4 ms·

is it really though? I was actually doing something, was a bit curious, spent 30 seconds on it and thought "well this looks like a waste of time" and then scro

is it really though? I was actually doing something, was a bit curious, spent 30 seconds on it and thought "well this looks like a waste of time" and then scrolled through to see the comments and now I'm bouncing and going back to what I was doing. The people better than me wouldn't have even done that. The best and the brightest are busy doing stuff. Why would they even come in contact with stuff like this?

wil93 4y ago
I'm under the impression that CTFs are where the top security talent is harboured and discovered, though I have no data about it.
- saagarjha 4y ago
  Definitely not required, but it’s a fun pastime for many. Kind of like how bullet chess relates to the professional game.
- kristopolous 4y ago
  I guess. The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games. There's a lot of clever people that really do not care for competitive recreation. You can be a serious scholar without also being an enthusiastic puzzlemaster So CTF is just another form of cohort filtering masquerading as competence selection; a modern version of going for beers and golfing with a candidate and then wondering why you have a bunch of beer drinking golfers working for you
  - UncleMeat 4y ago
    I've got a PhD in security from arguably the best program in the world. A bunch of people in my cohort did CTFs regularly. Many of us didn't, but the idea that CTFs were only done by less skilled people is bogus. Further, security really is one of those fields where skill matters more than everything else. There really are people attending defcon that don't have any formal training but are as deeply skilled at the people published best-papers in Oakland or whatever.
    - kristopolous 4y ago
      > the idea that CTFs were only done by less skilled people is bogus. And that's why it's not there. Just about any filter, even the most arbitrary one will work some of the time. To go back to the previous analogy, plenty of competent people like beer and golfing and plenty don't. It's about trying to recognize what's culturally myopic and extricating those signals.
      - UncleMeat 4y ago
        I don't understand. The parent comment said: "The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games." As a person who is a member of the very group you are speaking about, I find this statement to be completely non-factual. Do CTFs identify the very best security minds? No. They are fun hobbies. But you didn't say that CTFs aren't useful for finding the very best hires. Instead you said that the very best hires do not enjoy CTFs at all. This is just straight up wrong. Both in academic and industrial circles.
        kristopolous 4y ago
        " The best engineers and people I know " clearly has a selection bias and is not equivalent to " the very best hires do not enjoy CTFs at all. " they're complete orthogonal Saying I personally know smart people who don't play games doesn't mean I'm claiming all people who play games are stupid. This is extremely basic logic stuff here. Do you need me to draw you some pictures? I can do that
        UncleMeat 4y ago
        Why would this be relevant if it were just about your group of buddies? The post was obviously making a general statement about people in the industry.
        kristopolous 4y ago
        No. I think the diagram would be genuinely helpful. This is a set intersection. There's something called Venn diagrams that can help you here. Any recruitment of a feature by a proxy can do at best the intersection of the proxy and the feature set. That's the small overlapping slice of the diagram. You can argue how big that intersection is but recruitment by feature, directly, is a better strategy unless the feature matches the proxy in which case it's equivalent. So just go direct and skip the proxy. There's a tendency to hire by games of arguable relevance these days as opposed to direct observations of work. The optimizing towards the game is fundamentally dysfunctional for team building and eventually product development. It's not coincidental that valley tech has become more manipulation, extraction and distraction services than substantive products as a lagging indicator of this trend. (Of course there's macroeconomic forces as well. I mean, obviously, no shit) I really can't put any more time into this
hayst4ck 4y ago
This type of thing has been targeted at high school students and undergrads. There are often cash prizes, comped travel, and companies are eager to give a lot of these people interviews. I'm fairly confident the US government is happy to shower this type of thing with money as well. This is like ACM programming competitions. A significant number of the teams on ctftime.org represent colleges world wide. CTF's come with points and scores and ranks. Why do people play recreational sports? Why do people do escape rooms or puzzle hunts or any of that other stuff? As far as methods used to solve CTF problems, the practical knowledge gained from solving many CTF problems is directly applicable to future jobs in a way that other methods (like the majority of college homework) are not. If you do CTF's, you will definitely have to write programs that interact with file formats and you will definitely have to write programs that interface with webservers, and you are very likely to get into the esoteric edge cases of various languages that will result in a fairly deep understanding of how languages work past a few reserved words and a couple data structures. There are even problems that will draw you into learning about signal processing or how punch cards used to work.
barkingcat 4y ago
the poster who mentioned students is totally right on. There are many students who are doing higher level work than "pros" - the best and brightest are often bored out of their minds sitting in high school, undergrad, and graduate classes. Don't discount the younger generation just because they don't have as much experience.
forgotpwd16 4y ago
>The best and the brightest are busy doing stuff. Like CTF (what this seems to be basically) and similar hacking competitions? Competitive programming?
- saagarjha 4y ago
  It's a similar relationship, yes.
carom 4y ago
I bounced before the text finished printing.
jawadch93 4y ago
[dead]

wil93 4y ago

I'm under the impression that CTFs are where the top security talent is harboured and discovered, though I have no data about it.

