Machine and Man in Cyberpunk

[Thymos]

I agree with most of those assumptions except for 3. We actually call people who download these attack tools and blindly use them script kiddies. They are considered to be fairly poor hackers.

Hacking tools are more like a toolbox, and you need a skilled hacker to know what tools to use.

Pre-built attack tools can work, but they won't work on most systems for long. Keep in mind that the security people are browsing these hacker networks too, and when an exploit is broadcast over hacker channels it will be patched fairly fast.

So basically we do not need assumption 3.

[kzt]

So you think that Nessus, Metasploit, Blackhole kit, Zeus, red kit, cool exploit kit and their supporting websites are only used by poor hackers and hence are not a threat?

[Grek]

I disagree with assumption 2. There needs to be levels of security; a one size fits all "only experts can hack things" strength security should not be the standard.

Household appliances, consumer electronics, music players, vending machines, parking meters, children's toys and so forth should all have little to no hacking protection. Their main line of defense is having nothing inside that anyone but the owner wants. Hacking on this level is a "You'll void your warranty" level not-even-a-crime, and you can find how-to videos on youtube.

The next level up would be hacking cars, CCTV cameras, zapping price tags at the supermarket and tapping into public communications to steal cable and listen in on people's conversations. Stuff that is definitely a crime, but the sort of crime that corps will farm off to LoneStar if it's worth the cost to punish offenders at all. Script Kiddying is possible here, but most will only use it for petty crimes like stealing cable and making lights change in traffic, rather than for bank robbery.

Beyond that, you get into security that requires specialist level, bank robber and corporate spy grade hacking tools to deal with. Highly illegal, kinda like where you were going with assumptions #2 and #3.

[Lokathor]

In a shadowrun setting, much of the sloppiness in today's hacking would realistically be solved by the application of agents that monitor what software and firmware is on your network, and security patches. Therefore, you have maybe 12 seconds between the time that the latest java exploit comes out and the agent patches every instance of java on the network. Boom done.

No, even if all old versions of a problem software could be fixed within seconds of the new patch being issued, someone still has to report the problem to the proper persons, then they must make the patch and issue an update.

If security spiders can arbitrarily write code such as to "fix any bug" then you've just hit Singularity land and the game setting is over.

[Username17]

I think that we do want to support different levels of access (because having the CEO's key-dongle should be more valuable than having some random person's password), but not access to different specific systems (because there can be an unlimited number of those).

I suggest that access be rated by how well it's secured.

This "bottom up" security rating is a much better idea than the "top down" security rating of SR4. The problem with the whole "Admin Accounts" deal in SR4 is that no player would ever bother having a non-Admin account or allowing non-Admin accounts to do anything on any device they owned. And the net result was that the toasters and refrigerators of the PCs were amongst the higher security installations on the planet.

The idea that you have to do things to have security ratings happen is probably fundamental to having a game. Allowing security to happen by not doing things results in...



Going up in security rating should require expensive equipment and annoyingly strict security procedures and such. Not simply "leaving your phone turned off".

-Username17

[sabs]

Some of the Classic Hacker activities I want my decker to be able to pull off. Though not necessarily all out of chargen, and with no flaws.

1) Creating secure burner phones for team members to use.
2) Configuring/modding said secure burners to self destroy, etc, if need be.
3) Creating cover id's of various quality to support cons, jobs, etc. Not necessarily fake id's that will get you onto an space transport. Just something that will back up that you're Dr Gustov fore most expert on Zoophilia. Or what ever.
4) Burkof, I've lost him.. where is he. Hold on I'm running facial recog on the surrounding cameras.
5) Opening doors, closing doors, controlling elevators.
6) creating gadgets that will "clone his commlink, clone the datadrive"
7) writing special software for a run to do what ever.
8) Build up over the course of the game, a porfolio of hacked systems that can help them do 'stuff'

As a matter of fact, I think that deckers/hackers should write /most/ of their software.

Two iconic hackers I want to be able to replicate.
1) Burkof from La Femme Nikita (either the canadian series, or the US remake)
2) Alec Hardison from Leverage.

And I think that Frank is dead on, you want to basically get into startrek technobabble, because real hacking is boring.

