@Arminius great write-up

I feel like I'm understanding it although I can hardly spell "JavaScript"

ctftime.org/event/list/upcoming

Which one is next? :)

Maybe ctftime.org/event/669 ?

although it's kind of a bad timeframe for the europeans

Well, it's not that bad

Tired. What about you?

super tired, super busy

kind of a bad combination

were you able to wrap your head around that AES challenge?

yeah, that's kind of my problem as well. I get the logic behind it, but I don't understand the code

you really have to stop it with the "me being dense"

you know who's annoying? people who cannot admit that they do not know something

you know who's also annoying? people who say they don't know anything all the time :P

there's a difference between not knowing something specifically and being "dense" in general

you are not dense

okay?

okay.

god, I'm tired.

> HumanCTF 13 Oct., 01:00 UTC — 13 Oct. 2018, 08:00 UTC

Wow.

okay?

7 hour ctf

why not

This one is bad for Europeans

Hum, I've been logged out from the main site

Am I hacked????

You're now J.J. :o

I'm not logged out, so doesn't seem like a site-wide thing @BenoitEsnard

Yeah, my cookie will expire again on April 1st

I guess I've last logged in 6 months ago

:o

Your name is teen. Seven teen.

I can't wait for that day.

We will have a new meme!

Everyone loves memes.

inrupt.com/blog/one-small-step-for-the-web

Tim Berners-Lee's new company

tl;dr?

> Imagine if all your current apps talked to each other, collaborating and conceiving ways to enrich and streamline your personal life and business objectives? That’s the kind of innovation, intelligence and creativity Solid apps will generate.

solid.inrupt.com/how-it-works

> Think of your Solid POD as your own private website, except that your data interoperates with all your apps, which means you have your own personal API to go along with it. When you post comments or videos online, your friends can view them with whatever app they like, such as an album viewer or a social feed. It’s your data, that can be shaped in any way or form.

sounds interesting

Sound way too optimistic to be true

> I’m incredibly optimistic for this next era of the web.

Hehe.

@BenoitEsnard On Twitter, someone pointed out that strict-dynamic was set in the CSP, so the bypass my solution had wasn't actually necessary because the note-inserting script was already trusted, so every script it created would be trusted as well

That explains why they had that html() XSS in the first place which my solution didn't actually employ

@Arminius Yeah, that was I thought too when testing the challenge, but I haven't thought about it again after reading your write-up

The write-up is still awesome. :)

Do you have any opinion about the next one we should do? ctftime.org/event/list/upcoming

also ping @HamZa

That's also the one suggested by @TomK.!

@BenoitEsnard Cheers :)

I always get the rating confused though

That reminds me

is 98 difficult or easy?

$ noslookup hasjoshturned18yet.com
** server can't find hasjoshturned18yet.com: NXDOMAIN

Still free

I'll leave that here for inspiration

FML, I mistyped nslookup, now I can't edit...

Same question here: What does weight mean in CTFs?

ctftime.org/faq/#weight

So HITCON has the greatest weight then

@Arminius los lookups, the new band from mexico!

Hahaha

What about this ctftime.org/event/689

But their website is not working

The Hackover looks good, no?

hasjoshturned18yet.com

Write-ups from 2016 ctftime.org/event/339/tasks

I won't be in town this weekend

but you boys have fun

@BenoitEsnard You're the man!

But no SSL :/

Yeah, not available before ~24 hours

Github Pages :/

Access-Control-Allow-Origin: * :o

Gimme bounty

HTTPS now available

@Arminius Yeah, we need that for the API: hasjoshturned18yet.com/api.json

phew

@BenoitEsnard The API lacks documentation though

@Arminius I won't push the joke that far. Why would anyone ever write documentation anyway?

I've updated the site theme.

Like it hasn't been pushed too far already :D

I hope someone will notice my new startup and buy it for millions.

@Arminius Never!

Should I add Google Analytics?

I expect everybody here to have properly configured an ad blocker, so would that really be useful?

@BenoitEsnard What about logging in with Google?

@J.J The pull request is already done

Oh, man.

My new start-up just opened a new R&D office, and they're currently working on balloons.

Flooding with electricity isn't even on that list.

