Handling of questions that match a good running CTF

Question

This question was about a running Catch The Flag competition reportedly organized by German officials, with an especially interestign question. Asking on crypto.SE was no clear violation of the CTF rules¹. However an organizer asked that my answer be made inaccessible (at least, by most) until June 1, 2020. I did that. I think another answer was similarly deleted.

There is consensus that we should close questions consisting primarilly of ciphertext as most crypto CTFs do. How should we handle the occasional interesting question that turns out to be a CTF?

Beside prohibiting dump of ciphertext and blatant lack of effort, should we explicitly prohibit asking a CTF question? Or perhaps rather require disclosing the fact, and linking to the CTF rules for public CTFs? I like that idea as a way to know the CTFs in the first place!

What should be the policy regarding answering a CTF question once it has become obvious that it's one?

Should we add something about CTFs in our topicality rules?

---

¹ The closest rule preventing asking on crypto.SE is "The tasks have to be solved individually" but this is below my threshold for: clear enough to be enforceable in the circumstance.

Answer 1

Beside prohibiting dump of ciphertext and blatant lack of effort, should we explicitly prohibit asking a CTF question?

Dumping one falls under our "no assignment / homework" dump policy. So a dump of a task will get closed accordingly.

Or perhaps rather require disclosing the fact, and linking to the CTF rules for public CTFs?

We can't require something we can't enforce. The best we could do is impose some draconic punishment if we find out by some mean that it was undeclared, but I'm not a fan of that. This is because we'd like help the person in good faith and then they'd most likely have the answer until somebody notices. Though giving a proper background to a question is always recommended.

What should be the policy regarding answering a CTF question once it has become obvious that it's one?

That's the tricky thing. We can't prevent knowledge from spreading. Nobody can. What we could do is indeed soft-delete / lock until the CTF is over. However this only ever works once - the first time this question comes up. Afterwards the question and answer are most likely on archive.org for anybody to retrieve no matter what we do. Also it is somewhat unlikely that CTF authors will come up with tasks that have no solution strategy already on Crypto.SE (short of ciphertext analysis questions).

There's also the additional case to be made that we'd be unfair to those honest competitors that didn't ask on Crypto.SE by hiding the answer because at least one person most likely already got the answer before we are notified that it spoils a CTF.

So here's my (reasonable) suggestion for a policy:

We treat all questions as non-CTF by default but encourage people to disclose the source. We handle bad dumps as usual. If the question is actually good and not a duplicate and has no answers (yet), we lock for the duration of the CTF, if it is already answered we have'd have to reach out to the organizers to find out whether they consider this cheating and whether they can invalidate "cheating" submissions. If they can, we soft-delete until the CTF is over and lock, otherwise we let it stay to leave a fair chance to everyone. Contacting the organizers will be left to the discretion of the moderator team or anyone else volunteering beforehand.

I know this is a bit of a mouthful of a policy, but I think it represents the most reasonable course of action for the different scenarios we can encounter.