Hello
Announcing Starfighter
351–360 of 418 posts
Re: Announcing Starfighter
#352I'm all, involved? and stuff? You can, like, ask us stuff, I guess. Let me answer the most frequent questions we're getting right here: "CTF" stands for "Capture The Flag". Conventionally, it's a contest with a collection of "flags" each of which is guarded by a programming puzzle; teams of people compete to collect flags. What we're doing is not a conventional CTF, but if you want to get the flavor of what we're doi…
Thank you for running a long-term CTF ! I've always been interested in those "improve your coding skills by playing" challenges but from my inexistent experience most of them fall in a combination of: - They are timeboxed - They are mostly (if not only) about cracking security - They are targeted towards low-level languages You've already stated that it won't be timeboxed (which totally makes sense as a hiring "middl…
My collegues like http://www.codingame.com/ which is more game oriented than security and you can use various languages (Haskell,bash,Clojure,C,...)
Re: Announcing Starfighter
#353I'm all, involved? and stuff? You can, like, ask us stuff, I guess. Let me answer the most frequent questions we're getting right here: "CTF" stands for "Capture The Flag". Conventionally, it's a contest with a collection of "flags" each of which is guarded by a programming puzzle; teams of people compete to collect flags. What we're doing is not a conventional CTF, but if you want to get the flavor of what we're doi…
if you're monitoring everything players do, doesn't that create an incentive for them to write their own tests locally and only interact with your servers when they have stuff already working? so they look like a genius instead of a guy who made a bunch of mistakes. "look i never make any syntax errors, hire me". but seriously whatever you monitor, players will have incentive to try to figure out and game it. and tha…
First, no part of our model involves monitoring how many "mistakes" someone made, and second, if you see what challenges like this are like (again, see Microcorruption), you know that there's no realistic way to do them that doesn't involve making zillions of little mistakes.
Re: Announcing Starfighter
#354Earlier quoted context omitted.
> "... if you ask people to follow the honor system, they tend to do it!" This is great but I think the stakes are somewhat different if it's ostensibly about jobs/hiring. I don't recall the crypto challenges being promoted as a hiring mechanism (though they may have been useful for that).
The crypto challenges were how we (for instance) hired Alex: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. Look, the reality is, most of the people who participate aren't going to be looking for a job when they do. So all our incentives are to make the experience itself rewarding to parti…
> The crypto challenges were how we (for instance) hired Alex
But that's the use from your (or Matasano's) perspective. I joined the crypto-challenges not at all because I want a job in security, but because I continuously heard people be super-enthusiastic about it (both the participants, as well as yourself, tptacek :) ), because it reminded me of the old Malattia+ 3564020356 puzzles (level 6!), because it seemed more fun than the Euler Project puzzles (which I did enjoy, but you can only solve so many palindrome prime puzzles before it gets tedious) and of course because I would learn things about practical crypto.
Unfortunately I only got halfway the first set of the Matasano challenges, but that was more because I did it in Python and at some point got frustrated by its lack of speed :) (even using NumPy) I did make a rather elegant English-text MLE detector using a log-probability frequency table of only 256 bytes :) I thought that was pretty cool. I might have another go at it and this time use Java instead.
Re: Announcing Starfighter
#355This whole interview process is broken. Even with this mind of ctf game, one should not be expected to race through peers with different kinds of tools. Developers are expected to build resumes at work via daily routines, then at home via github, hackerrank, side projects. System administrators are expected to do daily system administration routine, know OSes, tools, cloud/iaas/paas providers inside out and code side…
What race/competition dynamics we are going to have are for the benefit of the participants. Microcorruption has been running for over a year; the first finisher finished a few days after we released it. I'd have paid very close attention to someone who finished Microcorruption yesterday, if I was still hiring for Matasano.
Re: Announcing Starfighter
#356Earlier quoted context omitted.
> I don't care if membership in some particular group is correlated with lack of privilege. And what if lack of privilege is caused by association with the group? > If you want to argue that lack of privilege is an individual injustice You may believe in individual rights, but you can't deny group injustice. Blacks were made slaves not due to any individual selection. > For example, being black will sway college admi…
I don't deny group injustice. I don't believe injustice based on group membership is worse than any other kind - slavery is an injustice even if it's equal opportunity. Insofar as having bad schools or bad parents is not an injustice, it's also not an injustice if some group has more of them than another. And insofar as such a thing is an injustice, the fact that it's correlated with some group is irrelevant to me. I…
Well, group injustice is just individual injustice done to many individuals. And, I think, you would not consider it unfair to demand a robber to pay back the money he's stolen. The problem with underprivileged groups is not the reality of the offense against them, nor the identity of the victim, but the identity of the perpetrator, and this is where study and of power comes in. Because the reality is that human society, like gas molecules, performs many acts not as individuals but as a group (even collective property preceded the invention the first private property), and therefore the perpetrator in the offenses of underprivilege is society as a whole. The actions under discussion are not as acts of nature but acts like for men, acting as a group (and collective action is a positive fact). Assigning individual responsibility is as futile as assigning individual responsibilty to specific gas molecules in expanding a balloon; doing so is just an ineffective model. And what society has stolen as a group (from individuals!) it must pay back as a group. Identifying the victims as a group is just a matter of statistical convenience as well as an aid in the description of the dynamics.