Not sure if chat memes should be on it though

@BenoitEsnard that needs fixing!

hahahaha - I clicked on it:

> {"answer":"no"}

very nice

pypi.org/project/isjosh18

$ pip install isjosh18
$ isjosh18
Josh is NOT 18.

@BenoitEsnard I put the JSON API to good use. Even though it's poorly documented...

hahaha

> The author of this package has not provided a project description

Oh, come on :/

How do I know how to use this module?

Well, there is isjosh18 --help.

I'm way too lazy to do a npm / Composer module sorry

Haha

@Arminius Bad news!

We'll close our API in 365 days from now.

We leave you a full year to migrate to another API.

Not okay. Integrating another API would be way beyond our budget

Your problems aren't our problems.

Wow

I've been your customer since the very first day. That's disappointing

You didn't even pay us once.

How is that a customer?

Touché

@Arminius I won't be present Friday evening, so I'll only be here on Saturday. :/

But we can still try it, I guess

Your insomnia is sec.se's best tool

Heh, Saturday should be fine though since it ends at 23:00 CET

Well, nobody has openend a fan shop yet

I'm thinking t-shirts, mugs, USB sticks...

Well, you got to keep the 17 in there

Whaaat

What's your python version...?

Or pip --version

@J.J Should work now

Python 2.x sucks

@J.J What more do you want? Balloons?

There you go

Well, $ isjosh18 --balloons

Damn.

I'm now forced to add balloons.

@Arminius I noticed a bug in your program. Balloons are here even when it's not Josh's birthday, as long as he's 18.

Do we need a API v2 to tell if it's his birthday?

@BenoitEsnard Yeah, your API didn't support that. :/

holy fuck

@Arminius this is great

@TomK. I'd rather say stupid, but thanks. Let's hope @BenoitEsnard implements some balloons too

@J.J yes

heck even after reading the writeups i didn't understand the solution (shrug)

i don't want to dramatise and discourage you guys though :P

Alright, I'm about 90% sure I'll be available for Hackover then

(Apparently the event for 2017 got cancelled, so only 2016 writeups are available)

Someone setting up a meta post or shall I?

Go for it

And add balloons please

To the meta post?

Of course.

@HamZa the one I proposed was just the only weekend I am free

and I mean 90 weight does not necessarily mean it will have the same weight this year, right?

@TomK. well we can always register at BOTH!

@TomK. true, after all it's just an indication

I messed up the times before... so it's actually 21:00 CET, not 23:00 CET

@BenoitEsnard I added a balloon :)

@HamZa Of course we can. But my original question was about which one was the next one, and there can only be one next one. :o

true

and I mean, we could just register for one CTF per weekend

and just see who's coming

That would be cool

But we need to learn from our mistakes, do we have the time to learn from them in only one week?

Is there any video game about hacking?

Like en.wikipedia.org/wiki/Watch_Dogs?

That was my first thought, but it's not really hacking

If by hacking you mean hacking-themed

Ingress also allows you to hack portals, but it's non-sense drawing

Well if it's real hacking it's a CTF :D

Although with some dedication, CTFs could surely be more immersive

I've heard about the .hack series, but I never check its theme

store.steampowered.com/app/503460/Security_Hole

...

store.steampowered.com/app/365450/Hacknet

> You become a hacker who passes 3D virus blocks through security holes to save humanity.

This one looks better

The thing for me is -- the closer the game gets to "real" hacking, the more it'd make sense to just spend my time on actual security challenges instead.

Yeah of course

But I guess video games could open "hacking" to more people, by lowering the amount of knowledge needed

I mean, Mr. Robot is a nice TV series

Way better than almost everything we got before about IT

It's far from perfect, of course

store.steampowered.com/app/370360/TIS100 <-- this one looks like assembly language

Would be nice to have real assembly learning gamified in that way

Let's learn game development

Just clicked your profile

"46231507".split('').map(d => "Arminius".charAt(d)).join('');

Heh

Do spambots evaluate this kind of JS?

Really don't think so

I'll put a XOR-encrypted text in my profile, the key will be my email

You think I should put that snippet there instead?

People will need to solve the challenge to send me an email

Your profile desc seems empty to me

You aren't skilled enough

Seems like it

All I see is a pokemon trainer

Skiddo, my favorite pokemon for obvious reasons

Mine is Charmander.