Would you pay 100 usd to get on the front page of HN and who knows what other popular sites? Maybe it's just a marketing stunt
Why would you have to pay anything? Have a friend tweet the response.
Did I just win?
71–80 of 140 posts
Re: Did I just win?
#72Earlier quoted context omitted.
Ah, I think my brain got led down a "garden path", a concept I just learned had an official name from yesterday's Parsey McParseface announcement https://en.wikipedia.org/wiki/Garden_path_sentence
Explain please? I cannot make sense of the op's sentence in a way that advocates social engineering.
The first half of the sentence is saying, "Don't do things the hard way (hacking) when you can do them the easy way (social engineering)". The second half is saying "Everyone should know this."
Re: Did I just win?
#73Earlier quoted context omitted.
Ah, I think my brain got led down a "garden path", a concept I just learned had an official name from yesterday's Parsey McParseface announcement https://en.wikipedia.org/wiki/Garden_path_sentence
Explain please? I cannot make sense of the op's sentence in a way that advocates social engineering.
[deleted]
Re: Did I just win?
#74It's not clever to hack something that you can socially engineer, and that should be hacking 101. Clever win.
For those of you misreading this comment: Aelinsaar is saying that if a system/target is vulnerable to social engineering, then hacking (code) that system/target is not clever.
Re: Did I just win?
#75Earlier quoted context omitted.
What definition of "software project" excludes Web sites?
Static websites are documents (although this file happened to be PHP, it looked pretty static), is a book or a word doc a software project?
Unless it is served as plaintext, I'd say it counts.
Re: Did I just win?
#76Earlier quoted context omitted.
You could probably hide it pretty effectively during a normal pull request to fix an existing issue. As long as they aren't greping for the string anyhow. If he's going to use tools to to search a PR for the string, you'd have to obfuscate it. There are plenty of string and / or byte array manipulation techniques to sufficiently hide something like this as long as it's masked by an otherwise real PR.
You'd have to rely on a ball of jumbled crap somewhere in the PR though - maybe if they don't wrap lines or something you could slip it in?
I'd be XORing against some existing strings in the code of the same length to obfuscate the content, with some hidden method to invoke the reverse XOR to regenerate this challenge text string.
Re: Did I just win?
#77Re: Did I just win?
#78What exactly happened here? All I see is a highlighted line that seems to have already been there.
A guy issued a challenge saying he'd give $100 to anyone who could trick him into inserting a certain string into any of his software projects. Another guy responded "You should put this challenge on your website." The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website. GG
Oh, come on, I'll give that a troll win at best. The clear implication was subverting software users would run. Let him social engineer that one. I'd put it in a bug-fix or something Obfuscated C contest style.
Re: Did I just win?
#79slow clap.
Re: Did I just win?
#80Would you pay 100 usd to get on the front page of HN and who knows what other popular sites? Maybe it's just a marketing stunt
What exactly could DefuseSec be marketing here? Disclosure: He and I have been friends for years.
Advertising is always about grabbing attention. The more impressions, the more odds of sales or uptake. It's a legit consideration anytime some stunt happens in public spreading on media or social networks.
Not that I think that has anything to do with this. Looks more like normal goofing around by security or hacking folks. If anything, he looses money or precious beer from it.