On sockproofing

zed · 2016-10-05 13:18:34

3 years later, and this game and its problems still occupy a portion of my
brain. As an attempt at exorcism, I thought I would try to formulate how I
would redesign it to be cheat-immune. I expected that this would require a
radical overhaul of the mechanics in a way which would turn it into an
entirely different game (basically I expected it to have to end up being
Intricacy). But in fact, repeatedly picking at my incomplete "proofs" that no
better solutions could exist, and making liberal use of miscellaneous
suggestions made by various people in the heyday of these forums, I was
surprised to eventually find a solution which, while still involving radical
changes to the game, I believe preserves its core.

For me, and I think for Jason, the core of the game lies in the nerve-wracking
exploration of a player-designed house, knowing that one false move could lead
to failure with painful permanent consequences - while also knowing that the
risk could be reduced if only you had more money, and that the only reason
you're taking the risk is to get the money you need to reduce risks to
yourself and your family, and while also being aware of the irony that success
would mean imposing on another precisely the likely-fatal destitution you hope
it would help avoid for yourself.

I'll briefly recall the problems with cheating in the current design. Firstly,
the default client restricts the player in ways which aren't forced by the
network protocol - by disallowing undo, and by only showing parts of the map
which have been revealed. So one can easily cheat by using a client without
these restrictions. Secondly, and much harder to deal with, a player with
multiple accounts can use their "sock puppet" secondary accounts to boost
their primary account, in a variety of gamebreaking ways. Probably worst is
that they can use their secondary accounts to do all their robbery, so not
risking their primary account at all. More prosaically, since new spawns start
with cash which can easily be transferred to another player, they can use
their sock puppets to directly enrich their primary account.

Before I get to my proposed solutions, let me explain that as a general
principle, I believe that the correct way to handle cheating is not to fight
it head on, but to roll with it: if some behaviour is considered cheating,
and there's no simple sure way to render it impossible, one should rather
redesign the system to render the behaviour unobjectionable. So I will reject
out of hand any solutions involving obfuscated protocols or attempts to police
the playerbase to root out sockpuppetry. I wish cullman luck if ey still
intends to attempt such solutions, but here I'm considering keeping the game
as free software with variant clients to be encouraged, and dealing with
sock-puppetry by allowing players to have arbitrarily many accounts, but
aiming to ensure they can't be used to give any one of the accounts an
advantage over those using only one account.

-----

With all that in mind, here's what I suggest.

For the problem of the protocol not enforcing fair play, I think it's clear
and well-understood that the only real solution is to change the protocol. So:

(i) Safe Self-Test: No permadeath during self-tests.

(ii) Server-Side Processing: All game logic processing during robberies happens on
the server, with the client sending moves and getting back the new visible map
state.

For the problem of sock puppets, I propose the following:

(iii) Conservation of Value: A steady-state economy - no money is created or
destroyed, only moved around and converted between different forms.

(iv) No Permadeath: "dying" during a robbery doesn't mean losing everything.

(v) Robbery Ante: Attempting a robbery requires wagering some money, lost on
"death".

In game terms, this can mean that in order to attempt a robbery you must
take a special tool which isn't used up, say a backpack; this has a
value and is left behind to be sold (at no discount) if you "die" in the
robbery, though you yourself actually escape.

(vi) Reserves: You must keep a certain "reserve" of cash, say a proportion of
your house value, and may not buy tools or build if doing so would eat into
the reserve. If your cash levels are below the reserve level, you must sell
tools and house tiles to get up to it if you can.

(vii) Hidden Values: The current cash of a player isn't shown to potential
robbers.

Now let me try to show that these are basically inevitable.

(i) and (ii) I think are obviously necessary.

For handling sock-puppets, first let me define a "sock-puppet subgame" to be
what happens when you and your sock-puppets all pretend to be playing the game
properly, but interact only with each other. We must ensure that what an
account does within such a subgame can't advantage it against players outside
it.

(iii) then almost follows immediately: if money is created in the course of
the game, by any mechanism, then it will also be created in a sock-puppet
subgame. So there can't be any sources of money. Technically this doesn't rule
out there being sinks - we could have a purely deflationary economy, with
money continuously disappearing and the value of the remaining money
accordingly increasing... but steady-state seems neater.

