patch: found the exploit

My son is seven, and he draws mazes. Not the kind you buy in a coloring book, not a printed grid with one clean path through it. He draws them himself, on printer paper, in pencil, and they are interactive in a way that should probably be patented. You start tracing a path with a pencil, and as you go, he is drawing more maze in real time, live, reactively, based on where you're at.

He adds lasers. He adds monsters, standing at specific junctions. He adds a square that is, and I'm quoting the design document here, a math test, which if you land on it he requires you to solve a problem out loud before you may continue. He adds spikes, and his favorite feature, the one he's proud of, is a teleporter square. Land on it, and he redraws your position somewhere else on the page entirely, usually somewhere worse.

He also, and this is important, really likes making these mazes hard. Maybe even impossible. He is seven. He has not yet developed a check on the impulse, and frankly, I'm not sure he should, because the mazes are incredible.

So Papa, my father-in-law, is over at the house, and my son hands him one of his patented mazes. Then Papa gets about halfway through it and hits a wall. Not a metaphorical wall. An actual dead end, drawn in pencil, no way forward, laser on one side, monster on the other. And Papa, a grown man, a retired adult, with decades on my seven-year-old, picks up the pencil, and draws his own teleporter square, right there. Unlicensed. Unsanctioned. Self-issued.

My son is furious. Not upset-furious. Offended-furious. Of course he is, he just watched a fundamental rule of the universe get violated in front of him by someone who should absolutely know better. And I watched all that, and instead of being a mom about it, I made it a whole thing, because that's what I do.

Welcome back to Chaotic Commits, I'm Joanne Skiles, and today's episode starts with my seven-year-old's anger over an unauthorized teleporter and ends, and I promise you this is a straight line, at TSA, CAPTCHAs, and the movie Office Space.

Because watching Papa draw himself out of a maze kicked off a wonderful debate in my house. The opposition's position, my husband: cheating is never justified. Full stop, you don't get to unilaterally rewrite the rules because you don't like where you landed. My position: sometimes, before you get mad at the person who cheated, you have to ask whether you built a situation where cheating was the only reasonable option left on the table.

Both of those are real positions. Both of them are, I think, correct, depending on which direction you're looking from. And the reason I wanted to make an episode out of a seven-year-old's maze is that this argument turns out to be the exact argument under TSA lines, CAPTCHAs, why your professor makes you turn on your webcam during the final, and honestly, a decent chunk of the code you've ever written or will write in your career. So let's get into it.

So let's start with the opposition. This position deserves the full weight of it, and not a strawman I get to knock down in the next section. Cheating is never justified. You do not get to unilaterally rewrite the rules of a shared system because you personally don't like where you landed inside it. That's the whole argument, and it holds up under real pressure.

Because look at what happens the moment you allow an exception. If Papa gets to draw his own teleporter because the maze got too hard, then the maze stops being a maze. It's not that this particular teleporter is a problem. It's that "I get to change the rules when I'm losing" is a rule that, if it's allowed once, it's always allowed, for anyone, about anything.

Zoom out from the pencil drawing for a second. A test only means something if everyone sitting it faces the same test. A game only works if the win condition is fixed before anyone starts playing, not renegotiated by whoever's currently behind. A contract only functions if both parties are bound by the same terms regardless of how the deal is going for them today. The entire concept of a shared system, a maze, a test, a game, a market, a legal system, depends on the rules staying put regardless of who's currently unhappy with them. The second the rules become optional for whoever's inconvenienced, you don't have a system anymore. You have vibes.

So when Papa draws his own teleporter, the read is not, "well, the maze was too hard, that's understandable." The read is: the maze being too hard was never the actual problem. A grown man deciding unilaterally that the rules didn't apply to him anymore, that's the problem. And it would still be a problem if the maze had been easy.

I want to sit in that for a second before I push back on it, because I don't think it's wrong. I think it's the argument for why systems work at all. If nobody agreed to hold the line, there wouldn't be a line. But here's my problem with stopping there.

