[Xenon]

The text in 5e says I become aware of a sleaze attempt if it fails, but only an attack attempt if it succeeds (which seems backwards to me).

Compare a stealthy matrix action with a stealthy physical action:

If someone successfully palm an item from your pocket then you will not notice it. If someone fail to palm an item from your pocket then you will not only notice it, you will automatically spot whoever is the guilty one (even if the thief was trying to hide in the shadows - doesn't matter).

If someone successfully snoop your communication then you will not notice it. If someone fail to snoop your communication then you will not only notice it, you will automatically spot whoever is the guilty one (even if the snooper was trying to hide - doesn't matter).


Compare an offensive matrix action with a offensive physical action:

If someone successfully shoot you then you will automatically be aware that you were attacked and if the attacker is not trying to hide then you will also automatically spot him (to spot an attacker that is trying to hide require an opposed perception test). If someone fail to hit you then you will not even be aware that you were attacked in the first place... OK, maybe not best of examples but you get the idea :-)

If someone successfully land a data spike then you will be automatically aware that you were attacked and if the attacker is not trying to hide then you will automatically spot it (to spot an attacker that is trying to hide require an opposed matrix perception test). If someone fail to land a data spike then you will not even be aware that you were attacked in the first place.



Note that the above relates to SR5. In this edition it depend on the action you are taking if the sleaze action will be noticed or not. Probe, for example, will not be noticed on a failed attempt (unless perhaps the hacker glitch) while Backdoor Entry will always not only be detected on a failed attempt, the backdoor will also be deleted and hacker need to start over with a new Probe attempt.

And also that in this edition it seem as if individual devices does not run silent. Either the entire network they are hiding behind is running silent or it isn't. If the network is running silent then it seem as if you take an opposed matrix perception test to spot it. Once you spot the network it seem as if you no longer have to also spot individual devices that belong to the network....

Same as in this edition it seem as if you don't need access on individual devices. Either you have access on the entire network they are hiding behind or you don't have access. Once you have access on the network you no longer have to also gain access to individual devices that belong to then network...

I would "see" the attacking persona appear next to the icon and try to Brute Force it.  I can now target that attacker without needing to roll to "find" them. If they were Running Silent before the BF action pretty much spoils that effect?  Or are they still not visible in AR unless I use MP to find them normally?

Not sure about the "next to the icon" part since distance in the matrix is a bit funky, but yes, if you are obviously attacked by a PAN then you can attack back. Unless perhaps if the PAN is currently running silent, in which case you first need to take an opposed matrix perception test to spot the PAN.

Once I know I was hacked, to locate the attacker, do I ever use the Trace Icon action or just Matrix Perception to find the offender? 

If your target is trying to hide then you resolve it with an opposed matrix perception test, otherwise you don't.

If you also wish to know the physical location you first need to gain admin access and then take an Electronics test to get the real life location....

because they are running silent...

No, not because the network the hacker belong to is running silent....

Reason target don't notice is because the Probe action explicitly state that: Probing a device does not raise an alarm automatically. Even if your attempt initially fails, it will not trigger an alarm unless major mistakes are made.

Target will also not notice a successful Backdoor Entry attempt.

However(!) on a failed Backdoor Entry attempt the hacker will be detected. But this have also nothing to do with running silent or not. Reason why target notice is because the Backdoor Entry action explicitly state that: If this test fails, the backdoor you have made was detected and removed, and you cannot attempt Backdoor Entry again with the same host until a new backdoor is made through the Probe Action.

This also brings up that Full Matrix Defense as published is confusing as well.

You spend a major action on full matrix defense. If you are attacked before it is your turn to act again then you add firewall to your defense. Repeat until you need to use your actions on your turn on something other than full matrix defense. Not really more complicated than that.

Data Spike is not tagged as an Attack-linked action in the text.  Is that on purpose, or an errata item? 

This was addressed in the Aug hot-fix errata.

[skalchemist]

If someone successfully palm an item from your pocket then you will not notice it. If someone fail to palm an item from your pocket then you will not only notice it, you will automatically spot whoever is the guilty one (even if the thief was trying to hide in the shadows - doesn't matter).

I think your post is useful, don't get me wrong, but this seems like only one possible fictional outcome of failure in this case.  For example, maybe failure means you had to abort before reaching into the target's pocket?

I raise this simply to say I think viewing all of this as a binary is maybe the wrong way to look at it.  Maybe better to consider as a spectrum.  For example, maybe a stealthy action in the Matrix DOES leave traces that can be seen sometimes.  Maybe a data spike fails so badly it might as well have targeted a different system and therefore is unnoticed. 

I say this because I think this is a place where glitches and critical glitches can be worked out, and beyond that where the GM can get creative with the consequence of failure. 

But I admit I haven't processed the matrix section of the rules in any detail, so maybe it really is presented as a true dichotomy.

[Typhus]

   Compare a stealthy matrix action with a stealthy physical action:

Very helpful analogy.

