I got to level 3 but then figured I had already spent my entire weekend plus a day and had responsibilities like grocery shopping, going to work, laundry, etc.
Stripe-CTF 3 Writeup
61–70 of 74 posts
Re: Stripe-CTF 3 Writeup
#62I've got mixed feelings this time. Disclaimer out of the way: No sense of entitlement here, every time I see a challenge like this I expect to fail. I'm really, really happy that people (Stripe, here) offer their time and resources to entertain us. I'm a proud owner of the CTF2 shirt. This time I couldn't finish level4. My takeaway is: I invested too much time and shouldn't have done it. I guess I'll pass next time w…
This is very different from my experience. They give you a build.sh script that does anything you want and a container with open access to the internet. Anything you print to stderr is shown to you. I didn't use the provided code for any of the challenges, and thought it was awesome that they didn't force you into a particular implementation. It's just a reference to help you get started.
And hackers staying up all night to write openCL gitcoin miners? That's just awesome. I don't know how you concluded that pvp "wasn't a good idea". I thought that challenge was just fantastic.
Re: Stripe-CTF 3 Writeup
#63Very fair feedback on moving the deadline. We'd debated doing it or not, and ended up moving it in the spirit of distributed systems education. A lot of people in the chat appreciated it, but that's obviously a selected segment. So we know for next time, how strong are other people's feelings on this?
If you move, commit to another firm deadline, not to a fuzzy, never know when it'll be done one, that's awful for planning and only increases stress.
Re: Stripe-CTF 3 Writeup
#64Earlier quoted context omitted.
Op here, just wanted to say thanks. Of course it is not cheating in the sense that I tricked the system to give me a better score than warranted but my solution only works for this ONE dictionary so.. maybe it is not cheating but using tighter assumptions than those which were provided by the original task description :-)
The problem description did say: # Our test cases will always use the same dictionary file (with SHA1 # 6b898d7c48630be05b72b3ae07c5be6617f90d8e).
Re: Stripe-CTF 3 Writeup
#65Here are my thoughts: I managed to scrape through level 4 so saw them all - this CTF was fun and educational. Level 4 in particular felt like a real education (for me at least), and a great way to learn. Unlike many others I was fond of level 0 because it brought up questions that even beginner programmers should address - how to organise your data so that you can search through it easily, which was in some ways a pr…
> Explicit language independence for all the problems would be great. I disagree, because the real world isn't all specs and cleanly defined APIs everywhere in the stack, and it definitely isn't mono-lingual. Oh sure, Stripe's actually pretty good with their public API, but I'm sure their stack has a few warts in different languages they'd like to rewrite. Not knowing Ruby, or Scala, or Go, I had great fun getting in…
Re: Stripe-CTF 3 Writeup
#66Here are my thoughts: I managed to scrape through level 4 so saw them all - this CTF was fun and educational. Level 4 in particular felt like a real education (for me at least), and a great way to learn. Unlike many others I was fond of level 0 because it brought up questions that even beginner programmers should address - how to organise your data so that you can search through it easily, which was in some ways a pr…
The reason the build times on level 3 were so bad was due to time spent downloading libraries. Stripe seems to have set things up to use a different ivy cache for each user, so every time you deployed code it had to redownload all of the dependencies. For me, this tended to take a couple of minutes. Actually compiling the Scala was pretty fast ( So yes, Scala is generally slow to compile, but don't blame scalac for t…
Thank you. So normally you'd have the dependencies prebuilt, and it wouldn't take long at all to deploy? That sounds more sane. The build time for golang was l4 was pretty hard, even just integrating raft in the time available, I started adapting what they had, then switched to inserting raft - I was still left with some issues, and it was humbling and awesome to see people scoring so highly on it for me with things like in-memory dbs, but also great just to read about the problem space, which isn't one I'd normally touch at all. So an education even if you didn't pass, which was pretty chancy anyway in my experience.
Note to Stripe: I would gladly pay $10 next time around if it could buy more/better ec2 instances.
