Capture the flag (CTF)
The competition format that assesses security skill: time-boxed contests where teams solve prepared challenges and submit a proof string. It matters to this spoke as an assessment regime — the second one the corpus holds, and the first that is not a hiring interview.
Entered with kernel-exploit-dojo, an archive of 100+ kernel-exploitation CTF challenges.
Why the difference matters
The spoke’s thesis is that what gets taught is downstream of what is assessed. Until now the assessor was the hiring interview, and its properties quietly shaped every conclusion drawn from it. A CTF differs on four of them:
| Hiring interview | CTF | |
|---|---|---|
| Audience | private, one candidate | public, ranked scoreboard |
| Scoring | opaque, per-firm | published, per-problem |
| Problem reuse | asked repeatedly, kept secret | used once, then released |
| Result | pass/no-hire | solve counts, times, standings |
The last two are what produce a problem-archive. Because problems are released after the event and scored in public, the exam leaves behind a reusable corpus with difficulty data attached — which no interview does, and which is why the corpus’s first item-level numbers arrive through this regime rather than the other.
What it assesses
Solving under time pressure against a working system, with a verifiable result: the flag either validates or it does not. That makes CTF scoring unusually objective for an education corpus where nothing else is measured — and unusually narrow. It rewards speed on prepared, solvable puzzles with a known-good answer, which is not the same as the open-ended work the skill is a proxy for. The gap between the two is the standard criticism of the format and this wiki holds no source arguing either side of it.
Open
- Is there outcome evidence for CTF? The format is old enough and public enough that competitor standings could in principle be tracked against later careers. The corpus has none, and this is the same missing-outcome hole that applies to every source here — but with better-shaped data available than anywhere else in it.
- Who writes the problems, and against what? An interview’s scope comes from a job. A CTF’s comes from the challenge authors, a small group whose selection nothing in the corpus documents.