If someone successfully shoot you then you will automatically be aware that you were attacked and if the attacker is not trying to hide then you will also automatically spot him (to spot an attacker that is trying to hide require an opposed perception test). If someone fail to hit you then you will not even be aware that you were attacked in the first place... OK, maybe not best of examples but you get the idea :-)

See that's the baffling part to me, I feel like I surely would notice.  Pew goes the bullet past my head, thunk goes the knife into the wall near me.  Would my Firewall not also say "hey buddy, I just stopped an attack"?  Today, I believe most malicious stuff gets logged.  Seems like your system should have that basic ability.  shrug

If someone successfully land a data spike then you will be automatically aware that you were attacked and if the attacker is not trying to hide then you will automatically spot it (to spot an attacker that is trying to hide require an opposed matrix perception test). If someone fail to land a data spike then you will not even be aware that you were attacked in the first place.

Seems like the corps are overlooking some old school functionality there.  The best logical I can conjure is that systems get swiped at so often, the corps don't care to follow up on failed attempts.  Script kiddies and bots might be the bulk of such efforts, so they just ignore it?  Seems like a decker would not want to do that though.

Note that the above relates to SR5. In this edition it depend on the action you are taking if the sleaze action will be noticed or not. Probe, for example, will not be noticed on a failed attempt (unless perhaps the hacker glitch) while Backdoor Entry will always not only be detected on a failed attempt, the backdoor will also be deleted and hacker need to start over with a new Probe attempt.

And that makes sense enough, for sure.

And also that in this edition

Yep, all that I gleaned.  Nicer way to go, really.

Not sure about the "next to the icon" part since distance in the matrix is a bit funky, but yes, if you are obviously attacked by a PAN then you can attack back. Unless perhaps if the PAN is currently running silent, in which case you first need to take an opposed matrix perception test to spot the PAN.

I'm thinking of it as a GM here.  If the hacker is on overwatch, what do they "see" in VR when they would detect a hack?  Would it reasonably look like an icon materializing out of nowhere?  If so, that icon needs a position relative to the target icon.  So, I assume "next to me from my perspective" would be the relative position, since they are attempting to interact with the network I am defending.  If they are not detectable to me at first, and use some sort of attack action, I see the attack animation, but not their icon.  When I roll well enough spot them, the icon sort of shimmers into visibility in VR or something I suppose (?).

If your target is trying to hide then you resolve it with an opposed matrix perception test, otherwise you don't. If you also wish to know the physical location you first need to gain admin access and then take an Electronics test to get the real life location....

That is what I was gathering.  Makes sense enough.

Reason target don't notice is because the Probe action explicitly state that: Probing a device does not raise an alarm automatically. Even if your attempt initially fails, it will not trigger an alarm unless major mistakes are made.

Target will also not notice a successful Backdoor Entry attempt.

"raise an alarm" brings up another point.  That's not a ideal choice of wording to describe it, since "alarms" are not a thing by the rules as such.  This line introduces a new term that doesn't connect to anything specific in the rest of the text. It should probably simply read "does not alert the target to the attempt".

However(!) on a failed Backdoor Entry attempt the hacker will be detected. But this have also nothing to do with running silent or not. Reason why target notice is because the Backdoor Entry action explicitly state that: If this test fails, the backdoor you have made was detected and removed, and you cannot attempt Backdoor Entry again with the same host until a new backdoor is made through the Probe Action.

I'm talking about becoming aware of the hacker's icon due to the hack attempt itself, vs becoming aware of just the hack action. 

You spend a major action on full matrix defense. If you are attacked before it is your turn to act again then you add firewall to your defense. Repeat until you need to use your actions on your turn on something other than full matrix defense. Not really more complicated than that.

Seems like it is more complicated though.  So each round you are using a Major action, fine.  Not clearly written, but there's no other precedent in the book that suggests actions carry over longer than one turn unless they are Extended tests.  That's fine. 

However, it also says you are prevented from attacking.  I feel like most games have any sort of Full Defense preclude making attacks, so it would make sense.  However, Full Defense has no such limitation.  Is that an oversight or intentionally different? 

Also, it seems like it should be an Anytime action, like FD is.  I don't see any other Matrix actions that seem like candidates for that, so I think that would be the only one.  The rest would be Initiative actions, I assume.  If there's supposed to be parity, there isn't currently, and Matrix actions aren't tagged either way. 

I hope at the least this helps for further FAQ or errata.  Looks like I have a choice to make as the GM to either treat FD and MFD differently (closer to RAW) or go more traditional and treat them equally (picking one or the other to use for the baseline - Initiative Action with no attack or Anytime Action and allow attacks).  At least until some errata is ever dropped. 

Would one "break the game" more than another to choose?  Seems like allowing the parity with FD is the more favorable option, but I can't conjure any downstream effects that would be an issue.

[Xenon]

I think your post is useful, don't get me wrong, but this seems like only one possible fictional outcome of failure in this case.  For example, maybe failure means you had to abort before reaching into the target's pocket?

