It’s the Smallstep Holiday CTF!
Carl Tashian
Happy holidays! This is our 5th year doing a Smallstep holiday project, and for this year’s project, we created a Capture the Flag (CTF) project with a few quirky puzzles.
Smallstep Holiday Bakery MUD
The playing field for the CTF is a Multi-User Dungeon (MUD)!
A MUD is a text-based multiplayer game that was popular on the internet of the 1990s. Some MUDs had thousands of rooms, hundreds of NPCs, and dozens of college kids playing on them every night. As a teen, I learned to program by working on a MUD. So, this project has some special nostalgia for me.
I hope you have as much fun playing it as I had building it.
Details
- The CTF is at https://bakery.lab.step.toys
- It will be available until January 16, 2026 at 23:59:59 UTC
- You will need
stepCLI oropenssl. - Join our Discord channel! It's #holiday-ctf-2025. I'll be lurking in case you need anything.
- Some puzzle elements may be easier to solve collaboratively, while others are going to be unique to you. All puzzles can be solved solo.
- We’ll give Smallstep swag to a few people who finish all the puzzles!
State of Device Identity 2026
Each year, we create a State of Device Identity report. Want early access to our State of Device Identity 2026 report? Fill out the Smallstep Annual Survey and we’ll drop it into your inbox in Q1, as soon as it’s ready.
- Fill out our survey for an additional chance to get Smallstep swag!
*No purchase necessary. Void where prohibited and subject to applicable laws. Entry period beginning December 19th, 2025, ending January 16th, 2026 at 11:59pm UTC. Entrants must complete the 2025 project and provide a valid email address to enter. Project completion is required for entry and equivalent to one entry per person. An additional entry may be submitted by completing the 2025 State of Device Identity survey. Winner will be selected at random before January 31st, 2026 and notified via email. Prize will be shipped to the winner if in the United States; any winning individual outside of the US may be provided with a comparable item at the discretion of Smallstep. Smallstep may modify or terminate the giveaway at any time. Entrants agree to hold Smallstep harmless from liability.
Carl Tashian (Website, LinkedIn) is an engineer, writer, exec coach, and startup all-rounder. He's currently an Offroad Engineer at Smallstep. He co-founded and built the engineering team at Trove, and he wrote the code that opens your Zipcar. He lives in San Francisco with his wife Siobhan and he loves to play the modular synthesizer 🎛️🎚️
