Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Frontier AI has broken the open CTF format

kabir.au

Post reply on HN
Print view View original

321–330 of 502 posts

Re: Frontier AI has broken the open CTF format

#321

Post by marshray »

hnthrow0287345 wrote: post #172
josh2600 wrote: post #165

Earlier quoted context omitted.

Why is it important that a dev can’t do fizzbuzz without ai? If they can ship code that matches a spec, why does it matter if they’re using ai or not? Genuinely curious.

It doesn't. It's just a low-end skill filter that got really popular. It could have easily been replaced by other tests like is this word a palindrome.

I wrote the "function to reverse a string" in a job interview once. Then the interviewer reminded me that strrev() had been part of the standard C library since K&R.

I'd been programming in C(++) for ~15 years by then and had never had the occasion to reverse a string. I still wonder whether that makes it a good job interview question, or a terrible one. Some of both probably.

Re: Frontier AI has broken the open CTF format

#322

Post by Aurornis »

doublescoop wrote: post #307
bawolff wrote: post #297

Earlier quoted context omitted.

Which acronym do you mean? CTF? I think that acronym, just like BGP, is more well known by itself than what it stands for. More generally, not every piece of writing is meant for every audience. Like if someone writes a blog post about CTFs aimed at people who like CTFs, nobody in the target audience needs to have CTF explained to them. Ultimately HN is a link aggregator, but sometimes its a bit like eavesdropping on…

Best practice in writing about technical concepts is to spell out acronyms like this on their first use. There is a ton of stuff I learn about here on HN that I didn't know anything about before. It doesn't help that the linked article never bothers to explain this either.

For a general audience this is good advice.

This article was written for a specific audience who follows this blog because they know the term. If you start spelling out fundamental acronyms it makes the content look more basic and general.

This always upsets the general audience who stumble upon the article (like this) but it wasn’t meant for a general audience. CTF is extremely well known and the people who would be interested in this topic would wonder what’s happening if it was spelled out. It would be so odd that it would probably attract accusations of ChatGPT writing.

Re: Frontier AI has broken the open CTF format

#323

Post by marshray »

tpm wrote: post #295
brookst wrote: post #206

Earlier quoted context omitted.

I remember when everyone bemoaned the kids not knowing assembly language. How can anyone understand software if you don’t know assembly? “Kids these days don’t work as hard / know as much / value the important things” is as tired as it is universal.

> How can anyone understand software if you don’t know assembly? I'm genuinely curious how someone who never wrote a program in assembly, or debugged a program machine instruction by machine instruction, can really understand how software works. My working hypothesis is most of them don't and actually it's fine because they don't need it.

"Assembly" is just another virtual machine instruction format sitting atop another, mildly better-hidden, pile of abstractions.

Re: Frontier AI has broken the open CTF format

#324

Post by bawolff »

doublescoop wrote: post #307
bawolff wrote: post #297

Earlier quoted context omitted.

Which acronym do you mean? CTF? I think that acronym, just like BGP, is more well known by itself than what it stands for. More generally, not every piece of writing is meant for every audience. Like if someone writes a blog post about CTFs aimed at people who like CTFs, nobody in the target audience needs to have CTF explained to them. Ultimately HN is a link aggregator, but sometimes its a bit like eavesdropping on…

Best practice in writing about technical concepts is to spell out acronyms like this on their first use. There is a ton of stuff I learn about here on HN that I didn't know anything about before. It doesn't help that the linked article never bothers to explain this either.

> There is a ton of stuff I learn about here on HN that I didn't know anything about before.

But that is about you right? Its a little entitled to expect every piece of content on the internet to have a 101 explanation attached. If they were specificly aiming to have the blog post appear on HN that would be one thing, but they (presumably) weren't.

Re: Frontier AI has broken the open CTF format

#325

Post by weird-eye-issue »

sumeno wrote: post #245
weird-eye-issue wrote: post #231

Earlier quoted context omitted.