Just to clarify (if it wasn't clear enough from the post I made). Here he was asking about how it worked in SR5. Rules changed in SR6. The example you just quoted were to illustrate how it worked in SR5, not SR6.



For SR6::

When it comes to Probe (which is linked to sleaze) you will not alert the target on a success and you will not alert the target on a fail, either (except maybe on a glitch).

When it comes to Backdoor Entry (which is also linked to sleaze) you will not alert the target on a success but you will alert the target on a fail.

When it comes to both Brute Froce and Data Spike (which are both linked to attack) you will [at the very least] alert the target on success.


In SR6 you need to take an opposed matrix perception test to find something that is hiding. You don't need to take a matrix perception test to find something that is not hiding (or if you are already inside the network when your target tries to hide).

[Xenon]

See that's the baffling part to me, I feel like I surely would notice.  Pew goes the bullet past my head

As I said, the analogy was not really that good :-)

(but also it is much harder to notice a bullet going pass you than you might think - unless you apply Hollywood-realism).

Would my Firewall not also say "hey buddy, I just stopped an attack"?

In SR5 your firewall would cause matrix damage to the offender, but the owner would not be alerted (your firewall are probably fending off a lot of attacks on a daily basis without you knowing.

Don't think too much of the examples I gave in the start of the post, they were to justify how it worked in SR5. Rules might have changed in SR6.

Seems like the corps are overlooking some old school functionality there.  The best logical I can conjure is that systems get swiped at so often, the corps don't care to follow up on failed attempts.  Script kiddies and bots might be the bulk of such efforts, so they just ignore it? 

Something like that, yes. Also remember that in SR5 the firewall would cause matrix damage to offenders - by themselves. But this is, again, how it worked back in SR5. We should probably not analyze that too deeply.

Also, it seems like it should be an Anytime action

I think the intent here is that if you for example are a rigger, then you would "by default" always use full matrix defense in your turn (no matter if you expect to get attacked or not), except in turns where you actively wish to spend spend your major action on something else.

Unlike a street samurai. He would probably not bob and weave all over the sidewalk while just walking down the street to make himself harder to get shot at. Unless perhaps he seriously suspect that he is currently being a target.

[Typhus]

I guess for noticing hacking I was intending to divine how it was intended for SR6, not 5. It makes some sense to think of it like the constant barrage of attempts being ignored, I suppose.

I think the intent here is that if you for example are a rigger, then you would "by default" always use full matrix defense in your turn (no matter if you expect to get attacked or not), except in turns where you actively wish to spend spend your major action on something else.

Like an attack type action, in theory? 

Is that your assumption of the intent, or based on something more concrete?  I'm also not sure if you mean that it should not be an anytime action by design. 

[Xenon]

It is not marked as either Initiative or Anytime, but the wording of the action itself seem to imply that you take it on your turn and that it take effect "The next time you are attacked..."

Compare the wording of anytime actions, such as Avoid Incoming (A): "character can use this action when it is not their player turn to get away from an incoming Blast or Gas attack, Block (A): "The roll must happen in the same player turn in which the action is used" or Dodge (A): "The roll must happen in the same player turn in which the action is used"

You spend a major action on your turn to take the Full Matrix Defense action and if you were attacked before your next turn then you get to add firewall a second time to the defense roll.

But if it is to be treated as an Anytime action you would save a major action and then take the action out of turn if you are attacked instead.

Doesn't really matter how you resolve it since the end result is basically the same in both cases.



Also this:

SR6 p. 197 Resist Hacking
Riggers spend a significant amount of time and effort protecting their gear, and that includes liberal use of the Full Matrix Defense action (p. 182).

[Michael Chandra]

I really dislike Matrix Full Defense because it's a Major for a one-time advantage, versus normal Full Defense being against-all. But you tend to face less opposition in the Matrix, I guess?

[Xenon]

and it also does not work against all matrix related aggression, only against "an action is taken that will directly cause you damage.

It seems clear that this action does not help against for example Backdoor Entry, Control Device, Crack File, Crash Program, Disarm Data Bomb, Edit File, Jump Into Rigged Device, Matrix Perception,  Probe, Reboot Device, Snoop, Spoof Command...

Depending on your reading it also does not work against Brute Force attempts. But also Acid, Binder, Crash, Jammer, Marker, Patrol, Scramble, Tar Baby, Track. And Diffusion, Editor, Pulse Storm, Puppeteer, Resonanace Veil and Static Bomb.

The only actions that it is clear that it work against are the following: Data Spike and Tar Pit. And it probably also works against Black IC, Blaster, Killer and Sparky. And unless complex forms are treated differently it is also clear that it work when defending against Resonance Spike.

[Stainless Steel Devil Rat]

You don't want to face Full Defense on top of everything else when your PC is hacking NPCs/Hosts, do you?  Makes sense to me that Full Defense has a narrow range of utility.