saagarjha 4y ago
Definitely not required, but it’s a fun pastime for many. Kind of like how bullet chess relates to the professional game.
kristopolous 4y ago
I guess. The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games. There's a lot of clever people that really do not care for competitive recreation. You can be a serious scholar without also being an enthusiastic puzzlemaster So CTF is just another form of cohort filtering masquerading as competence selection; a modern version of going for beers and golfing with a candidate and then wondering why you have a bunch of beer drinking golfers working for you
- UncleMeat 4y ago
  I've got a PhD in security from arguably the best program in the world. A bunch of people in my cohort did CTFs regularly. Many of us didn't, but the idea that CTFs were only done by less skilled people is bogus. Further, security really is one of those fields where skill matters more than everything else. There really are people attending defcon that don't have any formal training but are as deeply skilled at the people published best-papers in Oakland or whatever.
  - kristopolous 4y ago
    > the idea that CTFs were only done by less skilled people is bogus. And that's why it's not there. Just about any filter, even the most arbitrary one will work some of the time. To go back to the previous analogy, plenty of competent people like beer and golfing and plenty don't. It's about trying to recognize what's culturally myopic and extricating those signals.
    - UncleMeat 4y ago
      I don't understand. The parent comment said: "The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games." As a person who is a member of the very group you are speaking about, I find this statement to be completely non-factual. Do CTFs identify the very best security minds? No. They are fun hobbies. But you didn't say that CTFs aren't useful for finding the very best hires. Instead you said that the very best hires do not enjoy CTFs at all. This is just straight up wrong. Both in academic and industrial circles.
      - kristopolous 4y ago
        " The best engineers and people I know " clearly has a selection bias and is not equivalent to " the very best hires do not enjoy CTFs at all. " they're complete orthogonal Saying I personally know smart people who don't play games doesn't mean I'm claiming all people who play games are stupid. This is extremely basic logic stuff here. Do you need me to draw you some pictures? I can do that
        UncleMeat 4y ago
        Why would this be relevant if it were just about your group of buddies? The post was obviously making a general statement about people in the industry.
        kristopolous 4y ago
        No. I think the diagram would be genuinely helpful. This is a set intersection. There's something called Venn diagrams that can help you here. Any recruitment of a feature by a proxy can do at best the intersection of the proxy and the feature set. That's the small overlapping slice of the diagram. You can argue how big that intersection is but recruitment by feature, directly, is a better strategy unless the feature matches the proxy in which case it's equivalent. So just go direct and skip the proxy. There's a tendency to hire by games of arguable relevance these days as opposed to direct observations of work. The optimizing towards the game is fundamentally dysfunctional for team building and eventually product development. It's not coincidental that valley tech has become more manipulation, extraction and distraction services than substantive products as a lagging indicator of this trend. (Of course there's macroeconomic forces as well. I mean, obviously, no shit) I really can't put any more time into this

hayst4ck 4y ago

This type of thing has been targeted at high school students and undergrads. There are often cash prizes, comped travel, and companies are eager to give a lot of these people interviews. I'm fairly confident the US government is happy to shower this type of thing with money as well. This is like ACM programming competitions. A significant number of the teams on ctftime.org represent colleges world wide. CTF's come with points and scores and ranks. Why do people play recreational sports? Why do people do escape rooms or puzzle hunts or any of that other stuff? As far as methods used to solve CTF problems, the practical knowledge gained from solving many CTF problems is directly applicable to future jobs in a way that other methods (like the majority of college homework) are not. If you do CTF's, you will definitely have to write programs that interact with file formats and you will definitely have to write programs that interface with webservers, and you are very likely to get into the esoteric edge cases of various languages that will result in a fairly deep understanding of how languages work past a few reserved words and a couple data structures. There are even problems that will draw you into learning about signal processing or how punch cards used to work.

barkingcat 4y ago

the poster who mentioned students is totally right on. There are many students who are doing higher level work than "pros" - the best and brightest are often bored out of their minds sitting in high school, undergrad, and graduate classes. Don't discount the younger generation just because they don't have as much experience.

forgotpwd16 4y ago

>The best and the brightest are busy doing stuff. Like CTF (what this seems to be basically) and similar hacking competitions? Competitive programming?

saagarjha 4y ago
It's a similar relationship, yes.

carom 4y ago

I bounced before the text finished printing.

jawadch93 4y ago

[dead]