For (iv), the problem with permadeath is that it penalises those who don't use
sock puppets, who risk a valuable life rather than that of a disposable sock
puppet.

Without (v), a sock puppeteer could scout houses without risking anything,
which runs counter to the core of the game.

(vi) and (vii), or something much like them, are required to handle an obvious
problem arising from (iii) and (v): if players don't get money when they
spawn, and if they have to get money before they can attempt a robbery, where
are they to get their money from? It has to be from other players attempting
to rob their house. But why would anyone try to rob a starter house, if new
spawns have no money? It must be because starter houses often *do* have money,
and because those with money can't be differentiated from those without.
Without enforcing a reserve, we can expect optimal play, at least at first, to
involve immediately spending any money you get, or indeed transferring it to
another account with better protection. With a reserve, even low value houses
will typically be worth robbing.

(vi) also solves another problem, which is how a player can lose if there's no
permadeath. When you're robbed, you have to rip down much of your house to
refill the reserve; if you keep getting robbed, you'll eventually end up with
no money, and probably no family, which we can call having lost.

-----

This scheme doesn't actually wholly satisfy the criteria I outlined (although
I think it's about the closest possible), because it can still make sense to
run multiple houses, pooling any surplus generated from them. However, in
order to generate any surplus, you'll be having to properly play the game with
each house - using the same house design for each is no good, because others
will quickly recognise this and not take risks in its multiple incarnations,
while robbing all of them as soon as they can rob one. So would-be sock
puppeteers will be contributing to the experience of others by providing
interesting houses. This does have the unfortunate corollary that optimal play
will involve devoting your every waking hour to working on one house design or
another... but then that's probably true with only one house, and it isn't
clear that it would actually make sense to divide your attention between
multiple houses.

-----

Some further suggestions on the details of having a "steady-state economy":
New spawns start with no disposable money, but can design a house with a
certain maximum value.

Tools and building components can be sold for as much as they cost (but
you can never sell below the starting house value).

If you use a tool, its value can't be destroyed; instead, it goes to the
owner of the house if your robbery is unsuccessful, or back to the robber
if successful.

When map tiles are destroyed/killed during a successful robbery, their
cost goes back to the house owner (claiming on building insurance, let's
say). But note that this will typically go to filling up the reserve
rather than straight to rebuilding, so this isn't the same as not having
permanent damage.

One remaining problem: if you can sell tiles from your house at full value,
this lets you freely remodel your house whenever you want, meaning we lose
the richness of houses grown organically as more money becomes available.
Although I wouldn't consider this a core necessary part of the game, it
would certainly be nicer to keep it. Part of a solution could be to say
you can *only* sell tiles after a robbery, while at other times replacing
tiles keeps the value of the old tile available for selling later without
actually having it sold immediately. This isn't a complete solution,
because sock puppets could be used to harmlessly trigger such a sell-off.
This could be dealt with by having a successful robbery impose an extra
permanent penalty on the victim, beyond the theft. Perhaps simplest: the
price you pay for house tiles permanently increases each time you're
robbed (representing increased insurance premiums, perhaps).

About the neighbourhood list:
In place of showing the cash held by a house, the list could show the
value of the house itself, i.e. the sum cost of its tiles. If the reserve
is set as a proportion of this, as seems reasonable, this would still be a
pretty good guide to what's worth robbing.

Houses which have been robbed should be removed from the list until the
owner checks them back in. If they leave it too long, this should be done
automatically (repossessing arbitrary chunks of house until it makes up
the shortfall), to stop money falling out of the economy when a player
goes awol.

-----

Probably there are more details to be worked out, but I have the impression
that with these changes, we would have a cheat-proof game which retains the
spirit of the original.

jasonrohrer · 2016-10-06 10:46:49

Excellent thinking here, as usual, Zed!

