Return to Unfiction unforum
 a.r.g.b.b 
FAQ FAQ   Search Search 
 
Welcome!
New users, PLEASE read these forum guidelines. New posters, SEARCH before posting and read these rules before posting your killer new campaign. New players may also wish to peruse the ARG Player Tutorial.

All users must abide by the Terms of Service.
Website Restoration Project
This archiving project is a collaboration between Unfiction and Sean Stacey (SpaceBass), Brian Enigma (BrianEnigma), and Laura E. Hall (lehall) with
the Center for Immersive Arts.
Announcements
This is a static snapshot of the
Unfiction forums, as of
July 23, 2017.
This site is intended as an archive to chronicle the history of Alternate Reality Games.
 
The time now is Fri Nov 15, 2024 4:49 pm
All times are UTC - 4 (DST in action)
View posts in this forum since last visit
View unanswered posts in this forum
Calendar
 Forum index » Meta » General META Discussion
Brute force - definition?
Moderators: imbri, ndemeter
View previous topicView next topic
Page 1 of 2 [25 Posts]   Goto page: 1, 2 Next
Author Message
addlepated
Unfictologist


Joined: 17 Aug 2003
Posts: 1885
Location: Austin, Texas

Brute force - definition?

I am a newbie at ARGs. I understand completely the spoken and unspoken rule regarding brute force. It reminds me of when I couldn't solve my Rubik's Cube, so I either peeled the stickers off and stuck them back on, or I tore the thing apart with a screwdriver and reassembled it. Neither method was as satisfactory as solving it myself (and cheating tended to weaken the cube to the point where it would eventually fall apart).

However, where does the line get drawn with regards to ARGaming? The use of scripts that exploit machine/OS vulnerabilities is obviously a no-no, not to mention illegal. Checking out Whois info on game sites and comparing registrants seems to be ok. Sometimes to solve puzzles it's necessary to dig around in different directories; some ISPs specifically mention this behavior (as well as port scanning) as prohibited.

Is this an issue where one has to say "If it feels like cheating, it probably is", or are there any more defined rules of engagement?

PostPosted: Wed Sep 03, 2003 10:59 pm
 View user's profile Visit poster's website AIM Address
 Back to top 
jamesi
Sentient Being


Joined: 25 Sep 2002
Posts: 2195
Location: Canadia

Re: Brute force - definition?

addlepated wrote:
I am a newbie at ARGs. I understand completely the spoken and unspoken rule regarding brute force. It reminds me of when I couldn't solve my Rubik's Cube, so I either peeled the stickers off and stuck them back on, or I tore the thing apart with a screwdriver and reassembled it. Neither method was as satisfactory as solving it myself (and cheating tended to weaken the cube to the point where it would eventually fall apart).


Cone on, it was slightly satisfactory. I mean, you did solve it, just not the way they wanted you too, right? CHEATER!!! Very Happy

Quote:
However, where does the line get drawn with regards to ARGaming? The use of scripts that exploit machine/OS vulnerabilities is obviously a no-no, not to mention illegal. Checking out Whois info on game sites and comparing registrants seems to be ok. Sometimes to solve puzzles it's necessary to dig around in different directories; some ISPs specifically mention this behavior (as well as port scanning) as prohibited.


I've always felt that 'Brute Forcing' is most dangerous when scripts are used. Whether they are designed to exploit a machine/OS or constructed to enter 100 passwords a minute into a form field, they shouldn't be fair game in ARG. While the script may seem harmless at first, it's the bandwidth costs (more often than not, paid for out of PM pockets) that skyrocket as a result of scripts, even small scripts running for short periods of time. Lockjaw experienced one or two of these kinds of brute force attacks during its run, and paid the price. On the same line of thought, I don't consider manual attempts at breaking a login password to be brute forcing, per se. If the attempts are honest, logical attempts, and not pick-a-word-out-of-thin-air guesses, I find these attempts to be acceptable practice. When players are trying to solve puzzles in JMX, I certainly don't mind ten or twenty attempts by the same person if they are attempting through manual input I've been lucky -- no scripted brute force attempts against JMX so far (knock on wood).

Digging around for 'hidden' directories, as well, is acceptable practice in my eyes, as long as, again, it is done manually, and not through a program or script.

WHOIS digging is acceptable, and sometimes, required practice to advance in a game. I still remember seeing the Ghaepetto names in the WHOIS reports for the sites in The Beast, confirming whether a site was in- or out-of-game.

