I'm trying to help one of my players make a Hacker and he brought up the point that why are most of the Hackers in the setting all using Hot Sim Hacking and putting themselves at risk of getting Dumpshock, being targeted by Black IC, etc... When it only gives you a +2 Dice Bonus and extra initiative. Mind you, he's trying to make a more subtle and careful Hacker with the idea of "try to avoid as much cyber combat as possible and get the information."

I mean besides the +2 to all your tests to Hacking, Computer, and other online checks, and the Initiative Boost.... Is there anything else that Hot Sim Hacking grants you that I'm missing here?

hot sim is cheap. for only 750 you can get a jack and hot sim, giving you 3 IP for your hacking/rigging. a hacker with a novatech airwave(3/3) running iris orb(3/3) with hot sim would only be paying 3000 , leaving the rest of his budget for programs. most hackers cant afford whiz ware. shadowrunners can, so they dont have to risk hot sim to get the job done.

aside from cost, look at 'probing the target' on page 221 of the main book. intervals of 1 hour in VR, or 1 day in AR. this can give you a backdoor that you can use repeatedly. the system only gets one roll to detect you each time you intrude in that system. that right there is why you need sim, but you can probe in cold sim and then use the expoit in AR.

You still get dumpshock and can be targeted by black IC in cold sim. Hot sim gives all the advantages of cold sim plus those extra two dice, which can be handy, but if you do come a cropper, you take physical damage.

The only way to avoid dumpshock and Black IC is to hack through AR. According to RAW you can use the extra IPs from physical initiative boosts (from magic or 'ware or drugs to get extra initiative in AR, but that's a much greater BP investment, and makes probing for exploits far slower.

Sorry, I meant to say the player was leaning towards Hacking through AR.... And you bring up another good point as well about Augmented Reflexes via Cyberware, Bioware, Magic, etc... If that's the case, your only missing out on the +2 to doing everything in the Matrix?

AR Hacking also increases the interval in the probing extended test, which is the kind of hacking a careful precise guy would probably use to 24 hours. In VR, its 1 hour.

So you can hack a lot faster safely in VR.

That ruling is in the FAQ. It does mean that someone with a good meat initiative is as fast (or faster if they have 4 IPs) as a VR hacker risking his neurons via hotsim, for all purposes except probing. It's not something I like personally (and have houseruled to my personal preferences in my game), but both sides have argued the issue to death, if you fancy doing a search for the thread.

Neither is really better. If you have a low hacking job on a low risk node that needs to happen ASAP hotsim is the way to go. Likewise if you want the call logs from a comlink you just looted, but it's guarded by nasty IC AR just might be the way to go. If you are GMing I encourage you to make both choice viable so the play gets to make choice in game and test there characters values, not just running there A-game 24/7 and seeing if there paper tiger is big enough.

AR hacking is so equivalent to VR hacking that there's pretty much no reason to actually use VR for hacking purposes. You're better off just having a pile of commlinks and switching from one to the other whenever anyone damages or inconveniences the icon generated by the commlink in your hand in any way. Even better, you can load an Agent onto the icon of every commlink in the pile and have them all do stuff on your behalf. Beats the pants off of +2 dice so hard it isn't even funny and there is no risk to you and yours.

Techniques are called hackastack and Agent Smith.

-Frank

Just to give you an idea of possible house rules, we've house rules it so that AR matrix actions are limited to 1 per round, no matter how many IPs you have...
While this makes little sense from a realism point of view, it does make hackers go cold or hot VR if they need things done quickly...

Nah, they just have their agents act for them.

imo, if you're going to use VR to hack, may as well make it hotsim. if you're not going to use VR, well, you're not worried about effectiveness, you're clearly worried about safety instead. so really, it's all about where you place your priorities.

i just wish that they had extended that to doing data searches as well. it would make sense
(as as much sense as the SR matrix rules makes, anyways)

Yes. It aslo gives you more Addiction (Simsense) Tests.

And the ability to have your brain spray out your ears when an AR hacker has his agents hit you with black hammer.

Just jack in and burn it, wussies.

Welcome aboard the matrix rules train: Next stop, burning hatred!

No, that stop isn't available until after Unwired. Hope still exists, despite all evidence, that they might fix the madness....