[Stahlseele]

See Hackers the movie . .
That's how hacking really works.
Nerds tapping away at keyboards.
The whole cyberspace stuff you saw was basically what the matrix does in SR.
It only explains to you in visible concepts what the code in there is doing.

[sabs]

See Hackers the movie . .
That's how hacking really works.
Nerds tapping away at keyboards.
The whole cyberspace stuff you saw was basically what the matrix does in SR.
It only explains to you in visible concepts what the code in there is doing.

And in Hackers the movie, they focus on the social interactions, and the outcome of hacking, not the actual hacking. Because actual hacking is fucking boring as shit.

[Stahlseele]

And they do social engineering/hacking to get to the part where they can actually do shit because they need accounts for them to use . .

[Username17]

The main advantage of social engineering is that it works fairly similarly in 2070 as it did in 1970 or 1470. Guards have been allowing people to enter high security areas because they were holding their generation's equivalent of a clip board or a mop for thousands of years, and humans show every evidence of continuing to do that for thousands more. Also, when it works properly it's pretty cool. Watching a well-done episode of Leverage is great fun.

The problems with it are basically three:

• While everyone pretty much nominally agrees that trickery is a real thing that exists, it also strains peoples' willing suspension of disbelief incredibly hard. Basically because people are a bunch of crybabies who think they are perfectly rational snowflakes with fully incorrigible thoughts. Any actual example of trickery will cause lots of people to react with a kneejerk rejection that such a thing is possible. Just look at any online discussion ever of what "epic bluff checks" or their equivalent should be able to accomplish. Yes, despite the fact that no matter what religion anyone is, they still live in a world with at least six billion other people who follow a religion that is (to their mind) bullshit made up by a completely mundane con man; they still react incredulously to the idea that people can be fooled. Any in-game trickery is going to have a lot of pushback from the armchair realism police, even if what it allows is far less impressive than events that grace the BBC's columns on a weekly basis.
• Crafting a plausible social engineering attack on something generally requires a lot of information about the social conventions to be engineered. That requires a lot of legwork, and in a game requires either the MC to give huge infodumps that are almost all going to be useless or requires the MC to give out short infodumps that are basically Choose Your Own Adventure prompts by only handing out levers that the MC has already thought of. So it's usually either boring or disempowering and all too frequently both.
• Actually acting on social engineering actions is something that generally takes a lot of relative game time to do. It's more comparable with a legwork action than a combat action. And that means that "face" characters have a hard time mixing their actions with characters doing other things.

-Username17

[kzt]

I disagree with assumption 2. There needs to be levels of security; a one size fits all "only experts can hack things" strength security should not be the standard.

Oh, yes. But baseline needs to be high enough that you need to invest significantly in your character to be able to do this. Otherwise everyone is running around with a Mage/Hacker. That is fairly easy to do with Franks house rules under the normal SR rules (not using his brain hacking system) and we found that was what everyone who understood the game mechanics did.

Household appliances, consumer electronics, music players, vending machines, parking meters, children's toys and so forth should all have little to no hacking protection. Their main line of defense is having nothing inside that anyone but the owner wants.

No, this actually exposes a huge amount of data that can be utilized by PCs. If everyone can do this, why are we trying to create a hacker archetype?

Hacking on this level is a "You'll void your warranty" level not-even-a-crime, and you can find how-to videos on youtube.

And if you view the video the nice men with guns will kick your door down, shoot your dog and drag you off in handcuffs to talk about your choice of entertainment. It's treated like downloading a kiddie porn video.

It's usually a DMCA violation now to hack something you own that has any sort of protections, but this is a dystopia we are talking about. The enforcement mechanisms are rather more "robust". Hacking needs to be something that can't be casually done in order for there to be dedicated PC hackers.

[Username17]

Hacking needs to be something that can't be casually done in order for there to be dedicated PC hackers.

This conclusion does not follow from any premises I would accept.

Shooting a dude casually in the face is a thing that can be done. Nonetheless, you can have dedicated PC enforcers. A task can be performable by untrained people with cheap and ubiquitous equipment and still support characters who specialize in it. All that requires is for the specialist to be in some way noticeably better at the task in some way that is valuable to the team.

