Andrew Kerr

Tumblr's 4th Annual Security Capture the Flag

Wed, 13 Jun 2018 10:17:17 -0400

We’ve hosted an internal Security Capture the Flag (CTF) event for four years in a row now, with each year getting better than the last!

The event

Previously, we were only open to Tumblr employees. This year we decided to extend an invite out to the other teams housed under our parent company, Oath.

All participants had a three hour window to hack, a buffet of tacos, beer, and wine to dive into, and a stack of prizes for the top four players (see Prizes below for details)!

Challenges were available Jeopardy-style, broken down by category. We had eight fun categories to select from:

Auth Bypass (authn | authz)

Cross Site Request Forgery (CSRF)

Cross Site Scripting (XSS)

Crypto

Forensics

Reverse Engineering

SQL Injection (SQLi)

XML Injection (+ XXE)

We also sprinkled a few “inside joke” Easter eggs around the system that awarded bonus points to anyone that discovered them! For example, if they attempted to find a hole in the CTF system itself and navigated to /wp-admin, we’d give them a flag on a prank WordPress page; or perhaps testing to find XSS with a <marquee> tag — only the greatest of all XSS tags!

While the Security Team walked around and helped out, we also setup a mini lockpick village just because.

Keep reading

Come join us!

Thu, 31 May 2018 11:52:18 -0400

cyle:

javascript:

If you’ve been following this Tumblr, you’ll likely know that we, the Core Web team, have recently started rewriting and modernizing the Tumblr web platform. This undertaking presents some incredibly exciting opportunities to innovate with lots of fun technologies. We’re working on improving every aspect of the web; the dashboard, the archive, the blog network, you name it.

Are you a senior JavaScript engineer and wanna be a part of this adventure? Come join Core Web! You’ll help create the building blocks with which a brand new modern Tumblr will be built. Your work will directly impact and define the user experience for millions of users and the development tools for a large number of product engineers across several teams at Tumblr!

What you’ll do

We’re looking for an extraordinary senior JavaScript engineer who wants to take on the following challenges:

Keep making our build and deployment more delightful and futuristic

Help establish norms and standards for how this new web client should be architected, including setting JavaScript, CSS, performance and other best-practices, and introducing/creating the tools to achieve them

Internally and externally raising awareness around the work the team is doing by being active in the Open-source and engineering community

Whatever else you think will help us create the highest quality web platform and development experience!

Who we’re looking for

An ideal team member is someone with:

Strong JavaScript and CSS fundamentals

Experience setting up Continuous Integration / Continuous Deploys

Expertise in build tools like Webpack, Parcel (or similar)

Pragmatism and the ability to decide what’s “good enough” (while planning ahead and knowing when to iterate)

An ability to independently drive projects

A desire to innovate and bring new things into the world

An understanding of code quality, unit test coverage, and performance

Empathy and the desire to elevate those around them

The belief that work is just as much about the journey as the destination

Our current toolkit

Webpack

ES6

React and React Router

CSS Modules

TypeScript

Jenkins and Jenkins pipelines

Docker

Node and Express

Kubernetes

If you’re interested, but your background does not include all of the above, please don’t let that hold you back. Let’s talk! To apply, follow the instructions at the bottom of our official job listings page!

We can’t wait to hear from you!

come work for Tumblr’s Core Web team to help build a brave, beautiful, and bold new Tumblr

cyle: tumblcoin market is back, blaze it

Fri, 06 Apr 2018 16:58:55 -0400

cyle:

tumblcoin market is back, blaze it

staff: It’s the Great Tumblr Bug Hunt: iOS Edition Help find...

Fri, 30 Mar 2018 13:46:51 -0400

staff:

It’s the Great Tumblr Bug Hunt: iOS Edition

Help find bugs lurking in the Tumblr iOS app before they get released to the bug-hating public.

Who’s eligible: The first 10,000 people to register. You need to be an iOS user, obviously. And you should use Tumblr every day—because bugs are natural sneaks. You won’t find them if you’re not using the app all the time.

How it works: You’ll get access to each new release about a week before it goes public. When you see a bug, take a screenshot and email it to to ios-beta@tumblr.com with a description of what happened and what you were doing at the time. (Some legal stuff: Any feedback that you send in is completely voluntarily but it will be exclusively owned by Tumblr so we can use it to make Tumblr better—even the mean stuff).