I like that way, too. I figured that AR is a lot like turtling in SR3. You can use all of your passes, but you can only use one of them on AR.

they can do that anyways, if you're in cold sim. the difference is that you can run as many agents as he can, but you yourself are in all probability going to have superior dice pools. he can keep on booting up a new commlink from his hackastack, but every time he shows up you can just defeat him. the only way he can be instantly back in the fight is if his next commlink in line is also logged in to the same node, which can only happen if he is logging into the same node once for each commlink (requiring a number of actions equal to the number of commlinks, and facing a number of detection checks equal to the number of commlinks). hackastack is crazy good for getting a lot of attempts at one thing, but sometimes you just need to succeed the first time. hackastack does absolutely nothing for that situation; hotsim does.

also, nobody houserules hotsim into uselessness, whereas almost everyone you meet is gonna nerf hackastack (and probably agent smith too, and in some cases multiple meat IPs). but mainly, it's the fact that hotsim actually provides you with a boost to your ability to hack. one that makes the difference when you need to succeed on the first attempt, and succeeding on the 2nd or 3rd or 50th or 100th etc is just not gonna cut it. for example, when you're trying to block the alarms of that secure facility you're in so that you don't have a couple of firewatch teams waiting in ambush when you step outside said secure facility. but hey, it's up to you. the concept of an AR hacker is certainly workable, but yes... there is a reason to use hotsim.

If wound penalties didn't exist, your argument about being materially better might be interesting. But he has to just get lucky once and suddenly you're doing worse, while he can never actually loose. Plus he could very well have an extra IP thanks to magic, cyberware or whatever, and that would just make him flat out better than you.


And it's not like initiative enhancing cyberware/magic wouldn't help him massively the rest of time. (Consider you're gunslinger character, would you trade 2 dice for an extra IP pass? err, yeah?)

Yeah, the part where you can KILL him and the most he can do is force you to reboot your comlinks tends to suggest that this doesn't bode well for the VR guy. You'll eventually get a good roll and fry his brain while his good rolls just annoy you.

I know that by RAW there's not much other than the Probe time that it effects. But if I'm GM'ing, I wouldn't let an AR hacker get the same use of his IP's as a hot sim VR hacker gets.

I'd probably rule it like this:
1 Meat IP / 1 Matrix IP
2 Meat IP / 1 Matrix IP
3 Meat IP / 2 Matrix IP
4 Meat IP / 2 Matrix IP

Or perhaps with 4 Meat Ip / 3 Matrix IP, to gimp it less.

It really doesn't matter, because your agents all act at the same speed, and an agent can kill someone in hot sim too.

and the hotsim hacker can use the same amount of agents.

the fact remains that sometimes, "eventually" succeeding isn't an option. if i am a street sam who is relying on your ability to take over the security systems for the building i'm about to physically break into, i'm not going to accept the assurance that "eventually" those sentry guns will stop shooting me, or that "eventually" the alert will be cancelled. i want it done, and i want it done now. the *first* time. you know, the time *before* lone star gets called in, for example.

in a hacker vs hacker fight, there is no "eventually". there is only 1 active account for that hacker at any given time. unless he has already hacked in with each and every separate commlink, and logged in with each and every commlink (generating a lot of traffic and looking suspicious, especially if he's bringing along an agent horde as has been suggested... not to mention now instead of facing 1 detection test or 1 series of tests if he hacked in on the fly, he's now facing one per commlink in the hackastack) by the time he gets hacked into the node again he is facing a node on active alert with all of the bad stuff that entails.

An agent smith army is an army. A Hacker is a shadow runner. There are things runners can do that an army can't, like sneak. If you try to flood a node with IC some of them will be seen. Most matrix runs are already failed if they are detected.

In the case you have you are essentially allowing the AR hacker to run around with a real gun with real bullets that will kill you, and your team has netf guns, which if you shoot the other guy really good he has to go run back and tag his base, then comes back and shoot more real bullets at you. How would this work out?


