Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Project Euler Humble Return

#101

Post by 0942v8653 »

ColinWright wrote: post #97
Retra wrote: post #87

Earlier quoted context omitted.

If you're not sending 20 megs of data, you're not getting 20 megs of security. So why allow it if it doesn't add anything?

It doesn't add to the security, but I might find it easier to remember 20 MB of redundant and meaningful stuff than to remember 384 bits of literally random stuff. The entropy might be the same, but my memory is not a computer. I can remember vast amounts of material that is meaningful and use it as a password. I can't remember 384 bits that have no meaning. The benefit isn't in the entropy, it's in the abilities of…

Maybe 1 or 2 KB, max. 20 million characters is a ridiculous password to remember.

Re: Project Euler Humble Return

#102

Post by ColinWright »

0942v8653 wrote: post #101
ColinWright wrote: post #97

Earlier quoted context omitted.

It doesn't add to the security, but I might find it easier to remember 20 MB of redundant and meaningful stuff than to remember 384 bits of literally random stuff. The entropy might be the same, but my memory is not a computer. I can remember vast amounts of material that is meaningful and use it as a password. I can't remember 384 bits that have no meaning. The benefit isn't in the entropy, it's in the abilities of…

Maybe 1 or 2 KB, max. 20 million characters is a ridiculous password to remember.

That's not the point - the difference between 2 KB and 20 MB is purely a detail. You said:

  > If you're not sending 20 megs of data,
  > you're not getting 20 megs of security.
  > So why allow it if it doesn't add anything?
You could just as equally say:

  > If you're not sending 2 KB of data,
  > you're not getting 2 KB of security.
  > So why allow it if it doesn't add anything?
Your point is the same, and it's still wrong. What you're getting is not the security - that's only half the story. My point is that is does add something, it's just that the something it adds isn't the entropy for the purpose of security.

Re: Project Euler Humble Return

#103

Post by ChristianBundy »

rnovak wrote: post #94
daguava wrote: post #81

Earlier quoted context omitted.

While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.

I think you're confusing "exploit" and vulnerability. An info leak is a vulnerability. Period. And yes. You completely went around their request, and made this info public without their consent. Actions like this are THE reason the relationship between vendors and security researchers is strained. There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosu…

> if you did this to a site I owned, especially without my consent, I'd be very motivated to contact the proper authorities and pursue civil remedies.

Actions like this are THE reason the relationship between vendors and security researchers is strained.

Re: Project Euler Humble Return

#104

Post by asdfologist »

mhink wrote: post #80
daguava wrote: post #74

You can list what problems you've solved by showing an image generated for you. Ex) https://projecteuler.net/profile/daguava.png But you can also use this to quickly test the status of accounts. For example, I was able to find Euler is an admin account by trying https://projecteuler.net/profile/euler.png It tells you it's admin in the image, why? Edit: Wonder if they're exposing some vulnerability with the HTTP 300 M…

So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately? Kind of a jerk move.

Yeah but how else would he get the same ego boost from showcasing his brilliance on HN?

Re: Project Euler Humble Return

#105

Post by codyb »

trengrj wrote: post #84

Part of me learning to code was by going through the challenges on Project Euler and I always get a sense of nostalgia when reading about it. It is a pity it keeps getting hacked. I think that the site owners are more interested in algorithms and mathematics than mundane engineering. It would probably be a good idea to open source the site.

I can't imagine the rationale for hacking projecteuler in the first place. Always a favorite place of mine as well and I still bring newbies to the scene there when I attempt to show them the basics of programming. I guess there's just an asshole for everything when you have hundreds of millions of people online these days. Sucks a bit doesn't it?

Re: Project Euler Humble Return

#106

Post by gregmolnar »

ChristianBundy wrote: post #103
rnovak wrote: post #94

Earlier quoted context omitted.

I think you're confusing "exploit" and vulnerability. An info leak is a vulnerability. Period. And yes. You completely went around their request, and made this info public without their consent. Actions like this are THE reason the relationship between vendors and security researchers is strained. There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosu…

> if you did this to a site I owned, especially without my consent, I'd be very motivated to contact the proper authorities and pursue civil remedies. Actions like this are THE reason the relationship between vendors and security researchers is strained.

100% agree!

Re: Project Euler Humble Return

#107

Post by fao_ »

austenallred wrote: post #24
edem wrote: post #20

I don't get it why someone would hack project euler.

http://www.hackthissite.org/ lists "hack project euler" as the final challenge

  ...Hack This Site is a free, safe and legal training ground...
It's rather amusing how they claim they're 'legal', then.

Re: Project Euler Humble Return

#108

Post by branchless »

ChristianBundy wrote: post #103
rnovak wrote: post #94

Earlier quoted context omitted.

I think you're confusing "exploit" and vulnerability. An info leak is a vulnerability. Period. And yes. You completely went around their request, and made this info public without their consent. Actions like this are THE reason the relationship between vendors and security researchers is strained. There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosu…

> if you did this to a site I owned, especially without my consent, I'd be very motivated to contact the proper authorities and pursue civil remedies. Actions like this are THE reason the relationship between vendors and security researchers is strained.

Good grief, Americans and threatening to sue anything that moves.

Re: Project Euler Humble Return

#109

Post by jdiez17 »

tsukikage wrote: post #95
aikah wrote: post #83

Open source that site. Vet a few devs to have access to the source to begin with then opensource it. Or even better, let the community rewrite the source from scratch. How hard can it be? and there are often a lot of people willing to contribute to open-source projects.

"How hard can it be?" <--- yeah, that's how you end up with vulnerable sites.

Not if you make security your number one goal from the beginning. But "letting the community rewrite the site" would be very complicated, especially on a niche website such as Project Euler, where a lot of its users are opinionated and would probably take a long time to reach consensus on anything.

Re: Project Euler Humble Return

#110

Post by fao_ »

elektromekatron wrote: post #45
goldenkey wrote: post #8

Why is project euler not on github? Yeah..no one's gonna help unless you open-source your project buddy.

Why is X not on Github is the programmer version of folk getting offended when you don't use Y social network. Also: Github Presence != Open Source Open Source != requirement in asking for help/advice

Of course, but perhaps the point that most people who try and coerce others into using GH are making, is that the community would be more able and more ready to help them fix vulnerabilities quicker if they had access to the (non-sensitive parts of the) source code.

As such we can only trust that the people running the site are taking due notice and patching it correctly -- which, (I hate to say) given Project Euler's track record in the last year or so...

Post reply on HN