I wondered if that was part of the challenge, particularly on l3, it meant it was harder to solve with just one instance, but yes it did cause frustration, particularly because a working solution locally would then not work remotely and scores were all over the place, even for the same code, due to contention and the random tests loading remotely. It's probably really hard to set this stuff up, and I look forward to the infrastructure posts to see how they did it.
Re: Stripe-CTF 3 Writeup
#67I've got mixed feelings this time. Disclaimer out of the way: No sense of entitlement here, every time I see a challenge like this I expect to fail. I'm really, really happy that people (Stripe, here) offer their time and resources to entertain us. I'm a proud owner of the CTF2 shirt. This time I couldn't finish level4. My takeaway is: I invested too much time and shouldn't have done it. I guess I'll pass next time w…
> Ripping the provided framework out was kinda possible, but a pain in the ass to debug This is very different from my experience. They give you a build.sh script that does anything you want and a container with open access to the internet. Anything you print to stderr is shown to you. I didn't use the provided code for any of the challenges, and thought it was awesome that they didn't force you into a particular imp…
- Ripping out the framework caused lots of issues for me. Maybe my choice was wrong? I actually (in spite of my complaints) used two 'interesting' languages for myself. I polished my ocaml for the miner and switched to Clojure for level3. The latter was hard, because the infrastructure was down a lot and you already had a hard time getting past 'Kicking of your trial' messages - only to fail because leiningen complains about the inability to verify ssl certs for example. Try to fix it (doesn't happen locally...), push, fail to kick of the execution of the build script.. Loop.
- The miner: As I said, I loved the idea of that challenge. The problem was highly interesting. My problem with pvp was mostly "There's no way to compete". When I joined it felt already like installing a bitcoin miner on my home machine. openCL based miners? That's changing the field of course and the only way to participate at that point is to follow - and I'm running a laptop here with an integrated Intel chipset for everything else. That totally ignores the fact that I don't know a thing about openCL or CUDA and would've started from scratch (as w/ Scala, as w/ go).
I certainly understand the fascination, but .. how many people _could_ compete against each other? The implementation (gpu based) and the network (git pull was sooo slow, same for push) made this inaccessible. At least for me.
Re: Stripe-CTF 3 Writeup
#68I've got mixed feelings this time. Disclaimer out of the way: No sense of entitlement here, every time I see a challenge like this I expect to fail. I'm really, really happy that people (Stripe, here) offer their time and resources to entertain us. I'm a proud owner of the CTF2 shirt. This time I couldn't finish level4. My takeaway is: I invested too much time and shouldn't have done it. I guess I'll pass next time w…
Level1 was immensely satisfying and interesting, but the pvp challenge was .. well.. dead. By the time real life let me join others were throwing GPU based miners at the problem and traffic was constantly heavy anyway. So amazing level, the arena type thing was imho not a good idea. PvP challange dead .. but heavy traffic? Sounds like a contradiction. I think it's a flawed deduction that the arena was a bad idea beca…
Re: Stripe-CTF 3 Writeup
#69Very fair feedback on moving the deadline. We'd debated doing it or not, and ended up moving it in the spirit of distributed systems education. A lot of people in the chat appreciated it, but that's obviously a selected segment. So we know for next time, how strong are other people's feelings on this?
I'm glad you did (but I wouldn't have finished if you hadn't). More people learning & having fun is better. IMO people only complain about the extended deadline because of its effect on the rankings. The scoring system was an interesting addition over CTF2, but it also created these complaints and silliness like people submitting the same code repeatedly to get the best score possible. It may have been better to only…
Btw, I agree that the scoring needs to be consistent or less coarse grained (percentiles) so that people don't submit thousands of attempts to get the max out of their solution...
Re: Stripe-CTF 3 Writeup
#70Very fair feedback on moving the deadline. We'd debated doing it or not, and ended up moving it in the spirit of distributed systems education. A lot of people in the chat appreciated it, but that's obviously a selected segment. So we know for next time, how strong are other people's feelings on this?
I'm not completely sure if extending the deadline was a good idea or not, but what was awfully bad was the way it was moved. If you move, commit to another firm deadline, not to a fuzzy, never know when it'll be done one, that's awful for planning and only increases stress.