I am going over the sr3 rules for decking again, and I need some clarification on a few things, and I am trying to write up a quick tutorial.

Your deck is pretty hot and has 8/6/6/6/6. Computer skill of 6.

Host is a soft system Orange-6 9,8,7,8,7
Security sheaf:
3 Probe 5
7 Probe 7
10 Killer 8, passive
13 Killer 10, active
16 shutdown

You pull up to the SAN and you see a gate attendant, and a hell hound(6)blaster just inside.

You have your sleaze (5) and deception(6) fired up, and you run your "logon to host"(access) test.

It is an opposed test.
Decker gets 6 + hacking pool TN 3 {Access rating(9) - deception(6) = 3}
System gets its rating(6) TN 6 {Masking(6) + Sleaze(5) /2 =5.5 round up}
(personally I am just going to just drop the sleaze program, seems silly to me)

Any successes by host are added to Security Tally.
The decker passes the gate now he can fire up the Analyze(4) try an figure out the hell hound.

Does the decker use the control rating of the host or the rating of the IC as the base TN?
Assuming rating of IC:
He runs the Analyze IC control test Sensor rating (6) TN 4 {IC rating( - Analyse(4)}

Assuming control rating:
He runs the Analyze IC control test Sensor rating (6) TN 5 {IC rating(9) - Analyse(4)}


Is this an opposed test?
System rating TN MCPC of deck? Would the system counter successes still add to the tally?

Satisfied that he knows what the hound is, our decker decides to search for a phone log file for the date 1/1/61.

He runs an Index test Computer(6) + hacking TN 5 {Index Rating( - Browse(3)} VS Security rating(6) TN 6 {Masking(6) + Sleaze(5) /2 =5.5 round up}

Any successes by host get added to tally.

Is this close so far? more to come.

We had a great thread dealing with the ins and outs of deckingidiots guide to the matrix. You should be able to find a lot of info from there.

Also, if you use the rules for creating a random security sheaf, they are way, way longer than the sample ones. Even a red host gets to a tally of like 50-70 before shutting down, and a green host can hit a tally of 200 before shutting down, by the dice.

I wrote a program for my TI-85 to dynamically generate security sheafs. You put in the color code and the system rating. It comes back with what is triggered when the tally reaches the next trigger step. You hit enter, and it'll give you the next trigger step and IC triggered. It'll also tell you when alerts happen and the shutdown.

Any status on the archives? Those are the first few links in the posts. would be nice to get those old threads saved somewhere.

Questions about decking:

"More sophisticated"?

~J

Last comment removed, anyone care to help with the question?

Nothing to see here. Ignore me.

If you're asking about the rules as they are now, the answer is "no". If you're asking whether it might make sense to add rules to do that, I'll need to know what you want to achieve with that to comment.

~J

Well, what I am trying to achieve is a way to passively circumvent the IC.

What I was thinking should happen is you have the ability to ask for credentials. (some details of your activity are suspicious, so they ask for a revalidation)
The odds are that this will increase the security tally because this will be a system test (essentially another logon test). If the decker succeeds, the probe goes passive again but the odds are that the system will ratchet up some additional successes and increase the security tally. (possibly triggering more ic, like a trace, which is not a big deal if you are a legit user) If the decker ignores the request.. then the tally goes up by the probe's rating. Or you can attack it, then suppress it.

With probe IC, the ways to accomplish that are ignoring it or logging off and trying later when things calm down. IMO it doesn't make sense to be able to make things calm down, on account of the system already having detected suspicious behaviour.

Though I think ultimately this comes down to the conflict between decker-has-tally (in which case the probe really is responding to you personally) and system-has-tally (in which case the probe is responding to suspicious activity, and if you prove you're legit that just means it has to look elsewhere (while it continues watching you) to find the source of the activity).

~J