A king passing through a town finds a man about to be punished for fraud. He intercedes and asks what the matter is. The trickster says in his defence, "I ask people for things, and they give then to me". The king is incredulous but poses a challenge: "You must ask and receive money from the richest man in town." The trickster agrees, but being short on assets, requests a loan. The king obliges, and the trickster arranges (eliding details) to induce the town's richest resident to provide him with a wealth of goods. He returns to the king two days later with evidence in tow. The king is impressed by this demonstration, at which the trickster notes that he'd actually met the conditions 48 hours earlier when the king, wealthier than the town's richest resident, had offered him a loan.
There's something to those old stories.
(I'm not positive of the source but believe it's included in Idries Shah's World Tales.)
Lloyd: I'll bet you twenty dollars I can get you gambling before the day is out!
Harry: No!
Lloyd: I'll give you three to one odds.
Harry: No.
Lloyd: Five to one.
Harry: No.
Lloyd: Ten to one?
Harry: You're on!
Lloyd: I'm gonna get ya!
Harry: Nu uh!
Lloyd: I don't know how but I'm gonna get ya.By mixing in advanced machinery, our innate heuristics like harm measurement need many more dimensions of analysis. Hackers, in tune with modern machines, recognize this as a blunder since we have seen trust misused with secrets in machines before; still how can a "[s]cientist and security researcher" and "farmer and shoe-repair-man with a handheld" alike learn to recognize wider effects of their machine-enabled actions?
0: https://twitter.com/search?q=from%3ASc00bzT%20to%3ADefuseSec...
2. Offer a $100 bounty to people who can trick me into getting some string into my projects. The easiest way to "trick" me of course is to hide it inside of a PR which fixes a real issue.
3. Find and remove the string before merging the PR. I've had one of my issues fixed for free. Rinse and repeat!
Bonus Round: Stage an announcement on twitter and have someone cleverly trick me into including the string on my website (which I was totally going to do anyway). Post clever trick to code geek social media and reap the sweet free viral marketing and hackers trying to earn a Benjamin.
Another guy responded "You should put this challenge on your website."
The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website.
GG
(And kudos to the originator for acknowledging that.)
The offer still stands though, if you'd like to try: https://twitter.com/DefuseSec/status/730904219419443200
@Sc00bzT > @DefuseSec You should put this challenge on your website.
@DefuseSec > @Sc00bzT Good idea, added it to this page: https://defuse.ca/security-contact-vulnerability-disclosure....
@Sc00bzT > @DefuseSec Did I just win?
@DefuseSec > @Sc00bzT FUCK. What's your paypal/bitcoin?
[See https://github.com/defuse/defuse.ca/commit/4770ad5c9d4851d40... for commit.]
Maybe we shouldn't drink and "crypto"? :-)
Maybe it's just a marketing stunt
Disclosure: He and I have been friends for years.
Not that I think that has anything to do with this. Looks more like normal goofing around by security or hacking folks. If anything, he looses money or precious beer from it.
Even if it is a marketing stunt, it is a nice one.
He clearly intended for some variant of "any of my software projects that other people actually use", but failed to specify that detail.
But it's nonetheless hilarious. Laughs all around.
Now insert that string into Linux source code, and I ll get surprised.
Social engineering has been understood for a long time, and yet we can't develop defenses in the same way we can develop defenses in software. So we have an underpaid workforce of software hackers uncovering vulnerabilities which get patched and an overpaid workforce of social engineers exploiting unpatchable vulnerabilities in the human condition.
Who is really being exploited here?
Also, if he validated the code before copy and paste, the string would be invisible.
I assume you only write leet codes in assembly?
"I'll give $100 USD to anyone who can trick me into inserting the string "BackdoorPoCTwitter" into a release of any of my software projects."
Emphasis on the "trick me".
It is not even a string too.