Pwn.college
339 points
• 6 days ago
• Article
Link
pwn.college 是一个实践型教育平台，旨在让学习者沉浸在计算的核心领域，从而培养必备的网络安全技能。参与者从 white belts 起步，随后在直接与终端、 CPU 和网络交互的过程中掌握相关概念，并逐步晋级，获得不同颜色的 belts 。该平台由亚利桑那州立大学（Arizona State University）的一支团队维护，并向全球学生和感兴趣的个人免费开放，是 ASU 自身网络安全课程的重要组成部分。
dojos 中提供的挑战主要用于教学目的，并作为全球大学学生评分的依据。正因为其承担了教学功能，创建者希望用户不要在互联网上发布挑战的 walkthrough 、 solution videos 或带有直播尝试的内容。尽管这条规定是自愿性的，遵守它仍能帮助维持平台的持续可用性，也让课程对学生和讲师都保持有效。
如果你有兴趣将该平台纳入自己的课程，pwn.college 允许在标注适当署名的前提下，将其 lectures 和 slides 用于非商业用途并免费使用。教育机构甚至可以选择把这些挑战导入面向学生的 private dojos；团队也欢迎收到有关平台使用情况的通知，以支持他们持续的学术工作。课堂之外，该项目还希望通过举办基于活动的密集培训课程，与各类 conferences 进行更多互动。
当学习者在平台上不断进阶，学习之路仍将通向更高水平的熟练度，最终达到 brown belt 和 black belt 的阶段。团队鼓励毕业生通过 Capture The Flag 竞赛、长期 wargames，以及 CryptoHack 或 OST2 这类替代学习平台来进一步打磨技能。对于想要深入研究的人，创建者在 ASU 提供 internship 机会，并欢迎为支撑其网站的 open-source 基础设施贡献力量。
pwn.college serves as a hands-on educational platform designed to help learners develop essential cybersecurity skills by immersing them in the core of computing. Participants begin their journey as white belts and progress through various levels, earning different colored belts as they master concepts by interacting directly with terminals, CPUs, and networks. The platform is maintained by a team at Arizona State University and is available for free to students and interested individuals worldwide, forming a significant component of ASU's own cybersecurity curriculum.
The challenges provided within the dojos are primarily intended for educational purposes and serve as the basis for grading university students globally. Because of this pedagogical role, the creators ask that users refrain from posting walkthroughs, solution videos, or livestreamed attempts of the challenges to the internet. While this rule is voluntary, following it helps preserve the platform's viability and keeps the curriculum effective for students and instructors alike.
For those interested in integrating the platform into their own coursework, pwn.college allows for the free use of its lectures and slides for non-commercial purposes, provided proper attribution is given. Educational institutions even have the option to import these challenges into private dojos for their students, and the team welcomes notifications regarding the platform's usage to support their ongoing academic work. Beyond the classroom, the project also seeks to engage with conferences by offering intensive, event-based training sessions.
As learners advance beyond the platform, the journey continues toward achieving high-level proficiency, eventually reaching brown belt and black belt status. The team encourages graduates to refine their skills through Capture The Flag competitions, long-term wargames, and alternative learning platforms like CryptoHack or OST2. For those looking to delve deeper into research, the creators offer internship opportunities at ASU and welcome contributions to the open-source infrastructure that powers their site.
