Useful for Competition
Separate teams that solve it
from teams that don't
Prefer strong correlation
with finals ranking
Slide 62
Slide 62 text
Useful for Education
Teach new players
something
Get players over a hang-up
Slide 63
Slide 63 text
Usable
Intended difficulty only
Minimize corner cases
Unintended vulnerabilities?
Slide 64
Slide 64 text
Reliable
Remain
vulnerable
Slide 65
Slide 65 text
Reliability is Hard
Players like to attack
Players like to brute
Players like to complain
Slide 66
Slide 66 text
Reliability is Hard
Slide 67
Slide 67 text
Reliability is Demanding
Slide 68
Slide 68 text
Reliability is Expensive
If you want it
to be
Slide 69
Slide 69 text
Reliability is Cheap
Build software
that can be
run reliably
Slide 70
Slide 70 text
Twelve Factor App
• VIII. Concurrency
• Scale out via the process model
• IX. Disposability
• Maximize robustness with fast
startup and graceful shutdown
Slide 71
Slide 71 text
Twelve Factor Challenges
• Limit global state
• Process per connection
• xinetd ftw
• Make adding resources cheap
Slide 72
Slide 72 text
Adding Resources
Automate!
Slide 73
Slide 73 text
Operations Automation
Puppet or Chef
for server
provisioning
Slide 74
Slide 74 text
Operations Automation
Docker is slow
to spin up
RunC is fast
Slide 75
Slide 75 text
Shared State
• Process per connection not always feasible
• Sandwich challenges in 2014
• JRuby & Celluloid slow to start
• State still per connection
Slide 76
Slide 76 text
Shared State
• Global state and web challenges
• Persisted XSS
• Tricking a global database
Slide 77
Slide 77 text
Waiting For Your Touch
• 2015 web challenge
• /r/thebutton knockoff
• JRuby, Rails, websockets, postgres
Slide 78
Slide 78 text
Waiting For Your Touch
Slide 79
Slide 79 text
Waiting For The Challenge
Slow when not slow 500s
Thankfully during the day
Slide 80
Slide 80 text
Waiting For Your Touch
1. Took it down
2. Opened replacement challenge
3. Debugged for an hour
Slide 81
Slide 81 text
Debugging For Your Touch
4. Leaked and exhausted postgres connections
5. Fixed leak
6. Allocated more connections
Slide 82
Slide 82 text
Waiting For My Fix
7. Took an hour
8. Gyno forced a fifteen minute cool-down
between "is it fixed" and "it is fixed"
9. Reopened
Slide 83
Slide 83 text
Most Important Part
People are
the most
important
Slide 84
Slide 84 text
Respect People
• Respect for yourself
• Respect for your team
• Respect for players
Slide 85
Slide 85 text
Respect for Yourself
Slide 86
Slide 86 text
Respect for Your Team
Slide 87
Slide 87 text
Respect for Your Team
Slide 88
Slide 88 text
Respect for Your team
Make services
easy to keep
running
Document!
Slide 89
Slide 89 text
Respect for Your Team
Provide easy to run
smoke tests
"Is this exploitable?"
should be a one-liner
that spits out the flag
Slide 90
Slide 90 text
Respect for Players
Slide 91
Slide 91 text
Respect for Players
Slide 92
Slide 92 text
Respect for Players
Slide 93
Slide 93 text
Respect for Players
Slide 94
Slide 94 text
Building Challenges is
Software Development
Useful
Usable
Reliable
Slide 95
Slide 95 text
Reliability Imposes
Constraints
Limit state
Limit dependencies
Automate