The Legend of the Murder Hobos

Spoiler alert: The real prize is friendship.

At R00tz Asylum, an official DEF CON event for kids, Facebook’s security team was running a CTF. The scene matched most rooms at DEF CON: intense staring at screens, poking at punny challenges, and no one really talking to each other. We chatted up our neighbors, Sodapop and p0wnyb0y about the con, the badge, and the contest. We realized the organizers encouraged teams, but no one else was talking. Pooling our resources, a 7 and 9 year old shot to the top of the leaderboard and took home the prize: 2 Chromebooks, and a con-friendship.

A chat at Toxic BBQ in 2018 lead to another team-up. Tinribs and I were Vegas locals looking to change up our DEF CON experience.  We took on the inaugural Dungeons@DEFCON with our 12 year old kids. Styled as the Murder Hobos, we won the Psychoholics-lead, D&D themed, CTF-style classic crypto challenge through cooperation, luck, and shenanigans, and we came away with the win and a black badge for our team of four. As far as we can tell, the kids are the youngest black badge holders in history. Grifter commented to The Dark Tangent during closing ceremonies, “What I like about a couple of kids winning a black badge is how much it’s going to cost Jeff. For life, baby!”

But we had a problem: only 4 of the 6 Hobos had a black badge, and so the next chase began. The very next year, family obligations took me away from DEF CON, so the Murder Hobos stormed Dungeons@DEFCON again but fell to the inimitable Fellowship of the Token Ring. Post-Covid, another run at D@D (with FOTTR contributing puzzles and CrookedFingers our Dungeon Master) ended with a second place finish. FOTTR decided to host their own contest, and Spy v Spy was born. With a thrilling finish, CamelCase bested the Murder Hobos by unlocking the dead drop minutes before P0wnyb0y arrived. Victory was elusive, but we couldn’t give up.

At DEF CON 33, I was trying to play it cool and relax. When we absorbed ourselves in a contest, we’d look up on Sunday afternoon at closing wondering where the weekend had gone. I was thinking I should take it easy. But it was not to be so. Spy v Spy had returned, and it had a compelling hook: souvenir slabbed playing cards when you completed incremental challenges. Sodapop and P0wnyb0y registered right away, and we were at the top of the leader board the most of the con. We cracked crypto, fabricated loaded dice with other teams, and chased dead drops for two days.

When the final round started, we made the cut, but didn’t know what we were up against. It was rumored one team had 12 people! So we unwrapped the challenge code book and got cracking. Sat at the disused Warlock Gamez booth, we were right in the walkway and kept getting interlocutors asking what we we’re working on (some of whom, we found out later, were actual spies from other teams), and they got a gruff reply. It was serious. Tinribs and Sodapop cracked numbers stations, P0wnyb0y decoded RTTY, and we found the spy. The final answer was phoned in over Discord while I walked back from the other end of the conference.

As I approached, I saw a confluence of people around the contest table. Tinribs was walking towards me shaking his head.

“Too late, we were a minute too late.”

Crestfallen.

“Just kidding. We got it.”

Elation. Joy. I screamed several expletives at him.

Around table was an excited mix of teams and organizers asking about clues and solves, tips and congratulations. Fox from the Whiskey Pirates may have teared up a bit, but so did we.

These contests and conferences are largely excuses. To get us off screens and in front of each other. Make friends and build community. Share skills that are weird and unique and unavailable in any concentration. Sometimes through competition, but also cooperation and conversation. With the win in hand, there was one final question.

The news came the next day: be at the main stage at 3pm. Victory, finally, after a 6-year chase, the Hobos all had black badges. After a whirlwind weekend, we were back on the main stage. None of the kids are children anymore. But we’re already planning our next escapade rather than retirement. FOTTR wants us to make our own contest. And I really want to share how we got here again. And maybe hang out with other puzzlers outside of one weekend per summer.

Cheers,

DuncanYoudaho

How I Juice Limes in My Countertop Cast Iron Citrus Juicer

 Got a question on Reddit as to how I juice limes using my generic countertop cast iron juicer. I picked this up from a McMenamins bartender in Kalama, WA. Speeds up the juicing, gets more juice out, and makes it easy to press every last drop out.

First, cut a coin off one end:

Then add a small slice across the line about a quarter of the way into the lime. This opens it up a bit:

Stand your lime up on the juicer plate and crank it:

That’s it! You can also press the lime shell a bit to make sure all the juice gets got. I’ve only ever observed a teaspoon or so left behind, however.

Edit: I tested the above remaining juice on several limes. Between 1/6 and 1/3 oz Lime juice is left behind on thin skinned limes. Thicker varieties leave almost nothing.

Bluesky Handle Subdomain Setup

While revamping my Palindrome News Bot, I needed to set up a new account and make sure the handle took advantage of this sweet domain name for which I'm paying a buck a month. The setup for an individual handle without subdomain is straightforward. But was not necessarily obvious to me how to add a second user handle or one that uses a subdomain instead of the domain root.

TL;DR: add your subdomain after _atproto with a period separating them in the TXT record. 

To set up your handle using a custom domain, you go to your Settings, Account, Handle and get a screen like this:

 

 You have a domain you'd like to use instead of bsky.com, so click the "I have my own domain" button. The next screen displays with some DNS changes you need to make (that did is not a secret, don't worry):

 

 The trick here is that these instructions are specialized for domains and not subdomains. If your domain is danlearnssstuff.com, these will work fine to make your Bluesky username @danlearnsstuff.com. Add a TXT record with the name of _atproto and the text portion starting with did (it's unique per user). This publishes an "_atproto.<domain>.<tld>" TXT record that bsky reads.

But for using subdomains, the above instructions will not work. Instead, you need to publish a TXT record with the host of "_atproto.<subdomain>" and the did contents as given. With the correct host, DNS will propagate the full "_atproto.<subdomain>.<domain>.<tld>" For example, here is how my two TXT records look in Cloudflare:

 The top one is for Tobswen, the bottom is for my main handle. Both are verified now.

Finally, not sure if you'll run into this, but it took about 20 minutes to propagate my subdomain TXT record globally in a way that Bluesky could recognize it. Not sure if that's normal. I've read TXT records can take 24-48 hours to propagate, but other records went out way faster.

If you have a wacky handle you'd like to try, check out the ATProto handle spec for more details.