Transcript 0:00 I'm nervous after not doing this for a while. Like- Yeah, we haven't done it in a minute... no, not, not even that. I'm, I'm nervous. Like, is it actually recording, or is it just saying it's recording? I don't know. 0:09 Uh- I mean, I see both audio- We could ask the AI, and it could just tell us whether the thing we physically set up is doing what we've asked it to Welcome back to Hacker Hangouts. We are here Saturday at DEF CON in... 0:27 My gosh, it's been an awesome DEF CON. We have been all over the map. We have mostly been focused in the contest area, though, and- It's where everything good happens anyway. It's very true. We're in, we're in Scav Hunt. 0:39 And Scav Hunt, as always, such an amazing contest. And they have- Set up, they set us up, uh, this between two spanning trees set up, uh, which is absolutely gorgeous. Dual De outdoes himself every year. 0:51 The, the only thing I don't know is with these chairs and this pillow and being this close, I, I don't... Like, I don't know how to sit. I don't know that your shorts are short enough, and you should fix that. 1:02 [laughs] We gotta see those pretty, pretty knees, my good friend. All right. So let's jump into it. So we, we tested... Uh, we talked to a bunch of contests, and one of the biggest ones that fell in was Hack Fortress. 1:16 Yeah. And this is what spawned some of the conversation, was the, on the Discord... 1:21 So Hack Fortress, for those who don't know, originally, a couple years ago, it was a team would play Team Fortress, they were gamers, and then another team would be hackers doing challenges. 1:33 The better the gamers did, you would have the hackers get hints. Power-ups. And then the, the, the hackers could, they'd buy power-ups and things like that. Yeah. 1:41 But it was this really cool interaction of, of hacking and gaming. Now, I was wondering this year when it came back, how were they were gonna do it- Yeah... because they weren't gonna bring all the equipment. 1:51 So they said, "No." Mm. 1:53 "It's, they're gonna use Quake III, it's gonna be the JavaScript client, which runs in a browser, and you're gonna bring your own hardware," to which someone in the Discord asked the question, "Well, how, what are you gonna do to, like, prevent, like, hacking or like-" Aim bots... 2:09 like aim bots and, and like real ch- cheating. Yeah. Like, a- against the spirit of the game- Yeah... let's say. And the response in it was, "We're not." Go ham. Go ham. 2:22 And I walked up, and we, we had this conversation that they didn't do the scoreboard, and it sounded like they had some issues with the contest. 2:29 But ultimately, it launched this con- uh, this question of, like, how are contests gonna handle LLMs? And we talked about it a little bit on the past stream before we came on. 2:40 We talked about this a little bit on and off, and I think neither of us has a good answer for this. 2:46 At least we didn't, and then we come here, and we see how the games are actively, you know, bobbing and weaving around the problem, and some of them are not. 2:54 Some of them are like, "Let's just bring back what we did last year." They did it, and they found how the players were starting to use it. Some of the contests are not very happy about that. 3:03 Other contests, they're vibe changing the contest as it runs in response to what the players are doing. And, uh, every approach seems different, and I think the creators are... I, I would say some of them are a little 3:21 put off by it. They're not sure if they're gonna come back. They're not sure if they wanna keep doing it if this is all it's gonna be. And other ones are like, "I'm very excited to see how this goes." 3:31 Well, and here's where my mind started going. Let's, again, let's use the Quake III Hack Fortress team. So no human is ever gonna compete with an aim bot. Can't. And now- Yeah... 3:44 even worse with that game is because it's JavaScript, you have a pro- a proxy, there's WebSockets, you can legitimately say, "I see a player here. Great. Adjust vector. Aim. Fire." Sure. Yeah. And it, it, it's trivial. 3:57 It's not like, oh, the, the... I have, I have to cr- I don't have to create my own hooks into the software. They provide me a proxy for it. Yeah. 4:04 So the best way to play that game would be to program aim bots, and you have a 10-person team. It would be six players who don't actually play, it's just aim bots, and then they come to the hacking side. 4:19 But there's nothing to do on the hacking side, because all the hackers- All they do, yeah... are doing, are running stuff through Codex or Claude or insert whatever LLM to solve the challenges. 4:29 And they'll be able to solve the challenges for every one except physical, because all the challenges need to be easy enough to be solved within five minutes. Five minutes, yeah. Because it's a 30-minute- Less than that. 4:39 Like- Yeah. It's a 30-minute game. You have 20 challenges. So, like, they're made to all be solved. So this game will revolve into, or evolve into 10 people staring at computers do- doing work. 4:51 While everyone else is staring at 10 people staring at computers doing work. Ex- exactly. 4:55 Which is actually exactly what happened, I think it was six or seven years ago, when the Cyber Grand Challenge came, and they had all of these servers up on a stage. And they were like, "Ready? Go." 5:09 And they, like, cut a ribbon, and then there was a big crowd of people that just stood there watching servers compute. And there was, there was nothing to look at. 5:19 [laughs] And y- and but here's the thing is, so we, you and I then came, and we started competing in Reality Overrun. Yeah. Awesome game. They've done so many cool things with it. Oh, my gosh. They... 5:31 You, you run around a map. You run around a, a, this virtual world they created. Actual game. Actual game you can, like, log in and play. Full story. You have mobs. You have boss fight. 5:42 But we hit this really interesting thing, which was they, they put protections in to kind of, like, hinder you using LLMs. But it then b- quickly became this fun cat-and-mouse game. Yeah. 5:52 It became really, a really fun cat-and-mouse game. Yeah. Because it was, you'd find a way around it, they would rate limit it, and then you would, you would come up with another one. 6:00 And then we started talking with G Hawk as he was sitting there, and he mentioned something, "Well, some of that is against the spirit of the game." 6:08 And I, I mean, I took an instant, instant dislike to that response, in part because, for example, uh, in the game you have to go to different places and, and to find the challenges and unlock the challenges, and there are monsters all over the place, and they didn't want you to just use the coordinate system to warp around the map And, and there's a function here, which is, we disassembled it. 6:35 One of the challenges, like you have to listen on the socket, and you get a flag there, it shows up. Yep. But while you're doing that, we started seeing this, this function which would come across, which was move player. 