lastorders

ideas that really should have stayed in the pub

[lastorders]

i missed microcorruption when it was released initially. its an impressive CTF created by matasano and square that simulates a hardware device where you use your knowledge of the running software (gathered via a debugger) to construct an attack using a custom crafted input.

while it lacks the real-world relevance of other CTFs where you exploit (known) weaknesses in higher-level languages / frameworks - its a rewarding puzzle for the gifted or (in my case) stubbornly persistent.

i've posted my solutions on github for reference

[lastorders]

gnome invasion

ever since i did the original stripe ctf challenge, i've been interested in the practical side of how vulnerabilities are exploited. so i was curious enough to try out the SANS / counterhack holidayhackchallenge over christmas.

it's basically a CTF competition where you have to discover exploits in a set of remote servers. to keep it current it features some interesting twists

a childrens toy running embedded linux with a secret camera upload

several cloud deployed control servers running a MEAN UI

a cute javascript meta-game RPG

since this isn't my day job, i have to muddle through from first principles re-learning packet disassembly and x86 assembly but i eventually got there and you can check out my groovy-based gnome-invader or ideally one of the much better writeups from the winners page.

an interesting post-script to the challenge is that ctf challenges are often criticised for being unrepresentative and simplistic - but it seems remotely exploitable cameras and node apps that allow trivial remote-code execution are going to keep the security professionals busy for the foreseeable

[meezlabs-blog]

This is the first of a series of short articles on build automation for Adobe AIR applications. One of the most cumbersome parts of managing a complex multi-platform build is the signing flow. Setting up an automated build without compromising the keys used to publish your application is a...

[meezlabs-blog]

New effect in the works…

[lastorders]

Nice

[lastorders]

pivotaltracker post-commit hook for svn

another reason to use pivotaltracker, even if you have some repos still in svn.

add this post-commit hook to your svn repo and all tagged commits will appear as comments on the associated pivotal story. if you have viewvc installed it can also add links to the revision history so you can view the commits inline

https://gist.github.com/petermd/5203384

[rathboma-blog]

Say you’ve built some library you want to use in Hive, or even in Hadoop. If this library is a UDF for use in hive queries you can load it like this:

ADD JAR ‘s3n://matthewsbucket/superudf.jar’;

CREATE TEMPORARY FUNCTION super as ‘com.matthewrathbone.SuperFunction’;

If you’re creating a...

[lastorders]

debugging amazon emr jobs in standalone mode

Amazon EMR is a fantastic service for running Hadoop jobs without the complexity of deploying and managing a cluster. Debugging a custom jar can be a problem though, esp. if you can't / won't run a local cluster for testing and the debug logs aren't always available / useful.

Here's what I do to develop / tests jars

Start a new Interactive Job Flow (Hive Program -> Hive interactive). This allows you to ssh into the cluster once its running. Make sure you provide a SSH-key-pair so you can login to the cluster

SSH onto the master (via Master Public DNS Name) as user hadoop, using the ssh credentials you specified for the cluster

SCP your job jar onto the master

Make a copy of the conf directory ("cp -rL ~/conf ~/conf.standalone" to take a copy of the files not just the links)

Edit the mapred config file (vi ~/conf.standalone/mapred-site.xml)

Remove everything, leaving the empty <configuration/> block

Run "hadoop jar" but point the config to your new standalone configuration (hadoop --config ~/conf.standalone jar JARFILE ARGS...)

The job should now run locally, outputting any errors to the console. You can then just re-upload new jars to test fixes until you are happy with everything and switch back to the standard configuration once you want to run on the entire cluster.

[lastorders]

off-screen rendering in Away3D

If you're not animating an Away3D scene then it can make more sense to just take a snapshot render. You just need to fix up the culling to ensure that the current stage dimensions are not used to clip your image.

View setup

// Render a 1600x1200 view var w:int=1600 var h:int=1200; // Position View3D at center of bitmap this.view=new View3D(); this.view.x=w/2; this.view.y=h/2; // Use offscreen clipping to clip to viewport this.view.clipping=new OffscreenClipping({minX:-w/2,maxX:w/2,minY:-h/2,maxY:h/2});

OffscreenClipping.as

import flash.display.Sprite; import away3d.core.clip.Clipping; import away3d.core.clip.RectangleClipping; /** Custom Clipping implementation for off-screen rendering */ class OffscreenClipping extends RectangleClipping { // // Public methods // /** Create new OffscreenClipping */ public function OffscreenClipping(init:Object) { super(init); } // // RectangleClipping implementation // /** Use the defined Rectangle to define the 'screen' clipping region also */ public override function screen(container:Sprite, _loaderWidth:Number, _loaderHeight:Number):Clipping { // Over-ride default implementation that returns the stage dimensions return this; } }

[lastorders]

ludum dare #20

Here's my effort at ludum dare #20. its a solo-game developing competition where you have 48-hours to make a game on a given theme from scratch. the theme was

"It’s Dangerous to go Alone! Take this!"

so I made a game set in a famous creek, where you'd be ill advised to venture without a paddle.

play 'the creek' (flash)

in a good display of life imitating art i soon discovered i really didn't have the skills or time to take this on, although i'm not sure time was the limiting factor..