The way it is done better could even be somewhat orthogonal to the task itself. For example: anyone can blow up a door with a pile of explosives, but a demolitions expert can save you money (by using less explosives), save you fingers (by not running risks of hurting the team with improperly used explosives), and save you from police crackdowns (by not leaving a data trail back to his apartment). None of those things are directly involved in the door being blown up or not, but the demolitions expert is still a valuable dude to have around.

-Username17

[kzt]

Shooting a dude casually in the face is a thing that can be done. Nonetheless, you can have dedicated PC enforcers. A task can be performable by untrained people with cheap and ubiquitous equipment and still support characters who specialize in it. All that requires is for the specialist to be in some way noticeably better at the task in some way that is valuable to the team.

The way it is done better could even be somewhat orthogonal to the task itself. For example: anyone can blow up a door with a pile of explosives, but a demolitions expert can save you money (by using less explosives), save you fingers (by not running risks of hurting the team with improperly used explosives), and save you from police crackdowns (by not leaving a data trail back to his apartment). None of those things are directly involved in the door being blown up or not, but the demolitions expert is still a valuable dude to have around.

Well, sure. But do people really think that demolitions expert is a critical slot in the average 4 player SR game? Does it deserve role protection? What percentage of you character points are needed to produce a demolitions expert?

I seem to remember you as the guy who really objected to the hacker being a secondary skill of a mage or a gunman. You seemed pretty convinced that it required role protection. If you want it to be a specialized character type it needs to be something that you can't do casually.

SR isn't HERO, where 6 skill points are the the difference between 5% success and 95% success. The one or two success you gain from a decent skill (vs the two or three from characteristics + skill of one) are just not that exciting. So a secondary hacker would likely still be fairly effective against everything that a skilled hacker would be able to reliably take.

You're a lot better at this kind of mechanics, what are you trying to accomplish here?

[Stahlseele]

Well, technically, anybody in SR4 can be a hacker, because you can do it without needing to use up valuable essence . . so even a Technomancer, who has actually little need to do so, can reasonably well play a normal hacker.
As can the Mage. And the Adept. And the Samurai. And the Face is that usually already. All it takes, right now, is some money to become a mediocre Hacker . .
Same as with anything else aside from resonance/magic related.
Because most of the stuff you would use as cyber for a shooter are available as external gear too. Smartlink and Gyroscopes, Vision Enhancements. But without going further, you will always simply be mediocre at that too.
Technically, aside from the incompatibility of magic/resonance, you can always play a Jack of all trades, master of none just by using money.
IF you really want to be very good at what you do, even if what you do ain't very nice, THEN you need to start making choices and sacrifice ability in other things.

Hell, Skillsoft is a Thing in the World of Shadowrun.
There is really no reason for anybody to not be able to do something ever.
Aside from magic/emergence stuff for obvious reasons . .

[Username17]

I seem to remember you as the guy who really objected to the hacker being a secondary skill of a mage or a gunman. You seemed pretty convinced that it required role protection. If you want it to be a specialized character type it needs to be something that you can't do casually.

The thing is you've already conceded that "gunman" is a primary archetype. And yet, we know for absolute certain that firing guns is a thing that non-specialists can do. And in fact, that they can do casually. Nevertheless, the enforcer has important stuff to do and is rather easy to imagine and cast as a role protected archetype.

Role protection does not mean that the action can't be taken by someone who isn't in the protected role. It means that the action is in some way that happens to be important better when taken by someone who is in the protected role. If other people can't take the action at all, then the role protection is easy - "doing it" is generally better in at least one important metric than "not doing it" (the metric of "existence"). But the metric of role protected improvement can be anything as long as it is measurable, noticeable, and important.

-Username17

[kzt]

Role protection does not mean that the action can't be taken by someone who isn't in the protected role. It means that the action is in some way that happens to be important better when taken by someone who is in the protected role. If other people can't take the action at all, then the role protection is easy - "doing it" is generally better in at least one important metric than "not doing it" (the metric of "existence"). But the metric of role protected improvement can be anything as long as it is measurable, noticeable, and important.

