Backstage: Dice

Daniel H
Regular

Nonexistent author of Andrew

Posts: 244

World: IRL

Backstage: Dice May 23, 2015 4:23:51 GMT

Quote

Post by Daniel H on May 23, 2015 4:23:51 GMT

It is possible to cheat at the dice on this board. This can either be done through JavaScript manipulation (undetectable to others) or through dice weighting (only detectable if you try to quote the original post). For example, Mother Starlight’s last message was (in UTC) posted at 2015-05-23 04:08:13. I will now roll a “completely random” date and time.

HtfXNh2m1900-2100w0,2015w11-12w0,5w11-31w0,23w1
0-23w0,4w10-59w0,8w10-59w0,13w1

Looking at my post, you can’t tell anything is off about those dice ranges. If you quote it, you can.

If I had manipulated the JavaScript in my web browser (relatively easy to do in general, but I don’t know how in this case), there would have been no way to tell I cheated.

Should we just assume the characters cannot do either of these things without it being clear to the other characters?

EDIT: If I had been more careful I would not need to be editing now, but I forgot to turn the minutes and seconds into actual dice. It also looks like 4-digit dice have weird formatting.1900-2100w0,2015w1·1-12w0,5w1·1-31w0,23w1·0-23w0,4w1·0-59w0,8w1·0-59w0,13w1

Last Edit: May 23, 2015 4:25:30 GMT by Daniel H

Mother Starlight
Administrator

Posts: 634

World: the Deep Sky
Pronoun: she

Backstage: Dice May 23, 2015 14:49:19 GMT

Quote

Post by Mother Starlight on May 23, 2015 14:49:19 GMT

Oh dear. I could prevent the dice weighting exploit, by disallowing custom rolls and manually entering a list of allowed rolls, but I'd rather just ask people not to do that. Have you tested the JS tampering attack to make sure it actually works?

Daniel H
Regular

Nonexistent author of Andrew

Posts: 244

World: IRL

Backstage: Dice May 23, 2015 17:09:44 GMT

Quote

Post by Daniel H on May 23, 2015 17:09:44 GMT

I have not, but I think I found a way that’s equivalent to JS tampering but easier to implement. This post and the next should contain the same exact roles, but I don’t know what they are ahead of time.

8|uC6Rdd10d999

I don’t think fixing the weighting problem would be worth it. Can you change the template so that the actual roll range is shown? That seems like a good compromise. It has the problem that it will prevent authors from controlling characters’ dice, though. I would prefer the solution of we the authors trust each other and we assume that the characters can’t roll weighted dice unless the game allows.10d999

Daniel H Regular Nonexistent author of Andrew Posts: 244 World: IRL	Backstage: Dice May 23, 2015 17:12:21 GMT via mobile Quote Select Post Deselect Post Link to Post Back to Top Post by Daniel H on May 23, 2015 17:12:21 GMT This post should have the same dice as the previous one. 8\|uC6Rdd10d999 Let’s see if they match. 10d999

Daniel H Regular Nonexistent author of Andrew Posts: 244 World: IRL	Backstage: Dice May 23, 2015 17:14:38 GMT Quote Select Post Deselect Post Link to Post Back to Top Post by Daniel H on May 23, 2015 17:14:38 GMT Fortunately, what I just did does not allow you to easily choose the values of the rolls, but it can be used to re-roll or re-use a roll from another post (including a post which was a PM to yourself).

Mother Starlight Administrator Posts: 634 World: the Deep Sky Pronoun: she	Backstage: Dice May 23, 2015 18:07:46 GMT Quote Select Post Deselect Post Link to Post Back to Top Post by Mother Starlight on May 23, 2015 18:07:46 GMT Sneaky. I'll see what I can do about showing the underlying roll.

Mother Starlight
Administrator

Posts: 634

World: the Deep Sky
Pronoun: she

Backstage: Dice May 23, 2015 18:19:39 GMT

Quote

Post by Mother Starlight on May 23, 2015 18:19:39 GMT

I don't think I can fix that. I looked at the code, and it's full of cryptic variable names.

I could just not show the range at all. That would remove the false sense of security while still allowing the quote-and-peek.

eta: I could also disable rolling in PMs. But I'd kind of rather not.

Last Edit: May 23, 2015 18:21:25 GMT by Mother Starlight

Daniel H Regular Nonexistent author of Andrew Posts: 244 World: IRL	Backstage: Dice May 23, 2015 18:36:17 GMT Quote Select Post Deselect Post Link to Post Back to Top Post by Daniel H on May 23, 2015 18:36:17 GMT I think the way it works now is probably best, partially because it allows authors to control characters’ rolls (for good or bad luck). We can say the characters can’t cheat, and this forum requires assuming good faith from authors anyway.

lurkingkobold
Regular

Posts: 181

Backstage: Dice May 23, 2015 19:11:49 GMT

Quote

Post by lurkingkobold on May 23, 2015 19:11:49 GMT

May 23, 2015 18:36:17 GMT Daniel H said:

I think the way it works now is probably best, partially because it allows authors to control characters’ rolls (for good or bad luck). We can say the characters can’t cheat, and this forum requires assuming good faith from authors anyway.

That's my feeling too, not that I expect to find myself using this feature.

Mother Starlight Administrator Posts: 634 World: the Deep Sky Pronoun: she	Backstage: Dice May 23, 2015 20:36:42 GMT Quote Select Post Deselect Post Link to Post Back to Top Post by Mother Starlight on May 23, 2015 20:36:42 GMT Okay.

Post by Daniel H on May 23, 2015 4:23:51 GMT

Post by Mother Starlight on May 23, 2015 14:49:19 GMT

Post by Daniel H on May 23, 2015 17:09:44 GMT

Post by Daniel H on May 23, 2015 17:12:21 GMT

Post by Daniel H on May 23, 2015 17:14:38 GMT

Post by Mother Starlight on May 23, 2015 18:07:46 GMT

Post by Mother Starlight on May 23, 2015 18:19:39 GMT

Post by Daniel H on May 23, 2015 18:36:17 GMT

Post by lurkingkobold on May 23, 2015 19:11:49 GMT

Post by Mother Starlight on May 23, 2015 20:36:42 GMT

Quick Reply