Andrey Gein: -- I think such system is needless. We need to rank competitions by difficulty. How do we solve the problem with selection participants for contests? Each contest can organise quals for itself. We need to organise more good contests and not depend on audience, geography or level.
Alexey Kharlamov, Honeypot: -- We would like to divide students into two categories: ordinary and newbies. Victor Minin: -- Who needs a weak classic CTF? Andrey Gein: -- We organised QCTF Starter for the newbies and noticed that it's very important and needed. In classic CTF there's nothing like that, although it could lower the entry point to CTF.
Nikolay Tkachenko, Shadow Servants: -- We are not the team of one single university, that's why this system gives us many troubles. We don't have to go in the direction of participation on behalf of universities, we have to make universities want us to participate on behalf of them.
Victor Minin, ASICO: -- Development of regional competitions led us to understanding that we need to order all the contests organised by different teams. Also we understood that student teams work only with students, but it's necessary to also include school pupils in this. Due to experience of Siberian teams we developed four-level system: 1. School, University contests. 2. Level of federal subjects. 3. Level of federal districts. 4. All-Russian competitions.
Infrastructure and experience allow us to develop more. The appearance of standards leads to increase in number of levels. RuCTF gets to the 5th level as an international competition, accepted by many countries.
Acceptance of this structure depends only on CTF players, no government structures can influence on CTF organisation.
Maria Kiskachi, RuCTF director: -- Another topic we are going to discuss -- systematisation of CTF organisation in Russia, Victor Minin will talk about it.
Andrey Gein: -- Thank you, in addition to the expected answers I heard a lot of new interesting ideas. About the old format: it's going to live as long as the organisers well be able to organise it, and participants -- play it. We'll see what is more interesting, useful and productive to play.
1. Possibility to play in one person kills socialisation? To my mind, teams will nevertheless more powerful then one person. So in this area little will change. Somebody writes exploits better, somebody finds the vulnerabilities better. 2. Current format suits only for beginners? Nope! Entry point for current classic CTF is very high.For the last 10 years in Russia there appeared no more than 100 teams. With the new format to start playing and train would be easier. 3. You played CTF too little, and that's why you are not familiar with the problems? I think it's the opposite. Those problems are the reason you played little. 4. About fun: yes, there will be no fun. I don't know what to do with it, how to make fun and solutions to problems get along. Probably, it would be more interesting to somebody. Let's try and see. 5. About creating vulnerabilities that are hard to detect in traffic -- I think it's better to create those that exist in real life. 6. The skill to configure the network, dockers and so on is important, if you are an information security specialist, but in the current variant it's too much. System-wide vulnerabilities -- yes, system administrators' competition -- no.
Konstantin "Kost" Plotnikov, Hackerdom: -- I started playing CTFs in 2006. For me the words of everyone present are pretty much comforting. In the new concept there is no communication between teams, the fun goes away, some knowledge and skills disappear, like for example forensics. It had to be a more academic thing, not instead, but along with the old format.
Dmitry Sklyarov, Positive Technologies: — I, myself, never played CTFs, so this is my view from the other side. Andrey says that everybody is cheating and breaking the rules. But the whole information protection thing is about breaking the rules! Find a bypass, break a planned ahead script is an important part of the game. Creating new rules is useful for organisers, not participants. New format is not bad, but it doesn't have to be a replacement for the old one. If we do everything according to the rules, we'll kill CTF.
Nikolay Tkachenko, Shadow Servants: — In any contest there's a place for random. It's impossible to make those without accidents. If we take the communications between teams away, we'll get another ACM-like stuff which is hardly connected to CTF. I suppose we should make the contested themselves more interesting and not create new format.
Kharlamov Alexey, Honeypot: — It seems that we should develop not the part with the idea, but the technical one, so that any team could organise a classic CTF and the number of such contests increases. That's when we could start experimenting with the other aspects of organising CTFs.
Alfyorov Roman, girav: — For inexperienced teams it's interesting to watch how they are attacked and learn from the other teams. About the "prepared at home" thing: much is completely impossible to prepare beforehand, and those that can be prepared make an integral game aspect.
Dubrovin Alexey, VoidHack: — I totally agree with Andrey that the A/D format, as a way of choosing the best team, is pretty bad. Format that Andrey suggested is more exact.
Artur Liss, Destructive Voice: — The feelings are mixed. Our team still can't decide whether it's good or bad. I, myself, would certainly take part in such a thing, it's interesting.
Victor Minin, ASICO: — There appear the problems of implementation, it would take more resources to spend. I don't know about the fun, but the novelties are always frightening. We're not done with playing yet, but we could try. In general, I agree with Andrey!
Oleg Broslavsky, SiBears: — We vote for fun in CTF! If we need to understand the skills of participants, we need to update new format. But if we want to get pleasure and a doze of adrenalin from CTF, we have to leave classic CTF the way it is. Our suggestion is to stay this way, but introduce a new version in which we'll solve services as tasks.
Roman Lebedev, Teamspin: — CTFs look like something "prepared at home", because many things depend on hardware which is used to set up servers. However, Andrey's solution is too radical from our point of view, because it would be absolutely different variant of CTF.
Dmitry Mutovkin, keva: — I don't get the problem Andrey mentioned. For me it hasn't yet come. We play CTFs too rarely, so it's too early to discuss such problems, but some questions to the format of contests are already coming to our team members' minds. I think the current format is good for beginners.