TLtlrobinson·Apr 10, 2018
In fact "GitCoin" was one of the levels in Stripe's distributed systems CTF in 2014: https://github.com/ctfs/write-ups-2014/tree/master/stripe-ct...
In Why SQLite Does Not Use Gitctfs
write-ups-2014
Python2014–2018
ctfs / write-ups-2014
write-ups-2014
Wiki-like CTF write-ups repository, maintained by the community. 2014
13Distinct people
15Mentions
0Explicit recommenders
1.9KGitHub stars
What to know before exploring
What it is
Wiki-like CTF write-ups repository, maintained by the community. 2014
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year15 dated mentions
Observed mentions: 2014-01-30 19:56:12 UTC to 2018-04-10 23:39:31 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 11 | 2 | 9 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
15 sourcesI remember, that it was the 9447 ctf in 2014.
The challenges were bashful and tumorous.
See: https://github.com/ctfs/write-ups-2014/tree/master/9447-ctf-...
In Don't publicly expose .git (2015)Note that we also provide write-ups and files for CTFs in 2013 [0], 2014 [1] and this year [2]. If you don't know what CTFs are: https://ctftime.org/ctf-wtf/
[0]: https://github.com/ctfs/write-ups-2013
[1]: https://github.com/ctfs/write-ups-2014
[2]: https://github.com/ctfs/write-ups-2016
In Show HN: Writeups and Files Repo for CTFs in 2015Related is the Gitcoin mining challenge from Stripe's Capture The Flag 3.
Here's a writeup: https://github.com/ctfs/write-ups-2014/tree/master/stripe-ct...
A Gitcoin miner updates the ledger (a text file in the repo), and "mines" the next-smaller hash.
It doesn't have consensus, but it does give a neat programming challenge.
In Is Git a Block Chain?Just recently I saw this used to make a script fail at a very specific point. A script running later expected the first one to have run successfully, opening up an attack vector that works even with CSP in place. The full story is here:
https://github.com/ctfs/write-ups/tree/master/hack-lu-ctf-20...
In Don’t use IDs in CSS selectors? (2011)For fun: Stripe's CTF3 included an implementation of Gitcoin in which the work wasn't actually semantically valuable contributions to a repo, but rather brute-forcing the commit message until the commit hash meets a certain criterion.
https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/le...
In Google's end-to-end key distribution proposalAs a regular CTF competitor for over 4 years now, I cannot emphasize the value in simply playing CTFs if you really want to learn this stuff. So many people seem to think there's a secret manual laying around that teaches you all that is involved in going from a compiled binary to a shell. The referenced book should be used as a resource for when you come across a new topic and need some help. If you want to get started here are some useful links.
http://smashthestack.org/
https://ctftime.org/
http://overthewire.org/wargames/
http://repo.shell-storm.org/CTF/
https://github.com/ctfs/write-ups
In Reverse Engineering for Beginners: Free bookThis was a challenge in Stripe CTF3. As mentioned by aljungberg, see https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/le...
In BasicCoin, a cryptocurrency in less than 600 lines of PythonThat's what Stripe's CTF3's Gitcoin was like: https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/le...
In BasicCoin, a cryptocurrency in less than 600 lines of PythonFor level2 you could also implement load balancing pretty easily. See my write-up: https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/le...
Would you mind sharing the code to your solutions as gists so we can link to them from the write-ups repository? You got some very nice scores.
In CTF3 architectureHere are my thoughts: I managed to scrape through level 4 so saw them all - this CTF was fun and educational. Level 4 in particular felt like a real education (for me at least), and a great way to learn. Unlike many others I was fond of level 0 because it brought up questions that even beginner programmers should address - how to organise your data so that you can search through it easily, which was in some ways a preparation for the other levels. For the more expert than me it probably felt tedious or inconsequential, but it was quick to solve, and I thought inviting for beginners and open ended.
Lessons learned for me
Distributed consensus was really interesting; I'd never heard of it and enjoyed reading about Paxos and Raft, even if I don't fully understand them yet. Distributed searches can actually be faster than searches in one pro
Read the rest
cess - I didn't believe this but as resources were limited on the server it was true in some cases (depends how fast you can make your search, mine wasn't as fast as Henrik's :).
Big scala projects take an aaage to compile - is it normally this bad in real projects? Anyone care to comment? The remote was pretty slow, so that might be why.
Golang needs package versioning! On level 4 there was a versioning bug with differing versions of the go-raft library being fetched locally and on the server which led to problems setting the heartbeat timeout of raft. That was confusing and annoying.
A few notes for the CTF authors
The dramatic variation between resources on remote and locally was a problem in tests - I felt like that needed to be adjusted for as the local test results were meaningless compared to the server. This particularly made level 3 and 4 difficult.
Code examples are great to get you started, but it'd be nice if there was also a clearly specified API for each one which you were required to conform to, to make it easier to use another language, and if the build scripts simply launched one binary at all times - level 3 had two different styles of starting the servers for remote and local for example, that was frustrating.
The varying test cases were sometimes frustrating, and were too varied and randomly chosen. I completely agree with Henrik that you need small tests. Each run should have say 5 tests which can be run individually (for speed), or as a suite. The downloading of tests broke a few times for me and left me stranded and constantly re-downloading new test data/tests seemed a bit pointless. Proper logging output when tests fail is really important - level3 was particularly bad for this as the diffs were useless; I had to edit the test harness to get decent output.
The use of the JVM on level 3 was pretty painful for me - compile times on remote were in the minutes, and I couldn't even get it to compile locally even after installing another JVM, nor on remote without compiling all the sbt stuff - this one was probably my fault, and I just rewrote with golang in the end. Explicit language independence for all the problems would be great.
Unix sockets felt like an unnecessary distraction which caused pain on level 4, it would have been nice if it used IPs, but perhaps for reasons to do with Octopus that wasn't possible, and on a deeper level, being given broken code to fix just felt a bit wrong and distracting - having slow code you have to speed up is one thing, but having code which feels like it has been sabotaged is another.
Don't bother changing the deadline even if people whine - the contest isn't remotely fair anyway or an objective test, so it's better to have a deadline and stick to it.
Oh, and thanks again Stripe, it was a blast.
The original code and some more writups:
https://github.com/ctfs/write-ups/tree/master/stripe-ctf3
http://blog.joneisen.me/post/75008410654
Added a link to your write-up and solutions to the collection here: https://github.com/ctfs/write-ups/tree/master/stripe-ctf3
In Stripe-CTF 3 WriteupStripe CTF3 Writeup – Problems published
4 points · Open discussion