We’ve hosted an internal Security Capture the Flag (CTF) event for four years in a row now, with each year getting better than the last!

The event

Previously, we were only open to Tumblr employees. This year we decided to extend an invite out to the other teams housed under our parent company, Oath.

All participants had a three hour window to hack, a buffet of tacos, beer, and wine to dive into, and a stack of prizes for the top four players (see Prizes below for details)!

Challenges were available Jeopardy-style, broken down by category. We had eight fun categories to select from:

• Auth Bypass (authn | authz)
• Cross Site Request Forgery (CSRF)
• Cross Site Scripting (XSS)
• Crypto
• Forensics
• Reverse Engineering
• SQL Injection (SQLi)
• XML Injection (+ XXE)

We also sprinkled a few “inside joke” Easter eggs around the system that awarded bonus points to anyone that discovered them! For example, if they attempted to find a hole in the CTF system itself and navigated to /wp-admin, we’d give them a flag on a prank WordPress page; or perhaps testing to find XSS with a <marquee> tag — only the greatest of all XSS tags!

While the Security Team walked around and helped out, we also setup a mini lockpick village just because.

Keep reading

If you’ve been following this Tumblr, you’ll likely know that we, the Core Web team, have recently started rewriting and modernizing the Tumblr web platform. This undertaking presents some incredibly exciting opportunities to innovate with lots of fun technologies. We’re working on improving every aspect of the web; the dashboard, the archive, the blog network, you name it.  

Are you a senior JavaScript engineer and wanna be a part of this adventure? Come join Core Web! You’ll help create the building blocks with which a brand new modern Tumblr will be built. Your work will directly impact and define the user experience for millions of users and the development tools for a large number of product engineers across several teams at Tumblr!

Originally posted by successfulantfarmer

What you’ll do

We’re looking for an extraordinary senior JavaScript engineer who wants to take on the following challenges:

• Keep making our build and deployment more delightful and futuristic
  
• Help establish norms and standards for how this new web client should be architected, including setting JavaScript, CSS, performance and other best-practices, and introducing/creating the tools to achieve them
  
• Internally and externally raising awareness around the work the team is doing by being active in the Open-source and engineering community 
  
• Whatever else you think will help us create the highest quality web platform and development experience!
  

Who we’re looking for

An ideal team member is someone with:

• Strong JavaScript and CSS fundamentals
  
• Experience setting up Continuous Integration / Continuous Deploys
  
• Expertise in build tools like Webpack, Parcel (or similar)
  
• Pragmatism and the ability to decide what’s “good enough” (while planning ahead and knowing when to iterate)
  
• An ability to independently drive projects
  
• A desire to innovate and bring new things into the world
  
• An understanding of code quality, unit test coverage, and performance
  
• Empathy and the desire to elevate those around them
  
• The belief that work is just as much about the journey as the destination
  

Our current toolkit

• Webpack
  
• ES6
  
• React and React Router
  
• CSS Modules
  
• TypeScript
  
• Jenkins and Jenkins pipelines
  
• Docker
  
• Node and Express
  
• Kubernetes
  

If you’re interested, but your background does not include all of the above, please don’t let that hold you back. Let’s talk! To apply, follow the instructions at the bottom of our official job listings page! 

Originally posted by strangememories

We can’t wait to hear from you!

i found these old tumblr stamps in the office and now i’m incredibly happy

Originally posted by fyspringfield

SSL security, which has been available on the dashboard for a while, is now here for blogs. To turn it on, go to your blog settings and enable “Always serve blog over SSL.” Mmmmm, security. Check out our help docs for more info.