6:46 Yep. And it would take XY coordinates, and if you gave it, you would warp on the map. Yep. So as a player, it's really hard to know what- Am I supposed to use that or not? 6:56 Because I'm supposed to be looking at this for other reasons, but then I see that come across, and it's really difficult for me to know, am I supposed to be using that or not? 7:06 And so you go use it, and then you f- you trip one of the, the mouse traps that you fall into, your account gets flagged, and then there's a timeout, and you go back and forth. 7:14 And the, some of the fun dynamic is, okay, maybe some of the mouse traps or the holes, the pitfalls you fall into, they were a little too steep, right? Yeah. 7:23 Like, we know that they know that you're gonna use scripts or a- LLMs to, to fight it, and we know that the- there are mouse traps to fall into, but then all of a sudden if I get flagged and I have to go physically do something to have my account unlocked, but I have other things I need to do, it makes the game less fun to play. 7:40 So there's this nice cat and mouse as you're play testing. Like, what's the right amount of, "We caught you," in order to disincentivize you from doing it? 7:49 But there is this thought of it's against the spirit of the game. You shouldn't be able to teleport around, but we're at a hacking conference. Yeah. So is it against the spirit of the game? Well, it, it- Or is it not? 8:03 It's a g- it's... There's not a right answer to that question, I think. Mm-hmm. And I think as a hacker, you wanna use any tools you have, and it would, you would be, you would be dumb not to use an LLM. 8:20 I think that is a fair statement. You, it ain't n- dumb. You would be hindered- Yep... very severely. 8:28 And it's been interesting because I feel like there's a, there, there is this weird friction with LLMs right now, which i- is actually kind of surprising to me. Yeah. 8:37 But I get, because it makes it very difficult to create challenges. Yes. So, but the thing is like, no, we don't want you to use LLMs, and this hearkened back to a really funny conversation we w- we had with Skyria. 8:50 She, she, she created it, this amazing pair of pants. Again, y- you're, you're- She makes clothing... she makes clothing. She's very, she made clothing. So she made a great pair of pants. She was showing it off to us. 9:01 It's got all these fun features. And go ahead. And then she, it, all these great features, and we're like, "Well, th- th- that is incredible. That's so cool." She goes, "Yeah, but, but I used a pattern." 9:13 And well, first I was like- A-... "Oh, you made that yourself by hand?" And she goes, "I used a pattern." So- It- So yes. So yes. Yes. You made it by hand. [laughs] You made it by hand. 9:23 And then it la- launched us into now this ongoing joke, which is like, well, I didn't actually hack anything. I, I, I used an LLM. I used an LLM. 9:32 And somebody said to me while we were sitting down playing the game, um, there's this old quote, uh, by Carl Sagan that says, "In order to make an apple pie from scratch, you first have to invent the universe." 9:44 And it, and it, it makes sense. Perfect sense. Is you go, because we started asking this question, okay, well, what is hacking? At what point is it, is it your hack? Is it your hack? 9:52 Is, is the, you go, "Well, you used an LLM." Well, o- okay. So you, well, as, [laughs] you know, you, you used an LLM. Oh, well, you used Google. Well, a real hacker wouldn't actually use Google. 10:09 They would go and grab an encyclopedia. 10:11 They would, they would grab the actual raw architecture manual and read the esoteric garbage that was originally produced instead of using the Wikipedia and shortcut systems that we've already created. 10:22 And then you would program it in what language? Uh, Assembly clearly, right? Yeah, you- 'Cause that's the only real language... because that's the thing is you can, you, you go, "Oh, well- Yeah... 10:28 I programmed it in Golang." Well, that's, that's kind of a cheating language. Yeah. You really should use... No, and then you go, Assembly. You can't use Assembly. 10:39 That, that's still, like, a little bit- You need to be writing the zeros and ones directly. Yeah, but then here's the thing is then we go over to Hardware Hacking Village, you know what Bunny will say? 10:48 Can't really write ones and zeros. Ah. That's really, that's really voltage. Yeah. So you need to actually write- In, in reality, it's all analog, so if you're not using a digital analog, [laughs] you're- Yeah. 11:00 [laughs]... if you're not using an analyzer to figure out the exact voltage you're putting on the line so that you know when you flip that bit, you're cheating. 11:08 And it, it seems so funny to me because we, we, we went down this path, and then we realized how absolutely arbitrary it is of at what point do you put a line. You go, "Oh, well, you used a pattern." 11:19 W- where does the line become, oh, it's, that's your hack. You're allowed to take credit for that. So- But you're not allowed to take it over here... 11:25 I'm gonna back up 'cause you were saying, and I said, some, some of the contests were actually kind of upset about it, and one of them was Crash Compile, um- Yeah... which is always a really fun game to watch. 11:38 You're supposed to be getting drunk, trying to compile esoteric code, and if you get it wrong, you lose points and all that stuff. And it's really fun to watch what's going on because there's the human getting drunk and 11:50 component of it. Mm-hmm. And supposedly, the team that ended up winning came totally prepared to just do it right out, quote unquote, "the right way." 12:01 But then they watched the other teams competing, and they all used agents, and they said, "W- if we get up, we're gonna lose, and so w- we'll be up there for way longer. We won't finish things." 12:12 So they were like, "Fine, let's just, let's just prisoner's dilemma. Everyone else is doing it. We're doing it." So they get up, and they just kill the entire competition. 