[Lrrr]

No. DevOps has nothing to do with security/obscurity in the context of this challenge. Running the code and idiots posting their private information should be avoided because not all developers use docker. E.g. cgroups=2 people prefer using podman and also mostly dislike the docker daemon. Besides, even the 'real' content is fugged because it's invalid JSON, by the way, so whatever the point of
this is, is not really a good indicator of coding skills, at all, if you're trying to recruit developers and not DevOps people. See the required skills:

Code

Experience with Python 3 or C
Experience with Postgres & Redis
Experience with RESTful API's
(Optional+) Data warehousing and analytics (Spark/Dask/etc)

Tell me, how many of them will be familiar with containers? See how that's flawed logic?

I didn't really intend for the coding challenges to have much to do with programming skills. I like to work on a micro-service infrastructure and honestly, those kinds of services are so simple to write, it is easy enough to train someone who is not very skilled with python how to write a simple python service with health checks and metrics. The idea behind the challenge is about how you came to the conclusion, how quick you assumed things (for example, posting the false flag) and other things. I was genuinely curious to see how people went about solving it, since it can be solved with nothing more than a few lines of bash...or as complex as what it is (which is an overly complex app)

[MavenGradle]

Containerization preferences aside, what matters is not the what but the how :)

Running this code outside of docker will return the default token, which will request the user information. How, in coding terms, is that a false flag? It's deliberately set to retrieve personal information and asking developers to post their personal information unless they happen to look at the docker file and figure out that they should have been running this in a docker container using a specific environment variable set. Users that wouldn't know any better would be posting their data here.

Please, don't mix DevOps with development (for which this recruitment thread is asking entries, not DevOps). There's a reason DevOps is not called development and DevOps is not called development. DevOps engineers don't even have to write code per sé.

I didn't really intend for the coding challenges to have much to do with programming skills. I like to work on a micro-service infrastructure and honestly, those kinds of services are so simple to write, it is easy enough to train someone who is not very skilled with python how to write a simple python service with health checks and metrics. The idea behind the challenge is about how you came to the conclusion, how quick you assumed things (for example, posting the false flag) and other things. I was genuinely curious to see how people went about solving it, since it can be solved with nothing more than a few lines of bash...or as complex as what it is (which is an overly complex app)

Coding challenges not having much to do with programming skills? Okay. It would be beneficial to use better wording (e.g. a DevOps & Developer recruitment). See description given above for reasons why, but I'll take my leave with the disclaimer in any case.

[Lrrr]

Running this code outside of docker will return the default token, which will request the user information. How, in coding terms, is that a false flag? It's deliberately set to retrieve personal information and asking developers to post their personal information unless they happen to look at the docker file and figure out that they should have been running this in a docker container using a specific environment variable set. Users that wouldn't know any better would be posting their data here.

Would you be less offended if i changed the wtfismyip reference to a blank json object on pastebin?

---

Coding challenges not having much to do with programming skills? Okay? It would be beneficial to post a DevOps recruitment, e.g. see description given above, but I'll take my leave with the disclaimer in any case.

Devops sector is actually a solid idea.........

[OverLoad]

post to come back when i fit the requirements

nice group i can see

[Lrrr]

I have pushed changes to remove any reference to `wtfismyip.com/json` and replaced it with a blank json object instead. This will hopefully help new members from potentially posting deanonymizing information.

[Shisho]

Running this code outside of docker will return the default token, which will request the user information. How, in coding terms, is that a false flag? It's deliberately set to retrieve personal information and asking developers to post their personal information unless they happen to look at the docker file and figure out that they should have been running this in a docker container using a specific environment variable set. Users that wouldn't know any better would be posting their data here.

Please, don't mix DevOps with development (for which this recruitment thread is asking entries, not DevOps). There's a reason DevOps is not called development and DevOps is not called development. DevOps engineers don't even have to write code per sé.


Coding challenges not having much to do with programming skills? Okay? It would be beneficial to post a DevOps recruitment, e.g. see description given above, but I'll take my leave with the disclaimer in any case.

Did you try... not using the default token and instead... replacing it? You’re tasked to get the application token not fix or submit working code.