What you should know: You’ll be looking for bugs, which means there are bugs to look for. Don’t register if you’re expecting a bug-free experience. But if you get tired of bugs, you can leave the beta program at any time. Also, even though it’s a beta, it’s still the Tumblr app and the same Tumblr Terms of Service and Privacy Policy applies.

How to register: Join this Google group with your email. In a couple days you’ll get an email from TestFlight with instructions on how to install the beta.

What else you should know: Is in this FAQ.

angel-baez:God bless John Oliver

Mon, 19 Feb 2018 17:08:44 -0500

angel-baez:

God bless John Oliver

alexander: adulthoodisokay: adulthoodisokay: continuants: htm...

Sat, 17 Feb 2018 15:28:35 -0500

alexander:

adulthoodisokay:

adulthoodisokay:

continuants:

htmlbyjoe:

shadowexorsist009:

adulthoodisokay:

yer-so-bad-best-thing-i-ever-had:

adulthoodisokay:

rachelfershleiser:

adulthoodisokay:

continuants:

adulthoodisokay:

htmlbyjoe:

adulthoodisokay:

htmlbyjoe:

Found some eggs

wait you just like found eggs casually sitting around tumblr HQ and were like “cool, nothing could possibly be wrong with these eggs, i’ll eat one!” i mean it’s tumblr HQ what if they were sent by a disgruntled user and were like laced with PCP or something?

They were in the fridge!

this whole story makes me v uncomfortable tbh. casual fridge eggs, just for the taking? i wouldn’t trust them.

SIXTH FLOOR HAS FRIDGE EGGS TOO???!!!!!1

WHAT IS HAPPENING AT TUMBLR HQ?!??? WHO IS LEAVING SKETCHY FRIDGE EGGS JUST LYING ABOUT WTF

Cates do you want us to bring you some eggs?

Good lord, no. But if u wanna come hang out at BuzzFeed HQ you can wash your weird fridge eggs down with my desk scotch.

My takeaway from this is that I want a job where I can have desk scotch. Or any kind of desk liquor.

Desk scotch/whisky/wine is the best. I am very lucky.

BUT BACK TO FRIDGE EGGS. ARE THEY PRE-PEELED? THEY APPEAR TO BE LIKE ALREADY PEELED EGGS. SOMEONE PHYSICALLY PEELED THOSE AND PUT ‘EM IN A CUP AND I THINK THAT’S WEIRD.

Someone wanted to be a bit eggy (edgy) I guess… no laughs for my pun? Ok

The eggs are back in town

Egg Review: kinda rubbery, but overall p good. 8/10 probably will eat again

I am seriously concerned about what goes on at Tumblr HQ.

I JUST GOT BACK TO MY DESK AND
WHY DO I HAVE DESK EGGS FROM TUMBLR AT MY DESK AT BUZZFEED

i survived off tumblr fridge eggs as an intern when they didnt have breakfast

While Tumblr fridge eggs now come in a bag, I can confirm they’re a-ok!

stickerstory: I’ll like it with all my heart, maybe even reblog...

Wed, 14 Feb 2018 19:35:03 -0500

stickerstory:

I’ll like it with all my heart, maybe even reblog it ;)

cyle: i found these old tumblr stamps in the office and now i’m incredibly happy

Wed, 14 Feb 2018 17:47:06 -0500

cyle:

i found these old tumblr stamps in the office and now i’m incredibly happy

security: security: support: support: SSL security, which has been available on the dashboard...

Mon, 05 Feb 2018 17:54:38 -0500

security:

security:

support:

support:

SSL security, which has been available on the dashboard for a while, is now here for blogs. To turn it on, go to your blog settings and enable “Always serve blog over SSL.” Mmmmm, security. Check out our help docs for more info.

An update on this:

SSL is being turned on by default for all Tumblrs that use our Official theme on the web, except those with custom domains. Because, well…Optica is the default theme, and why shouldn’t secure be the default?

This change only affects the web, because the mobile apps already use SSL all the time for your safety.

We don’t recommend it, but if for some reason you need to disable SSL, you can do so via your blog settings on the web, by turning off the “Always serve blog over SSL” option.