12:21 All, like, all of the s- uh, all of the things were solved in 45 minutes. And you have to ask the question- Is that fun to watch? The... I don't know. 12:33 'Cause that's part of the fun of that competition is it's fun to watch. Yeah. But now you're just like solve all problems, make no mistakes, and now I just sit here and drink a beer. And watch it. And watch it. 12:44 Well, this is now becomes a very weird thing is you're, you're silly if you don't use an LLM in the contest. Yeah. And then it, it looks dumb if you, if you, if you do. 12:58 And then and you're neutering yourself if you, if you don't, if you don't actually use one. And there is very few contests which, A, are not solvable with LLMs, or are not heavily impacted in one way or another. Right. 13:15 And we're sitting in Scav Hunt. Yep. And- Scav Hunt's probably the good example of right now they're, they stopped accepting pictures. They will not accept pictures of, uh, items. They will only accept videos. 13:28 But they've been talking about how it's coming, like, next year, year next, it'll be cheap enough and fast enough to produce videos of a particular thing, so they're gonna stop accepting videos. 13:38 They were talking about, like, maybe Polaroids, maybe. But even then there's- But then you said Polaroids. It's like, well, yeah, but then I can generate it on my phone, take a picture of a Polaroid. Yes. 13:47 And take a picture with the Polaroid camera of the thing- Yeah... that I generated on my phone. So it's like e- even Scav Hunt is impacted by this, where now it's do they have to bring everything physically to 13:59 the table, and c- does that mean we have to stop doing challenges with people 'cause then that'll just be, you know, constantly... And we had some fun times at this conference, uh, with the people challenges. 14:10 Um, but so it, it, it d- even the physical heavy challenges like Scav Hunt are still impacted [laughs] by it- Yeah... 14:19 which is kind of wild because they were depending on pictures and videos for proof that you did a thing with a person, and now they're like, "Well, we can't trust any of that now." 14:28 So th- but this is the thing is I, I, I don't think they've had anyone actually do it. Yeah. Like, no one, no one has... I don't think there's e- has, has been a single team that has done it. It's a lot of... 14:37 It's, it's fear over it, and they wanna keep the contest fair and all of that. Yeah. Th- this is where we go back to that the spirit of the game. I think with Scav Hunt, the spirit of the game is very clear. Yeah. 14:52 It's you have to create the item, you have to find the item, you have to convince the judge, you have to do whatever it is, but- Keep it weird... keep it weird, but you can't, you can't fake get an item. 15:03 Like, and that, there's, there is a very clear line that can be drawn- Yeah... for this contest. But when you go, like, crash and compile, you go, "Well, we're not gonna allow LLMs." 15:15 Now, what you could do is, again, go grab Chromebooks and say, "Hey, [laughs] here is your computer. You're now air-gapped," which is almost impossible- Right... 15:23 now because, again, there, with that game, there's so many esoteric languages that you have to research on. Yeah, y- yeah. So now you have to do this, okay, no LLMs for this. 15:33 But then you, again, it gets very complicated. Well, you're allowed to use VS Code, right? Because you have to co- Yep, you have to. Well, what level- It's all just built in... what level of auto-complete is allowed? 15:43 Copilot, I, you know, tab complete or Codex or any of them, you can tab complete, but you have to disable that. You know? 15:50 Well, there is a level of intelligence I can do of, like, automatic linting and automatic testing my... Because I'm only allowed to compile it once, but what I could do is... I don't think that's us. No, it's not. 16:03 All right. We're hearing a weird noise and buzzing over it. It sounds like speakers. So w- you, you have this, this level of, like, every time I compile and it crashes, I have to take a drink or I lose points. Right. 16:16 So I can use a linter, which, or an ES lint or something like that. It's basically, which basically just tells you when your code's not going to compile. Yeah, which tell, so- So is that cheating? 16:26 Is that against the spirit of the game? And I think the answer is yes. You're supposed to do it in, like, bare bones. Yeah. I don't think you're supposed to use- You're only allowed to use Nano. Yeah. 16:33 [laughs] Yeah, Nano. The, the far superior t- Yeah... text editor. Yeah. Can't use Vim. There's macros in that. So- [laughs]... there is, like, we, we do, with these contests, set these arbitrary rules. 16:45 And every contest sets its different line of what that arbitrary rule is, and I don't think anyone can dictate to them, "No, your line is wrong." But how do you enforce things when you can just outsource the logic now? 17:03 What... And, and how do you define that? Scav Hunt is a very easy one to define. Yeah. Don't, don't fake it. Don't fake your weird. But with something like a CTF, at what layer do you, could you draw a line? 17:16 Like, think of one. Well, we were just talking about this. We hadn't stepped over to the C- the, the proper CTF room to see how they were dealing with the problem. And I have to imagine, like, it's fair game. 17:27 Use whatever you want. And the only thing I could come up with for that point is 17:33 maximize the number of challenges that you could possibly have, create complete chaos, and minimize the number of points that each individual thing or flag that you're doing actually gets you, so you just see who makes the better harness, I guess, which is kind of what the CTF has been for a really long time. 17:54 That's the thing is, like, usually you can hide around some esoteric or, like, Middle Indian, where they did that Middle Indian architecture- But boop, I-... but now it's boop, fixed. 18:05 And you could do these e- esoteric things to force challenges, and I think, like, it, it is going to massively change. 18:13 If, if we're gonna embrace it, which we kind, you kind of have to, it's here, but if you're gonna embrace it in hacking challenges, how do you design around it? 18:23 And I think it's gonna massively change every single contest at DEF CON that they have to work from the ground up and go, "How can we make this really fun to watch," if that is one of the goals, and how- Or at least fun to play... 18:36 fun to play Embrace br- embrace LLMs being able to solve these things. And here's the thing is the more I think about it, I don't know how much you can design around it. I don't know that you can. 18:49 I think, um, I think the problems have to get bigger, and I've often said that the thing that agents have, or LLMs have allowed me to do is to allow code to now move at the speed of my ideas so I can move faster, try new things, get to the point of saying, "This thing is not gonna work," and move on to a new design. 