Why are you assuming that the guy trying to stop you from hacking a computer system that doesn't belong to you isn't supposed to be there? He and his agents don't have to hack into anything, they LIVE there. Hence, he won't get attacked by ice, etc. And 21 black hammers per turn will tend to help them stop you.

if the agent army and the unkillable target are on the defense, that just makes hotsim even more important, because if that's what's gonna be waiting for you in the event that you fail/are detected, it simply becomes even more important that you don't fail or get detected... which makes the +2 dice a whole lot more desireable.

like i said, hackastack is great if succeeding "eventually" is an acceptable outcome. if you have to succeed right now, on this attempt, and failure is not an option, you want every little edge you can get to help you out. sure, you might have someone standing by to yank the plug out of your head if you start twitching and squirting blood out of your eyes (or better yet, someone who can see what you can see in the matrix, but is watching from AR... i think there was a piece of 'ware like that in earlier editions... my brain wants to call it a hitcher jack for some reason?) but ultimately, you need that +2 dice, because if you fail, you're screwed either way... if you fail your brain might get fried (assuming they are even using black IC, which isn't terribly likely since it does absolutely nothing to nonliving targets, or even targets who aren't using simsense), but then again if you fail and are in AR you're probably going to get shot, burned, stabbed, bitten, drugged, or otherwise harmed anyways. when it's a choice between "better chance of success with death being the result of failure" and "worse chance of success with death being the result of failure", that's when you choose hotsim. the thing is, for shadowrunners that can happen pretty often.

Again, nice in theory. In practice those +2 dice are

A) Worse than a 4th IP. I'd much rather have that than two dice.

B) Only so good as long as you don't ever sustain a wound penalty

C) Not really that significant in terms of actually accomplishing things. On average it is less than 1 success. 56% of the time those two dice will be meaningless.

Maybe we should throw down some cybercombats just to illustrate the point.

Not only this, the AR hacker has other cool features

A) Three IPs all the time makes him a much more flexible character when the chips are down

B) He can actually move/sprint! around while hacking, vitally important while you are trying to open the door that's 600 meters down the corridor.

So, I'm not so sure it's as clear cut as you are thinking.

A) a 4th IP is not mutually exclusive. there's always the simsense booster

B) wounds can be healed, and with crazy shadowrun tech and magic coming into play, it may not even take long.

C) a 46% chance of making a difference vs a 0% chance of making a difference. gee, i wonder which is better?

A) can have 4 IPs all the time with a simsense booster and a rigged vehicle that he rides around in. better yet, he can give control of said vehicle to a pilot which has it's own 3 separate physical IPs which do not use up the hacker's actions should he need them in the matrix. who's laughing now?

B) see above.

i'm not saying hotsim is always the right choice, here. i'm saying that it can be a good choice, the right choice even, for many situations. considering a decent hacker is gonna be dropping close to 100k credits on a good commlink and programs, being able to pick up 3 IPs for the cost of a hotsim module is nice. being able to pick up a 4th for only 65k credits and .5 essence is way nicer than the cost for picking up wired 3 as well, never mind synaptic booster 3. and for another 10k and .5 essence, he's got a net of +4 to all vehicle actions when rigging in hotsim (including gunnery, which allows him to use any weapon provided it's vehicle mounted, a much better deal than the firearms group) and reduces all thresholds for vehicle tests by 1. seriously, i understand where you're coming from when you say that hotsim has it's drawbacks. my point is simply that there are times when those drawbacks are worth it, even the ones that can't just be skipped over entirely (the aforementioned supposed lack of mobility, for example, can be negated relatively easily)

Yeah, but we clearly think the 'default state' is different. I think that the guy who is unkillable (thanks to AR), undisruptable unless you fully damage him in one IP (thanks to logging into multiple nodes with one persona and medics with the agent program) is the best place to start because your defense is literally unbreakable for a minor increase in attack power.

Imagine if you could have a covert ops character who fully regenerates all boxes of stun and wounds every turn and resurrects himself every new combat turn. In return you have to sacrifice two dice off your 'stealth' group. This is a no brainer.

You think the 'slightly better attack' is worth sacrificing the 'unbreakable defense,' whereas I don't, and in fact think that in the general case the 'slightly better attack' will lose every single time in any 'whole of life cycle comparison' to the unbreakable defense guy.

Mobility cannot be negated as easily as you think. For example, the 'use a vehicle' plan is defeated by the cunning device known as 'a ladder' It is also defeated by any need to 'hide'

I'll do a worked example later on against knassers sample systems.

>Maybe we should throw down some cybercombats just to illustrate the point.
----
>You think the 'slightly better attack' is worth sacrificing the 'unbreakable defense'

Cyber combat is not all that hackers do. If you want to kick someone off your team's PAN, yeah AR and IC all the way. If you need to access a file and you know that the node is programed to shut down rather the second it spots an intruder those +2 dice to your stealth roll are rather nice and don't put you in any more danger.