So a casual hacker (stat 4, skill 1) gets 1.7 success on an average roll. A skilled hacker (stat 4, skill 4) gets 2.7 success on an average roll. While that is better, it isn't really that much better. Using edge for reroll a casual hacker gets about 3 success on average.

I'm not seeing how to effectively distinguish them. They both die fast with a "roll until you fail"as both of them can't pull off a large number of successful rolls and can't reliably succeed with 3 or more hits needed.

With shooting guns you roll a lot of times in every combat and combat is very common. If you resolve hacking with one or two rolls it doesn't seem like you'll see a significant difference without silly dice pools and silly number of required hits.

[Seerow]

Well, technically, anybody in SR4 can be a hacker, because you can do it without needing to use up valuable essence . . so even a Technomancer, who has actually little need to do so, can reasonably well play a normal hacker.

Speaking of this, I actually wouldn't mind if "hacker/decker" was a thing that could be picked up as a secondary specialization, and "Technomancer" was the specialist alternative that actually needed full character investment on the level of a Mage to be relevant. Though I'm pretty sure I remember Frank being adamantly against the idea.

[Stahlseele]

Which is sad, because, right now, it's kinda how it works in my eyes . .
Now remember, i don't actually play SR4, i just read the Den, Dumpshock and the books out of boredom and to know kinda what's being talked about at all . .
Meaning i could be off to alpha centaury on this i guess.
But yes, basically, a Samurai can be a pretty good Hacker.
He does not need certain attributes, because in SR4 Rules, it's Comlink-Stats and Software, not even Skill. He could be a Logic, Intuition and Computers 1 kind of guy with an expensive set of Comlink and Software in his pocket.
Under AR, because of his reflex work, he could actually keep up in terms of initiative with all but the most dedicated computer specialists. He'd have some dice less, but he'd also not face the VR problems of being a lump of meat on the ground or deadly damage from ICE as long as he stays with cold sim for the most part. And he can get to where he is needed by himself most of the time. And if all else fails, he just can be the WiFi Bridge end for the dedicated matrix specialist in his Bunker . .

[Thymos]

I think we need to all get on the same page about something.

Like I said earlier, if we're going to abstract hacking, we should abstract it with some purpose.

I propose we focus not on how hacking works, but rather on what the hackers goals are and formulate hacking such that it focuses on those goals and also facilitates the gameplay we want.

I suggest the following goals.

1. Objective. This is what the hacker wants to do, be it get sensitive information, wire himself money, or just turn off the other guys gun.

2. Not be found while doing the hacking.

3. Not have their location be found after or during said hacking.

4. Possibly leave a door open for future hacks.

5. Not have their objective reversed.

I think after some goals are defined for the hacker we can go about how they should roll dice to meet those goals.

Also one of my favorite suggestions in this thread is starting security at the bottom, not top.

[Username17]

So a casual hacker (stat 4, skill 1) gets 1.7 success on an average roll. A skilled hacker (stat 4, skill 4) gets 2.7 success on an average roll. While that is better, it isn't really that much better.

That's a really weird comparison point. The difference in dicepools for a gunmen of 5 dice to 8 dice is a Level 1 faceless mook to a level 2 faceless mook. The actual role protected Street Samurai rolls a lot more dice than that. Similarly, the difference in combat ability between a CP2020 Solo and a random mook or a Spacemaster Cyberspace Killer and a random mook is also comparatively considerably larger.

But even on your own terms, you just compared a character who has a 13% of pulling up no hits on a die roll to a character who has a 4% chance of pulling up no hits on a die roll and said there wasn't much difference between them in the "roll until you die" scenario. Obviously, there's a pretty big difference between the guy who fails on a bit more than one roll in eight versus the character who fails on less than one roll in twenty five. If you give characters a "second chance" (such as having an Edge mechanic of some sort), you just drew equivalency between two characters whose chance of real failure differs by more than an order of magnitude. And if those second chances have a cost of some kind, you also just drew equivalency between two characters who burn through that cost at a rate that is three times higher in one than the other.