54 comments • Comments Link
- pwn.college 平台由从 UC Santa Barbara 转到 Arizona State 的学者们开发，建立在网络安全研究与教育的共同历史积累之上。
- 用户常把它严谨的实操训练方式与 HackThisSite 、 OverTheWire 、 Microcorruption 等经典网络安全学习平台对比，认为它质量高、成效明显。
- 平台的设计融入了游戏化元素，例如通过推进进度来获得"belts"，从而激励学生更深入地投入完整课程。
- 绝大多数讨论都围绕对两端对齐（justified）文本的批评展开：反对者认为这会造成尴尬的字距和"河流（rivers）"；支持者则认为，只要采用 LaTeX 等合适的排版算法，就更容易阅读。
- 由于网络浏览器对高级排版功能的支持仍然有限，一些观点认为，在"hyphens: auto"或更优的断行算法成为标准之前，网页上不应使用两端对齐文本。
- 有人倾向把 Discord 作为主要社区中心，但这一想法遭到强烈反对，理由包括隐私顾虑、该平台的专有与中心化性质，以及与强制身份验证相关的潜在风险。
- 设立禁止发布"write-ups"的规则被认为是教学上为了维护学习过程完整性所必须的；参与者表示，越是解释这些规则背后的原因，越能提升遵守度。
- 研究表明，通过提供"安慰性（placebic）"的理由，往往能提高人们对请求或社会规范的依从性，这一观点也得到了关于人类互动心理学的研究支持。
- 该平台因通过 Discord 提供社区驱动的支持而受到关注，尽管围绕在安全教育中使用这一特定平台的伦理影响，争论仍在持续。
- 关于平台记分牌系统的讨论，反映出大家对指标呈现方式以及排名界面背后逻辑的轻松兴趣。
讨论的核心在于对 pwn.college 作为一种进阶教育工具的认可：它确实把学术理论与网络安全实践能力之间的鸿沟有效衔接起来。尽管对该网站的技术与教学设计几乎是一致的高度评价，但这场讨论也凸显了现代网页设计偏好与传统可读性标准之间的矛盾，尤其体现在两端对齐文本的争议上。此外，讨论中还隐约透出一种以隐私为中心的价值取向，尤其是围绕在网络安全社区中使用 Discord 这类中心化平台的问题。总体而言，这场讨论既像是在向平台创始人致意，也折射出关于数字自主权、 UI/UX 最佳实践以及技术领域有效教学方法的更广泛争论。 • The pwn.college platform was developed by academics who transitioned from UC Santa Barbara to Arizona State, building on a shared history of research and education in cybersecurity.
• Users frequently compare the platform's rigorous, hands-on approach to classic cybersecurity training sites like HackThisSite, OverTheWire, and Microcorruption, noting its high quality and effectiveness.
• The design of the site includes gamified elements such as earning "belts" for progress, which motivates students to engage deeply with the comprehensive curriculum.
• A significant portion of the discourse involves a critique of justified text formatting, with critics arguing it creates awkward spacing and rivers, while proponents suggest it is easier to read when implemented with proper typesetting algorithms like LaTeX.
• Web browser support for advanced typography remains limited, leading to arguments that justified text should be avoided on the web until features like "hyphens: auto" or superior line-breaking algorithms are standard.
• The preference for using Discord as the primary community hub is met with strong pushback, citing privacy concerns, the platform's proprietary and centralized nature, and the risks associated with mandatory identity verification.
• Establishing rules against posting write-ups for challenges is discussed as a pedagogical necessity to preserve the integrity of the learning process, with participants noting that explaining the reasoning for these rules significantly increases compliance.
• Compliance with requests or social norms is often improved by providing "placebic" justifications, a principle supported by psychological research on human interaction.
• The platform is noted for its community-driven support via Discord, despite ongoing debates regarding the ethical implications of using that specific platform for security-focused education.
• Discussions about the platform's scoreboard system reveal a lighthearted interest in how metrics are displayed and the underlying logic of the ranking interface.
The conversation centers on the appreciation for pwn.college as a sophisticated educational tool that successfully bridges the gap between academic theory and practical cybersecurity skills. While the technical and pedagogical aspects of the site receive overwhelming praise, the thread highlights a tension between modern web design preferences and traditional readability standards, specifically regarding text justification. Furthermore, the discussion surfaces a strong undercurrent of privacy-centric ideology, particularly regarding the use of centralized platforms like Discord within the cybersecurity community. Overall, the thread serves as both a tribute to the platform's originators and a microcosm of broader debates regarding digital autonomy, UI/UX best practices, and effective teaching methods in technical fields.