Port scanning sucks. I can't see why port scanning would be benficial in ARG, because you should never have to resort to cracking someone's computer to solve a puzzle/login.

Quote:
"If it feels like cheating, it probably is."


Not necessarily. If it feels like cheating, often times it's actually a feeling of sneakiness (such as finding sites through WHOIS or tripping over a directory by mistake). So, while something might 'feel' wrong, it can actually be just what the Puppetmasters were expecting of you. As confusing as it sounds, I think the 'guidelines' I mentioned earlier could definitely sharpen the edge between ingenuity and brutality.

NOB RUTEF ORCING
_________________
Digital Trail | Twitter | Retired ARGFest-o-Con 2012 Project Manager

PostPosted: Wed Sep 03, 2003 11:17 pm
 View user's profile Visit poster's website
 Back to top 
addlepated
Unfictologist


Joined: 17 Aug 2003
Posts: 1885
Location: Austin, Texas

Re: Brute force - definition?

jamesi wrote:
Cone on, it was slightly satisfactory. I mean, you did solve it, just not the way they wanted you too, right? CHEATER!!! Very Happy


/me hangs head in shame.

Ok, I liked it! I llllllllllllllllllliked it! I did it again and again and again! My parents would pound on the bathroom door and say "What are you doing in there for hours??" Twisted Evil

No wait, that was something else.

PostPosted: Wed Sep 03, 2003 11:45 pm
 View user's profile Visit poster's website AIM Address
 Back to top 
jamesi
Sentient Being


Joined: 25 Sep 2002
Posts: 2195
Location: Canadia

Congrats -- you've left me speechless.
_________________
Digital Trail | Twitter | Retired ARGFest-o-Con 2012 Project Manager

PostPosted: Wed Sep 03, 2003 11:50 pm
 View user's profile Visit poster's website
 Back to top 
Wolf
Decorated


Joined: 26 Sep 2002
Posts: 292

As a former PM, I can say this:

1) The PMs should never ever break the fourth wall and participate in their own game, even as a red herring or shill.
2) Dictionary scripts/hacks are a huge no-no. If they wanted you to hack them you'd know it by what they tell you.
3) Brute forcing sucks and costs bandwidth and cash. If you try it, be prepared to make a large cash donation to the folks running the game.
4) We can see you. You have an IP. We know what it is.
5) Whois info is almost never relevant. Get over it and leave it alone.

PostPosted: Thu Sep 04, 2003 10:09 am
 View user's profile
 Back to top 
vpisteve
Asshatministrator


Joined: 30 Sep 2002
Posts: 2441
Location: 1987

Whois info used to be relevant as a possible clue or piece of a puzzle, until the legal requirement came out that all info in whois registration must be accurate, not fictitious.

PostPosted: Thu Sep 04, 2003 10:13 am
 View user's profile Visit poster's website Yahoo Messenger
 Back to top 
Wolf
Decorated


Joined: 26 Sep 2002
Posts: 292

Oh, it's still relevant as a possible clue, but it's not a clue. And just because the law requires it doesn't mean we won't still lie.

And Dan and Anson aren't related, either.

Shocked

PostPosted: Thu Sep 04, 2003 10:18 am
 View user's profile
 Back to top 
vpisteve
Asshatministrator


Joined: 30 Sep 2002
Posts: 2441
Location: 1987

/me sobs uncontrollably.

PostPosted: Thu Sep 04, 2003 11:47 am
 View user's profile Visit poster's website Yahoo Messenger
 Back to top 
krystyn
I Never Tire of My Own Voice


Joined: 26 Sep 2002
Posts: 3651
Location: Is not Chicago

Not to mention that sometimes the bots missed stuff, or players would miss what the changes meant!

We sometimes did false updates to pages in Lockjaw, because it was so irritating to watch people sit back and wait for the bot to tell them when to play. Players stopped thinking about the game as much, and became very passive in respect to where the game was going.

I can say with confidence that there were several nuances and small puzzle elements completely missed by players, because they taught themselves to equate updates with plot advancement.

Sure, you're sitting in front of the New Boob Tube (your computer monitor), but you're short-changing yourself as a player if you let your brain turn to mush as quickly as your butt. Twisted Evil

PostPosted: Fri Sep 05, 2003 10:32 am
 View user's profile Visit poster's website
 Back to top 
sauceykat
Decorated


Joined: 10 Jul 2003
Posts: 251
Location: BC>Canada

I see all of your points re: port scanning, scripts, etc. but what about the case in Acheron where the PM supposedly gave people the tools to scan ports, hack, etc.?