First, if robbery is happening on the server, might as well make self test happen on the server too. However, if you eliminate permadeath, then what's the point of a dangerous self-test? I think the stress of sneaking through your own house, especially after it gets more complicated, is an important aesthetic aspect of the game. Still, I get that you are seeking to design a new, related game here. Just saying that real self-test is free if you move robbery to the server...

Having two different kinds of money (to build a house with a starting account) is a good idea. However, a true conservation of "real" money doesn't work.... because:

Where does the "real" money come from in the first place? Like, starting from zero, when the first new account joins the server?

The account gets some "house" money that must be spent only on building a house. The rest is lost or whatever. They have no reserve (stealable) money. They have no money to spend on robbery (including no money for the "ante" in the form of a backpack that is lost).

Now a second account joins. No real money is created again, and they are in the same boat as the first account. They can build a house, but have no robbable value, and have no money to fund a robbery with.

If you give them some free robbable money, then the old sock-puppet advantage comes back. Same is true if you give them a robbing budget (they can afford the ante, and then dump that in the other account).

I'm guessing that I missed some aspect of your proposal that addresses where money comes from in the first place.

Finally, I want to point out that cheating, though it may have been the main stone in your shoe, Zed, and other hardcore players, is NOT the reason the game died.

Having everything be "real" in the game means that there's a constant, vicious cycle of content destruction. As I pointed out many times in these forums, every player only creates one piece of content at a given time (their house), but they generally hope to consume many pieces of content (robbing many houses). On top of that, every time someone dies, a piece of content is removed from the game.

On top of that, the game is brutal and frustrating, which means that many players don't stick with it. The content pool shrinks, and new players come into the game with less to do, so they end up leaving after a short while.

Many solutions were floated to the content problem, all which involved making aspects of the game less real. What if multiple people could rob the same house over and over? What if houses lived on after you died? What if I generated some NPC houses for people to rob? But the aesthetic core of the game was that in robbing, you were hurting a real person, and in being robbed, you were being hurt by a real person who benefited from your misfortune. A real person would watch the security tape and see what you did to their family, etc. If you were robbing an NPC house or a ghost house, that would no longer be true. I think it would really diminish the "holy crap" feeling of giddy transgression when you come around the corner and see someone's vault. Same with the feeling you get when you watch someone die on one of your security tapes, especially if the name was known to you.

One thing that just came to mind would be to allow one person to build as many houses as they wanted, that they themselves couldn't rob. I don't know if each of these houses would have its own budget and family or what. But that might solve the content problem without making things less real. Though.... players would care less about each house, so I guess would make things less real anyway. And also, of course, make the game less focused.

A mini-solution that was actually implemented was giving the wife half the money (a piece of content could be consumed twice, once by reaching the vault, and a second time by reaching the family). Also, as long as the wife still had money to attract more robbers, people would drop their bounties and tools back into the vault, making the vault reachable multiple times as long as the whole house was not solved. Still, I don't think it was enough, especially with permadeath removing content from the game completely, even if it hasn't been consumed yet.

MAYBE leaving ghost houses around after permadeath would help a lot. But of course, the original owner would have the best chance of being the first to get through. So you could make them unable to see their own ghost house. Then they'd be tempted to use a sock puppet to get back in...

zed · 2016-10-06 11:57:58

Thanks for replying. You raise some interesting points.

> First, if robbery is happening on the server, might as well make self test
> happen on the server too.

That doesn't help, sadly. The player already knows the complete layout of
their own house, so they can work out a solution without talking to the
server, and then communicate it to the server (pretending to play live).

Adding some random element to the game would change this, e.g. making pet
movement nondeterministic. But that would be open to abuse - you could design
a house which can only be solved e.g. 1/1024 of the time, repeatedly build it
and run the self-test until you luckily succeed, and then have a house which
is nearly immune to robbery.

> Where does the "real" money come from in the first place? Like, starting
> from zero, when the first new account joins the server?
>
> I'm guessing that I missed some aspect of your proposal that addresses where
> money comes from in the first place.

Yes sorry, I skipped over that. I had in mind that at the start, all the money
goes to me! Or perhaps the first few players could get some initial cash -
that would benefit any sock pupeteers among them, but only for that initial
round of account creation.