That an electron is measured through its effect does not mean that we don't need to describe the electron itself. In fact, it is crucial that we do in order to understand its action. Same thing for power: you almost never observe it directly, but its study, and the term itself, are required in order to understand the workings of society.
And as to this game, I don't think it's inherently bad at all, but if its role in society is not studied it might become an unwilling accomplice to injustice. And, if, one day it is somehow discovered that abilities that convey power are dominantly genetic, I do not think that we should give certain jobs to people unsuited to them, but our society is judged not by the achievements of those born to privilege, but by how it takes care of those who lack it. Exactly how this moral obligation should be carried out is a complex matter in itself, and far beyond what I can write here.
Re: Announcing Starfighter
#357I'm all, involved? and stuff? You can, like, ask us stuff, I guess. Let me answer the most frequent questions we're getting right here: "CTF" stands for "Capture The Flag". Conventionally, it's a contest with a collection of "flags" each of which is guarded by a programming puzzle; teams of people compete to collect flags. What we're doing is not a conventional CTF, but if you want to get the flavor of what we're doi…
While this might indeed help employers find better employees, I am concerned about hidden (or not so hidden) bias. Games like this (and the way this one is described confirms it) select for competitive people. Other talented programmers might prefer expressing their creativity and talent in less competitive ways. While competitiveness might be a desirable quality, sometimes it is not. It might also appeal to men more…
It is a bias, but it is similar to the following bias: http://www.theonion.com/video/in-the-know-are-tests-biased-a...
How do you test for noncompetitive but still productive people using a competitive test?
Re: Announcing Starfighter
#358Earlier quoted context omitted.
I like this response. I think that one of the best things about a take-home challenge is that during the interview, you can then say, "The way you implemented this function was interesting. Let's talk about why you did it that way." If he knows what he's doing (or made a weird solution), you get a great glimpse into his thought process. If he plagiarized, then he's garbage. English teachers do the same thing for dete…
It's a neat idea, but ultimately, worrying about cheating or whether someone has cheated feels like a distraction. It suggests a test that isn't repeatable. I'm only confident in my ability to detect obvious plagiarism. Subtle plagiarism can exist in varying forms, such as reading an analysis of the problem and solutions. Some people who plagiarize will pass a thorough Q&A about their code, because they fully underst…
> Some people who plagiarize will pass a thorough Q&A about their code, because they fully understood the explanation of the solution, but are getting an unfair advantage over candidates who worked out a solution themselves from scratch.
This reminds me of the debate over whether performance-enhancing drugs should be allowed in mathematics. Why do you think it's so important for the candidate to personally invent every aspect of their solution? What if you just told people that it's ok to use external resources to solve the problem?
A class might give exams in any of these ways:
- exams only happen in class, where everyone can notionally be supervised
- exams are take-home, but you can't read the textbook while you're taking one
- exams are take-home, and you're free to read the textbook
There's cheating under all of those models, including the first one which takes the form that it does specifically to prevent cheating. The implicit goal (for the students) of model 1 is to make sure they've internalized whatever is being taught. The implicit goal of model 3 is to make sure that, even if they haven't internalized the material, they're capable of applying it. The implicit goal of model 2 is to make sure they'll comply with arbitrary, unenforceable demands (in this context, usually called "the Honor Code"). That might make sense if you're hiring a cashier -- but is it really your first priority?
Re: Announcing Starfighter
#359I wonder if this was inspired in part by the recent Alan Turing movie :)
How so?
There's a chuck of the movie where they're recruiting potential code breakers by putting a difficult puzzle in the newspaper and telling readers if they can solve it in under 5 minutes to apply to the job. Same sort of premise here.
Re: Announcing Starfighter
#360Earlier quoted context omitted.
You will not have to participate in a team or work on my 25 year old PL/SQL system; I made the PL/SQL optional.
Sad. There should definitely be a challenge involving table functions all the way down - combined with a Call of Cthulhu esque sanity system...
It looks like he clearly implies the challenge is there :)