GopherCon’s First Capture-the-Flag Challenge
“In general GopherCon feels like home to me,” says Benji Vesterby.
And at GopherCon 2023 — the annual user conference for the Go programming language — the cybersecurity/software engineering consultant gave back, co-creating the conference’s first-ever “Capture the Flag”-style event, where teams of attendees competed on flag-awarding challenges.
The “flag” was defined as a UUID-formatted string — always prefixed with a four-character shout-out to GopherCon — “gc23”.
“Much like a high-tech scavenger hunt, participants search for these flags by navigating a series of technical challenges,” explained the contest’s official site, “such as breaking into computer systems, deciphering encrypted messages, or exploiting vulnerabilities in software.
“Thoughtfully curated for Go engineers of every expertise, the event promises a merger of multifarious security domains and one-of-a-kind engineering and security challenges — all centered around Go!”
But it was more than that, starting a new tradition that will continue at this year’s 10th-anniversary GopherCon happening in Chicago in July — along with some new adjustments to make the playful competition even more welcoming to newcomers.
And maybe it was also a celebration of the fun and community that help a programming language thrive.
A Welcoming Vibe
Halfway between last year’s event and this year’s, Vesterby reflected on the new event — and what it means for the larger Go community. At Vesterby’s first GopherCon in 2018, “I walked in, grabbed my badge, turned around and started awkwardly introducing myself to people. I didn’t realize until later that I had done that to Erik St. Martin, Brian Ketelsen, Ashley Willis and the rest of the Microsoft team at the time that was there. I didn’t know who they were. They took it in stride, with grace and were friendly and welcomed me to the community and the conference. They welcomed me to the family.
“They probably don’t remember that, but I do.” In real life, Vesterby says, people you’ve only known online turn out to be “very down to earth.”
Vesterby wanted to create an event with the same welcoming vibe for newcomers. Capture The Flag came to mind. This is a game where each team gets a flag and, by solving puzzles and searching for clues, they can capture the opponents’ flags.
To create GoppherCon’s Capture the Flag event, Vesterby teamed up with Neil S. Primmer, who is a principal architect at the boutique cloud/data consulting firm Rearc. “Neil and I were just kind of hitting up each other on Slack with new ideas as we would go,” Vesterby remembered on the Changelog podcast Go Time.
They’d planned on having just 10 challenges, to see which team could finish first. “And what ended up happening was Neil and I started hacking away, and we ended up with almost 50 challenges.” (Although some were “bonus” challenges, where completing one challenge unlocked a series of additional challenges… )
🎙️ In the latest podcast episode from Go Time, @Angelica_Hill dives into the exhilarating world of organizing Go Capture the Flag at #GopherCon 2023 with organizers Neil S Primmer & @BenjiVesterby. 🚩💻
Tune in now! 👉 https://t.co/TkQapECfyM#golang pic.twitter.com/oYkHWBRWyq
— GopherCon (@GopherCon) February 9, 2024
On the podcast, Primmer said he’d been a fan of CTF-style events since ZDTV covered DefCon’s versions in the late 1990s, “and just being really drawn into that idea of gamifying your own education.” And Vesterby also thanked Adam Shaw, one of the organizers of the Kernelcon security conference in Omaha who’d staged Capture-the-Flag events before, and “helped kind of guide the initial parts of the process and give us direction”.
In the end, they came up with something for everybody, with challenges covering everything from web application security to the Internet of Things, from network security to reverse engineering — and even supply chain security. But amazingly, they’d created all the challenges in less than two months. “We were able to pull in a couple of others who helped contribute to some of the code,” Vesterby said on the podcast, “and then there were some people who helped run it on site.” They’d tested the challenges, Primmer added, “and there’s definitely somewhere we dialed back the difficulty a little bit.”
The contest’s official site even includes a reminder to ask for help if you get stuck. “Remember that it’s supposed to be fun.” And at GopherCon, both Primmer and Vesterby are always ready to help — or to welcome other participants. As Vesterby explained in our email interview, “I want to be able to help others feel the way that I did my first time at GopherCon so that they can grow and thrive in the community the way that I have.”
In fact, it was at his first GopherCon that Vesterby first met Primmer. Together they’d launched the #swarm channel on Golang Slack for GopherCon socializing in 2018 — and it’s been active and growing every year since. “It’s really cool to have been part of now two community events that have become part of a yearly tradition at GopherCon and people look forward to.”
He sees signs that it’s jumpstarting that sense of the community. “One of the really cool things that I saw while watching the teams taking part in the event was the self-organization that took place,” Vesterby said in our email interview. “It was really cool to see how organic it was, as different groups formed and started working together and sharing their very different expertises.”
But even Vesterby learned something — about a vulnerability in the contest’s file directories. “There was one particular attendee who was able to find three of the flags at once in one of my puzzles by leveraging a path traversal vulnerability to load the process ID file of the API process and read the environment variables that stored the flags for that particular challenge. It was really incredible to see.
“I couldn’t even be mad at it. It wasn’t something that I had thought about so now I know what to fix this year, and who knows, maybe there will be an easy way to find a couple of flags.”
Next Steps
Primmer noted on the podcast they’d intentionally included some challenges accessible to beginners — last year included a crossword puzzle. (“I think someone actually [used] ChatGPT and got their answers that way.”)
“The idea is that everyone who has any interest should be able to participate and should be able to pass at least one challenge. I think those are the people we want to reward the most, are the people who are taking a bigger step in coming in there and being able to say ‘I did it. Now what’s next?’ and being able to be part of the group. And community surrounding just the competition is going to help them kind of take that next step beyond that.”
In our email interview, Vesterby added, “The people who really went away with the most from the event were the people who gave it a try even if they only got one puzzle.”
And it’s a lesson he’s taking to heart for 2024’s event. “I plan on having more prizes for those participants.”
But in addition, “This year we’ll have more than just a security challenge, so be ready.” They haven’t announced 2024’s theme, but on the podcast, Vesterby acknowledged “It’s gonna be fun.” Vesterby added later that the challenges “are going to go beyond security, and they’ll be a little bit more in everybody’s wheelhouse, a little bit more approachable, I think, for most people.”
Vesterby shared a picture of “part of my bookshelf where I’m sure to pull challenges from.”
They’re assimilating what they learned from 2023’s survey. “we also have some of the participants from last year who want to help with this year’s challenges,” Vesterby said on the podcast. “And I think that that’s going to be good, to help direct us on a better path to make sure that more people get enjoyment out of it.”
Primmer added that since they spent so much time explaining what Capture the Flag was, “we’re going to rebrand from Capture the Flag, instead to Challenge Series.”
This will give them a broader problem space than just the usual security challenges. “Because at the end of the day, it’s meant to help people try new things and learn new things…. It’s really meant to engage people in the community to try something you haven’t tried before — learn something about Go you don’t know about. ”
That much is clear. Their event “added a whole new level of community last year,” Vesterby said in our email interview. It ran the entire length of the conference, and “people were talking about it every day… They were able to learn from others in the community in a semi-structured, low-stakes environment and try things they hadn’t tried before.”
It all echoes a lesson that he learned at his first GopherCon back in 2018. “The Go community is incredible,” Vesterby said on the podcast. “It’s welcoming and inclusive, and it is very much worth being part of.
“There has never been a development community that I have been more proud to be a part of.”