The initial conditions shouldn't really matter - the money will get spread
around the players during the course of play.

The trickiest point would be deciding on the right level for the amount of
money in the economy... probably the right amount would depend on how many
players you expect to be active, which you wouldn't know in advance. But
assuming everyone trusts the server admin (which they have to anyway),
occasional macroeconomic intervention should be ok - temporarily gifting money
to new accounts if there's too little money in the economy, or destroying the
value of abandoned houses if there's too much.

I guess one possible problem would be if it ever ends up with one player (or
cabal) having *all* the money, and knowing it, and being happy to have broken
the game - then they have no reason to try to rob anyone, so no-one else would
get the money to try to rob them. Hopefully this is unlikely!

> Finally, I want to point out that cheating, though it may have been the main
> stone in your shoe, Zed, and other hardcore players, is NOT the reason the
> game died.
>
> Having everything be "real" in the game means that there's a constant,
> vicious cycle of content destruction.

Point taken. I hope my proposals would actually have the side-effect of
helping with this - a house wouldn't be directly affected when its owner
"dies" in a robbery, and would only be diminished rather than destroyed when
it's successfully wholly robbed.

It's still true that a particular incarnation of a house can only be
successfully robbed once (ignoring wives)... but I don't see that this should
necessarily be a problem - most of the content is still enjoyed by all those
who try but fail to rob it. This does make it important to set the balance
such that successful robberies are rare, though.

Getting the balance right with this new scheme would be tricky, and would
probably require lots of tweaking of prices. One thing I'm not sure about is
what the minimum number of active players would have to be to keep the game
going. If it's more than a handful, I guess it's unlikely to happen now.

> One thing that just came to mind would be to allow one person to build as
> many houses as they wanted, that they themselves couldn't rob.

Well, allowing multiple accounts effectively does that. You can rob another of
your own houses, but all that does is transfer money between the accounts.
This does allow sufficiently dedicated players to contribute more content.

GotABigTrap · 2016-10-06 19:26:39

One of the great aspects of this game is how far you can really go with your building and invention; however, this also seems to be one of its biggest limitations. Throughout my time playing, I have created and solved some very interesting puzzles. When the game finally started to die down, I thought I had built something that was extremely difficult to gather all the information necessary to solve. Eventually somebody solved it by meticulously documenting all of the mechanics and electronics.

This brings me back to another point, that basically every amazing house that I've ever created eventually fell. Every good house I've attacked as well. What I wanted to say after reading this discussion and thinking about it and my experiences was, maybe we are looking at this the wrong way.

My goal was never really to stop a map hacker... maybe I would confuse them with the electronics but I would never stop a motivated map hacker. On the other hand, I always tried to build with the expectation that sockpuppets would come and try to solve my house by guessing numerous times (the other meaning of brute force) or document it until they are able to reproduce the system and get the tool less solution. I was always much more worried that somebody would just guess the solution or derive the information through numerous visits.

However, what if you try to look at this from another perspective. The problem is just that there really is only so far that you can go to improve your house. One problem that you must deal with as a builder is balancing the number of possible solutions with the total cost to brute force your home. The more space needed to re-inforce from tools, the lower the complexity of your puzzle. What if there were a way to get more space either by increasing the dimensions of the home or adding another level? The reason I throw this out there is because, as you say, the diminishing content in the game contributes to its downfall.

if we can build stronger houses that can withstand sockpuppets and extreme players, maybe then a set of really great houses can expand their wealth and become more stable. Part of the problem is the best design will, in the worse case scenario, cost a robber 70-100k to rob, if lucky, much less. At the start, building a house allows you to dramatically increase the puzzle complexity and reinforce your house and that this scales with the amount of money you have; however, once you run out of space, that pretty much stops scaling. This essentially forces the rich to go around like tyrants smashing the growing houses before they have the tiny amount of funds they need to brute force them. Maybe if we allowed the map size to scale we could change the dynamics of this.

This could really increase the levels of creativity far beyond what is currently possible within the game. You could have an ultra rich house with 1 million in the vault that has large areas of space simply there for show and much more complexity and reinforcement than any design possible within the current amount of space. At the end of the day it is all about reinforcement as I can easily make a combination lock that has millions of possible combinations.

