300 ads for McDonalds or Walmart, and they are just as effective, altough likely for another demographic.
It's not immoral in specializing on how to advertise. It's immoral to overstep some boundaries when doing it.
Disclosure: I worked in a company whose primary revenue was selling tools to create ads.
Painting the advertising industry as "humble startup putting up a sign in the downtown square" is also disingenuous. Most advertisements you see are done by big corporations. What's the excuse of Coca-Cola or McDonalds to plaster the streets with psychologically-crafted pictures of their unhealthy products, then?
Hardly. You buy a domain name, put something on it and then what, wait for an independent reviewer to monitor the registrars? And that review would be discovered how?
> Painting the advertising industry as "humble startup putting up a sign in the downtown square" is also disingenuous. Most advertisements you see are done by big corporations. What's the excuse of Coca-Cola or McDonalds to plaster the streets with psychologically-crafted pictures of their unhealthy products, then?
I have no idea how did you reach that conclusion from what I wrote.
By "independent reviewers", you mean bought youtube influencers, right? Because that's what's often happening in industries where external reviews plays a big role.
What that means is that ad design is rapidly iterated upon to maximize revenue of the company [1]. We also know from first principles that ads can have negative influences on people (making people dissatisfied with their bodies or lives, or making them engage in medically harmful behavior like smoking etc etc.). Now, there is very little legal regulation of what can be in an ad, except that factual statements in the ad are true; and ad creators rarely self-regulate.
So you have one variable A=product revenue. You have another variable B=negative psychological impact on viewers of ads. The ad optimization process only optimizes A, and places almost no constraints on B while doing so. Guess what? A significant percentage of ads end up with both high A and B.
This is the problem. I am not proposing any solutions, but the problem exists.
[1]. Also the techniques learned from internet ads are applied to tv, print and billboard ads.
> Biosimilarity, LLC: Partner. February 2013–May 2014.
Developed a decentralized massively scalable database based on the π-calculus and a secure distributed social network
The sentiment is a bit older than ads. It goes:
" I saw the best minds of my generation destroyed by madness, starving hysterical naked, dragging themselves through the negro streets at dawn looking for an angry fix,
angelheaded hipsters burning for the ancient heavenly connection to the starry dynamo in the machinery of night,
who poverty and tatters and hollow-eyed and high sat up smoking in the supernatural darkness of cold-water flats floating across the tops of cities contemplating jazz,
who bared their brains to Heaven under the El and saw Mohammedan angels staggering on tenement roofs illuminated,
who passed through universities with radiant cool eyes hallucinating Arkansas and Blake-light tragedy among the scholars of war,
who were expelled from the academies for crazy & publishing obscene odes on the windows of the skull,"
Howl by Allen Ginsberg:
In other words, I was saying "that's a bad assumption, but I can't actually confirm or deny whether the conclusion is true."
I don't know where you or other people responding to me got the idea that I was saying anything other than exactly what I said. I'm not sure where the breakdown in meaning has occurred.
The comment by DavidAdams to which you replied was thanking someone for mentioning the Ginsberg connection in relation to the topic under discussion, i.e. the 2011 'framing' which unambiguously draws on Ginsberg.
I think you're just making trouble, to be honest.
1. Hire the best of the best, typically PhD level.
2. Assign them to random crap project that have precious little to do with their specialty and strengths.
3. Assume that if they were smart enough to earn a PhD on topic X, they'll learn quickly how to do work on Y, even if X and Y are completely unrelated.
I think both CS and software engineering have their own importance but they are not the same. It's better to hire the right person for the job.
Imagine those with a university degree working at McDonald's serving menus
and later ...
> I’m currently looking for work in a staff or senior staff engineering or data scientist role. If you’ve got interesting technical analysis or optimization problems, please reach out to me and let’s talk.
I can't help but wonder if this write-up (which is fascinating) may not be one of those little animated shows to help propspective employers feel like they'll get their money's worth.
Also even if you're not interested in the author, it has useful information about cryptography, cryptanalysis, and optimization.
it is not part of the main business logic but neither are well designed icons.
Someone needed to front an estimated $100k of GPU costs, without being sure it would work - and then pay for your work on top; who risked that? You had no proof the claimed Bitcoins inside were real, or as many as claimed. You're in New Zealand(?) and the customer is in Russia - you need the file to study it and if you crack it then you have the Bitcoins as well - how did they become comfortable that you wouldn't steal them and say you couldn't crack it? Did it worry you that the owner might not be able to convert them to cash, e.g. if the Exchange was shady and there was very little recourse?
How much work did it take to convince your partner to stop what they were doing, and write GPU code for a crack which might not work?
Especially since, I can't remember what I did 2 weeks back to write in my blog.
Can you give us the secret of your documentation/notes workflow Mr. Mike (@metaweta)? Please don't say that you recalled from your memory!
Well, it looks like it's a lot harder than I thought. You still need the right software and hardware but you also need the right person to do it.
Most of what I read was above my understanding but it was good reading anyhow. Good job on the recovery and good job writing about it.
> ZIP supports a simple password-based symmetric encryption system generally known as ZipCrypto. It is documented in the ZIP specification, and known to be seriously flawed. In particular, it is vulnerable to known-plaintext attacks, which are in some cases made worse by poor implementations of random-number generators. https://en.wikipedia.org/wiki/Zip_(file_format)#Encryption
IMO the fact that the author was able to recover the password at all indicates weakness. Something encrypted with AES-GCM would presumably be all but impossible.
We won’t really know the true value of bitcoin until options are widely available on retail exchanges like fidelity or at least tdameritrade using people’s normal brokerage and ira accounts.
What was interesting, is that implementing the brute force solution and running it probably saved me time in the long run, because it managed to turn off a part of my brain that worries about wasted time. As long as I knew the brute force was potentially making progress, I didn't care if I ended up with false starts, or took a long time trying to understand the math, so it was easier to focus on the smarter solution.
Right away, you have to make a choice between doing it the reliable way (brute force) and taking a gamble on being able to out-smart the problem and doing it the math-y way. This adds a ton of pressure, no matter which path you choose.
If you choose to start with brute-force, you're stressed that you look stupid because you don't know the trick. If you spend precious minutes looking for the trick, you're stressed because there's no guarantee you'll crack it in the given time.
I've just gone through a gambit of software interviews and this is the biggest thing that determines whether I'll enjoy solving a problem or not. If they start with "find an efficient solution" or "the data set is in the millions" or something along those lines, I know I'm doomed if I don't recognize the form of the problem. If they encourage me to get to a working solution first, and _then_ figure out the trick, I'll typically do well regardless of whether the question is familiar or not.
Although blockchain technology fits your skillset, I hope you will choose to do something [actually|more] worthwhile to our societies.
And what a beautiful new baby password crack it was.
Or did your client remember selecting something really hard in the first place?
The field of cryptography has grown tremendously, and there's still a lot of research being done. There have been many competitions for developing strong cryptographic primitives. There's a lot of work being done on zero knowledge proofs and verifiable computation. Cryptocurrency has encouraged lots of bright young minds to get involved.
One thing we learned from the Snowden revelations is that crypto works where it's applied, so every little bit of crypto helps. Run a Tor node if you can.
Based on the price of Bitcoin back then, it seems like this was about 30-40 Bitcoin?
> Luckily, he still had the original laptop and knew exactly when the encryption took place.