Update to the update: Now SSL is available for blogs with custom domains, too. To turn it on, go to your blog settings and enable “Always serve blog over SSL.” Once you’ve done that, it takes a while (typically less than a day) for the SSL on custom domains to activate. We’ll send you an email when it’s ready.

Yet another update: SSL is now being turned on by default for ALL Tumblrs that use our Official theme on the web. Even though we don’t recommend it, you can still turn it off in your blog settings.

😎

Photo

Thu, 01 Feb 2018 21:07:55 -0500

cyle: we had another crazy hack day at tumblr

Wed, 24 Jan 2018 13:00:10 -0500

cyle:

we had another crazy hack day at tumblr

aleclikesmacintosh:Word 98′s Helper

Mon, 15 Jan 2018 21:10:57 -0500

aleclikesmacintosh:

Word 98′s Helper

Playing low frequency noise to disrupt hard-drives: denial of service for CCTVs, data-centers, and other computing environments

Mon, 15 Jan 2018 14:40:21 -0500

mostlysignssomeportents:

A group of Princeton and Purdue researchers have demonstrated a successful acoustic attack against mechanical hard-drives where low-frequency noise keyed to the resonant frequency of the drive components is played nearby, causing the drive to vibrate so that the drive can neither be read nor written to.

The researchers demonstrated the attack under lab conditions, successfully preventing a CCTV’s DVR from recording the camera signal and stopping a laptop from being able to use its operating system.

The attack is not ready for primetime yet, though: this preliminary work requires relative precision in speaker placement as well as knowledge of the make and model of the target drives. However, the researchers hypothesize that with some refinements, the attack could be carried out by, for example, tricking (or hacking) a victim into playing the correct tone through their computer or device speakers.

https://boingboing.net/2018/01/15/bad-vibes.html

http?! Come on… at least use https! 🤣

Fri, 29 Dec 2017 17:00:15 -0500

http?! Come on… at least use https! 🤣

Photo

Sun, 24 Dec 2017 21:00:35 -0500

tess: mattklimas: Recently made a set of coloring pages for a...

Wed, 13 Dec 2017 15:00:57 -0500

tess:

mattklimas:

Recently made a set of coloring pages for a @tumblr meeting. Of course, cats. This one DEEP SPACE KITTY.

Business pro tip: grown-ups love to color during meetings and can pay better attention while doing so. Thanks for designing these coloring pages! Our meeting was better for having them. 💕😺

Deep Space Kitty
Deep Sea Kitty
Deep Earth Kitty

Once more for old time’s sake

Fri, 01 Dec 2017 16:12:15 -0500

staff:

🔥 With your help, we passed Title II net neutrality protections. Now we need to defend it.🔥

On December 14 the FCC will vote on Commissioner Pai’s plan to repeal Title II rules. This week he tried to justify that decision with a “myth busting” explainer where he makes a lot of sweeping claims he doesn’t think you’ll fact check.

So let’s go through his big points:

❌ Mr. Pai claims ISPs won’t block access or throttle content

These are the real facts. Before Title II, the internet was so “free and open” that…

Comcast blocked P2P file sharing services (EFF).

AT&T blocked Skype from iPhones (Fortune) and, later, wanted FaceTime users to pay for a more expensive plan (Freepress).

MetroPCS blocked all streaming video except YouTube (Wired).

In today’s media market where the same huge companies make and deliver content, Commissioner Pai wants us to trust that corporations won’t use their dominance to bury competitive content or services.

❌ Mr. Pai claims Title II keeps ISPs from building new networks

Here’s another claim Commissioner Pai doesn’t want you to fact check, but:

AT&T’s own CEO told investors that the company would deploy more fiber optic networks in 2016 than 2015 when the FCC passed Title II protections (Investor call transcript).

Charter’s CEO said “Title II, it didn’t really hurt us; it hasn’t hurt us” (Ars Technica).

And Comcast actually increased investment in their network by 10% in Q1 of this year (Ars).

❌ Mr. Pai claims repealing Title II won’t hurt competition

As we mentioned above, ISPs tried to interfere with the services their customers could access and courts had to step in to stop them.

