Are attributes always added to every roll? How do I tell when I do and when I don't and where is this spelled out in the book?

Hacking is hacking + exploit. Does exploit, the complex form/program (technomancer/hacker) replace the attribute in the normal attribute + skill roll that the dice pool section talks about, or is it an additional bonus to the roll? Are actual attributes mentioned anywhere in the Matrix sections?

The Matrix rules are an exception to the rule of Skill + Attribute. A lot of people (myself included) hate that fact and create house rules for the Matrix where it's Skill + Attribute with the hits limited by the program's rating.

You'll rarely find such examples outside of the Matrix, however, so there's really not much to tell you in that regard. When it happens, the rules are pretty clear about it, so it's safe to assume that it only happens when the rules expressely tell you they do.

For your convenience, that house rule is actually an optional rule in the book for you (Unwired, p39, 'Using Attributes').

I've consdiered both alternate versions, and I'm frankly still split on which way I like best. Both ways essentially treat hacking actions a lot like spellcasting, with maximum Hits being capped by either stat or program.

The version that's most directly analagous to spellcasting is [Stat+Skill] cap [Prog Rtg], the same way that spellcasting is [Magic+Spellcasting] cap [Spell Force]. This version could be described as "you're only as good as your tools".

The other version is to turn it around: [Stat+Prog Rtg] cap [Skill], described as "it's the (wo)man that's important, not the gear".

Which one you personally like better will depend on your world view, and if you simply perfer mechanical consistency within the system. Frankly, the reason I'm split is because I know people who, if given a command line, can do amazing things. At the same time, I am really big on internal consistency. Either option tends to cut down on "script kiddies" to some extent in that you have to be being "smart" is important to being "good".

The other thing I brought up forever ago was the possibility of using INTuition in this model for fast action (read: cybercombat) because, if the fluff is to be believed, it's the ability to rapidly adapt and select the right program actions as opportunities arise that is critical. On the other hand, probing the target would be based on logic, under the heading of "if you can take the time to think about it". Being able to process a lot of information in a structured manner (LOGic) is more important in a methodical and deliberate attack, but being able to slip between the lines of code for a hack on-the-fly takes a great deal of INTuition to recognize the weakness and exploit it before it closes/moves.

Also, if you're using the optional dice-caps for skill checks, it would be the LOWER cap on the Hits kept. m So if your skill was a 2, but your program was a 5, you'd be capped at 4 Hits. Again, skill being more important than gear.

I guess, if push came to shove, since I always use (and encourage all my GMs to use) BOTH dice caps, the first option is my preference, because the cap rules cover SKILL being important, while the optional rule covers being smart and/or adaptable. Using the idea of alternate LOG/INT for the checks, a high-LOG character will be a superb methodical Decker (I will NOT use the term "hacker" *grin* I'm just too old-school for that. I think the old term "Decker" helped flavor Shadowrun from the early days, and "legacy" terms pervade modern computer culture, so I see no reason it couldn't linger past the demise of the cyberdeck.), while the high-INT character will be better in smash-and-grab hacks and cybercombat.

Anyhow, that's my two centinuyen. Your actual mileage (kilometerage sounds silly, and I did mention the popularity of "legacy" terms in culture, right?) may vary.

[Edit: Technomancers would probably substitude RESonance for "Stat" in the above examples, since they seem to use it for everything else...]