Hacker News Reader

Comment by schoen | Hacker News Reader

Are the Matasano crypto challenges currently stuck in some way, like with a grading backlog? I signed up some months ago, sent my first set of answers just after the new year, and have never heard back about the second challenge set.

View on HN

We are way. way. way. backlogged.

If anyone has any idea on how to help a hapless team of security researchers manage many thousands of people looking to get through the crypto challenges, we'd be t-h-r-i-l-l-e-d.

We were able to keep up last summer, but then Microcorruption happened, we got into a hole, and we're only slowly digging ourselves out of it.

Alex, Sean, and I are turning the challenges into a book, which we're going to release "choose-your-price" with all funds directly going to a charity (I like Watsi, but who knows); that book will also include Set 8, which is all ECC.

I'm hoping we'll be done with that by August.

Have you considered taking people who have passed challenges (and are excited about them) on as volunteer assistants for the challenges?

If anyone has ideas on how we could do that, I'm all ears. We'd have to mitigate the privacy issues somehow, because not everyone has given us permission to reveal that they're working through the challenges, and passing submissions to people outside the firm would be that.

Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned).

People could sign up and post their solutions, and others would be able to validate entries of levels below them (so someone on level 3 could validate a level 2 submission). Or hell, the webapp may even be able to validate some of it (obviously not entries where you paste code, but things like "Decrypt !4321hj4123$@!#$" could be automated).

This way, you could submit solutions via your login (attached to your email) and people validating the entries wouldn't be able to see the email address, just the answers, and could comment on the submission.

Sorry, this was a bit stream of consciousness. If this was particularly barebones, you might be able to slam it out in not too much time. If you don't mind PHP or Common Lisp in the backend, I might even be able to help out a bit.

We actually do have a web application we use to track the challenges (the mail is all done through Mailgun).

Two things complicate managing the challenges:

* We have to actually read the code people send us (if you get things wrong, there's a pretty good chance we'll catch it). We try hard not to move people forward a level until they've gotten the previous challenges right.

* We don't dictate any particular format for submissions. Some people paste code into their email messages; some people attach lots of little files; some people attach archives. Some languages let you stick all that code in 1 file; others, like Java and C#, have complicated directory hierarchies.

We have a pretty cool submission system in use at my university, that will spin up a VM, compile and run your code and have a set of validators check if the output is correct. That way people can test their submission and immediately get feedback. You would still have to look into the code to make sure it's really valid, but I guess you could filter out lots of invalid submissions. If you are interested, I can hook you up with one of the developers of that system.

I know I haven't submitted in forever (and may have been removed of the set of active participants), but I got your New Year's bankruptcy mail, but never the "bonus set".

Is that still part of the backlog?

Reply on news.ycombinator.com