Starfighter, Summer 2015
sockpuppet.org
sockpuppet.org
If you haven't yet, give Micro Corruption a try. It's the first thing I recommend when people ask me how to get started in application security, and everyone I've recommended it to loves it.
You don't need to know anything about security to finish the first level, but by the time you finish the last level you'll be a force to be reckoned with.
Best of luck to tptacek and co., the Samurai CTF team can't wait to play your next game.
[1] https://microcorruption.com
[2] I've since dropped out of school to work full time in security, and now compete on a top-tier CTF team. I couldn't even spell buffer overflow before Micro Corruption.
From Thomas's background in Chicago I predict the following firms as early customers:
http://www.spottradingllc.com/
But then again I am probably the only one who is disappointed over this announcement - the game sounds really boring to me.
This is generally the case at most places where software development is done, even when the software is the product.
For example, as any developer working at an "enterprise software" shop -- despite being the "producers", you're still beholden to (and less important than) the sales folks.
Not saying that's right or wrong, just that that is how it is.
... but, if you talk to any big-finance leaders these days, they'll probably admit to you that their tech is their competitive advantage (and not just in HFT, either).
Second fiddle, depends where you're working. Like everything else, there are crappy shops and there are amazing ones.
Even if your imagination were correct, I'd expect "money" would be a factor. Not all developers are primarily concerned about maximizing workplace status.
However, could you address a concern regarding negative hiring signals? I'm concerned that you're going to collect a huge amount of data as I play - and some of it will reflect badly and stop me either ever getting seen by your process for introductions or will lead to your employers throwing me away when you pass me to them.
I guess my question is - does starting without the skills you're looking for mean that while I might have fun and "level up" I'll never get the hiring benefits?
Does a 'bad level' caused by, say, trying "that language/framework/problem space/etc you’ve been meaning to learn" (quote from Patrick's original announcement post) stick out and mean it's game over from the hiring perspective? If I decide to learn Ruby to write some REST API (again, an example referenced in Patrick's announcement) on some level, and my newbie Ruby is rubbish - isn't that going to mean anyone who looks at that thinks I'm rubbish? Sure I had fun and learnt something, did I also stop myself ever getting an intro? You say you'll show them exactly what happened when I implemented that REST API, which is great - but I can't use it to learn some new skill if I want to look good right?
Sorry, this has got a bit long. To summarise - I'm concerned about the clash between on the one hand the claim I can play to learn new things, to get better - but on the other that you'll show employers exactly what I did. Of course the hiring thing is just extra and I can have fun without it, but if I'm interested in the hiring bit how do I experiment with new things without flooding myself with negative signals?
To be clear, the game sounds awesome. I'm just concerned I'll either screw up by not being world class yet or by trying new things and lose opportunities.
The REST API thing lets me tell employers "The reason I'm bringing Bob to your attention is you asked me to keep a lock out for API devs. Do I have a story for you..."
As to whether someone recently learning something new and useful makes you seem less valuable to the SF founders when we do our internal "Do we try to reach out to this person to get the ball rolling?" calculation, just trust us to not be idiots on that score. (I acknowledge idiots are widespread in the industry.)
On another topic, presumably the handheld devices for traders and gophers have a UI of some kind. Has this UI actually been implemented? And if so, what kind of UI is it, and will players need to interact with it? Or will players just be getting down and dirty with hacking the device in a debugger? I ask because I wonder how accessible this game will be for blind people. Of course, you may argue that the devices and software in the real world of stock trading probably aren't accessible either. And depending on what kind of UI the emulated handheld devices have, the OCR features or plugins of some popular screen readers may be enough to get by.
What does work:
- Native apps that use the platform's standard controls
- Native apps that have custom controls but implement the platform's accessibility APIs (this is a lot of work)
- Web apps that use standard HTML elements in the intended ways (e.g. links, form fields, headings, lists, tables that actually represent tabular data...)
