Reworking the Matrix, for players and GMs Options

[biccat]

I'll be up front with you - I don't like the Matrix.

The rules are confusing, it segregates characters from one another (the Decker can do everything remotely and the meatbags can't do much in the Matrix), it can be a great big I WIN button for PCs or NPCs alike (depending on how the GM runs it), it requires a specialized character, and it operates according to a very different set of rules than the rest of the game.

It's a terrible system, and even people who know how it works have a hard time with it:

Netcat attempts to eliminate the Rigger’s Access ID from the drone’s accounts list. Unfortunately, the clever Rigger has programmed the drone not to accept Admin account deletions. Netcat and the Rigger are at a stalemate.

The Rigger programmed the system not to account Admin account deletions? Why not just program it not to accept any new accounts? Seems like a good idea to me. "Do you want your drone to be hackable? Y/N"

There are some things that I like about the Matrix:

Base statistics - Signal, Response, Firewall, System - they all make sense, you have two hardware and two software limitations that seem to cover what is needed for any computer system.
Dependency minimums - your System can't be higher than Response, Programs can't be higher than System, etc.
Sprites and Agents - Good ideas, these are the "spirits" and "drones" of the Matrix world.
Nodes - Another good idea, each system has a defined "space" in the Matrix, and in order to do something, you have to get into that system.

However, there are a lot more things that I don't like:

Skill + Program pools - This doesn't make any sense. Everywhere else, players use ability + skill to do something. It doesn't matter that you're an expert marksman (Longarms 6), if you can't hit your ass with both hands (AGI 1), you can't do crap. However, for some reason an MITT grad (LOG 6) and a street troll (LOG 1) with the same Hacking skill and programs are on even ground. Sorry, but that doesn't work for me.

Non-intuitive actions - comparing what you want to do with the available actions means everything has to fit in the Free/Simple/Complex realm.

Admin account superiority - Once someone gets an administrative account, and they've got a good stealth program running, there's nothing to stop them from doing whatever they want. Open doors, lock security in offices, it's all pretty simple, taking at most a few seconds by the Hacker.

"Jumping In" - The counter to account superiority. Someone hacking your system? Jump in. They're kicked out, you can fix things up and return them to normal. This would be the immediate response of any security decker in a system. Sure you could get in and fight, but why? Jump in and kick them out of the node, then try to deal with what's going on.

There's a lot more, which I think will become apparent as I detail what I think are some good changes/new rules for the Matrix.

This is a work in progress with the intent to make the Matrix easier to use for regular games. Details to start in my next post. Criticism and comments are welcome.

[Yerameyahu]

Use the 'Logic Matters' optional rule.

[AStarshipforAnts]

I'll be interested in watching this and seeing what comes of it.

[biccat]

The biggest complaint I have with the Matrix rules is the use of "Skill + Program" instead of "Ability + Skill" for dice pools. To deal with this, I'll start with the base Matrix-related skills and define what they're used for:

Computer - Logic - A normal person's ability to work with a commlink and the Matrix. If you don't care if people are following what you're doing, then use it. If you want to hide your tracks and be sneaky, use stealth.

Data Search - Intuition - A person's ability to search through the drek on the Matrix and find what they're looking for. Similar to perception or "gather information" (from D&D), this is used to search out and find relevant information.

Hardware - Logic - I've got no problems with this. If you're working with hardware, use this skill.

Software - Logic - Again, no problem. If you're writing software or trying to put a virus in some hard code, use this skill. This is a technical skill.

Cybercombat - Nothing wrong with this skill, except it's listed as a Logic attribute and from what I can tell, it's only ever used combined with attack programs. Used to attack other people. Still debating on what ability this should be linked to. Logic and Intuition don't make sense.

Electronic Warfare - Intuition - To simplify the present situation, this skill only applies to communications between nodes. Intercepting traffic, spoofing traffic, tracking hackers, or following someone will be done with this skill. Based on INT because (1) that's what tracking, shadowing, and perception use and (2) Hackers should need a 2nd ability.

Hacking - Logic - Anything someone is doing where they don't want to get caught.

There are two options for incorporating programs. The first is to allow players to have whatever level of hacking skill and equipment they want. Second is to require players to have programs for what they want to do, which adds a layer of detail, but also a layer of complexity. For any Hacking skills, the player's pool contribution for the Hacking skill can't exceed their program rating. For example, a player with a Stealth 3 program and Hacking 6 would only get 3 dice. As before, your program skill can't be greater than your system (which can't be greater than response).

This details the skills, I've also got some ideas for accounts in the next post.

