Automatic task retrieval

[XeR]

That would be nice to have CTFNote retrieve tasks automatically.

I see multiple problems:

• It needs a new connector for every CTF framework (CTFd, mellivora, etc.) and custom ones (0ctf, ASIS, hack.lu)
• Task modification will be a pain (change of categories, description, name, description)
• Most organizers want to see big numbers. They require authentication to display the challenges

I have wet dreams of a standardized CTF API where all the tasks are publicly visible (or with an bearer token)
This is the reason why current CTFNote lets you import tasks from CTFd's JSON instead of fetching it

Is it worth it ?

[JJ-8]

I think that it would be more than sufficient to make an easy extensible system for importing tasks from a CTF framework. So the first thing you do as soon as a CTF starts, you import it from the website and all the tasks are there immediately. A realtime (or periodically) sync is not necessary in my opinion. This way we can just slowly extend the compatibility for CTF frameworks.

Changes in the data after the initial import will indeed be difficult to track. However, I think it will not be very difficult for the players to manually correct these changes. Or we can try to match data in a smart way to detect 90% similarity between the data and a task and this way choose the correct task to update. Or we just import another (duplicate) task with the new changes and we allow the player to see and change the HedgeDoc pad URL and therefore a player can just copy the pad from one task to another and delete the old one.
It is at least a big time saver already to have it correctly imported at the beginning of a CTF instead of manually adding it one by one.

Right now I see that the import is implemented in the browser. This will make it impossible to allow custom CTF frameworks since CORS will probably block it. So we have to add a server side fetch functionality for this. We can directly design it in such a way that it is easily extensible and that it doesn't require a lot of effort to add a new CTF framework. For the authentication we can add additional fields where the user can paste in their cookie/bearer so the server would be authenticated as the user.
A standardized CTF API would be something more for CTFTime. If they would fix that, that would be awesome for everyone!

[XeR]

Or we can try to match data in a smart way to detect 90% similarity between the data and a task and this way choose the correct task to update.

This looks complex.
We would also need to take into account that some CTF might have Foo flag 1 and Foo flag 2. A naive implementation would import the challenge 1 and rename it as soon as it sees the second challenge.
What about Bar getting renamed to Bar (old) with the release of Bar (fixed) ?

I believe all CTF framework expose some kind of task identifier (id, url, etc.). We could reuse this to solve the problem.
It will not help if the organisers remove a task and create a new one with the same name.
This should not happen too often (I hope I won't jinx it !) that we could ask help to a human when that happens.

A standardized CTF API would be something more for CTFTime.

There was an effort to have a centralized page to see scoreboards on CTFtime. I don't think I've seen it used more than 5 times.

Also you can provide JSON feed of your CTF scoreboard, so we can update information at CTFtime in realtime. At the moment this feature is in progress.

Source

Maybe we can draft a standard that does not require authentication and try to get it implemented on major frameworks ?