Hi I'm Polly. I care about security and other thin...
# introduce-yourself
p
Hi I'm Polly. I care about security and other things. I've done a lot of hacking the past 5 years, a lot of cryptography but also webs security, binary exploitation and whatnot. Almost all of it was in the context of CTFs. Back when I was a kid I learnt programming through creative coding, where I wrote a lot of games and simulations and nonsense programs. I have a website with very little on it. Lately I've been very interested in thinking about building secure software. It's kinda the problem that my field is unable to solve, or even really think about. I really like Rust because it made a good push towards that. I got very sucked into a bunch of the blog posts on todepond.com after re-discovering Lu's mastodon, and have since binged some of the future of coding stuff and read/watched so many of the cited works.
🐸 2
👋 10
a
Hello Polly! What was the most interesting part of ctfs?
p
getting into it I really liked the feeling of mastery over some software, it's really fun to feel like you can trick the computer. Looking back I find a lot of small things really interesting: it breaks down some software elitism, if you wanna hack some PHP thing, you have to give it the dignity of being understood before you are able to abuse the boundaries of the system. Some of the really cool CTFs like Google CTF 2023 has some really weirdo computation models, like they did computation in a huge minesweeper clone. Hacking touches something foundational about computing in a lot of ways I think.
Like this exploit from a while ago (I think this is the one I'm thinking about at least) where attackers abused a small bug by repeatedly using the bug through a turing complete machine constructed in an image parser. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html I find these weird machines fascinating. The effects of the security vulnerabilities are unfortunate tho. Security is usually like this 😞
a
@Polly Have you seen that middle-endian architecture? https://github.com/legitbs/cLEMENCy
p
I don't think so, was this at the DEFCON CTF last year? I see it says 2017 on the github. I haven't looked at this architecture yet, but it defo looks weird 😛
a
yep, old now, but it's an interesting idea to test how software can be tweaked to work with something foreign like big or little endian