- Web apps that implement custom widgets (e.g. a div or span that's actually a button) and provide the appropriate ARIA (http://www.w3.org/WAI/intro/aria.php) properties and keyboard focus behavior
- Flash apps that implement the Flash accessibility API, or use standard Flash or Flex controls and are compiled with accessibility enabled. I really don't know much about this.
JavaScript as such is not a problem for any remotely recent screen reader or other access technology. Neither are dynamic page updates, a.k.a. Ajax or single-page apps. Though in some cases, it may be helpful to mark a dynamic area of a page as an ARIA live region so screen readers will read new content automatically; the textbook example is a chat app.
- Late addition (because it was so obvious to me I almost missed it): anything command-line or terminal-based (second late addition: as long as the user can use their own terminal emulator).
What's not ideal but still basically usable for a tech-savvy blind user (i.e. anyone who's actually going to play Starfighter):
- In web apps, links or buttons that are images with no text equivalent (e.g. alt or title attribute), but where the meaning can be deduced from the link or image URL; in some screen readers, users can even add their own labels for these
- In web apps, elements that are effectively buttons (i.e. they have a click event handler) but are just generic divs or the like rather than actual links or buttons, and don't have the appropriate ARIA role; a user can usually deduce from context that these are buttons in disguise, and use a screen reader command to click them
What isn't generally considered accessible, but can be used with some effort through a screen reader feature or plugin:
- Textual information that is presented as an image, where all the info the user needs is in the text itself (e.g. not in any actual graphics, highlight colors, or the like), and the user doesn't need to click within that part of the screen; in that case, the user can use OCR to get at the text
What isn't generally considered accessible, but could be spun as just another challenge for the aspiring blind hacker wanting to play Starfighter, to be overcome by writing scripts for their screen reader or something like the Greasemonkey add-on for Firefox:
- Pseudo-buttons (as above) that are HTML inline elements (e.g. spans) rather than block elements (e.g. divs). The screen reader will probably present these as a single block of text with no immediate way to click on individual pseudo-buttons, but a hacker can probably write a script to add the appropriate ARIA role to these elements or do something equivalent at the screen reader level.
- In web apps, information that is presented visually without using appropriate semantic markup or ARIA attributes, but where the visual state of the element can be deduced from something like its class or id attribute, or even the presence of specific CSS in the style attribute. An example would be a list view or grid widget where the currently selected item is highlighted; assuming the selected item has a distinctive class or style attribute, a hacker should be able to write a script to add the appropriate ARIA attributes or do something equivalent at the screen reader level.
- A scenario like the one above where text is presented as an image, but the user now has to click inside that part of the screen. If the location of each clickable area (e.g. button) in pixels is a constant, then a hacker should be able to define hotspots in their screen reader, possibly with a little sighted help.
- On Windows, native apps that implement a custom UI and don't implement the platform's accessibility APIs, but use GDI (the original, obsolescent Windows graphics API) to draw to the screen. Since the early 90s, WIndows screen readers have used some truly hideous hacks to cope with this rather common scenario (if interested, the best explanation I know of is in this rather FUD-y piece I co-wrote years ago: http://ur1.ca/n4eyk). Windows screen readers have heuristics for things like detecting highlighted text and working with custom edit controls by detecting the position of the caret. And people have written very elaborate (and fragile) screen reader scripts to make various niche Windows applications usable.
What really isn't feasible to work around, even with hacking:
- A scenario like the one above where text is presented as an image, but now the user has to know the foreground or background color of some of the text, e.g. to know which item in a list is selected. I'm not aware of any screen reader OCR feature or add-on that can provide that info.
- On platforms other than Windows, custom widgets that don't implement the platform's accessibility APIs basically boil down to the same thing as above. Ditto for a web app that implements its UI using canvas, WebGL, or the like.
- Late addition (another one that was too blindingly obvious to me): Graphics that have no text equivalent (e.g. alt or title attribute in a web app), and where the user doesn't have anything else to go on, like a link URL, image URL, or element ID.