19:08 So I can do architect work much faster, and so we... There was a physical challenge here where, uh, at Reality Overrun where the... you had a basically a little RC car. 19:18 Not RC, but it was, um, different sensors on it, and they gave you a simulator to be able to, uh, simulate it navigating a maze. Mm. 19:28 And then you would go build your model on the car, take it to the maze, and see if it could complete the maze. And there's a few different intended ways to do this. 19:36 You could do it manually and just have it navigate the maze manually, or what you could do is, like, run the maze 20 times yourself in the simulator and then, um, have it do feedback loop, uh, analysis with an LLM and then find, try to maximize the, how you get in there. 19:54 But the limitation there is that the sensors are not precise enough to actually translate from the simulator onto the real board, so you're actually better off going the human route and just, like, d- like, doing some testing and then moving forward. 20:11 But it is an interesting problem that at least the LLM allows you to do the rapid testing cycles, 'cause you don't have to sit down and like, "Oh, I don't know C," or, "I don't know how to flash something onto an Xtensa." 20:24 And- Well- And we've often felt this before. Coming to a conference and having to sit down and spending your entire conference on one challenge or one thing is, 20:36 it feels bad sometimes, and if that allows you to go to do more things and get a taste of what is going on in all of these things, I think that's really good for your average attendee. 20:49 You're getting more access to more things. Is it good for the contests themselves that are trying to, you know, engage a player for an entire weekend? Probably not. Um, and I don't... I think you're right. 21:00 I don't think you can design around it. And that's the thing is, like, every- every time I think about, like, oh, you could make more of the questions wrapped into the story. 21:08 Well, you can still eat the whole story in an LLM and look at that. Yep. Like, I, I was... we ha- we were talking about, like, how would you design around it? 21:16 I was like, oh, with Reality Overrun, maybe what we do is we, we... like, or m- I was talking to Zero, who's one of the designers, who was like, "Maybe you could have it so you actually can't control your own character. 21:28 The L- like, there's an LLM as the character, and you have to inject prompts for it then to do in the game." I was like, "Well, yeah, but then I still create, have the, another LLM control that," and it's like- Yeah... 21:39 oh, gosh. So I don't know- The goal is to gaslight the LLM. [laughs] You have to convince the LLM it's actually a person. Oh, gosh. But that, th- that's just a bug bounty. 21:51 So j- you're, you're just bug bounty-ing the- It is. It's just a bug bounty... you're just trying... But so this is, I think this is one of the hardest problems, is you're, you're designing around a... 21:58 y- I don't know if you can design around it, and if you eventually get to the point where you could design around it, I think it will be boring to watch, because then all you're gonna be doing is just tuning, trying to constantly just tune this thing- Yeah... 22:10 and then just sit there and watch it. 22:12 I, I, I get that feeling too, like, uh, we were talking on the last podcast a little bit about this translation project I was working on, and I, I decided I was gonna go post what I was doing on the particular fandom subreddit that, like, "Hey, I've translated this thing. 22:27 It's done with an LLM," and I wanted to see what the ratio was and up, you know, up and down. 22:34 And it's a little entertaining for me to see just how negative it was, and then there was just the average person saying, um, "I'd rather embrace this so I can play the game." 22:46 And I think there are interactions like that which you're not working around it. You're finding what it enables new to do. It's a bigger problem. Whatever the, whatever it is, 23:00 the question of how to make it entertaining to watch is a good question. So, like, the video game I translated. Mm-hmm. It would be interesting. 23:09 I was saying it would be interesting if you brought a pile of untranslated games to Def CON, and your competition was how many games can you translate in a weekend or how far into a game can you get LLM assisted? 23:22 Even if you know nothing about it, it's tractable to do. You can do it, and then you can have some subjective judging. But you know what else you can do? 23:30 You can burn it to a disc and pop it in a PS1 and make somebody play it. You can put it on a CD-RW, right? 23:37 And then make them play the game, and, like, now that's, like, you get points if how far into the game you get, you know, and then you have to drink or whatever. Like, that would be a... 23:47 You could build a game around that that would be fun. But one, one thing I was thinking about is you know how a lot of contests do it so far, how you do at LLM, I think of Hacker Jeopardy? Alcohol. 23:58 [laughs] Passing a pile. Yeah. Alcohol. Yeah. Every time you make a mistake, alcohol. Any time they catch that you're using an LLM- Yeah... alcohol. So maybe alcohol is the solution to all of these problems. Ah. 24:11 Both for the creator and the player. That sounds very unhealthy. [laughs] But fun. It's true. So, like, I don't know what else to talk about. I don't know h- I, I don't have a solution to this. 24:21 We still got one more day, um, and I think we have more people to talk to. I do wanna see exactly how the proper CTF embraced it, uh, because those, that, that team that develops that every year, 24:36 uh, really tries to make a good game. The funny thing is it's not a game you can necessarily have fun watching. Mm. Um, the re- the recaps of it are always fun. 24:47 They tried to do the watchable, like, live CTF last year, um, and the, a couple years prior, but now they're so good that even the live CTF would most likely just be boop. Yeah. Right? 25:01 One, I, I think that's, [laughs] that's the other piece of it, too, is y- one-way contests have thought about it, and I know we've t- we've seen a few of them where it's like your system is completely air gapped. Yeah. 25:12 You have no internet access, but it's gonna be one y- one year b- until you have a chip on your system that can do it all locally. Yeah. 25:20 I mean, one year, two years, whatever it is, at one point you're gonna have a chip on the system. I don't know. I'm, I'm, I'm, I'm flummoxed. Fl- Flummoxed. Uh, I don't, I don't- Gobsmacked. I'm gobsmacked. 