I finished OverTheWire Bandit last night. Level 33, the final one. I had imagined a finish line — some closing ceremony, a banner, a nod from the game that I had done a real thing. Instead, the game handed me a README file that said no more levels, printed a prompt, and waited. A blinking cursor, at four in the morning, and nothing left to solve.

I sat with that for longer than I should admit. Because the strange thing about Bandit is how little of it is actually about Linux.

On paper it is a beginner’s wargame: thirty-four levels (bandit0 through bandit33), each one an SSH login to a machine where a password for the next level is hidden somewhere on disk. You learn ls, cat, find, grep, sort, diff, base64, ssh, a little cron, a little git. The commands are the vocabulary, but they are not the lesson. The lesson — the part I only saw standing at the prompt with nothing left to type — is that the whole game is a rehearsal for the discipline I actually want to spend my life on: holding other people’s money and not breaking it.

Let me try to explain what I mean, because it took me thirty-three passwords to see it.

It begins with a password you were handed

The first move of Bandit is almost embarrassing in its simplicity. You are told the credentials for bandit0. You log in. You read a file. The file contains the password to bandit1, and the whole game is that sentence repeated thirty-three times.

ssh [email protected] -p 2220

There is nothing clever in that. And yet everything downstream depends on it, because Bandit teaches, from the very first level, that access is the whole game. You cannot analyse a machine you cannot log into. You cannot move a position you have no mandate to move. The lock is not the obstacle between you and the work — the lock is the work, and the first skill of any operator is being trusted enough to hold the key.

I think about that every time I write about a portfolio. Every allocation begins with someone deciding to hand you a password.

The password chain is a track record

Here is the mechanic that I kept coming back to: no level gives you the password to the level after next. You get exactly one step. You cannot skip, and you cannot brute-force your way to the end — the whole point of the game is that progress is earned in sequence, one password at a time, each one unlocked by the one before it.

That is compounding, and it is also what a track record is.

Nobody hands a young analyst a mandate because he has a good thesis. They hand it to him because of the last password he found, and the one before that. Each level of trust is bought with the previous one, and it can only be spent forward. The bandit who tries to jump to level 33 gets nothing; the analyst who wants the big book before the small one gets the door. The only honest way through is to solve level n, use it to reach level n+1, and let the chain prove you can be depended on. It is slow, it is unglamorous, and it is the only path that exists.

You cannot skip to the payoff in Bandit, and you cannot skip to it in a career. The password is the payment, level for level. The game is not the destination; it is the receipt.

A permission bit is a position limit

Somewhere in the middle of Bandit, a level stops being about finding a file and starts being about why you are allowed to open it. That is where the game quietly changes genre, from scavenger hunt to something that sounds a great deal like risk management.

Every file on a Unix system carries permissions — who may read it, who may write it, who may run it. Bandit makes you feel the weight of those three little columns. The wrong bit and the level is impossible; the right bit, and the machine will calmly hand a stranger the keys to itself. You learn that chmod is not a formatting preference. It is a statement about trust, and trust has a shape.

This is the least-privilege principle, and it is the first rule of every portfolio mandate I have ever written.

A risk budget is a permission bit. A position limit is a permission bit. The clause in an investment policy statement that says you may not exceed 5% in a single name is nothing more and nothing less than the operating system saying this, and no further. And the discipline Bandit drills — take exactly the access you need to finish the level, and not one permission more — is precisely the discipline a portfolio manager needs when the temptation is always to widen the limits after a good quarter.

The wargame punishes broadening your access by accident. So does a stop-loss. The market calls it a margin call.

Portfolios are composed, not picked

The heart of Bandit, the thing it is really trying to teach you, is the pipe.

cat data.txt | sort | uniq -u

Small tools, each doing one thing well, wired together so the output of one becomes the input of the next. No single command is impressive. sort does not sort portfolios; uniq does not know what a stock is. But composed, they do something neither could do alone: they extract a single true line from a file of millions.

That is quantitative portfolio construction, described with a keyboard instead of a spreadsheet. A covariance matrix is a sort. A factor is a grep. A risk model is a long pipe that takes a universe of noisy, correlated, half-lied-about prices and filters them, stage by stage, until what drips out the far end is a set of weights you can defend. No individual component is where the intelligence lives. The intelligence lives in how carefully you connect them — and in the fact that a mistake in the first stage quietly propagates to every stage after it, which is the single most expensive lesson in quantitative finance and, apparently, in shell scripting.

The lonely line is the alpha

My favourite level in the whole game is the one where you are handed a file of millions of lines and told that every line repeats — except one. Find the one.

sort data.txt | uniq -u. The unique line is the answer.

I have not stopped thinking about how much of the market works exactly like this. In a crowded, efficient, well-covered name, every line repeats: every price is somebody’s consensus, every ratio has been screenshotted into a hundred identical pitch decks. The edge is never in the line that repeats. It is in the one line that doesn’t — the fact the market has not priced, the disclosure buried in a footnote, the single number that everyone copied from everyone else and nobody checked. The alpha is the lonely line. And finding it is not glamorous work; it is sort, then uniq, then a great deal of patience.