I'm happy to discuss any of this in more depth, on or off HN (see my profile for slightly obfuscated contact info). I guess the question of what does and doesn't work is such a natural first question for any developer new to accessibility that lists like those above should really be published somewhere easy to find, albeit with less of an emphasis on scenarios that require workarounds by a user who's a hacker or aspiring hacker.
There are probably lots of places where we'll need to make improvements, but, for what it's worth, we're all React wrapping standard Bootstrap components, with all their annoying semantic markup (which I am now starting to see the point of).
I'll ping you offline soon for more info. Thanks again.
https://paypal.github.io/bootstrap-accessibility-plugin/
Addendum: Accessibility validation tools exist, but the best way to test accessibility is with a real screen reader or other assistive technology. On Mac, the VoiceOver screen reader is built in; just press Command+F5 to turn it on, and go through the tutorial. On Windows, there's an excellent open-source screen reader called NVDA (http://www.nvaccess.org/). On desktop Linux, there's the Orca screen reader for GNOME and (less well supported) Unity. The screen reader for iOS is also called VoiceOver, and on Android, there's TalkBack. They can both be found in Settings. Note: On mobile platforms, screen readers change all the touchscreen gestures. FWIW, the majority of blind programmers I know use Windows as their primary platform for real work, and iOS as their primary mobile platform.
Sadly frozen pork belly futures don't trade anymore and haven't for about 4 years (almost to the day), and the Globex contract was GPB not GBP. But whatever, that sounds like a cool story and you should tell the rest of it :)
(The ticker is my fault).
I would love to be proved wrong if anyone has a story with evidence. Preferably with pictures of shipping containers arriving at a city office!
"Ideally, the broker will make sure everything goes according to plan," the Prince of Peanut Oil told me. "But I once knew a guy who was trading for himself. He bought six egg contracts, with each contract worth 18,000 cartons of one dozen eggs. That's 1,296,000 total. The guy somehow made the mistake of taking delivery."
Pretty excited about this as I was on a team that built a trading system (won't say which one but it was a big one) and my education is in electronics. It will be refreshing to deal with a (fake) trading system that uses "JSON/REST" as most of the real ones use proprietary binary protocols or something even worse like FIX!
Fun fact, the SOH delimiter character renders as a smiley face in some terminals. Some of the proprietary protocols are fixed width which makes them so much simpler to parse than FIX.
Hm, maybe shouldn't have given that one away. Oh well, people will forget before we launch.
This post has given Starfighter a lot more flavour in my mind. Thanks, Erin!
edit: For anyone interested, here's a link to that ATmega8515 data sheet: (caution, pdf) http://www.atmel.com/images/2512s.pdf
We'll have (architecture X) done in a month or so. And a pretty hilarious "architecture" after that.
Is that an intended aspect of the game, and how do you see it fitting in with the game's ecosystem?
Perhaps by corollary, will there be a significant open-source community built around the game; will there be open-source assets, but also the ability to contribute to those assets?
I don't see us shipping much OSS at launch, but that's something I'd be willing to try in the future.
If you want to release any source code for any segment of the challenge, while the challenge is ongoing, it will be torn apart by the competitors for bugs.
Because, as Erin said: "...pretending all our bugs were intentional, to make things more like the real world!"
Starfighter sounds incredibly ambitious and fun. Patrick's part sounds like it'll be making fun of Bitcoin exchanges. And there's probably going to be a rush to build higher and higher level compilers for this emulator.
This is gonna be awesome.
Oh believe me, when we do Bitcoin, we won't be nearly that subtle.
But then I got to the end of the email, and it turns out that it's the opposite :-) Guess it'll be playable just when it's back to the grind for me. But it does look incredibly interesting. And maybe having multiple separate things to do will make it easier to pick up after a bit of an absence; can just start on one of the other "tech trees" instead of having to redo old work to get up to speed.