So I reject your statement categorically. First of all, the relative difference between a "hacking specialist" and a casual hacking dabbler should be relatively larger than you are giving credit for in your set piece. Secondly, even if that was the extent of the difference, it would actually be trivial to make that difference between those characters noticeable. If you made the "please don't get zero hits and set off the alarm" test even ten times in the life of the game, you'd notice the difference between the characters.

1. Objective. This is what the hacker wants to do, be it get sensitive information, wire himself money, or just turn off the other guys gun.

That's very non-abstract. Turning off a device is a slippery slope that has a tendency to end in people protecting themselves in redundant systems while the hackers have a sad. Your objective is to interfere with the enemy's ability to fire back. Turning off their gun, filling their headsets with ear splitting static, or sending false information to their TacNets is all just Star Trek technobabble for why the targets lose actions when you succeed at harrying tasks.

-Username17

[Strung Nether]

I had an Idea that was rolling around in my head.

What if we get rid of all of the other technology crap in the hacking thing, and mechanically turn hacking into "i shoot a gun at the computer". You have your stat, your skills, your conditional modifiers, your "weapons/armor", your HP, etc. We have already taken all of the "how it actually works" out of driving cars, shooting, swinging swords and throwing fireballs...why don't we do that with hacking?

To expand on that a little, It has some really useful side-effects:
if you don't have a comlink, or it's off, you don't have armor or aren't wearing it. if you don't have any IC, then you don't have a gun. you can't shoot someone from 3 cities away, so you need to be in the same room or maybe in a building across the street if you KNOW your target is visible from the window.

[TheFlatline]

In a shadowrun setting, much of the sloppiness in today's hacking would realistically be solved by the application of agents that monitor what software and firmware is on your network, and security patches. Therefore, you have maybe 12 seconds between the time that the latest java exploit comes out and the agent patches every instance of java on the network. Boom done.

No, even if all old versions of a problem software could be fixed within seconds of the new patch being issued, someone still has to report the problem to the proper persons, then they must make the patch and issue an update.

If security spiders can arbitrarily write code such as to "fix any bug" then you've just hit Singularity land and the game setting is over.

You're missing my point. Say you release a worm or virus out into the environment. There's a certain length of time before that worm or exploit or virus comes to the attention of the programmers/antivirus people. At that point, they patch the hole or issue AV signatures.

From then on, the *only* way that virus or worm is going to work is if someone has been lazy and hasn't run the patch or downloaded the AV yet. AV is good about updating multiple times a day, but exploit patching... that's a horse of a different color.

That's why you see so many java exploits (aside from java being a piece of shit). It's a fucking pain in the ass to update, it nags you weekly, installs bloatware on your computer, and many people don't update because it's fucking annoying. Which means that a sizable portion of the population is vulnerable to six month old exploits floating around on the net, looking for vulnerabilities.

An agent that auto-patches as soon as there's patches released would reduce the infection rate in the internet by around 75-80%, and that's not hyperbole.

And I can also see in SR's future that even though these corps are all at each others' throats, there's a good reason to share data on information security. Yeah, you may want runners to hack a system for you, but you also want *your* system to be as secure as possible.

With semi-autonomous knowbots able to construct code in game as something that actually happens in game, it might be a second or two before exploits and vulnerabilities are discovered, analyzed, and patched. A human in hot VR with a coding suite could probably do it in maybe 15 or 20 minutes, and push it out in another 5.

Remember Star Trek and The Borg? Their shields adapt to phasers after 2-3 shots? That's going on right now on the internet. In 50 years information security is going to be frighteningly fast and automated as much as possible to prevent the lazy user from not patching his fucking java.

Which is why we abstract the fuck out of the system. Each attack is generating new exploits and overrides and viruses tweaked for a one-shot attack. Who cares how fucking hard that would be in the real world, because you're a hollywood hacker.

I think if you're not an IT expert, the last thing you should be doing is trying to design a granular, in-depth hacking/global network paradigm based on *real world* technology, because I promise you it's going to suck shit. You're going to make assumptions about what is and isn't possible or realistic, and odds are that's already either being done somewhere, or is being researched for being done. Just abandon reality and create your own paradigm completely unrelated to today's technology.

