Target Commlink - Standard secure, but not hacker elite
Firewall (5) + Admin (6) = 11
Analyze (4) + Firewall (5) = 9 avg 3 hits

Hacker - Elite System
Hacking (6) + Exploit (6) + VR (2) = 14 avg 4-5 hits
Stealth (6)

The hacker will need from 2-4 passes to hack into the system, on a fast hack the system will run analyze each try for the extended threshold. It will only take 2 or 3 passes for the system to spot the hacker. Once this is done, the system can drop link to the Hacker (looses all his work), then will be on Alert status providing it +4 to its Firewall.

I disagree. In my opinion, Commlinks typically only come with Admin Access.

I would have to agree with Feshy. Even my pda phone has two levels of access. There is no reason to think that a comlink would have a poor security model as to have only one level of access.

In SR, a "poor security model" is actually superior to the known "best practice" of having multiple accounts. This is primarily because once a Hacker has attained any access at all, it's relatively trivial for them to acquire Admin status without raising an alarm.

If you don't mind that the Hackers are all a Complex Action or two away from having Admin with little to no consequence, that's fine. If you do feel this is a bit undesired, either insist that most devices only have one user account (Admin) or change the rules for ratcheting up access levels once hacked inside.

you just edit the account list, of course... which is going to be a simple hacking + edit test, since it likely isn't something your hacked account is allowed to do.

I didn't disagree with the idea of commlinks only having one security level in that post. I only commented that having hacked your way into a system at a lower level didn't do much to help you then hack it at a higher level. About the only advantage I can see is if it let you move to a different part of the network where no IC was currently residing, so you could hack in peace. However, that would be of limited value in my networks. Usually I set my networks up so that logical groups of nodes share access permissions, but when you come to a logically distinct area, you may have to make a new hack attempt. An example would be two separate offices owned by the same company that shared some matrix resources, but not all. I've never had much difficulty in pitching the difficulty of hacking a network about where I want. Usually, I only make it moderately difficult, knowing that I can complicate things further if I need to. Once a node has detected the presence of a hacker, there are so many things it can do to make things difficult that it gets silly. Amateurs care about breaking into a node. The pros care about do so without being noticed while they do it. And the masters care about not being noticed after they're gone.

It's a bit of a judgement call on commlinks and access levels. You could use an example of how many people today have phones that are tied to a particular network provider. The user does not have Admin access to their phone. But regardless of whether or not there is an Admin level to the commlink, if the user can get their data in and out, make calls, etc. with just the user level access, then so can the hacker. With simple devices, it's harder to determine the functional differences between Public, Security and Administration. You have to either round up or round down, really. The name "public" encourages you to round up for most things that aren't publically accessible, but that has the negative effect of making your auto-fridge conceptually harder to hack than an office computer network. I tend to solve this by making it a non-issue. E.g. the fridge is not really a node, it is a device that is subscribed to your house node and it is the house node which is an entity that you hack. Then it becomes simple - the Hacker hacks the house node and if they want to defrost your fridge while you're out, they need user / public access because that's what you would normally need as a user to do this. If I want to turn off the alarm system, you'll be wanting Security access. And if you want to add a new user account to the household so you can live there while the owner's on holiday... that's Admin.

Maybe in your game. But a public user doesn't have the access rights to that sort of data in my game. There's no boot strapping.

The rules in SR are abstract. They need to be as we're dealing with computer technology over sixty-years in the future. If someone is getting themself security level access to a system, then maybe one way they would do that is to hack an account list, but that attempt is a hack attempt at the node and we have rules for that. It's certainly not a generic Edit test (for which the book gives example such as changing text documents, graphics, video, transferring files, etc), unless the GM says "by the way, there's a file in this node that lists who's an Administrator. Do you want to add your name?"

You're falling into a trap of adjusting the rules to fit an overly-developed guess at how the Matrix would work. And it's also a way that I don't think the Matrix would work, anyway.

I assume this is how people are bumping themselves up a level. Since this is the closest it comes to saying its possible. But this is an output only, not a file. Basically if they are printing out information on you, you can intercept and edit the "No Record" to read your information. But it doesn't put you in the system, you only exist for that one time it is being referenced.

Basic users wouldn't have access to the admin user list, so it makes no sense for someone to edit them in. The only way to do that is to be Admin level, then you'd be able to do that. That's how you make a back door. You can only edit what you have access to, Security has access to video feeds, but they aren't allowed to change them, thats a hacking edit. Edit doesn't give you access, only exploit, so you can't Edit your way into a system.

Also I added the page reference for the access above, its short, and just one of those "Oh yeah, and this" type lines.

This is interesting. I think in my game I would allow the PC to add dice equal to the net hits on a Con+Charisma test...

In the section on actions in the chapter on combat. Let's see, page ... hang on, my PDF is still loading ... page 137 in your hymnal.

Actually, I like the system, and wouldn't be surprised if this was intentional. Fake identities should be more like commodities and less like real estate, at least in my opinion.

Cheap ones should, but reliable ones should be vaguely reliable.
If a rating 6 fake SIN fails against a rating 1 scanner 3% of the time, then buying a frozen burrito once per day from the stuffer shack with no other activity whatsoever means the best of the best fake ID will fail 60% of the time within a month under the lightest scrutiny. Boo.

This is a specific case of all Even-sized dice pools glitching more often than dice pools which are one less in size - but the effect is largest at the bottom end, I think.

DS

I'm gonna go look it up, and if it's under the description for the shield...


edit: Page 317, under Helmets and Shields.

This reminds me of the Terry Pratchett "Discworld" scene in which the protagonists have to do something incredibly difficult, but choose to make it even more difficult (one eye shut, over the shoulder sort of thing) so that the magic of "the odds are a million to one, but it just might work" would take effect.