The rest of the file is where everyone else is. The answer was never there.

setuid, or: the honesty of privilege

Then Bandit does something cruel and important. It introduces you to a class of binaries with the setuid bit set — programs that run with privileges you do not have. You are an ordinary user; you execute the program; it acts as root. You get one carefully packaged, temporary promotion, and the entire level depends on using it well.

I do not think it is a coincidence that this is where the game starts to feel like leverage.

Leverage is setuid for a portfolio. It is access to power you did not earn — you borrow someone else’s balance sheet, and for a while you get to move like a bigger person than you are. It makes possible things that are otherwise impossible, and it works perfectly right up until it doesn’t. In Bandit, the setuid binary is a test of restraint: how much of this borrowed power will you spend, and can you get the password and hand the privileges back without setting the machine on fire?

In markets, the same binary is offered every day, and most of the people who blow up are not stupid. They are people who found a setuid bit, enjoyed the feeling, and forgot they were not root.

Leverage is a setuid binary. It will do exactly what it promises, and you are the only security check in the system. Spend it with the assumption that one day the bit gets unset.

cron: the strategy that does not need you

Later levels put a job on a timer — cron — that runs whether you are watching or not. This is the quietest level in Bandit and, to me, the most interesting one, because it stops being about what you can do and starts being about what runs without you.

That is the whole difference between being clever and being systematic.

A discretionary gut-call only works while you are awake, alert, and not fighting your own emotions. A cron job just runs. A rebalancing rule just runs. A systematic strategy is a cron job for capital: you decide the logic once, in daylight, with a clear head, and then you let it execute in the dark when you would otherwise be at your worst. Bandit taught me that the mature move is almost always to automate the decision I do not trust myself to make twice — and then trust the system I built, which is a far more uncomfortable act of faith than it sounds.

Obfuscation is not security

Many of the middle levels are simply encoding. Base64, ROT13, hex, compression stacked on compression. The password is right there, dressed up in a costume, and the trick is that the costume is not a lock. It is decoration. Anybody with the right incantation reads it in one line.

I wish I could make every retail investor sit through those levels.

Structured products, layered fees, the fine print that is technically disclosed and practically illegible — so much of the machinery of modern finance is base64: encoding designed not to hide something from a determined analyst but to make it inconvenient for a trusting one. Bandit teaches the professional reflex in about ten minutes flat: if something is obfuscated, someone is hoping you will not decode it. So you decode it. Every time.

The sandbox forgives. The market does not.

Here is the difference that has kept me up, and the one I most want to hold onto.

When I broke a Bandit level — and I broke many — I could log out, log back in, and try again. The machine forgave me instantly. The cost of being wrong was a second and a fresh prompt. It was safe to be incompetent, which is what made it possible to become less incompetent — thousands of cheap, consequence-free reps, the same way a flight simulator lets a pilot crash forty times before they ever touch a real cockpit.

The market does not have a reset button. Getting a position wrong costs money, and money is somebody’s rent, somebody’s retirement, somebody’s trust. That asymmetry is the most important fact of the profession, and it is why the sandbox matters so much. Bandit gave me a place to make every mistake a first-year analyst is going to make — the snotty rm, the overwritten file, the permission I did not understand — while the cost was still zero.

The instinct that the wargame engraves is not cleverness. It is the reflex to check before you press enter. That reflex, transferred from a terminal to a trade ticket, is worth more than any model I will ever build.

I also watched git show up in the late levels — commits, branches, the history of every change anyone ever made — and understood that it, too, is a risk-management tool. An audit trail is not bureaucracy. It is the difference between a discipline you actually have and a story you tell about having it.

The loop returns nothing to a quitter

Not long ago I wrote about hauling applications up a hill and watching them roll back down — Sisyphus, in a Casablanca of empty inboxes. I said then that the loop never ends, but that you are not the rock.

Bandit is the same loop, from the other side of the mountain. Each level ends, and a new one begins. You never arrive at some plateau called done; you arrive at a README that says there are no more levels for now, and that they are working on new ones. The game does not close. It pauses.

I used to read that as cruelty. Now I read it as the most honest thing in the whole exercise, because it is exactly what the market will tell me for the rest of my life. There is no final level. There is no quarter where the risk finally goes away and the questions stop. You solve what is in front of you, you bank the password, and tomorrow there is another machine to log into.

The bandit is not a bandit because he steals. He is a bandit because he keeps coming back to the locked door, every night, with the tools he has, until it opens — and then walks through to find the next one.

Thirty-three times, and then a cursor.

I think that is the whole job. And I think, standing at the prompt with nothing left to type, that I have finally started to learn it.

If you want to climb it yourself

OverTheWire Bandit is free, and it is the best on-ramp to the command line I know. Start at level 0, read every README, resist the walkthroughs for at least an hour per level, and pay attention — not to the commands, but to what each level is quietly asking you to become. It is not a Linux tutorial. It is a course in earning access, one permission at a time. That is the part I did not expect, and the part I will not forget.