4 ms·

As someone who plays in a lot of "conventional" CTFs (e.g. DEFCON, Codegate, GitS, etc.), this sounds very cool, even if my participation in those already gets

As someone who plays in a lot of "conventional" CTFs (e.g. DEFCON, Codegate, GitS, etc.), this sounds very cool, even if my participation in those already gets me some job offers :) One question: for a less "just for fun" site like this, with no time barriers, how do you plan on dealing with people just following write-ups? You can randomly generate the flags, but people could still follow the steps. You can say "don't write write-ups," but write-ups will still be written ;)

tptacek 12y ago
This is (a) a real challenge, (b) something we're addressing in part by not letting the content get stale, (c) something we were surprised by with the crypto challenges --- if you ask people to follow the honor system, they tend to do it! --- and (d) something that the game model will also somewhat address. It's hard for me to go into more detail on (d) without revealing a whole bunch of stuff about the game I don't want to talk about yet; I should be more comfortable talking about it, but until we announce it officially I have a lot more leeway to slip rev1 features. :) The shortest simplest answer though is: we're a firm whose whole purpose is to make fun, interesting CTF-style games (well, one game; we're the Blizzard of CTFs, and we're building our WoW), so we can address a lot of these kinds of problems with brute force, because this isn't a spare-time thing. If it helps to understand where we're coming from: Chris Eagle, the author of The IDA Pro book, published an IDA Pro plugin for the bizarro-MSP430 that Microcorruption (our last CTF) emulates. There are tools with "microcorruption mode" in them because of all the little ways we broke MSP430. Someone wrote a symbolic execution engine to solve the Hollywood level on Microcorruption and posted it to Github. There is still a #uctf channel on Freenode for Microcorruption. This. Is. Awesome. It is my favorite thing about Microcorruption. We did practically nothing at all to foster a community for Microcorruption, apart from Erin starting the IRC channel. That's not an opportunity we are going to miss this time; in fact, doing better on the community and sharing side is part of the thesis of the company. I reallllllllllllly hope people share code and tools and stuff to make progress in the game. How cool will that be?
- amirmc 12y ago
  > "... if you ask people to follow the honor system, they tend to do it!" This is great but I think the stakes are somewhat different if it's ostensibly about jobs/hiring. I don't recall the crypto challenges being promoted as a hiring mechanism (though they may have been useful for that).
  - tptacek 12y ago
    The crypto challenges were how we (for instance) hired Alex: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. Look, the reality is, most of the people who participate aren't going to be looking for a job when they do. So all our incentives are to make the experience itself rewarding to participants. I'm weird about typing those words because very very soon we're going to actually ship the first rev and levels of this thing, and as anyone who ships software knows: right now, at this point in the release calendar, my instincts are to be LOWERING the bar, not raising it. :)
    - throwawaymaroon 12y ago
      >I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. >most of the people who participate aren't going to be looking for a job when they do. This is weird, and I'm sensing some miscommunication between you and patio. I'm only hearing about this as a tool for proving my worth. Your major marketing (as far as I'll likely ever be aware) has CAREER CAREER CAREER stamped all over it. People won't follow the honor system if the stakes are at the 'career' level. You're losing the 'fun and free' culture of Microcorruption that makes people spend their free time building fun tools. Your understanding of the incentives differ from the incentives that have been communicated to me about Starfighter.
      - tptacek 12y ago
        Patrick. You're fired. Anonymous Throwaway Account? Yes, you over there. I'm looking RIGHT AT YOU. Yes you. You're the new CEO. Get to work. Explain this to everyone else on HN. The clock's ticking!

tptacek 12y ago

This is (a) a real challenge, (b) something we're addressing in part by not letting the content get stale, (c) something we were surprised by with the crypto challenges --- if you ask people to follow the honor system, they tend to do it! --- and (d) something that the game model will also somewhat address. It's hard for me to go into more detail on (d) without revealing a whole bunch of stuff about the game I don't want to talk about yet; I should be more comfortable talking about it, but until we announce it officially I have a lot more leeway to slip rev1 features. :) The shortest simplest answer though is: we're a firm whose whole purpose is to make fun, interesting CTF-style games (well, one game; we're the Blizzard of CTFs, and we're building our WoW), so we can address a lot of these kinds of problems with brute force, because this isn't a spare-time thing. If it helps to understand where we're coming from: Chris Eagle, the author of The IDA Pro book, published an IDA Pro plugin for the bizarro-MSP430 that Microcorruption (our last CTF) emulates. There are tools with "microcorruption mode" in them because of all the little ways we broke MSP430. Someone wrote a symbolic execution engine to solve the Hollywood level on Microcorruption and posted it to Github. There is still a #uctf channel on Freenode for Microcorruption. This. Is. Awesome. It is my favorite thing about Microcorruption. We did practically nothing at all to foster a community for Microcorruption, apart from Erin starting the IRC channel. That's not an opportunity we are going to miss this time; in fact, doing better on the community and sharing side is part of the thesis of the company. I reallllllllllllly hope people share code and tools and stuff to make progress in the game. How cool will that be?

amirmc 12y ago
> "... if you ask people to follow the honor system, they tend to do it!" This is great but I think the stakes are somewhat different if it's ostensibly about jobs/hiring. I don't recall the crypto challenges being promoted as a hiring mechanism (though they may have been useful for that).
- tptacek 12y ago
  The crypto challenges were how we (for instance) hired Alex: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. Look, the reality is, most of the people who participate aren't going to be looking for a job when they do. So all our incentives are to make the experience itself rewarding to participants. I'm weird about typing those words because very very soon we're going to actually ship the first rev and levels of this thing, and as anyone who ships software knows: right now, at this point in the release calendar, my instincts are to be LOWERING the bar, not raising it. :)
  - throwawaymaroon 12y ago
    >I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. >most of the people who participate aren't going to be looking for a job when they do. This is weird, and I'm sensing some miscommunication between you and patio. I'm only hearing about this as a tool for proving my worth. Your major marketing (as far as I'll likely ever be aware) has CAREER CAREER CAREER stamped all over it. People won't follow the honor system if the stakes are at the 'career' level. You're losing the 'fun and free' culture of Microcorruption that makes people spend their free time building fun tools. Your understanding of the incentives differ from the incentives that have been communicated to me about Starfighter.
    - tptacek 12y ago
      Patrick. You're fired. Anonymous Throwaway Account? Yes, you over there. I'm looking RIGHT AT YOU. Yes you. You're the new CEO. Get to work. Explain this to everyone else on HN. The clock's ticking!