On top of everything else, I can't imagine that would be very difficult to implement. You could always curb sock puppets by changing the starting cash to a loan for 2000$ that can be used for building or buying tools (which must be used to rob), but only a small percent of it can be placed in the vault.

Last edited by GotABigTrap (2016-10-06 19:39:29)

zed · 2016-10-07 13:10:12

> On the other hand, I always tried to build with the expectation that
> sockpuppets would come and try to solve my house by guessing numerous times
> (the other meaning of brute force) or document it until they are able to
> reproduce the system and get the tool less solution.

This problem is fixed by "Conservation of Value" and "Robbery Ante". They
prevent sock puppets from being used to rob/scout risk-free. Then, with
appropriate balancing, I expect we would find that 32x32 is plenty. If not,
increasing it would indeed be an option - but I think it would be best to
aim to balance things such that increasing it isn't necessary.

GotABigTrap · 2016-10-08 16:49:42

Wouldn't it be better to make simple changes in order to try to preserve the current nature of the game? The 2000 at the start would be better if it was a loan and that only 1/4 of that loan would show up in your vault. Secondly, the game scales really well until you run out of space. Once you run out of space, it's only a matter of time before somebody figures out your house without any need for brute force. In my opinion sock puppetry cheat is much worse in that it lets people steal money from themselves than being able to try a house several times. As it stands, 1 person can try to rob a house every 2 hours now. Adding starter loans to the game would preserve everything about the game and mitigate the side effects significantly. Secondly, space is one of the largest other problems related to content creation itself because it limits creativity and it makes finished houses very vulnerable as the economic opportunity of robbing the house starts to drastically outweigh the cost to rob it. Yes there have been houses that had millions and survived for a long period of time, but if people had stayed in the game they would have seen that the game has evolved and that even the best houses can be efficiently brute forced or even solved with a little dedication. The problem is that typically a fully built house built by a good player will not last a week when there are other good players around. Given these facts, I would propose 2 fixes.

1. introduce a simple starter loan in which you have 2000 to build but only 500 of that will appear in the vault until the loan is payed back.
2. Allow people to purchase extra levels (more space) in exchange for some amount cash.

I feel like these two things would seriously address a lot of the issues around retaining game content and curbing multi account cheaters by reducing the benefit to multi-accounting.

Last edited by GotABigTrap (2016-10-08 16:53:31)

zed · 2016-10-11 12:57:47

> Wouldn't it be better to make simple changes in order to try to preserve the
> current nature of the game? The 2000 at the start would be better if it was
> a loan and that only 1/4 of that loan would show up in your vault.
> [...]
> Adding starter loans to the game would preserve everything about the game
> and mitigate the side effects significantly.

Well I'm working here from the assumption that players can get as many
accounts as they want. Then this kind of mitigation doesn't help at all - even
the smallest advantage can be magnified arbitrarily.

It's true that on the main server, this assumption isn't quite right, because
players have to give Jason money for each account. But that wouldn't be true
on a third-party server.

As for preserving the current nature of the game - see my next post, which I
think gets us much closer to that!

zed · 2016-10-11 12:58:50

I realised that the "one remaining problem" with "Conservation of Value" which
I mentioned in my original post is more serious than I thought. Conservation
of Value implies you must be able to sell off the contents of your house,
getting back what you put into it. But then you can effectively remodel your
house at any time, by performing such a sale and transferring the money to a
fresh account. It's possible to make this annoying to perform, but not to
prevent it.

I think this is enough of a problem to make it worth ditching "Conservation of
Value". Luckily there was a get-out clause in the justification I gave for it
- it's actually ok to have sinks in the economy, you just can't have sources.
So we can retain the current phenomenon that money spent on a house can never
be reclaimed.

The consequence is that we have a deflationary economy - money gets scarcer
over time, and hence more valuable. Rather than representing this literally by
reducing prices exponentially over time, which would quickly get ridiculous,
we can instead intermittently simultaneously rescale everyone's cash reserves,
multiplying the money in each vault by the same number, so as to make the sum
a fixed constant (say $100000). This should probably be done at random times
(Poissonically) to stop it being gamed, say on average once per day.