I tried to analyze my thoughts on that; I'll try to give some feedback/impressions, but please forgive if chaotic or otherwise flawed. So, in somewhat random order:
- I'm absolutely not interested in topic of "stock trading", or similar stuff. I'm not into trading/speculation, whether stock, currencies, or else. I don't like gaming others. Or PvP. So, if that's gonna be required, or important, sounds very much like something unfun to me. I like building stuff, and especially useful stuff. In my mind I characterize myself as "an engineer". And from this description, I don't see much in this area for myself. Even if I'm going to be building something here (some in-game "cyberdeck" of tools), I don't know how this could be practically useful for someone else, outside the game; so for now it sounds like wasted time and effort to me.
- From the original announcement, it sounded to me as an attempt at something revolutionary, appealing to a wide audience, and who don't have much free time they can put into this (but I may have overinterpreted, I dunno). Given my previous objection, I don't see how it is so, for now. Specifically, when/if I have free time, I prefer to put it into attempts at some open-source work, so that it would be useful to others, while also I could learn something. But when I don't have much time, I don't see how I could take part in the game in any meaningful way, such that my "score" could reflect my knowledge & abilities. In other words, for now it sounds like it requires some "grinding", and for me that sounds like wasted time (real world requires enough grinding). I don't really see how this differs from MicroCorruption (where I also didn't care to waste time on that), or other "CTF"s. Or, really, "an actual job". Only unpaid^H^H^H^H^H^H"paid" in virtual karma points/pixie dust ("score").
- The one thing that seems mildly interesting to me as of now, is the AVR theme. I'm somewhat hoping to dabble a bit in microcontroller programming (one of my many hobby project ideas). So, if I correctly understood that it's aimed to have a very faithful simulator of an AVR, I may at least learn something in this area, which may be easier than experimenting on real hardware. So, maybe the relatively "wide range of topics" (stock trading, AVRs, compilers, competition) might be the "revolutionary" aspect, so that there's higher chance everyone will find something for oneself? But if I'm willing to grind only on one aspect in-game, then my "total score" will probably be low, no? Unless at least the scores are multi-aspect, not totalled/averaged. Still, if I don't grind on other aspects, they won't show up in my profile, and will remain unknown to "potential employers", no? Also, back to the AVR theme, microcontrollers are closely related to electronics (i.e. very physical hardware: cables, soldering, analog voltages, timing, unexpected capacitances, coupling, etc.), and here I presume I won't be able to learn anything anyway.
All that said, I understand that this is kinda "2nd trailer announcement", and the stuff is not open to public yet, so the jury is still out.
I've followed Patrick McKenzie since before BCC and this is the first thing that I don't get. Maybe it'd appeal to me if I played computer games.
Having said all that, I'm not meaning to be negative. Clearly it does appeal to some people. I really only wrote this so akavel would know that he/she wasn't alone! I think uninterested people generally don't comment and it's impossible to be against someone creating a product like this so naturally all the comments are from interested people.
Summary: Nothing against it, it's just not for me.
A lot of very talented people won't want to participate. There are amazing engineers with families whose discretionary coding time is committed entirely to open-source projects. It is not our thesis that we can or should pull those people away from that work.
But those people also have no trouble getting noticed by employers.
Our target candidate is in the workforce but underemployed. They have an aptitude for solving hard, lucrative problems. But they've never had the chance to get their hands dirty, and so nobody will give them that chance. Our target candidate is a .NET line-of-business backend software developer at a boring insurance company who is secretly one of the industry's best distributed systems software debuggers. They shouldn't be wiring yet another database row up to yet another Struts HTML form. They should be optimizing the wire protocol for a RAFT implementation at a software company. Only: nobody knows that yet, not even that candidate.
Those people exist. We think they exist by the thousands. I ran a recruiting project at scale for several years looking for them. We found them, over and over again. It was an incredibly gratifying experience for me, and so: I started a company to do it full time.
You're not one of those people. That's just fine. We're just going to find some great new people for you to work with.