Just curious what the rules would be in that situation...

PostPosted: Fri Sep 05, 2003 2:19 pm
 View user's profile Visit poster's website Yahoo Messenger MSN Messenger
 Back to top 
Wolf
Decorated


Joined: 26 Sep 2002
Posts: 292

Quote:
the PM supposedly gave people the tools to scan ports, hack, etc.?


Interesting point, and a very dumb move if they don't want folks to try bruting sites. I took the message linked below to be an in-game PM warning to not do it, but I could be wrong.

http://forums.unfiction.com/forums/viewtopic.php?t=2277

PostPosted: Fri Sep 05, 2003 2:31 pm
 View user's profile
 Back to top 
sauceykat
Decorated


Joined: 10 Jul 2003
Posts: 251
Location: BC>Canada

imbri wrote:
sauceykat wrote:
I see all of your points re: port scanning, scripts, etc. but what about the case in Acheron where the PM supposedly gave people the tools to scan ports, hack, etc.?

Just curious what the rules would be in that situation...


Well, if they are providing the tools, then I'd say they expect & want it to happen. Unless they mention otherwise in their TOU/TOS. That's one reason why I tried to distinguish between games that have an exposed curtain (such as Acheron and CTW) and games that don't (such as LockJaw). With the "meta site" they can provide a TOU/TOS that players agree to.

So, if they provide the tools to perpetrate such things and it's not specifically mentioned as being a no-no somewhere on their Meta page, I'd say they want you to use the tools they gave. PMs don't give players such things without a reason.

Brooke


Thanks Brooke for your input! And Wolf too!

PostPosted: Fri Sep 05, 2003 2:42 pm
 View user's profile Visit poster's website Yahoo Messenger MSN Messenger
 Back to top 
Digital Avatar
Greenhorn

Joined: 01 Oct 2003
Posts: 5
Location: Earth

The basic tenets of "netiquette" as defined by the collective Terms of Service and Acceptable Use Policies of various ISPs, as well as local, state and federal laws, should set the boundaries for ARGs.

In other words, to expand on what someone mentioned above... whois, dig, traceroute or other commonly accepted practices should be fair game... However, violating the terms of service or acceptable use policy of your intenet service provider is clearly unacceptable. This may include, but not be llimited to, hacking, scanning, joe-jobbing, spamming, DoS attacks, brute force scripts, etc.

The funny thing is... Some people seem to think this sort of activity elevates their status in the internet community. The truth is, those of us in the internet security community look at "script kiddies" as a most amateurish nuisance.

i.e. brute forcing, packet flooding, etc. doesn't impress anyone with real skills. ("5|<1LLz" for those of you who think "Swordfish" and "Hackers" contain realistic portrayals of hacking and IPv4 topology.)

PostPosted: Wed Oct 01, 2003 6:40 pm
 View user's profile Visit poster's website AIM Address
 Back to top 
Abraxas
Unfettered

Joined: 27 Aug 2005
Posts: 736
Location: Cologne, Germany

The person who created the guide on Cloudmakers is against whois digging. I wondered if UF is generally inviting one to use whois information or not. From this little bit I read it seems to be ok. And in the short time I have been here it was sometimes necessary to use it for confirmation whether or not a site is in-game or not.

But there's the catch: I think originally you were never meant to know what is inside the game and what is outside of it. Because TINAG was the whole experience. Did things change and with it the use of whois or is it still the same? Should PMs just protect their information better and is it their fault if vital information is found that way?

PostPosted: Sat Dec 10, 2005 3:47 pm
 View user's profile
 ICQ Number 
 Back to top 
jamesi
Sentient Being


Joined: 25 Sep 2002
Posts: 2195
Location: Canadia

Personally, I've always found whois information to be 'fair game' as far as shared knowledge is concerned -- strictly in the Out-Of-Game realm, of course.
_________________
Digital Trail | Twitter | Retired ARGFest-o-Con 2012 Project Manager

PostPosted: Sat Dec 10, 2005 4:05 pm
 View user's profile Visit poster's website
 Back to top 
Display posts from previous:   Sort by:   
Page 1 of 2 [25 Posts]   Goto page: 1, 2 Next
View previous topicView next topic
 Forum index » Meta » General META Discussion
Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
You cannot post calendar events in this forum



Powered by phpBB © 2001, 2005 phpBB Group