Do you have any examples where that's actually happened and by escaped a sandbox you don't just mean like where it got a credential in a file it already had access to (which is what happened in the recent incident that went viral where somebody's production database was deleted... They had left a credential that allowed it to do so in the code)?

OpenAI documented a case in the o1 system card where the model found a misconfiguration in docker to complete a task that was otherwise impossible https://cdn.openai.com/o1-system-card.pdf There's also some research that points to it being a feasible attack surface: https://arxiv.org/pdf/2603.02277 > Models discovered four unintended escape paths that bypassed intended vulnerabilities (Section C), including exploitin…

I think you would have a greater chance of dying in a car crash in any given day than Claude Code attempting something like that. It's all about risk and reward so it ultimately would be up to you but I think it's a bit silly to worry about this when the 99.99% is in your control

Re: Frontier AI has broken the open CTF format

#326

Post by [deleted] »

Nifty3929 wrote: post #296

Must I beg to have an acronym spelled out a least once, the first time it's used? Even if you assume 90% of readers already know, the other 10% (including me, in this case) will thank you, it doesn't take much effort, and it expands the reach of your communication or idea. Exceptions for cases where the acronym is just so well known that a lot of people don't even know what it stands for even though they know the con…

[deleted]

Re: Frontier AI has broken the open CTF format

#327

Post by bawolff »

graceful6800 wrote: post #309
Nifty3929 wrote: post #296

Must I beg to have an acronym spelled out a least once, the first time it's used? Even if you assume 90% of readers already know, the other 10% (including me, in this case) will thank you, it doesn't take much effort, and it expands the reach of your communication or idea. Exceptions for cases where the acronym is just so well known that a lot of people don't even know what it stands for even though they know the con…

Since this is the top comment at the moment: CTF stands for Capture The Flag. Personally I have never, ever heard that concept referred to by the initialism. Granted, it's almost never come up in my circles, so... shrug

Just to give the actual answer, CTF in this context means a computer security competition. Generally the way they work, is you get some programs, and you have to hack them to get some string called the flag (e.g. maybe the server has a root owned file called flag, so you have to get root somehow to read the file). Team with the most flags at the end wins.

In this context, CTF is almost exclusively referred to by the initialism, i think to help distinguish from other uses of the term.

Re: Frontier AI has broken the open CTF format

#328

Post by tptacek »

Nifty3929 wrote: post #296

Must I beg to have an acronym spelled out a least once, the first time it's used? Even if you assume 90% of readers already know, the other 10% (including me, in this case) will thank you, it doesn't take much effort, and it expands the reach of your communication or idea. Exceptions for cases where the acronym is just so well known that a lot of people don't even know what it stands for even though they know the con…

Apart from everything else people have said in response to this, it's rude to presume that an article has HN as an audience simply by dint of it being available for us to link to. It's totally reasonable for people to write for an audience they know understands these terms.

So, in fact, you must not beg to have authors include courtesy definitions for you. That's not reasonable. Instead, you should simply ask here, on the thread, without complaining about the article.

Re: Frontier AI has broken the open CTF format

#329

Post by tptacek »

parasti wrote: post #81

I can't help but draw parallels with video games. Aimbots in competitive multiplayer games is a well defined issue: it's considered cheating and frowned upon, players caught cheating are banned from the game. Tool-assisted speedruns (TAS) where a player attempts a world record at completion in a single-player game is another face of the same concept (computers help you win), but one that is socially accepted as long…

Aimbots in competitive multiplayer games are (almost always) game-breaking abuses. CTFs have always rewarded tooling and automation. They're different cultures.

Re: Frontier AI has broken the open CTF format

#330

Post by tptacek »

A big fraction of the comments on this thread are about the impact of cheating on competitive games. It's important to understand that automating CTF challenges isn't usually cheating. It's normally part of CTF culture. The better teams have toolboxes ready to shred the early challenges; it's not a level playing field and was never intended to be.

(The author of the piece understands this; I think they're broadly right, though I think these games will find other ways to incentivize participation without the now-meaningless leaderboards.)

Post reply on HN