I think the different assumptions about 'default state' have a lot to do with assumptions about 'default tasks'. At my table once a hacker is IDed they are almost worthless, so stealth in paramount. Cybercombat is rare, for exactly the reasons you are describing. Anyone who is smart about it can make it a relatively moot issue with AR and IC.

Sure, but things only have to go wrong once for you to attract IC. It's almost certain in a hack on the fly that you will have some unwanted attention heading your way.

If it's just an unattended system most hackers can just widdle on it from a great height anyway, so I'm not sure thats an issue.

This is coming down to how a GM runs the matrix. There isn't really a cannon answer to what systems have security decks in them at what frequency. AR-IC is hands down the best way to beat beat stuff in the matrix. Hot sim + metahuman only buffs is the best way to sneak (fully aware I'm ignoring TMs, Threading, and Spirits). I'd say your augment is very similar to saying that riggers are just better than sams. Riggers can get way more attacks than a sam possibly can have, without a huge drop in DP. This doesn't mean riggers strictly dominate Sams. Some times one shot is all you will get. Some times you'd much rather have only person risking infiltration rolls.

The point is it's situational and that comes down to how the matrix run at your table what the default state should be. If you GM likes deckers being keyboard cowboys constantly locked in cybercombat: AR-IC. If your GM likes deckers being sneaky ghosts in the machine agent smithing it will draw to much heat for you to do your job. Playing along will get with your GM will get you further than anything and THAT should set your 'Default state' for runs.

Pointing out another assumption, I was thinking 'default state for a run' which I feel is an open question. If you were thinking truly 'default state' being untouchable via AR-IC while living your life, eating, sleeping, watching trid, and other down time activities then I see where you are coming from. There is no reason to expose yourself if there isn't something you need to being actively ninja-ing

The hacker in the game I'm running goes hot sim most of the time. prefers the digital world in all its splendor to the real one. But then he dresses like a clown. No, really...red nose, size 35 shoes,the works.

Cthulhu Dreams: I agree that by RAW AR does heavily dominate VR in cyber-combat stakes. But you do have the high cost of meat IP enhancements, which does play a role in character budgeting. Yes, the meat IP is widely useful outside of the matrix, but it still costs a lot, thus limiting what you can spend on gear and programs, which are vital for a good hacker.

While Hacking on the Fly in Hot VR you get +2 dice to your Hack + Exploit test but the system still only gets Firewall + Analyze. So a VR hacker is better at Hacking on the Fly and faster at Probing. Basically, the rules give a fluff reason for "True Hackers" to use Hot VR to get in, and then afterwards you can switch to AR while fiddling with the system.

apparently that has been errated. you can no longer take actions while the medic program is being used on you.

also, like i said, that option could easily be available to the hotsim hacker; if your agent army is packing black hammer/blackout, they do nothing to an opposing agent army, IC, etc. it's much more likely for them to pack the all-purpose attack program if they're on the offensive, or the track program if on the defensive (it's more important that they know where you are if they want to stop you from trying again than it is to blow up your persona).

of course, this is once again assuming that the agent army is even an option, which it likely won't be for a shadowrunner trying to get into an opposing system. who is going to want the best chance possible to succeed, because failure means that your target knows you're coming for them, and will respond with security forces coming to your location.

seriously, i'm not arguing that most people are going to use hotsim. but from a shadowrunner's perspective, hotsim does make sense. it makes sense because if you are detected, you are screwed anyways, and the only difference between hotsim and AR is that in hotsim they might be killing you with black IC (but more likely will be using other programs, i would suspect, unless you're in some place extremely secure that's worth using illegal black IC) whereas in AR they're going to be killing you with real life bullets.

and sure, ladders might stop a vehicle. then again, depending on what you need the ladder for, it might not... consider a lockheed sparrow with the LTA mod on it (technically you can do that with any vehicle, but that just feels wrong... at least the sparrow is a flying vehicle to begin with). it's human-sized roughly, and infiltration(vehicle) would allow you to hide with it. especially if you put ruthenium coating on it (and yes, i know you can only put so many mods on it, but i'm merely pointing out there are options to make your vehicle usable for these purposes).

Sure you can. You just have to act through any of your other commlinks.

-Frank

in which case we are back to hacking in and logging in X number of times, where X is the number of commlinks you want to hack in with. which increases the probability of you being detected, which increases the probability of you getting shot in the face by angry security guards.

hackastack works great for a security hacker guarding a system. it does not work well for joe shadowrunner.

