3 ms·
I don't think I can add much more than what was included in this very well thought out answer. I will double down on "Make it unambiguous and obvious when a cha
by legitbs_ctf 8y ago
I don't think I can add much more than what was included in this very well thought out answer. I will double down on "Make it unambiguous and obvious when a challenge has been solved." ALL of our flags started with "The Flag Is: ", and that string was NEVER allowed to show up outside of the answer. It made some classes of file carving challenges not possible to do well (because they could be solved with grep...), but I'd argue that those aren't great challenges to begin with. When we did come up with challenges like that, it forced us to be more thoughtful about what made the challenge difficult through being clever, instead of just by brute force red herrings.
Hack.lu in 2018 had a pretty bad challenge that left a bad taste in a lot of players mouths. https://twitter.com/fluxfingers/status/1053279841578086406 https://twitter.com/fluxfingers/status/1053279841578086406 describes some of the thinking in making that challenge. I disagree with things like that, though.
Also, meta, but on challenge design: if you're gating your challenges, keep in mind that your final challenges may need to be opened sooner than the last hours of your competition. There's an expectation that challenges get harder as the game goes on, but also, the teams are getting tired, and the time left in the game is going down. We viewed challenges that remained completely unsolved at game close as minor failures. I think one year we didn't let the final challenges open as there was too little time left at the end of the game, so we rolled them over to the following year.