Scavenging, Tech, and CTF
I still remember the first time I watched a CTF final at DefCon. Not competed, just watched. This was the last year it was at Ceasar’s convention center (the year of the bomb threat), watching the scoreboard tick up and down in real time as teams popped boxes, patched their own services, and occasionally sabotaged each other just enough to buy themselves breathing room. It’s a strange kind of spectator sport. There’s no ball, no puck, nothing you can point a camera at and immediately understand. Just a bunch of very tired, very caffeinated people staring at terminals, and a scoreboard that tells the story if you know how to read it.
And then there’s the stuff that isn’t the main event but somehow ends up being even more memorable. My favorite is 5N4CK3Y, pronounced “Snacky”, the hardware CTF built around a vending machine, where you’re picking locks, sniffing buses, and finding your way to a redeem code to get a prize. Then there are badges that turn into their own multi-day puzzle chains if you know where to poke them. My favorite this year was the amazing Cult of Cthulu badge. Then there’s CTF buried in the pinball machines. It seems like everything centers around a CTF puzzle games. I’ve come to realize that all this is just an extension of the real-world puzzles people have loved to play basically forever.
What I find more interesting than the mechanics of the infosec CTFs we’ve come to know, though, is where CTF culture actually comes from. It didn’t spring fully formed out of network security. It’s a direct descendant of puzzle hunts, the most famous perhaps the MIT Mystery Hunt, the kind of thing where a small group locks themselves in a room for 48 hours chasing a chain of cryptic clues because someone built an elaborate narrative around a prize that’s mostly symbolic. It’s also got DNA from wargaming, from the old phone phreaking scene’s love of finding the undocumented edge of a system just to see what’s there, and from tabletop and video game design’s obsession with layered challenge. The idea that the fun isn’t the answer, it’s the process of getting there.
That’s the spirit the organizers want to borrow for DevOps Days Rockies this year.
Geocaching, escape rooms, alternate reality games, these are all relatives of CTF that people love for similar reasons. They’re all built on the same underlying appeal: a real or virtual space gets overlaid with an invisible layer of meaning that only reveals itself if you go looking. You’re not just walking through a building or browsing a network, you’re on a secret mission, that makes you different than everyone else in the room, because you know there’s something hidden in the structure of it. That’s the actual throughline connecting a scavenger hunt at summer camp to a DEF CON CTF bracket to an ARG that makes you decode a QR code on a stranger’s bumper sticker. Different domains, same itch.
If you’re going to be at DevOps Days Rockies, this is your heads-up: there’s a scavenger hunt running alongside the conference this year, styled as a real-world CTF. It’s not a coding challenge sitting behind a laptop screen, it’s built to make you move through the physical event, look closer at things you’d normally walk past, and follow a trail that starts in one specific place.
That starting point is here
I’m not going to spoil anything past that, because the whole point of a hunt like this is that the first flag should feel like it was hiding in plain sight the entire time. Go start there, and treat the rest of the conference as the board.
