Hacker News Reader

Comment by tptacek | Hacker News Reader

Go easy on us for a bit; this is a fresh deploy in a new environment and it's bound to be janky. The odds of it not completely asploding tonight are pretty low.

Happy to answer questions.

One obvious question we haven't answered: how long will it be up for? Answer: a'unno. Until it gets boring? Or super expensive? We're in no rush to shut it down. I've never understood why awesome CTF events are so eager to shut down.

Here's what it looks like:

http://twitter.com/tqbf/status/423992147155509248/photo/1

We're on Freenode #uctf if you want to bug us live.

In case you're interested: this is a very small Rails app talking to an emulator we wrote in Golang that exports an HTTP/JSON interface.

View on HN

This looks cool!

> I've never understood why awesome CTF events are so eager to shut down.

We actually were planning to leave the first Stripe CTF up indefinitely. We'd mostly just built it as a side project, and hadn't really expected anyone to take notice. But we were swarmed by thousands of users, and suddenly keeping everything running was a full-time job — Andy wrote a script to alert us to forkbombs, and every hour or two we'd have to go in and clear out the forkbombs from a machine. The runner for level5 would get wedged due to an exploit that hung it, and would require kicking. One of the machines would be overloaded with level6 password bruteforcers, and we'd have to spin up another or kill off runaway ones.

For the second CTF, we at least knew what we were in for and built a much more resilient architecture. It was successful in that it was much less work to maintain, but there still was a lot of maintenance, ranging from working around an EC2 security groups bug that would blackhole traffic from certain client IP addresses to spinning up more level2 boxes (since everyone was overloading them in their attempts to bruteforce the level8 passworddb).

Anyway, my tl;dr is that running any production system is hard, and we couldn't have kept them running without significant time investment.

In other words, "we're going to keep this site up for a long time" sounds like famous last words to you. :)

On the other hand, we're a security consultancy, so maybe we have lower, more tolerable standards for "up in production" than Stripe does.

Nelson Elhage is a machine; he ripped through 9 levels in under an hour.

Yep, pretty much :).

Also, fun fact: Nelson was our test solver for CTF2. He also ripped through all the levels there in a few hours. But then he got to level8 (PasswordDB, which was source port counting), and was stumped for a few days. He had a lot of hypotheses about the vulnerability, many of which were much cooler than the actual one. Given it had taken him so long, I decided the level was too hard and made it easier by adding some code that would log source ports. (It turned out to still be too hard, so launch day I released a bunch of hints until finally wgrant solved it, at which point I went home and got some sleep.)

Is there any place to download the code or the image to the original Stripe CTF? I would love to replay it again.

Yep: https://stripe.com/blog/capture-the-flag-wrap-up.

I also recently learned that someone packaged our second CTF: https://github.com/e28eta/stripe-ctf-2.0

Enjoy!

I won one of your Launchpads at CSAW -- it seems that was just a teaser to this challenge. I'm having lots of fun so far!

I like the references to "Cy Yombinator."

Does this mean the matasano crypto challenges are over/no longer available?

I sent an email last week to join, but haven't heard back yet.

Nope, but it does mean I've been a little slow about them this week.

Reply on news.ycombinator.com