To Play or Not to Play: Insights and Lessons Learned from 20 Years of CTFs with ENOFLAG

Imagine the world of cybersecurity as a giant, high-stakes gym where the equipment is made of digital traps and the workout is breaking things to see how they hold up. In this gym, there's a popular game called "Capture The Flag" (CTF). Think of it like a digital scavenger hunt mixed with a lock-picking contest. Instead of finding a physical flag buried in a sandbox, teams of hackers hunt for hidden strings of text called "flags" hidden inside intentionally broken computer programs. They have to figure out how the program is broken, fix the hole to stop others from using it, or exploit the hole to steal the flag from their rivals. It's a way to learn how to protect computers by learning how to break them, turning boring security lessons into an exciting, competitive sport.

For the last two decades, a group of students and teachers from a university in Berlin, Germany, known as ENOFLAG, has been running around this digital gym. They started as a small team just trying to show up to a local contest, but over 20 years, they've watched the game change from a small gathering of friends into a massive global phenomenon. They've seen the tools get fancier, the number of players explode, and the rules of the game shift in surprising ways.

This paper is their "time capsule" and "field guide" rolled into one. The authors, Jörg Schneider, Sebastian Neef, and Sebastian Koch, look back at 20 years of organizing and playing these contests to tell us how the game has evolved and what they've learned about keeping a team alive for two decades.

From a Small Club to a Global Stadium
When ENOFLAG started in 2006, the CTF world was a quiet neighborhood. There were only about 20 to 25 teams playing in the biggest contests. If you wanted to join, you had to build your own team from scratch because there weren't many around. Today, the scene has exploded. It's now normal to see hundreds of teams competing at once. The authors explain that this boom is partly because the "gym" has moved to the cloud. In the past, every team had to rent their own servers and wires, which was hard and expensive. Now, organizers can just click a button to spawn hundreds of virtual machines in the cloud, making it easy for anyone to join the party.

The Two Ways to Play
The paper highlights a shift in how people play. Twenty years ago, the most popular style was "Attack-Defense." Imagine a game where every team gets their own castle (a virtual machine) that they have to defend while simultaneously trying to break into everyone else's castles. It was intense, interactive, and very hard to organize. Today, the "Jeopardy" style has taken over. This is more like a standard quiz show or a video game with levels. You get a list of puzzles (like cracking a code or finding a bug in a website), and you solve them at your own pace to earn points. The authors suggest this style is winning because it's easier to run and doesn't require the complex, real-time fighting of the Attack-Defense mode.

The Tools of the Trade
The tools the players use have gotten a massive upgrade. Back in the day, if you wanted to see what was happening on the network, you might use a simple tool that just showed you a stream of data, like watching a river flow. Today, teams use powerful, automated systems that can analyze traffic and launch attacks with the speed of a supercomputer. For the people running the contests, it's also gotten easier. In the early days, organizers had to build the entire scoreboard and game management system from scratch, like building a rollercoaster from wood and nails. Now, there are ready-made platforms that let anyone set up a contest in a weekend.

The Mystery of the Missing Notes
One interesting change the authors noticed is that players are sharing less of their secrets. In the past, after a contest, teams would write detailed guides called "writeups" explaining exactly how they solved the puzzles, and they'd post them online for everyone to learn from. It was like a public library of solutions. Now, the authors observe that these guides are disappearing from public sites. Instead, they are being shared in private chat groups or not shared at all. This means the "library" is getting emptier, making it harder for new players to learn from the old masters.

The Robot Revolution
The most dramatic change the paper discusses is the arrival of Artificial Intelligence (AI). The authors note that AI agents have demonstrated the feasibility of winning CTFs by solving challenges of varying difficulty and from all categories. This means that for human teams, the chances of winning are becoming "diminishingly small" because the speed and capabilities of AI outpace a single player. The paper suggests that this is changing the game forever. Teams are now forced to use AI just to keep up, or they will lose. This creates a new problem: if the game becomes a race to see who has the most expensive AI subscriptions, it stops being a test of human skill and learning. The authors worry that this might make students lose interest because the gap between a well-funded team with a super-AI and a student team is becoming too wide.

What They Learned About Keeping a Team Alive
Finally, the paper offers some advice on how to keep a team like ENOFLAG going for 20 years. The secret isn't just having the best players; it's about community. They found that having regular weekly meetings, a friendly atmosphere for beginners, and a mix of students and teachers is crucial. They also learned that having an official club status helps, because it protects the team when professors retire or university buildings change. They emphasize that the goal should always be learning and having fun, not just winning prizes. If a team becomes too focused on being "elite," it loses the new blood needed to survive.

In short, this paper tells the story of a digital game that grew from a small experiment into a global sport. It shows us that while the tools and the players have changed, the core challenge remains: how do we keep learning and having fun when the robots are starting to play the game better than we do? The authors suggest that the community needs to invent new ways to play that keep humans in the driver's seat, ensuring that the game remains a place for education and discovery, not just a contest of who can afford the best AI.