[TheFlatline]

I had an Idea that was rolling around in my head.

What if we get rid of all of the other technology crap in the hacking thing, and mechanically turn hacking into "i shoot a gun at the computer". You have your stat, your skills, your conditional modifiers, your "weapons/armor", your HP, etc. We have already taken all of the "how it actually works" out of driving cars, shooting, swinging swords and throwing fireballs...why don't we do that with hacking?

To expand on that a little, It has some really useful side-effects:
if you don't have a comlink, or it's off, you don't have armor or aren't wearing it. if you don't have any IC, then you don't have a gun. you can't shoot someone from 3 cities away, so you need to be in the same room or maybe in a building across the street if you KNOW your target is visible from the window.

So wait, if you *drop out of the matrix* entirely you're completely defenseless against matrix attacks? Joe blow without a commlink is more vulnerable against a spammer than joe blow with a commlink?

That's such a broken bit of logic it hurts my head.

Also, while abstraction is fine, and probably necessary, the goal should be to make hacking interesting enough to justify the in-game rewards vs the time taken to hack the thing. If it takes 30 minutes real time to hack a computer (as SR4 does with it's 80+ dice rolls to hack one single commlink), the payoff better be on the order of killing the ancient red dragon in AD&D.

A hacking system has to address the following as far as I can tell:

1. First and foremost, the resolution system must be interesting enough to make a player *want* to hack. Otherwise, relegate it to NPCs or to a single "hack computer" skill and move on.

2. The payoffs for the hacker need to be worth pursuing. 20 hacking rolls to give someone a -1 to their dice pool isn't a worthy goal.

3. The system needs to be fast enough so that the real world time requirement is justified by the results. This is not so much for the hacker, but for the rest of the group who isn't interacting with the hacker's world. Remember: splitting up the party sucks, and SR hackers do this *by default*.

4. The system must be complete enough that it can deal with player injected logic. Technically this is metagaming, but it's the risk you run by using real-world paradigms as your design standpoint.

5. There must be room for growth. I list this last because most games don't last *that* long. But there does need to be some longevity to the hacker's pursuit.

[Username17]

So wait, if you *drop out of the matrix* entirely you're completely defenseless against matrix attacks? Joe blow without a commlink is more vulnerable against a spammer than joe blow with a commlink?

That's such a broken bit of logic it hurts my head.

And yet, that's the logical and necessary conclusion of trying to make futuristic hacking rules work. If you spend more resources on Matrix defense, then you have more Matrix defense. If you spend less resources on Matrix defense, you have less Matrix defense. Allowing there to be an amount of resource expenditure you can give to Matrix defense that is so little that it wraps around to maximum Matrix defense is broken on first principles. It's a clearly optimal expenditure point which is simultaneously the most boring and you end up with all the players wiring up their equipment and totally ignoring Cyberspace during missions. That is anti-genre, anti-fun, anti-balance, and not even terribly "realistic".

While the game can accept rigid structures that block cyberspace propagation in both directions for the same reason that it can accept walls being effective cover in fire fights, it cannot accept people divesting themselves of VR equipment in order to render themselves immune to hacking. For the same reason that it cannot accept people simply refusing to purchase a firearm to make themselves immune to bullets.

If you're a tech specialist and your opponents go the full cromagnan,, you should own them. To the same extent and for the same reason that a man with an assault rifle should be able to cut down considerable numbers of unarmored pacifists if they decide to do that.

Now in a world with seizure inducing lightshows, incapacitating accoustic projections, and microwave pain inducers like the world we actually live in, it is no stretch of the imagination to say that those who have shiny tech toys and the specialty in using them should have a substantial edge over those who do not. Once you posit people being able to "voluntarily" replace their entire set of sense data with a virtualization projected directly into their head, the options for the unopposed technology specialist increase a thousand fold.

-Username17

[kzt]

How does a really skilled gunman with a really cool gun deal with a spirit who just uses materialization to walk through him? Is this a huge issue? If sometimes guns don't work is it ok if sometimes computers don't work work either?

(It does point out the whole MagicRun aspect of the game, but that's pretty much how it has always been.)