Although it isn't actually historically accurate, having a deflationary
economy actually feels quite in keeping with the game's theme... it finally
gives a reason for everyone to be hiding their money at home rather than in a
bank!

It also gives players a clear reason to keep money in their vaults - if they
can just hold on to it, it'll grow in value over time. EDIT: sadly this isn't
enough to mean we can do away with Reserves - it doesn't matter which of your
houses you store your money in, so you're motivated to store it in your best
protected house. Then without reserves, it would make sense to maintain a pool
of empty-vault starter houses on sock-puppet accounts, which feed anything
they make to one main account. So we still need reserves.

So although it would take some experimentation to see if it really works,
here's an updated proposal:

Keep safe self-tests, server-side processing, costly backpacks in place of
permadeath, listing the cost of a house rather than its contents, reserves,
the "loan"/"voucher" for new spawns in place of actual money; but forget the
rest of (iii), replacing with:

(iii') Deflationary Economy: money in players' vaults is frequently revalued,
i.e. globally rescaled to keep the sum constant.

Would anyone actually be interested in testing this scheme? I think I wouldn't
mind doing the necessary coding work, then I could run a test server on my
computer.

Last edited by zed (2016-10-11 17:55:40)

cullman · 2016-10-18 12:06:48

Great thread, we are still chugging along over there at terminal heist. We just launched another project today http://ward.tv. Now we are going fulltime TH. Here is our current anti-cheating plans :
- 100% server side play (the client is just a dumb interface).
- Using something like Neo4J to look for relationships between sockpuppets
- Eventually have the ability for users to report suspicious relationships between accounts
- We are removing the random name thing, so bad behavior of individuals will be easier to track by the community
- Zed, definitely, some very smart stuff in there. I would hate to lose permadeath and hate to lose permadeaeth self test as it's one of the things that makes the game so exciting.

Last edited by cullman (2016-10-18 12:07:04)

zed · 2016-10-18 13:49:03

cullman:
> - 100% server side play (the client is just a dumb interface).

Actually I've just finished a first stab at this.

Branch 'serverSideProcessing' at gitlab.com/zugz/tcd/ .

EDIT: polished it off a bit; could do with thorough testing, but as far as I
can tell it works fine.

It's using an expanded threaded version of the "headless client".

I'm keeping to Jason's "no copyright" public domain policy for this work, so
feel free to make use of this for TH.

Last edited by zed (2016-10-21 11:09:48)

cullman · 2016-11-01 14:07:30

Zed,

Thanks for your generosity. I might take you up on that. The one thing we did (against my wishes but the labor was free is we replaced all the PHP with Java. However, we still use the headless client so perhaps we could use yours as a replacement and be done with that. If you would ever want to join the TH team you are welcome to, so far it's done nothing but lose money, but like you I can't get this crazy game out of my head. Send me a message if you are interested.

-Cullman

zed · 2016-11-02 09:38:09

Hi Cullman. Yes, feel free to use the modified headless client. Although
there's no copyleft licence to require it, I would appreciate it if you made
public any improvements you might make to it which aren't specific to TH.

I'm not interested in working on TH directly, but thanks for the offer!
Good luck with the project.

The Castle Doctrine Forums

#1 2016-10-05 13:18:34

On sockproofing

#2 2016-10-06 10:46:49

Re: On sockproofing

#3 2016-10-06 11:57:58

Re: On sockproofing

#4 2016-10-06 19:26:39

Re: On sockproofing

#5 2016-10-07 13:10:12

Re: On sockproofing

#6 2016-10-08 16:49:42

Re: On sockproofing

#7 2016-10-11 12:57:47

Re: On sockproofing

#8 2016-10-11 12:58:50

Re: On sockproofing

#9 2016-10-18 12:06:48

Re: On sockproofing

#10 2016-10-18 13:49:03

Re: On sockproofing

#11 2016-11-01 14:07:30

Re: On sockproofing

#12 2016-11-02 09:38:09

Re: On sockproofing

Board footer