My son had built a maze with, by his own admission, probably no solution: lasers, a monster at one legitimate turn, spikes on another option, and a math problem gating the third. Papa wasn't looking for a shortcut through a fair maze. He was standing at the actual, literal end of the actual, literal path, staring at a wall, with no move available to him that the maze's own rules permitted. That doesn't excuse drawing a teleporter. The opposition is still right that you don't get to do that. But it does mean the question "why did Papa cheat" has a second half that "cheating is never justified" doesn't answer, which is: why was cheating the only remaining option. And that's the actual point of this episode.

Most anti-cheat mechanisms you've ever encountered is a fossil record of somebody who cheated first, or could have. And the entire rest of us has been paying for that moment ever since.

Think about what an anti-cheat mechanism actually is, mechanically. It's friction, deliberately added to a system for everyone, because a minority of people in that system did something the system's designers didn't want. The bad actor gets one moment: one exploit, one shortcut, one drawn-on teleporter. And then everyone who comes after them, forever, pays a small permanent tax so that particular exploit can't happen again.

That's not a controversial claim about mazes. That's the entire discipline of security engineering, wearing a seven-year-old's maze as a costume. The bad actor doesn't usually stick around to experience the tax. Papa drew his teleporter, finished the maze, and left. He's not the one who has to deal with what happens next time my son hands someone a maze and says, "no teleporters this time," in a slightly wounded voice, for what will probably be the rest of that person's natural life.

The tax lands on everyone downstream of the exploit, almost never on the exploiter. Once you see that shape, you cannot stop seeing it. So let's go look at where else it's hiding.

TSA exists in its current form because, in 2001, a small number of people did something catastrophic with things they were allowed to carry onto a plane. In 2006, a different small group of people planned to do something catastrophic with liquids. Neither of those groups is the group standing in line with you at six in the morning, taking off their shoes, decanting their shampoo into 3.4-ounce bottles, unpacking a laptop into a separate bin. You are paying the tax. Every single person who has boarded a plane since is the tax, permanently, for something a handful of people did once, decades ago. The system isn't irrational. It's precisely rational. It's just rational in a way that has nothing to do with you personally and everything to do with the worst thing anyone has ever tried.

CAPTCHA is the same fossil record, compressed into a smaller and more annoying object: "prove you're not a robot." That exists because bots were abusing forms, scraping data, buying up concert tickets and sneakers faster than a human could click. So now, every human, every single time, has to squint at a distorted string of letters or click on every image containing a crosswalk, to prove a negative, on behalf of everyone who came before you and everyone who will after.

And here's where I bring in AI, because you knew I was going to. CAPTCHA is currently losing. Machine learning models solve most CAPTCHAs faster and more accurately than the humans they were built to let through. The system built specifically to filter out automated actors is now most efficiently defeated by an automated actor, while actual humans sit there squinting at a fire hydrant for the third time because the site wasn't confident about our first two answers. The tax didn't go away. It just stopped taxing the group it was designed to stop, and kept taxing everyone else.

Academia has its own version, and it's escalating in real time. Professors didn't want to run remote exams with lockdown browsers and a second camera angle pointed at your hands. Nobody went to grad school dreaming of building a surveillance apparatus for a sophomore statistics final. That infrastructure got built because some students cheated on remote exams, and now every student, the honest ones, the anxious ones, the ones with a shaky internet connection and a toddler walking through the frame, all of them sit for their tests under a camera because of the ones who didn't.

And now let's bring this to the world of code: rate limiting on an API. Somebody wrote a script that hammered your endpoint, so now every legitimate user gets throttled, whether they were ever going to abuse it or not. Least privilege permission scoping happened because somebody had access that they didn't need and went and did something wrong with it, so now every new hire spends their first week filing tickets to get access to things they obviously need for their actual job. Mandatory code review before merge: somebody shipped something bad without a second set of eyes on it once, and now every trivial one-line fix is waiting for someone else's approval. Input sanitizing on every form field, because someone tried to inject something they shouldn't have — little Bobby Tables — and now every legitimate user's apostrophe in their own last name has to survive an escaping function before it's allowed to exist in our database.

