Author: David Lutz
Title: Nerf
Description: This was basically an excuse to shoot Matt with Nerf bullets. Nerf bullets covered in red paint.
Bugs? None, it was brilliant.
Title: Logstash
Description: This giveaway was directly related to the logstash talk. A simple HTML form was created that submitted to itself with a GET request. This was to put some data into the apache log file. Meetup attendees were asked to pick a random number and submit it using the form. Then a random number for the winner was created with bash $RANDOM. Logstash was installed on the server that hosted the form. The logstash UI was queried to find the first winning number and name.
Bugs? None, it was brilliant.
Author: Richo Healey
Title: Random CPU Hack
Description: An essential part of cryptography is the ability to generate random numbers. This actually quite hard for computers to do. Unix-like operating systems try to use the entropy of their environment to help using external input from keyboard, mouse etc. If you can artificially control the availability of random numbers on a system, this can be a way to hack it. For example, if you could replace the kernel module for /dev/urandom with one that emits "4". However, intel CPUs manufactured recently have a random number generator on die that can be used for seeding. You can pop a number off the stack but not inspect it.
This hack uses
1. jquery to grab the list of attendees
2. wraps some asm in some python
3. abuses the CPU instruction to get a "random" number
4. picks a winner using this number "Not backdoored at all"
Bugs? Zero error checking, RDRAND isn't very entropic
Title: Game of life using attendees faces!!!!
Description:
1. Attendees of the meetup sign in to the site with their google credentials.
2. App written in node.js looks up their gravatar
3. Makes a 2 bit version of the avatar
4. Uses this image to seed a game of Conway's life
5. Takes the score from this and makes a leaderboard to pick the winners.
Amazing abuse of technology! Congratulations to the Infoexchange dev team :-)
Bugs? First two winners were suspiciously the same score. Suspect a default avatar scores highly for some reason.
Title: Command Line Meetup API
Description: Use curl to grab some json from the Meetup API. The json is a list of infracoders members who have visited the site recently. Pipe it through a few simple commands to narrow it down to one user.
curl -s "https://api.meetup.com/2/profiles?key=$MEETUPAPIKEY&group_id=3399832&order=visited&desc=truei&only=name"| jgrep --start results --simple name | sort -u | sort --random-sort | head -n 1
(You can get an API key here http://www.meetup.com/meetup_api/key/ )
Bugs? Doesn't take in to account who is actually at the meetup!