25:33 I, I think you're right. I think it's just not worth designing around. I think it's better to just embrace it and see how it can be fun. Mmm. I- in some ways, though, I will, I will say this. 25:44 Is, is, as painful as it is right now, we're in a transition- Yeah... state. Like, ju- just like when DEF CON was at, uh, one location, we came to the LVCC, it is now... 25:56 It, it took a few years, and now you get the vibe of it. I think we're gonna take a few years of contests, trying to figure out how to make better contests. 26:06 And I think ultimately we, we win in the contest realm, and there's two reasons I say this. One, because it's gonna take them time to figure it out, but two, they're... 26:18 You're le- you can now leverage an LLM to create things that you would never be able to do in a contest. Prime- Even the UI... prime example, actually. Um, so obviously we're using LLMs to play Reality Overrun. 26:32 Last year we did the same thing, but it was largely going, gonna copy stuff into ChatGPT, back and forth, it'll help me, and, you know, we are still largely doing it manually. 26:42 Silk and I took two very different approaches. Right? I have my own little agent model on my phone. I played the game entirely from my phone, but I spun up a brand-new app- That was sick... 26:53 and was, like, developing the app to be the front end for the game- Well-... that augmented the official thing... hold on. I, I need, I need to ex- th- explaining that, because I hear... I, we've seen it. Yeah. 27:04 What, what you did is there is the game. It has a whole interface, has, has all its buttons all the way to move around. 27:11 Gowrie made a mobile app, like developed a mobile application which loads the game in and allows you to interact with it, not only, 27:23 like, through the mobile app of, like, you're, move around in the game, but then inject commands into his mobile app, which then will play this containerized version of the game. Yeah. 27:35 When I say containerized, but, like, its version of the game, it's running with this thing sitting as a proxy. 27:40 Well, and then it has an LLM chat off to the side, and I can just go, oh, I see that we discovered something new. 27:46 Give me a new interface that sh- that lifts that background data up to something that's visible that I can poke and prod at. Mm-hmm. And then you took a completely different approach. 27:55 [laughs] Which was kinda similar, but, like, you were doing it entirely within Codex, I think. Yeah, I did my entire enco- in Codex. I took a very... 28:03 The, there's two pieces I think I took which were very different than yours. One, I took very much a lot of, I took a lot of time to research, like what calls are there, what's available, I can... 28:15 I, how much of it's client side. He's a much better CTF player than I am. [laughs] Uh, but the biggest thing I did, which is, is I built it for a future speed run, because I had either a suspicion... 28:29 I didn't want our account just to get boned, because we found out last year there was a function in it called Guess AI, which is there's characters running around which are AIs, really cool dynamic. 28:40 So you have real players running around the map. Some of those players you think are real are actually w- a little... What, I forgot what the model was he was using. I don't remember. 28:49 But it's, it's- But- There's a prompt on the back end. You can talk to it and you- Yep... and the idea is, like- You have to-... you interact and figure out which ones are the LLMs. Yeah. 28:56 So a lot of o- a lot of the characters have canned responses. You could say, "Hey, has anyone seen the color orange today?" And you would get a response back of them saying, "No, I did not see the color orange." 29:08 So you know they're not using canned responses. Yeah. But I, one of the things I did was I had, I ran a proxy between me and the game, and it recorded every- Everything... 29:19 object, every submission I had, every, uh, re- every challenge, response, all the, the summarization of all the information, but it was completely replayable. 29:30 So if my account got hosed, I could spin up another account, push a button- Pff... and it would bring my account all the way back up right before the fail point, [laughs] and then I could submit. 29:40 We, and just to be clear, we never needed it. Yeah, we never needed it. [laughs] Oh, I, I forgot that the, the, uh, that, that, what was it? 29:47 Submit AI was if you get it wrong, let me explain this, was if you got it wrong, you were locked out for two hours and lost half your points. Initially, and then- Initially... then we had conversations and, yeah... 29:58 we pulled it back. Yeah, it w- it was just super punishing- It was super punishing... even if you fat-fingered it. So that was... Either way, they fixed that, and they, they've done so much work on it. 30:05 But- And the game ended... The game's been great. Just to be clear. Yeah, game has been awesome. Um, but yeah, I, I don't know. Where are we going next? Like, what do you think? I, I don't know. 30:15 I just, I, I wanna keep talking about LLMs and I wanna go like, "Oh, we could fix..." But, like, I have sat there with Zero- Welcome to LLM Hangouts. LLM Hangouts. [laughs] I know. It's, it's... 30:25 I sat there with Zero for a half an hour j- just, we were just dorking with ideas going like, "Oh, you could do this," but, but then that could be solved that way. 30:35 You do this, and I have found myself being a very good... I have been a player of CTFs and hacking challenges for a long time. 30:44 I have designed challenges, but usually those challenges were a boss fight for, for DarkNet Yeah. 30:51 I have done very little design on challenges which were had to be solved in a certain amount of time, because the boss fight was easy to s- easy to create. Why? 31:00 Because there was like 50, you know, 400 people playing the game. Yeah. So I could make these absolute stupidly hard challenges or- And you just crowdsource the answers, essentially. 31:11 Yeah Yeah Or, like, or you can, you can dork it over the Sameer. We did like a Sameer one. So you had like 25 pieces they had to find, so they had to find 20 of them. 31:20 And then you could, you could see how quickly they're doing, and you'd actually swap out challenges along the way. 31:25 But for something where you had to, you have to build it ahead of time, it has to be solvable at conference, I don't have a good solution. And any solution I can come up with is boring as hell to watch. 