The FCC tried to craft net neutrality rules in 2010 called the Open Internet Order but the ISPs sued and won. The courts told the FCC that the only way to guarantee a free and open internet was using their Title II authority. Without those protections, any of these things would be legal:

Your ISP launches a streaming video service and starts throttling other streaming services until they’re unusable.

Your phone company cuts a deal with a popular music streaming service so it doesn’t count towards your data cap but lowers your overall data limit. If a better service comes along (or your favorite artist releases new tracks somewhere else) you can’t use it without incurring huge data fees.

A billionaire buys your ISP and blocks access to news sites that challenge their ideology.

Repealing Title II would be like letting a car company own the roads and banning a competitor from the highways.

❌ Mr. Pai claims there won’t be fast lanes and slow lanes

Let’s break this down: We won’t have fast lanes and slow lanes, we’ll have “priority access” and…non-priority access? Well gosh.

🚨 Please help us protect Title II one more time! 🚨

This week we co-signed a letter with more than 300 other companies—businesses Mr. Pai gleefully ignores—urging the FCC to retain the Title II internet protections. Now we need you.

Go to 👉 Battle For The Net 👈 to start a call with your representatives in Congress. Tell them to publicly support Title II protections.

The FCC votes on December 14.

We’re only powerful when we work together.

Oh, also: that post about automatically unfollowing the #net neutrality tag—it’s not true. It’s really not. That’s not who we are. Whatever happened, we haven’t been able to reproduce it. We tried. A lot.

But if it were true—which it’s not, we feel compelled to say again—THAT’S EXACTLY WHY YOU SHOULD CALL YOUR REPRESENTATIVES and demand a free, open, and neutral internet.

We can do this one more time, guys! ❤️

david:Letter I just sent to my team ♥️ 💕

Mon, 27 Nov 2017 13:46:31 -0500

david:

Letter I just sent to my team ♥️

💕

unwrapping: “People come to me and say that Tumblr saved their...

Sat, 11 Nov 2017 20:58:46 -0500

unwrapping:

“People come to me and say that Tumblr saved their lives.” — Tumblr founder and CEO David Karp (@david)

aleclikesmacintosh:7.5 Startup

Sun, 05 Nov 2017 17:23:37 -0500

aleclikesmacintosh:

7.5 Startup

Andrew Kerr

Tumblr's 4th Annual Security Capture the Flag

The event

Come join us!

What you’ll do

Who we’re looking for

Our current toolkit

come work for Tumblr’s Core Web team to help build a brave, beautiful, and bold new Tumblr

cyle: tumblcoin market is back, blaze it

tumblcoin market is back, blaze it

staff: It’s the Great Tumblr Bug Hunt: iOS Edition Help find...

It’s the Great Tumblr Bug Hunt: iOS Edition

angel-baez:God bless John Oliver

alexander: adulthoodisokay: adulthoodisokay: continuants: htm...

stickerstory: I’ll like it with all my heart, maybe even reblog...

cyle: i found these old tumblr stamps in the office and now i’m incredibly happy

security: security: support: support: SSL security, which has been available on the dashboard...

Photo

cyle: we had another crazy hack day at tumblr

aleclikesmacintosh:Word 98′s Helper

Playing low frequency noise to disrupt hard-drives: denial of service for CCTVs, data-centers, and other computing environments

http?! Come on… at least use https! 🤣

Photo

tess: mattklimas: Recently made a set of coloring pages for a...

Once more for old time’s sake

🔥 With your help, we passed Title II net neutrality protections. Now we need to defend it.🔥

❌ Mr. Pai claims ISPs won’t block access or throttle content

❌ Mr. Pai claims Title II keeps ISPs from building new networks

❌ Mr. Pai claims repealing Title II won’t hurt competition

❌ Mr. Pai claims there won’t be fast lanes and slow lanes

🚨 Please help us protect Title II one more time! 🚨

Go to 👉 Battle For The Net 👈 to start a call with your representatives in Congress. Tell them to publicly support Title II protections.

The FCC votes on December 14.

We’re only powerful when we work together.

We can do this one more time, guys! ❤️

david:Letter I just sent to my team ♥️ 💕

unwrapping: “People come to me and say that Tumblr saved their...

aleclikesmacintosh:7.5 Startup