Nobody on your team woke up and said, "Man, I really want to write a throttle." But somebody's exploit made it mandatory. That's not a design philosophy, that's a scar with a pull request attached to it.

So where does this actually land, between the opposition and me? Well, cheating is never actually justified. But I think the honest reconciliation of this is: there's a difference between someone gaming a fair system and someone finding the only available move in a broken one. A good system design has to be able to tell those two things apart, because they need completely different responses.

An impossible maze, one with a dead end, lasers, a monster, and a math problem gating every legitimate path, isn't a puzzle anymore because there's no solution left inside its own rules. At that point, it's not testing whether you can solve it. It's just a wall with decoration on it. My son didn't build a trap on purpose. He's seven, he was having fun. He honestly didn't think that "maybe even impossible" and "fair" had quietly stopped being the same design goal. But the effect is identical either way. When the only way through a system is to break it, you've not built a hard system. You've built a system that manufactures cheaters out of people who would have played fair if you'd left them a single legal move.

That's a useful lens. And now we have to take this out of the maze.

Is your on-call rotation actually sustainable, or is it just miserable enough that people quietly build workarounds — favor-trading and under-the-table swaps — because the official process has no legal path to "I cannot do this again this week"? Is your code review process catching real problems, or is it slow enough and vague enough about what "approved" actually requires that people have learned to route around it, opening a PR at 4:58 on a Friday because they've learned nobody's actually going to read it closely before Monday? In both cases, the honest fix isn't a stronger lock. It's asking whether the legitimate path was ever actually usable for a normal person under normal conditions, or whether you only left one, technically, on paper, and called it fair because nobody had complained yet.

Cheat-proof and trap aren't opposites, by the way. They're actually close cousins, and that's what makes this easy to get backwards. A cheat-proof system is one where the honest path is genuinely reasonable to take, so closing off the exploit doesn't feel like punishment to the people who were never going to take it. A trap is a system where the honest path was never actually reasonable, so every safeguard you bolt on lands on people who had no real option in the first place, and you get to be surprised when they route around it anyway.

None of this means Papa gets to keep the teleporter. He doesn't. My husband's right about that part completely: drawing your own exit is still drawing your own exit, and "the maze was unfair" is an argument for fixing the maze, not an argument for a grown man unilaterally rewriting his own kid's rules in the middle of a turn. But it does mean the next conversation isn't just "don't cheat." It's also, separately, "hey kid, a maze needs at least one real way through it. That's not optional. That's the job."

Honestly, this whole thing can be summarized by a scene from the movie Office Space. Michael Bolton, the character, not the singer, spends the entire movie annoyed that he shares a name with the famous musician. And somebody finally asks him why he doesn't just go by Mike. And he says, "Why should I change my name? He's the one who sucks."

That's the honest, unfiltered feeling underneath every single tax in this episode. You, taking your shoes off at six in the morning. You, squinting at a crosswalk for the third time. You, waiting for someone to unlock a case so you can buy a razor. You did nothing. You're just standing downstream of somebody else's exploit, absorbing a cost you didn't create and can't opt out of. And every fiber of you wants to say the same thing Michael Bolton said: "Why should I be the one adjusting? He's the one who sucks."

And the uncomfortable answer is: because the system can't find the culprit anymore, so it adjusted the only population it still has access to, which is everyone else. That's not fair. It's just the actual mechanism. And once you can see it, you start noticing it is everywhere, in your terminal, in your commute, in a seven-year-old's pencil drawing.

Papa still owes my son an apology, for the record, and my son owes the rest of us at least one maze with a real ending.

That's this episode of Chaotic Commits. I'm Joanne Skiles, who turned her son's frustration over an unauthorized teleporter into a full systems-design argument with her husband, because apparently that is just who I am in this house. New episodes wherever you get podcasts. No highlight reel. Just the commit history.