31:37 It's, it's kind of funny, like, I wonder if you gave people that playground to just build the interfaces to the game, but then you were streaming all of that, so you could see what people were doing differently, 31:51 and then you had, I don't know. Like, what, what really sucks, here's the thing that sucks, right? Like, we're talking about making it 31:59 enjoyable to watch, which already, like, we all have this want to be entertained, but hacking has never been entertaining to watch. 32:09 [laughs] So we're all just looking, like, "Oh, but now it's killing the last few things that were entertaining to watch. How do we retain that?" And the answer is probably just don't allow LLMs in those competitions. 32:20 And the unfortunate reality is that means we're gonna have to have a contained environment where those, those contests hand you a Chromebook or whatever that prevents you from accessing those, those resources. 32:35 Yesterday we watched- 'Cause otherwise, I was gonna say, 'cause otherwise what you're doing is you're designing not around it, but you're designing a game that ultimately will turn into my agent is building a thing and to solve the thing your agent is building in response to the thing my agent is building, and that's also just boring. 32:54 Yesterday we watched Whose Slide Is It Anyway? [laughs] I did not get to compete. I was on the list. A little bit bitter about that, but Rando was amazing. Yeah. Not gonna hold it against him. Next year. 33:09 Next, next year... next year. Point being- Next year... it, it, the whole contest is they generate this, uh, they've created these absolutely ridiculous slide decks. It's an improv competition. 33:19 You go up there and you pitch one. It's forced to be entertaining. M- m- maybe what the contest becomes, because I don't think AI is all that great about creativity- Nah... your job 33:36 is to solve whatever challenge it is in an entertaining way. I get- And you get points on creativity... yeah, subjectivity points. I like it And you get, you have a proj- you have- Oh, you're just describing Scav Hunt. 33:48 You're just describing [laughs] Scav Hunt. [laughs] And we've come full circle. Yeah, we've come full circle. Maybe, maybe we could make the social Scav Hunt. The social Scav Hunt, and played entirely on Tweeter. 33:59 [laughs] Tweeter. Tweeter, by your agents generating photos to prove that you got the item. Yeah. Ev- eventually, again, we just boil back down to an LLM solving an LLM. 34:12 In some senses, it's been really fun on the player side. 34:16 In other senses, I definitely feel for the organizers and the, the struggles they have agai- ahead of them, because it does feel like it has sucked all of the air out of the room. Mm. 34:28 That's, that's all there is to talk about. Like, just showing you, welcome to LLM Hangouts. 34:32 [laughs] It's like, it's, it's, it's all there is to talk about partially because it does enable you to do things so much faster, and to do things that you otherwise just, you'd be like, "Oh, this is gonna take too long. 34:45 I'm never gonna do that." Incredible things. Yeah. Incredible things. Like, the things that we... Oh, but this way, the things we have been able to accomplish, and this is not a, like, "Oh, this is so, we're so smart." 34:55 No, the things that we were- I'm really not smart, so [laughs] The, the things- Yeah, that's not true... the things, if you, if you counted up all the code that we've put together- Oh my God... 35:03 for this contest, and you said, "Had someone program it without an LLM," it, it's months, if not years, worth of work. It just wouldn't get done. It just wouldn't get done. You just would never do it. 35:16 So- And literally, otherwise, people would have been doing it... otherwise, people would be, and no, and it, there's no profit in it- Yeah... to create it for the, for, for this one challenge. 35:25 So that has been the coolest... Again, I, I, I have to imagine as a designer, you're just like, "Ah, they're, they're doing this." But as a player, I have had more fun in this contest- Yeah, easily... 35:36 than I have had in a very long time. I, I do not play CTFs. I just, I, I really dislike... 35:44 Most CTF games are designed, they're designed in one of two ways, and we used to help run DarkNet, and that was the, I would say, the more tutorialized CTF, where it wasn't there to stump the chump. 35:54 It was there to teach people, and I really enjoyed that style of game. 35:57 I enjoyed it so much that I was working staff on it, and I wanted to teach people binary exploitation, the really, really hard stuff that makes it really, really hard for people to become a hacker, quote, unquote. 36:07 And then you have the ones that are just like, "Well, we wanna be top of our game, so everything has to be stump the chump." 36:14 And I played a little bit of that when I was younger, and I just have a strong distaste for it, personally. Not saying anyone else. Mm. You're not bad for wanting to do it or not, wanting to make that style of game. 36:26 But I've never wanted to do that, play that style of game. 36:30 And now I'm staring here going like, "I could play it now if it was like this," 'cause I, I can move through it, and I can feel like I'm, I can feel like I'm accomplishing something with a pattern. Um, I used a pattern. 36:41 But you used a pattern. Right? But like, I'm- It's not hacking... it's not hacking... if you use a pattern... it's not hacking. You used an LLM. 36:46 Um, but like, I feel like I can sit there and work through some of these problems with something that- I'm taking stuff away from this watching the LLM work. Yeah. Right? 36:57 Like, that- There were, there was times we were sitting up to like, like, we have now launched a task. It's going to just run overnight. Yeah. 37:05 And I just wanna sit watching it work on it because I'm learning, seeing it's, how it's moving through it. It is fascinating. Well, and, and like, 37:14 watching it disassemble something, for example, and then go down the path of, um, reverse engineering certain pieces, and if you know a little bit about what you're already doing, you're looking, or maybe the game that you're playing already, you will notice that it still makes mistakes, and it's not... 37:31 I wouldn't even call, classify them as mistakes. It's things I would have done, and then have learned 12 hours later that that was a completely failed approach. And then you stop, and you steer it in the right direction. 