[Malachi]

The Rigger programmed the system not to account Admin account deletions? Why not just program it not to accept any new accounts? Seems like a good idea to me. "Do you want your drone to be hackable? Y/N"

This is missing an important point. When hacking into a system, the intruder gains access to the system as if they had a certain account but they do not actually have an "account" on the system. Even if this weren't the case, setting a drone to not accept the addition of Accounts doesn't prevent an existing one to be the gateway for the hack with the password for that account being guessed/cracked/obtained somehow.

Also, I'm trying to think of where the rules say that Jumping In to a system automatically "kicks out" everyone that is in the system. If you have a rules page reference for that please point it out.

[biccat]

To get around the "I'm the Admin, I'll do what I want" issue, I think some reworking of how accounts work is in order as well.

The first thing a player has to do is get access to a node. There are basically 2 ways to do so: spoof your location or hack into the system. Matrix computer networks automatically allow certain levels of access if you have the right credentials coming in, subscriptions basically. The second option is to make the computer think you're the right person but coming in from the wrong place, copying a password or otherwise fooling the system.

Option 1: Spoofing

The first thing a player needs to do to spoof into a system is figure out the signal. This is an Intuition + Electronic Warfare (Originating Signal + ECCM, 1 Minute) test (limited by Sniffer program), and only works when the machine you're spoofing is logged on. Then, the player makes an Intuition + Electronic Warfare (Signal, 1 Minute) (limited by Decrypt program) to decrypt the signal and figure out how to copy the signal. The player next has to modify their own signal to match the target, using Intuition + Electronic Warfare (System + Firewall, 1 Minute) to rework their system to match that of the host and confuse the server.

This is the fast method of getting online. It requires you have access to the hacker's signal (hopefully it's wireless or you'll have another B&E on your record), the hacker has to be online when you are looking for his signal, and it would be a good idea not to be logged on from 2 places at once (consequences up to the GM, maybe the system kicks both people, maybe it does some sort of verification).

This option could use some work, tbh.

Option 2: Hacking

Brute-force hacking is using a software program to get through the defenses, either circumventing them or figuring out someone's password (and then spoofing a new account so that you don't appear twice on the system). Everything is detailed through AR, using VR makes times faster by 1 step (Complex Action, Combat Round, Minute, Hour, Day).

Hacking on the fly - Make a Logic + Hacking (Firewall, 1 combat round) extended test (limited by the Exploit program). The target makes an Analyze + Firewall (Hacker's Stealth program) extended test for every round the player is working. Same as in the book, except it takes longer in AR (and uses Logic).

Probing the target - Make a Logic + Hacking (System + Firewall, 1 day) extended test (limited by exploit program). The target makes an Analyze + Firewall (Hacker's Stealth program) test every time the character makes a test. It's not an extended test, but the system gets more than one chance to find the hacker.

User, Security, Admin accounts are +0, +3, +6, just like in the book.

Now that you're in...it's time to do some damage.

[biccat]

Also, I'm trying to think of where the rules say that Jumping In to a system automatically "kicks out" everyone that is in the system. If you have a rules page reference for that please point it out.

My apologies I misinterpreted the Netcat/Slamm-O! fight. The jumped-in rigger doesn't kick people out, it precludes any commands other than by the jumped-in rigger.

[ Spoiler ]

Hacking and Spoofing
Another way to fight a rigger is to take control of her drones. Hacking
a drone can give you full control over it. The drawback to hacking is
that it takes time. Spoofing is faster, but limited in what you can do.
Spoofing also requires that you have the rigger’s access ID, which may
necessitate the Track program if she is in a remote location. Still, a
single command, such as “unload your weapon” or “reboot” can take
a drone out of a fight.

Such hijacking attempts against your drones can be foiled by
jumping into a device. A jumped-in rigger overrides any other control
of the drone, including by its Pilot.

Still, it's an "i-win" option for a rigger whose security system is under attack.

[Yerameyahu]

Yes, it's an important Spider tool. (IMG:style_emoticons/default/smile.gif)

[Belvidere]

Use the 'Logic Matters' optional rule.

Is this an actual optional rule, and where is it if so?

[Yerameyahu]

Yup. It's in the core book, IIRC. I can look it up if you need?

The 'Programs Limit You' optional rule is there as well, I think someone mentioned it in this thread earlier.

[McCummhail]

There are two options for incorporating programs. The first is to allow players to have whatever level of hacking skill and equipment they want. Second is to require players to have programs for what they want to do, which adds a layer of detail, but also a layer of complexity. For any Hacking skills, the player's pool contribution for the Hacking skill can't exceed their program rating. For example, a player with a Stealth 3 program and Hacking 6 would only get 3 dice. As before, your program skill can't be greater than your system (which can't be greater than response).

This details the skills, I've also got some ideas for accounts in the next post.

