81–90 of 140 posts
Would you pay 100 usd to get on the front page of HN and who knows what other popular sites? Maybe it's just a marketing stunt
What exactly could DefuseSec be marketing here? Disclosure: He and I have been friends for years.
Even if it is a marketing stunt, it is a nice one.
Earlier quoted context omitted.
A guy issued a challenge saying he'd give $100 to anyone who could trick him into inserting a certain string into any of his software projects. Another guy responded "You should put this challenge on your website." The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website. GG
Oh, come on, I'll give that a troll win at best. The clear implication was subverting software users would run. Let him social engineer that one. I'd put it in a bug-fix or something Obfuscated C contest style.
1. Create issues for items I need fixed on my github repos. 2. Offer a $100 bounty to people who can trick me into getting some string into my projects. The easiest way to "trick" me of course is to hide it inside of a PR which fixes a real issue. 3. Find and remove the string before merging the PR. I've had one of my issues fixed for free. Rinse and repeat! Bonus Round: Stage an announcement on twitter and have some…
Earlier quoted context omitted.
A guy issued a challenge saying he'd give $100 to anyone who could trick him into inserting a certain string into any of his software projects. Another guy responded "You should put this challenge on your website." The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website. GG
Oh, come on, I'll give that a troll win at best. The clear implication was subverting software users would run. Let him social engineer that one. I'd put it in a bug-fix or something Obfuscated C contest style.
Earlier quoted context omitted.
Oh, come on, I'll give that a troll win at best. The clear implication was subverting software users would run. Let him social engineer that one. I'd put it in a bug-fix or something Obfuscated C contest style.
This is what Social Engineering is. Asking someone to do something that they normally would do, in order to get the desired outcome.
The attacker thought out of the box to tackle a lesser challenge: getting a string on the website itself. It was technically true under rules, funny, and contest issuer even owned up to it. It's not the real challenge, though. No real-world impact. So, just amusing trolling.
Earlier quoted context omitted.
What definition of "software project" excludes Web sites?
Static websites are documents (although this file happened to be PHP, it looked pretty static), is a book or a word doc a software project?
Earlier quoted context omitted.
Oh, come on, I'll give that a troll win at best. The clear implication was subverting software users would run. Let him social engineer that one. I'd put it in a bug-fix or something Obfuscated C contest style.
A website is software that users run.
Earlier quoted context omitted.
A guy issued a challenge saying he'd give $100 to anyone who could trick him into inserting a certain string into any of his software projects. Another guy responded "You should put this challenge on your website." The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website. GG
He basically did this: https://www.youtube.com/watch?v=XsrU2dMBVUQ
Earlier quoted context omitted.
What exactly could DefuseSec be marketing here? Disclosure: He and I have been friends for years.
He could market himself and his site in order to increase his self branding. Even if it is a marketing stunt, it is a nice one.