if you were hacking a node on the fly and rolling really badly could you abandon the hack attempt to avoid notice then try again?

like for instance: i have 10 dice for hacking + exploit with a 5 stealth going up against a node with system 5, firewall 5 and analyze 5. if i start the hack and on the first roll get only one success, then another one on the second roll, i know that on the 3rd roll i may succeed but odds are the node will catch me and trigger an alarm. could i just abandon that hack and start over?

it sounds like taking advantage of the system but i didn't see anything prohibiting it.

Normally, you would not know exactly what the rating of the node is. (Under some circumstances, if you have been able to analyze it, and done well, the GM may have given you some of that information.)

It does seem that you can stop the attempt. After all, it is an extended test. However, you can not immediately start again without penalty.

Yours,
Joel

i understand you wouldnt know. basically what i mean is can you just take advantage of the odds.

like if i have 10 dice and i roll 0 or 1 success on the first roll then i know the odds are against me because i statistically gotten 3-4. so i abandon that hack and start over the next turn repeating the process until i pull out 4-5+ successes on the first roll of the hack. then i would continue the hack.

so you could just just keep starting the hack over every round until you started the hack with a good starting roll?

When you try to start over, there is a penalty. (I can't give you a page reference, but there is a listed penalty for repeated attempts at a task.) So yes, you can start over. But it gets harder. If you had a really good chance to start with, but rolled really badly, then what you suggest might make sense. Generally, it won't work out to your benefit.

Yours,
Joel

Well, regardless of the penalty, as GM I would also demand a spoof of your access id, so the node can't connect the two attemps.

What I can find per rules:

SR4A Page 65



That handles the penalty for restart.

SR4A Page 235



Hack on the fly is an extended test



This section tells you that they are doing an extended test based on your action not the test itself....so restarting without changing who you are (ei. Spoofing a new ID or changing to another commlink to switch.) should not erase the defending system successes. Think of it as a reflex action to a near by icon that starts to touch the node in its special place...if you don't mess with it...it ignores you.

I think if it said "Each time you make a roll for the Hack on the fly test", then starting over will restart the node, too.

my 2cp

my question about the penalty would be: does abandoning an extended test count as failing?

as for the rolling again being a continuation of the first test i disagree, if i do anything else then i am no longer trying to hack that node and it is no longer trying to find me and would have no reason know the second attempt was from me, i mean the whole point is that it didnt detect your attempt. even if it did, how long should it hold on to the logs from the previous attempt? if i come back tomorrow do the successes stand?

SR4A page 65

Under Trying Again



Also I would consider abandoning an attempt as failing...since you did not complete the task and quit. Should be a penalty for trying to avoid the Al-mighty dice god.



Another way to look at it is that you can pause between hack on the fly rolls and do other actions and the node gets to save its rolls for you so it not resetting. Its tracking the attempt by your persona which is obscured by your stealth program. Your persona is attached to an Access ID. To fundamentally change who you are you need to spoof the Access ID again. Your not changing how much it defeated your stealth for that persona with that Access ID. If it didn't "remember", why would you ever need to Probe a target just keep reattempting hack on the fly till you get an way above average roll to start your hack.

As to how long it holds...I would guess till the GM thinks the log would be flushed...would vary depending on security rating.

thats cool. the trying again rule was what i was looking for most. i am glad that is not as easy as it looked.

As for the extended test, yes. The extended test's success is measured by it's completion. Not completing it is failing. You try the same test again on the same thing again and you're subject to the -2 penalty. I'd say if you tried the next day no, as the rule is intended for successive actions. How long you'd have to wait is a GM call.


To the detection:
Just because YOU abandon trying to hack the node doesn't mean IT abandons trying to detect you. It knows your there the moment you start hacking, it only detects you as unauthorized when it passes it's analyze + firewall (stealth) extended test. Till then it considers you a user trying to log in, but it's keeping a record of suspicious activity.

Here's an example:
Your at a convenience store with the intent to rob it. You're non-violent so you want to just nab the register drawer next time it's open, so you start to hang around and make your way to the counter. The clerk starts to get suspicious of you since it doesn't look like you're shopping and you're taking a long time. So you leave, cause you're no fool and know you've blown your chance. But then you come back an hour later wearing the same clothing and try again, only moving faster to the register. You think he won't be just as suspicious of you since you were gone for an hour? A day wearing the same clothes?

Now, change the clothes and put on a baseball cap (spoofing a new access-ID) and he doesn't recognize you and therefore doesn't associate the suspicion with you anymore. You're free to start fresh.

Anyhow, it may EVENTUALLY clear the log, but that would be set by it's security procedures and thats up to the GM. Could be a day, could be a year. Heck, doesn't HAVE to clear the log EVER given the crazy amount of storage space in that day and age, and why not keep a record of suspicious activity?

If I were a security spider I would automatically back up the log to several locations every hour and routinely check the active log to see if any were removed for it as well. Any suspicious activity that mysteriously disappeared in the ACTIVE log compared to the back ups means someone was trying to cover their footsteps, or if someone deleted the log entirely to hide actions just taken I still have my archive of banned users, exploit holes used, etc instead of losing all that valuable info.

You've obviously never worked a till.

I had a woman come back one day--don't recall why anymore--and I didn't recognize her. She'd been through my line not two hours prior and had had some issue.

Only when she informed me of why she was back did I recall the incident (but still didn't recognize her).

Yeah, but I'm guessing you didn't have a personal interest in it. If say, he's the store owner not just the clerk and it's his money in the drawer and he thought someone was trying to take it? For you, her problem was likely only your problem so long as she was standing in front of you. A dedicated firewall will ALWAYS take a personal interest. n_n

Anyhow, it's just an example. Feel free to come up with a better one if you think the specifics don't match up right. n_n

dang double post

I'd say any node worth hacking would likely keep those logs for a long time. Best just Spoof between attempts and stop the argument before it starts, I say.