What we can add to that now is:
If you're the kind of person who will mess around with microcontroller assembly for fun, or who will write tooling for random APIs just to see what they can make them do, you might be interested in goofing around with the Starfighter CTF regardless of your professional interests.
We had to pick a couple things to start with, and we think we picked ambitiously: low-level systems programming and high-frequency trading.
Holy crap, he's talking about me!
"who is secretly one of the industry's best distributed systems software debuggers"
Oh, nevermind.
But I'm still very much looking forward to trying this out! Thank you all in advance for bringing such a cool idea to life.
As for reward for effort expended the goal seems to be finding interesting work, and this sounds like a lot more fun than taking time off work to go mumble about the same old things from Cormen while sweating in front of a whiteboard to me, but ymmv. Speaking only for myself, presuming for a second that I have time to mess with this when it is released (no sure thing, full time job and two young kids...), even if I don't get a job out of it, learning something about AVR, security, etc. sounds like a worthwhile return on time invested.
As to the second part, about finding work, that's much more interesting for me as some food for thoughts. Thanks!
I haven't seen enough info, either, but I got the same feeling. When I first read about Starfighter I thought "neat, maybe this is a way to avoid the obnoxious typical interview process by demonstrating what I can do with some kind of ranking system." The Starfighter site implies this "Starfighter is not here to fix the job interview. We're here to destroy it, and replace it with something better" http://starfighters.io/
From reading the OP, now it sounds like a way to filter out a few diamonds-in-the-rough in a very specialized area. The system may teach you something, but the people who will shine and rise to the top will (I think) have some natural talent that makes them stand out. What will the vast majority of players get from participating? And how many hours of time do you have to devote to this simulation before you get introduced to a company (if that even happens)?
Well, maybe I'm not the target market because I'd rather spend my free time building my own business than playing a game. I'm currently doing that. But if my business doesn't work out, and I need to go back to work at some point, I don't see this system helping me. I have no idea how much time it would take, and what the possible reward would be. I hope these questions will be answered eventually.
The first Starfighter CTF is first and foremost a labor of love. I know the hiring angle dominates discussion of the concept, but I can't say this any more clearly: we are sinking all our energy into building the programming game we've wanted to exist for years. The thing we're building is only peripherally connected to hiring.
"aptwebapps made his profile public."
"Ah, he must be on the hunt for a new role somewhere..."
Am I on the right track?
The thesis statement behind the game is literally, "what if CTFs were more like MMORPGs?"
What I'm getting at is the desired side-effect is for people to have something they use to show employers in the real world to say, "I am employable for doing this super hard technical work". But I can imagine that for some people, that part of the game would become the minority of it. What are your all thoughts on this? Maybe a way to show experience with technical project management? (I'm not being glib.)
I suspect they would view the evolution of that sort of culture as hugely successful & the incentives are setup such that they capture and try to place those people who are leading those groups. CTO placement also pays out at a pretty good rate I imagine...
I really liked working with Atmega (and AtTiny) hardware. So if you get a compiler chain that works for AVR because of the competition, you may as well continue and get a starter kit ;)
I kill me.
if err != nil
But C has weird bits & odd corner cases. C isn’t type safe. C requires you to do all your own memory management. C is in fact full of landmines for the ordinary programmer (which is all of us, even the very best on a bad day) to step on inadvertently. What if you could have a language that acted like C, but was type safe, did do memory management for you, and had a decent standard library so you didn’t have to spend time writing yet another linked list implementation? Oh, and the one true concurrency scheme (Hoare’s communicating sequential processes) is built right in to the language, so you can write type-safe asynchronous systems without tedious boilerplate.
That language is Golang. Like C, it’s a wysiwyg language, unlike C it’s much harder to shoot your own foot off with it.
All of my test code was compiled with Crosspack AVR libc. The bundle has its own test code which was very useful.
Uploading machine code -might- break something. But in a fun way, I think.