We use logic + skill at my table and software.
Software rating limits the number of successes in the same manner as successes on sorcery are limited by the force of the spell.
This makes both important without crippling deckers.
This also allows a 1/1 commlink with R1 software to be usable for basic tasks.

[biccat]

If a player gets an account on a node, it's not an absolute right to do whatever you want. There are hacking countermeasures (Agents with Analyze) that the player wants to avoid. Just like you can't simply walk through a corporate building with a security uniform and get into the CEO's wall-safe, having an account isn't enough to do whatever you want. This is the second big part of the change.

Therefore, any action a player wants to take will take some time. The account is simply a "uniform" that makes the player look like he belongs. He still has to get around the network security.

Actions are as follows for full VR:

Administrative Action - Logic + Hacking (System, 1 Hour)
Security Action - Logic + Hacking (System, 1 Minute)
User Action - Logic + Hacking (System, 1 Combat Round)

If you're using AR, everything goes up 1 step, with Admin actions taking 1 day, Security 1 hour, and User 1 minute. Everything is limited by the appropriate program, Edit, Browse, Command, etc.

These durations incorporate a variety of things, finding out what files you need to edit, editing the appropriate files, and covering your tracks. A player who isn't concerned with covering his tracks can step everything down 1 level and uses the Computer skill. Someone analyzing your changes can then find you without using a Track action.

The system (any agents, other users on lookout, etc.) does get a chance to activate intrusion-countermeasures against someone doing something they're not supposed to do.

The system rolls one System + Analyze (Hacker's Stealth program) test every time the player rolls the dice. So if your administrative action takes 2 hours to succeed, then the system gets 2 tests (not extended), to see you. If you're not a very good hacker, you might be able to get by with a good stealth program. But long detailed actions will pose a risk.

It's up to the GM what constitutes a user/security/admin action, but here are some suggestions:
User: Open a door, use the elevator, access typical files.
Security: Open a secure door, travel to restricted floors, access personnel or financial records.
Admin: Change permissions for users, disable elevators, access any files on the network.

Another option that players can use is adding their own agent/program into the system that activates according to a certain command. For example, if a player needs four doors to be opened at specified times and then closed again, he can write a program to do this and install it in the node. This is an Admin action for everything, and the player first needs to make a Logic + Software (Rating, 1 hour) extended test. This test represent modifying a Spoof program of Rating to interface with the node, and the Rating must be at least equal to the System of the node.

Players can use programs to perform user or security actions, but not administrative actions.

[McCummhail]

It is called "Using Attributes" on p.226 of SR4A.
works well for us.

[biccat]

Well, that's just a first draft, detailing a few big changes:

1 - Skills are linked to attributes, not software.
2 - The system gets more chances to notice players.
3 - It takes time to do things in the Matrix, more complicated actions take longer.

Otherwise, I think the system works well, technomancers excepted. As far as I can tell, a technomancer is a hacker who can summon sprites. While this is pretty darn cool, I think that there could be some more done to differentiate them from ordinary players, particularly with downplaying programs as described.

So like I said, I'm open to comments. The idea is to make the system more playable, so that simple actions don't require massive investment of time and dice rolls.

Also, (for now) I'm happy with the rationale of "drones can't be hacked, you can just spoof or disrupt their signal."

[Sengir]

Skill + Program pools - This doesn't make any sense. Everywhere else, players use ability + skill to do something. It doesn't matter that you're an expert marksman (Longarms 6), if you can't hit your ass with both hands (AGI 1), you can't do crap. However, for some reason an MITT grad (LOG 6) and a street troll (LOG 1) with the same Hacking skill and programs are on even ground. Sorry, but that doesn't work for me.

How much logic does it take to run an exploit program and watch it try hundreds of possible malformed packets? It requires a good (-> high rating) program and knowledge of how to use it (->skill) (IMG:style_emoticons/default/wink.gif)

[Aaron]

I came into SR4 late in the game (just after Emergence, I think), so I can't say anything with certainty. That said, having done a certain amount of study of the Matrix rules, here's what I've come up with.

First, there's Sengir's point, which is a nicely concise summary of the bit in SR4A (I believe it's called "Attributes and the Matrix" and is on the same page as the optional rule, p. 226) about attributes. Even nowadays, if I wanted to hack your computer, I'd run a packet sniffer (a program), then a port scan (another program), and/or a brute-force password guessing or WEP cracking program; none of these functions care what my IQ is, just that I know what to use for which problem.

Second, from what I've read, the original SR4 design team had the goal of changing the Matrix from the dungeon-crawl of previous editions and make it work during normal play. I completely concur with this goal. I'm a simulationist who teaches computer science and networking at the high-school and college level, but I'm okay with abstracting (or even faking) things to make them more playable.