37:43 And anyone who's used them to do code generation already knows that this is the case. Um, and, and those are the things that I say as, you know, a professional developer, 37:53 I think those things are matters of intent, where you could do it this way. It's just going to be infinitely harder if you do. 38:01 And unless you are intentful about steering it, unless you are there to click Control+C and stop, say, "Don't do it this way. Go this other way," you're gonna have a bad time. 38:14 Um, even putting on ultra code, and then it makes a bazillion tests. Yeah. Yeah, it's just useless, right? Um, so I, I don't know. Like, I have learned a lot this conference at the same time that I've used 38:28 agents to do most of the work. Um, I think this is one of the... When we came here on Thursday, usually Friday morning, by midday, I always have this sense of like, "Why am I here?" 38:41 Like, I'm here to see my friends, obviously, but like, what's my relationship with the conference? I haven't hacked anything in years. 38:49 This is the first time I've, I think I'll be leaving the conference going, "Okay, I, I, I feel like I've actually worked in the spirit of the conference while working outside of the spirit of every game I've played." 39:03 [laughs] It, there's a... 39:05 I think the other thing it's given me, e- especially with this game, is there is, there is a level of elegance in some of, like, in some of the challenges that don't exist in others, and ZeroAltitude's really good at this. 39:18 Oh, yeah. He, he made, uh, one of the challenges in the game is a bunch of haikus, like po- like a poem. That's not like haiku, like a, like a, some sort of crazy challenge. By the way, haiku was the LLM he used. Yeah. 39:32 Just- Forget it. Go ahead. Not, not that kind. [laughs] Uh, the poem form of a haiku. Yeah. And then each haiku had a s- one of the s- de- deadly sins in it. Mm-hmm. 39:42 And each one also had a sense in it, was like, you know, smell, hearing, whatnot. And each one also had, um, what was it, a, a musical note in it. And then all of a sudden these turned into trinary. 39:56 Like not, like it, it was like this, this very cool, elegant way. And then when talking to him a- about his design, he's like, "Oh, and when you do that, it just so happened to hit on the, at the ASCII range." 40:09 And it was a really elegant way of a cipher I've never seen before. Yeah. But I know he, he used some level of help to design- Yeah... some of those things. 40:19 And I, I think we might see these, these higher level, like really cool, elegant ones for someone who's really wanting to pour their time into it. 40:27 And you can go down this path, and then you would also ask it, like, is, is this solvable by a person? Yeah, and I, I don't know the answer to that question. Like, a person by themselves, right? 40:37 Like, um, obviously it's very easy, and we have a long history of this, of red herrings. Like it's very easy to unintentionally put red herrings into challenges. Mm. 40:52 Like anyone who's done any amount of game design knows how hard it is to make a puzzle that someone can actually solve and enjoy solving. It's just, it's just very- You don't need to design red herrings. Yeah. 41:02 You, you will- There are plenty... you will screw yourself over- [laughs]... far more than someone actually designing one for you. Um, but yeah. 41:09 Uh, but then I wonder, as we were talking about that one, uh, earlier, I, I had to sit down and go like, "I would never be able to solve that. By myself, I'd never be able to solve that." So I don't know. 41:27 And that was the thing is like also you, you would've gone, "I, I'm not gonna solve it. I'm gonna move on to other challenges." Yeah. 41:31 This is a way where you go, "Okay, I can now step through this and actually see it and experience it." That's actually, that's actually a good point. 41:39 I'm stepping through this in a way that I can see it and experience it. I think there is a tension for the game designers that someone will just hit the boop button because it is a contest, and they just want the points. 41:52 And I think that's a legitimate concern. Um, but for us, we're sitting down and watching it work, and we're looking at how the puzzles are actually falling out. And so we're still getting to experience it. 42:03 I'm being entertained. Yeah. I'll put it that way. I'm being entertained. And what else is there other than the learning component, if not designing these things to entertain people? Now, here's a question. 42:17 In the age of, boop, I have all the points, should contests still be exposed to being able to be a black badge contest? Or should that be reserved entirely for the CTF? 42:38 I think one of the hardest balances for black badge is right now, again, for those who don't know, black badge, for a black badge gains you free entry to DEF CON for life. It's a big deal. 42:52 Uh, they are only guaranteed for CTF DEF CON, and then the contest goons de- determine who is gonna get one. Yeah. Or yeah, maybe the contest goons, uh, some grifter, some- someone makes this determination. 43:05 It's, it's some kind of, they, they, I think- Committee... yeah, there's some committee that decides which contests and the order. Roll the dice. Yeah. However it's done. I'm just kidding. However it's done. 43:13 Oh, it- But it- But, but there's a, there's a subjective component to it, and they want to encourage people to play the games. 43:19 So in the past couple years it's been, I don't know that it's been random, but, like, there is a- No, it ha- it hasn't been random. No, it, this is my point... 43:25 but there's a component of, there's a component of we do want to encourage people to play games, but we don't want to encourage the same games every year, every time... 43:34 that, that was, my point was is not, again, I jokingly said roll a dice, but it's not roll a dice. We know it's not roll a dice. They go around and they look at the contests and they say which ones i- i- i... 43:48 wh- wh- which ones, this is gonna sound grandiose, but which ones embody the spirit of DEF CON. Yeah. 43:54 Which ones involve community in a way we haven't seen before, which ones have hacks we haven't seen before, which ones look the best, have had activity, had excitement around it, had people doing whatever. 44:05 Reminded, reminded of the year we gave away free DEF CON Darknet badges because it was hacks and crafts, and you had- [laughs]... and you, and you used, uh, copper tape and a soldering spoon- [laughs]... 44:15 to make your own badge, and that was a black badge competition that year because he watched... He came over and they saw just, like, 50 people making their own badges out of cardboard and stuff. 