It's just an action to create as many legal accounts as you want. Once any of your commlinks have hacked in, all of your commlinks can be logged in.

-Frank

But surely in order to create accounts you'd need to hack in as an admin the first time, and subsequent accounts would have a lower clearance of security or just user. Even then, a sudden succession of accounts being generated would surely attract attention from a security hacker who, upon realising that he was outnumbered, could reboot the system, kicking all your comlink personae offline. If there is no security hacker, then having your big stack o' comlinks would be pointless.

...no.

Once you have an admin account you do the following: Lock out all other users, create an admin account, disconnect, log into your newly created admin account, and do whatever you want. Once you have an admin account on a system you can create any account you want, erase any account you want, change any account password you want, change security protocols, and generally do anything else you want.

As for rebooting the system, thats why you upload that nice agent to an admin account and alter the systems settings so the first program loaded on reboot is said agent. They have to hack into their system to get it back, which includes getting treated as the invader as far as IC is concerned.

Sure, its not a quiet way to do things. But it is a sure way to do them.

Admin accounts can typically create all levels of account - including other admin accounts.

So you can have multiple admin accounts.

The point about the security hacker noticing is interesting, but him not noticing is exactly what the stealth program and scrubbing the logs is supposed to accomplish.

Rebooting the system every time you detect its been compromised is an intresting approach, but allows you to be DDoSed forever - I just repeatedly try to log in, you reboot ever time, you cannot run a track action to find me because you cannot get onto the node.

That and rebooting takes time so I might have done whatever I want to do

What's real fun is to have an encryption IC running around set to start acting as soon as anything is detected. It's to just go around and encrypt anything and everything in the system. Another fun one is what I call lazy IC. It just keeps opening multiple programs in the node until it is slowed to response 1.

And if you are the hacker its fun to load a databomb IC that just runs around databombing anything in site and broadcasting to anything that connects to the system "All programs will be erased when the system is next started up".

I'm pretty sure that generating enough accounts for your stack o' links would attract attention regardless of your stealth program rating. They might not spot your icon doing it, but the results would be glaringly obvious. The security hacker that notices this sudden influx of users could well be credited with the sense to realise that he was outnumbered and probably outgunned, so he pulls the plug on the system. Pulling the plug is a big deal, and would only be pursued if there was no other option.

Alternatively you leave your stack o' comlinks and agents behind, hack in as an admin anyway, do what you need to do without being noticed, and without the system being shut down.

You could take over the system as described by Tippy, but the physical location of the system is still in the hands of the company, and if it has been compromised as described the smartest thing they could do is shut it down, and fix it while it's offline, and they can deal with the boot sector agent in isolation.

This does impact on productivity and efficiency, but having your network stripped by a plague of agents is not a good outcome.

Wait, are you telling me that the Stealth Program doesn't actually keep people from noticing that you are there?

What the hell man? What the hell?

-Frank

I'm suggesting that the stealth program makes it harder for others to spot your icon, but there's no way it would have an impact on stuff you do.

If you crash some IC (or any programme) while you're running stealth, the IC is still crashed, and anyone paying attention would spot that their IC is no longer running. Or are you suggesting that a crashed programme appears to continue to run when crashed by a 'stealthed' icon?

The bot-net issue is not fixed. Unwired is supposed to work on that.

As for the original question: Why should I forego +2 dice (if I can go VR in the first place)? If combat will hurt, I´ll log off if I´m detected. If I can handle said combat in AR/cold VR, I can change modes and come back. The statistical +1.33 increase to initiative (while in hot mode) makes this strategy even more viable.

But aren't most of those actions fairly obvious to a security hacker or a cleverly-configured IC program? To use the warehouse analogy, a lot of those things are kinda like walking into the building, showing a badge to the guard(s), and then smashing up somebody's office. It's fairly clear that what you're doing is not according to proper procedure.

And spirits save you if they've got some sort of challenge-and-response protocol.

I was under the impression that the Stealth program makes you look innocuous, not invisible. I mean, if you're trying to access a node, and its System software doesn't think you're there, it's not going to send you anything, including what's in the node, etc., so you're basically disconnected. To use a modern example, if you have no ssh session on a box, you're not going to get jack from it, no matter how many commands you try to send it.

I've always thought the Stealth program didn't say "I'm not here," but rather "I'm a data packet, not a persona," or "Oh yeah, I'm totally supposed to be here," or "I am a hedge," or something.