Anyway, if you want to have a Matrix specialist that can run with the rest of the team, you need to have her able to handle more than just the Matrix. Physics is everywhere, so the street samurai are doing okay. Mana is pretty much everywhere, so the magicians can do their thing pretty much anywhere, too. The Matrix has, of these three different levels of reality, a more limited scope. This puts the hacker and the technomancer at a disadvantage in some situations, where they would, if they had to be exclusive specialists, be stuck on the sidelines.

By making the system Skill + Program rather than Skill + Attribute, characters can excel in the Matrix without completely sacrificing another aspect of shadowrunning. Rather than sitting around making the occasional research roll and then diving into the Matrix for an hour while the rest of the players go for pizza, the hacker can be right there in the thick of things.

Incidentally, making things "hack proof" is directly detrimental to the goal I perceived, the one where the hacker runs with the team rather than kinda near them. If there's nothing to hack, then there's no reason to have l33t sk33lz, and suddenly hacking is no fun.

[Yerameyahu]

Indeed. I'm fine with the Matrix rules. However, I'm fully in support of people 'fixing' the game so it's fun for *them*. (IMG:style_emoticons/default/smile.gif)

[Aaron]

Indeed. I'm fine with the Matrix rules. However, I'm fully in support of people 'fixing' the game so it's fun for *them*. (IMG:style_emoticons/default/smile.gif)

Fair point, I should clarify my previous post:

I'm talking about why it is the way it is. If it's your table and your Big Black Screen, do what you like. Up to and including turning programs into at-will, encounter, and daily powers. =i)

[Yerameyahu]

Aaagh, it burns us!

I just thought I'd echo that some people like the Matrix as it is, so readers don't feel left out. (IMG:style_emoticons/default/biggrin.gif)

[Prime Mover]

Actually as far as matrix rules go 4th edition like past editions has been an improvement over its previous incarnation. Now I like others have some concerns with this current edition. I've been careful to keep the hackers spotlight time on par with others and 4th edition rules has helped alot in that respect. If anything I've found that given enough time and alittle nuyen a skilled hacker can be nearly unstoppable by anything but high end systems. Of course this hacker was a paper tiger out of the matrix. In the grand scheme of the matrix rules evolution this version is definitely on track.

[Yerameyahu]

Mhm. I've really enjoyed my hacker-generalist. It's very easy to do other things, because hacking doesn't require massive attribute investment, massive nuyen investment, or massive skill investment. You can get to 80% of great pretty easily (non-trivial resources, but not crippling); you're not nova-hot, but you're clearly 'the hacker'.

[Malachi]

Mhm. I've really enjoyed my hacker-generalist. It's very easy to do other things, because hacking doesn't require massive attribute investment, massive nuyen investment, or massive skill investment. You can get to 80% of great pretty easily (non-trivial resources, but not crippling); you're not nova-hot, but you're clearly 'the hacker'.

I agree. One of my first (and most positive) impressions with SR4 was building a "hacker" character and realizing, "Wow, I have a lot of points left over to make him good at lots of other stuff too!"

[HugeC]

The high security level actions take way too long to be playable. Heaven forbid you need to do something at an admin level while hacking in AR! If the hacker is meant to be along on the run with the team, he needs to be able to do something useful in a complex action or two. Making conditions favorable could be something that takes a while, because you do that during the legwork phase, but if that security door needs to be opened NOW, it may as well be an impenetrable force field if it's going to take the hacker 20 combat rounds for a single test at opening it.

[Malachi]

The high security level actions take way too long to be playable. Heaven forbid you need to do something at an admin level while hacking in AR! If the hacker is meant to be along on the run with the team, he needs to be able to do something useful in a complex action or two. Making conditions favorable could be something that takes a while, because you do that during the legwork phase, but if that security door needs to be opened NOW, it may as well be an impenetrable force field if it's going to take the hacker 20 combat rounds for a single test at opening it.

... and this is the design problem when designing hacker actions: skirting the line between "realism" and "game usability." It is definitely easy to speed things up and make hacking Matrix actions quicker, but then you hear the cries of "no world could ever function if it was this quick and easy to break security!" So then the system could change it so that Matrix security is much tougher, and then you hear "all the hacking actions take too long! The hacker is useless with the party!" It's a difficult decision that comes down to "gamism" vs. "simulationism"

[sabs]

Then answer is complicated.
The way to do it is to differentiate between remote hacking and direct access hacking.
Hackers build one shot items, they social engineer themselves access.

Upgrade the rules for slow hacking, but leave the on the fly hacking rules roughly the same. Just assume that on the fly hacking is not subtle, and it'll be hard to remove your traces.