44:26 So in a world, I'm gonna answer your question, which is in a world where you can boop and maybe win a contest, 44:33 I think that if that is the type of contest, I would hope and I would expect that DEF CON doesn't make those black badge contests because they're not gonna get the whirlwind of activity and people and, and story and excitement which you would want in a contest at DEF CON. 44:53 But don't you think that could turn into a, a bit of a death spiral, right? Like, we just discussed about how hard it would be to make a contest that isn't subject to, boop, I have all the points. 45:05 It goes to the designers making a game which is fun to watch, fun to play, entertaining. I don't know how it's done. I have no idea. I have to imagine next year's gonna be even harder. Yeah. 45:18 But I would think that in a world where contests and challenges become easy, the challenges have to get harder, more advanced, work around the, the solutions that are in place. Um, 45:33 you know, b- more community involvement. 45:35 Maybe, maybe, like you were talking about with your translation of your game, that you come out after you've translated this game, there is something that can go back out into the world 45:46 and, and, and o- other people can get enjoyment. And maybe there's value in creating, creating, look, evaluating a game and say, "How does it impact the community? How are the challenges of it? 45:59 Is there some lasting impact this is gonna have outside of DEF CON?" Yeah. I think that's a really cool, and I don't think we've necessarily seen that last component nec- well, other than the CTF. 46:11 Like, people spend their whole year preparing for CTF, right? Like, that, that has a lasting impact, at least on the players of the CTF. I, I think ch- almost every game has a lasting imp- la- On the players... 46:21 lasting impact on the players. So but not on the players, right? 46:26 I would say the CTF has had a lasting impact on most university cybersecurity departments that have not just changed the way they teach cybersecurity, but also integrate CTFs into their curriculum in some way, shape, or form. 46:41 So, like, that has exited DEF CON and infected how we teach these things. But then I, I would call it the pro-social value of, like, 46:52 what things have we seen leave DEF CON that are not necessarily restricted to hacking that are given back to the world, which is... 47:05 I don't know that I've seen something clear that fits that description outside of something like CTF that has- Lasting impact... yeah, that has a lasting impact. 47:16 It'd be an interesting, it would be an interesting theme for future years to try and encourage people to design their games towards that. Mm-hmm. I don't know. I have no idea. But with that, I don't have anything else. 47:31 I have nothing else. What are you leaving us with? Um, I, you know, there's a lot of negativity around AI, and I am not saying that that negativity is unfounded. 47:47 I understand, believe me, I understand all of the very real-life consequences that come with this. 47:56 We're approaching this discussion from the perspective of people attending DEF CON playing games and understanding how that's impacting the thing that, one thing that we love, that we do every year. 48:09 I've never had more fun. 48:13 The only times I've had more fun at this conference is when we were helping to run DEF CON Darknet and my whole day was just meeting people and teaching people. 48:28 And we've had to reinvent ourselves as we've started doing photo and doing some other stuff, and I've been struggling the past couple of years to figure out why am I still coming. 48:37 This is the first year that I'm like, "Okay, I feel like I'm part of the conference again." Not just as, you know, going around and trying to give back to the community as a goon, but 48:47 as, like, I can now do both of these things. I don't have to feel like I'm sacrificing the weekend- 48:54 To do goon stuff, which I enjoy, but I can still engage in some of the competitions and reasonably expect to have a, have a good time, and not feel like, "Oh, if I had an extra hour here, if I didn't have to go on shift, or I didn't have to do that." 49:10 I can still engage and feel like I can, I can still learn something. I can still do that. So I, I feel like I've gotten a little bit of sense of wonder back this year that I lost. 49:19 I've said this on prior streams, I've lost a bit of that wonder. Now I feel like there's entire areas that I previously looked at and said, "That would take me two years to pick up that new skill. 49:31 I'm not even gonna attempt it." Now I'm like, "I think I can figure this out." I think for me, and th- I'm hoping this comes out right. 49:43 I would walk around a lot of the contests in prior years, and they all started to sound like the exact same contest. Yes. Not, not in a mean way. Like, they all had their own flair on it. Yeah. 49:56 They all had their own spin on it and all of that. Everyone's got a CTF. 49:59 But every single one of them, I will guarantee every single contest had some sort of cipher, some sort of ROT13, some sort of veneer cipher, some sort of, like, insert whatever. They would all have this. 50:14 And again, then they went and branched off, but they all started becoming this weird homogenous stew of CTF, and they all s- Here's your, here's your badge kit... Yeah, here's your badge kit. And I think I am excited. 50:31 I g- I have been excited with LLMs and things like that because I, I have been able to accomplish more than I have ever been able to accomplish in such a short period, and I go down months of, like, discovery in a very, you know, a week and go, "Wait, that idea doesn't work," and throw out what would've been months worth of work, but it only took me a few hours. 50:51 Yeah. And I think I'm excited because it is going to radically change every contest at DEF CON. It has to. It has to. 51:04 And I think what comes out of it, again, through, through the fire, what comes through the fire on this is, is going to be refined in such a cool way, is I think what comes out of it is really unique contests that have never been seen before, because they have to work around this ginormous problem. 51:26 And do you know why I think you're right? Because I've never, ever seen hackers back down from a challenge like that. It's like, "Oh, this is gonna break everything and everything's gonna be ruined forever." Game on. 51:44 [laughs] And with that- Yeah... thanks for watching, and hack on