The challenge is not that difficult! You’re focusing too much on Docker! If I were to rewrite the Docker configuration for use with Podman would it change the fact that the false flag is false? I’m sure someone would still complain about there not being a Docker configuration!

Forgot about Docker and use what you got halfway to solve the rest of the challenge, if you’re still interested.

[Lrrr]

Did you try... not using the default token and instead... replacing it? You’re tasked to get the application token not fix or submit working code.

The challenge is not that difficult! You’re focusing too much on Docker! If I were to rewrite the Docker configuration for use with Podman would it change the fact that the false flag is false? I’m sure someone would still complain about there not being a Docker configuration!

Forgot about Docker and use what you got halfway to solve the rest of the challenge, if you’re still interested.

If I were applying, I would make a big stink about how there isn't a README.md... that's bad practice.

[Shisho]

If I were applying, I would make a big stink about how there isn't a README.md... that's bad practice.

If I were applying I would make a big stink about this pesky application token generator.

Jeez, who taught you to write Python?

[Lrrr]

- Designing according to the thread but I am good with Social Media.

Do you have any front-end experience or exposure to working on "production" front-end applications? (Apps that are live to the world)
Any other design links you want to share or examples of web UI/UX design possibly?

---

Links to HF design threads or verifiable dribble/deviantart/etc: www.maxorgdesigns.com

Did you build the entire site yourself? Really nice.

---

Links to HF design threads or verifiable dribble/deviantart/etc:
https://hackforums.net/showthread.php?tid=6038479
https://hackforums.net/showthread.php?tid=6038932

The video stuff is really cool, how much video editing experience do you have? Any reels to share?

[MavenGradle]

Did you try... not using the default token and instead... replacing it? You’re tasked to get the application token not fix or submit working code.

The challenge is not that difficult! You’re focusing too much on Docker! If I were to rewrite the Docker configuration for use with Podman would it change the fact that the false flag is false? I’m sure someone would still complain about there not being a Docker configuration!

Forgot about Docker and use what you got halfway to solve the rest of the challenge, if you’re still interested.

You could probably figure out the rest..
Don't click here unless you're lazy and want a free entry I guess? (Click to View)

Code

b'{"op8":"Thanks for fixing this over-complicated app!","application_token":"O'
b'P8DEVEL2020::HF_USER_ID","instructions":"Please use this application_token a'
b"nd replace 'HF_USER_ID' with your actual HF user-id when applying for the de"
b'velopment sector."}')

I have pushed changes to remove any reference to `wtfismyip.com/json` and replaced it with a blank json object instead. This will hopefully help new members from potentially posting deanonymizing information.

Thanks, that's for the better and will only make the challenge more confusing or actually make sense without people posting their data, which is good and following the intended behaviour.

[Lrrr]

Don't click here unless you're lazy and want a free entry I guess?

Free entry sure, but I am more interested in the path taken to get the answer

My guess is that it's not as important to be able to solve the challenge as what your attitude is and how you are like as a person.

Nailed it

[The Frost]

Timezone do you Reside in?CET
Are you fluent in English?Not my first language, but yes i speak english quite fluently.
What sector are you most educated in?Design, I started messing around with graphic design like when i was like 16 years old which is already 6 years ago. Past 1,5 years i've been focussing on 3D design and 3D Motion design.
How much time can you realistically devote towards group activities per week?
Links to HF design threads or verifiable dribble/deviantart/etc: I don't really have any design threads that are of recent date. However i can pm you my behance where i put up a couple designs.

[Lrrr]

How much time can you realistically devote towards group activities per week?
Links to HF design threads or verifiable dribble/deviantart/etc: I don't really have any design threads that are of recent date. However i can pm you my behance where i put up a couple designs.

Feel free to PM me, you missed the "how much time" question.

[The Frost]

Feel free to PM me, you missed the "how much time" question.

Added it to the PM! Thanks!

[Shisho]

-snip-

Thanks, that's for the better and will only make the challenge more confusing or actually make sense without people posting their data, which is good and following the intended behaviour.

Nice job! Some other CTF challenges can be found on https://gitlab.com/op8-recruitment/op8-ctf-assessments which should be interesting if you like this kind of thing :)