Sooo... if you have a dice pool of 2, do it from cover or wear a shield before you try!

Purely in the interest of plugging my die roller that calculates statistics for SR4 (Die, found here) I can say that it's actually higher.

The odds of a critical glitch on a rating 6 SIN are 2% even. This will still beat (or at least tie) 16.7% of the time with the critical glitch of the rating 1 scanner, leaving 1.7% chance that you'll loose to a critical glitch. The odds of rolling zero successes (a requirement for being beaten by one die) are 8.8%. Figure that 1/3 of that 8.8% are a hit for the single die rating 1 system, and you get 2.9% of the time that the rating 1 will beat the rating 6 (this is probably where your 3% came from; it just didn't factor in the chance of loosing to a critical glitch!)

That's a total failure rate of ~4.6%.

And that doesn't take into account how the 4.2% normal glitch chance might affect results.

So overall, you're looking at ~9% chance something funny will happen, and a one-in-twenty chance you'll be totally hosed, every time you use your best that money can buy SIN number at a worst available ID checker.

For more normal values, say, best that a starting character can acquire vs. cheap, run-down car dealer in a bad neighborhood (Rating 4 vs. Rating 2), which should be a fairly safe activity, gives you outright failure odds of about 1 in 5, with a normal glitch chance around 7% causing you additional hassle.

That's pretty poor for a :nuyen: 4,000 bit of kit that becomes useless immediately afterwards.

I am not even going to check your math. I believe you. I was doing cheap calculations based on other people's number in the first place.

There are a number of issues at work here. 1- game designers are often bad at stats. No news here, it's a tricky subject, moving on.

2 - A more interesting issue is that if you work out a failure rate based on how often you realistically, within the context of the game-world, expect them to fail, you'll have a HUGE disconnect from how often they'll fail at the game table.
In other words, if you figure out a system assuming SINs will be checked hundreds of times per day and you make them last for several months, then at the game table they will effectively never fail.
If you make a system mean enough that they'll fail with some reasonable frequency during play, and then start assuming they should be checked a bazillion times a day then they'll fail instantly.
Again, this is probably nothing new but it's worth saying.

That said, I think the rules are STILL probably too mean. A rating 6 SIN shouldn't fail against a rating 1 scanner with any conceivable probability, IMO. I've heard some intriguing suggestions about making the scanner roll a test with a threshold equal to the rating of the SIN, dice could explode, opposing tests could be made, I have no idea where the odds would land, but if someone else wants to work that out that'd be great.

I agree with everything you're saying.
I'm not suggesting a better system, I'm saying I don't know what one would be.

And WTF does "O.o" mean?

now imagine the " " to be pointy ears and the smiley to have green blood and to be very arrogant and you'll get it *g*

Actually, you should have. I was wrong, it is around 3%. I forgot that critical glitches would overlap with the 0 hit rate (actually, I forgot that my statistics printout didn't subtract them from the 0 hit odds, which it probably should. 0 hits is different from a critical glitch! It handles this properly for extended die rolls, but leaves it in for normal rolls.) Oh well.

I need to add opposing rolls to the statistics calculations in my die roller, that would make this quicker.

I guess what it comes down to is, try to use your fake SIN as seldom as possible -- or SIN costs will rapidly outpace your lifestyle costs!

Stop that. I occasionally teach Statistics; I'd like to think I'm pretty good at it. =i)

Most of these were known to me. I have a few comments though:

1. The GM determines the effect of a glitch. A tougher shot is more likely to glitch, but in this case a bullet richohetting to damage something would be more appropriate than the gun exploding.. unless the glitch was very bad.

2. Every party with an awakened should know this one.

3. Silly system, as it makes Shadowrunning impossible. If you need to roll this every time you take the subway, buy things in a store, or pass some sort of checkpoint then only rating 6 works and then only for awhile.

My houserule is that you just compare SIN rating vs verification rating, the highest wins. If there is a tie, the owner needs to answer questions etc. and we roll opposed rolls. If the SIN fails or crit. glitches the owner is busted.

4. Yup. Good rule. You can't even use edge to prevent a glitch on this one.

5. Already used Our hacker tries to fool people with holograms alot. Still haven't been very useful though.

6. Nice to know. Shields haven't been much used though.

7. True, but a pool of 1 critically glitches more often than a pool on 2. I would go for 2 dice.

8. I use this all the time. Remember it's only when INJURED though, and would penalties apply.

..except for explosive ammo, which, additionally to any other GM fiat effects, goes boom on a glitch.

Not in any company I've worked for in the last 10 years! No network admin with any experience would give their users local admin rights to their workstations. Only tech savvy users like engineers/programmers/network-admins get local admin rights to their boxes and I'm sure the same security principle applies as much in 2070 as 2007.

Laziness is no excuse for incompetence. I'm not just picking on the SR4 guys here, or even just the SR guys in general -- but as a head's up to game designers everywhere, you are designing a game. Do a little math, and make sure shit works the way you think it does, knuckleheads.

I'm sort of divided on the subject, but comparison to workstations isn't accurate. Think PDA/phone/laptop. Then again I know operating systems are even now leaning towards making people use a user level account and run things as higher if needed, so this might eventually move over to commlinks.

Just a side note, there is only a test if you're wounded. I consider that pretty important.

The odds for one die being a critical glitch are 1 in 6, or ~16.7%.

For two dice, it's a bit more complicated.

The odds of both die being 1's is 1 in 36.
The odds of one die being a 1 is 10 in 36.
The odds of the remaining die being a failure is 2 in 3.

Taking those three factors into account gives you a critical glitch chance of ~21.3%
You also have a glitch chance of 9.3%.

However, your odds of getting at least one hit jump from 33.3% to 55.6%.