NetrunnerDB Exploit and How to Protect Yourself

I’m still not sure what your stance is - are claiming that the current netrunnerdb breach is:

  1. not cheating and acceptable behavior
  2. not cheating, but not acceptable behavior
  3. cheating, but acceptable behavior
  4. cheating and not acceptable behavior

?

1 Like

Not cheating, not acceptable, but understandable given the competitive landscape of this game.

That’s the last I’ll say; hopefully those involved will start the reconciliation process. It’s not a situation I’ll devote more emotional or intellectual labor to, personally.

4 Likes

This is super disappointing to hear, and I hope I don’t personally know anyone involved in doing it, because my opinion of people who would do something like this for a game we play for the love of it… not for cash or anything important enough to even begin to justify it.

And yes, this is cheating. If we were coaching a football team, you can’t just steal my playbook.

5 Likes

I hope they stole my 6 month+ old turbojank! Can’t wait to see what a refined Fanboi Iain, Shi-Kyu Sync, or Ice Analyzer-powered Nasir can do in the Neu Worlds Meta :smiley: (other than get DQ’d for not being legal, anymore, naturally)

Sucks that someone would try to get a leg up by underhanded means. To the wall of infamy!

I will say, though, it’s a damn shame to hear we don’t want to be “recognized” when we’re testing online anymore. That strikes me as some corporate sysop box jockey talk :slight_smile: . I’d like to see top players spending more time talking about their test decks ahead of time rather than less!

3 Likes

I was more sad and disappointed than angry about this. Our group was testing hard, using NRDB as an easy method to share dex among our group. To find that this highly useful tool (run by one community member) was mined made me not want to utilize it any longer. Alsciende does tremendous work, for a game we play for the game itself, the community, etc. The fact that this was for Worlds, more of a gathering and celebration, is doubly sad. We play for mouse pads, medals (?), and create-your-own-cards that may getting compromised or never see the light of day. Was that worth the enmity of the community?

I briefly discussed this with my patient wife, and wondered why? She noted it’s probably just a genetic flaw/perk in humans. We love to compete and win, in EVERYthing. Perhaps it is a survival mechanism.

Personally, I am not banning any of the offending players from KOS. Let them come forward and enjoy the day like everyone else. Hopefully, we’ll see more contrition by then. What little I saw off the bat was damning, at best. The initial crowing was the worst.

22 Likes

Hey, I’m the guy running AlwaysBeRunning.net. @Alsciende reached out to me and told me about the problem. I have disabled claiming with private decks until he comes up with a fix. When all is fine I will adjust to use the new secure service.

16 Likes

Some people play to win, not for the prize nor for the fun. They don’t enjoy the game as a recreational activity, it is only one of the ways they can affirm themselves over other people and satisfy their egos. If you have such a mindset there is no ‘enjoy the nice day’, there is only struggle and frustration until you make it to the top. In the process, every behaviour or action not explicitly forbidden is, in their mind, allowed.

I am not surprised that this happened in netrunner too, it boils down to your personal ethic, ego, and to the meaning we give to the things we do. Take a sample big enough of people doing crochet in their free time and something analogous will happen there too.

3 Likes

Some people enjoy finding competitive edges. There’s nothing wrong with that. The problem is there was a mass expectation of privacy, and it was violated.

6 Likes

I’ll note that MTG has an entirely different perspective on decklists. ‘Rusing’ is actually incredibly frowned upon, and you’ll likely find decklists for major teams leading up to the Pro Tour. There’s a couple of notable outliers, famed for deckbuilding skill, who keep their lists close to the chest, but in general the scene is way more open than Netrunner.

This is one area where MTG and Netrunner don’t compare well, because secret decklists gives you way more of an advantage in Netrunner, owing to the bluffing aspect of the game.

As to this hack in particular… Mixed feelings. I don’t feel it was cheating, but I also don’t think it should be the standard. Then again, I never felt Scouting was cheating, either. The main takeaway from this, for me, is that there exists a Publish function for public decklists, and this Share Decklists feature was (probably?) intended for private, one-to-one, or within-a-group sharing. Published decklists are a display, while Share Decklists was a wall of featureless, unlocked PO Boxes that may or may not have a deck behind it, and it may or may not be a useful/viable deck. It’s not, strictly speaking, illegal to look in an unlocked box laid out somewhere publically, but it definitely should feel weird.

4 Likes

Looking in one is different from making a robot that systematically checks each box for their contents and owners compares them to a white list then. It also scans for changes and updates for all new boxes.

4 Likes

Yes I agree with your sentiment - scraping decklists was a bad thing that is bad for the community, but overall it would be nice for people to be more open with what they are working on. I’ll be a little more direct though that secretly sharing your own decklist with only a select group of people can also be viewed as unsporting, given that netrunner is not a team game (at least in the Champs), and that it does give specific people an advantage. To be clear: as an observer, I like the fact that there is friendly (I assume) regional/team rivalry, but I’ve also thought that it certainly gives well-connected and popular players an advantage. The default belief is that this is not an unfair advantage but I hope it doesn’t get too crazy as time goes on.

1 Like

I don’t put in dozens of hours of practice to not win, either.

7 Likes

I think you hit the nail on the head and I share your sentiments. The breach is unsporting at best. The act of targeting specific players (including a fair number of prominent community members and sustainers) is the more egregious offense that has harmed the community. Like your analogy, the offenders went to specific persons’ mailboxes (as opposed to random boxes) in order to find information on the owners. This should be and is frowned upon by the community at large, and I suspect those who partook realized this but couldn’t resist the opportunity. If they didn’t realize this upon initial implementation (sometimes there’s just a “I wonder if I could…” instinct that needs to be satisfied for curiosity’s sake) they surely must have prior to being outed and should’ve stopped immediately.

As for the public vs. private debate. All lists compromised were public but unlisted (as stated on NRDB), giving the appearance of privacy but not the protection. Ideally we wouldn’t have to worry about this difference being exploited.

If people scraped lists without username association (as can be done now) I don’t think people would be as outraged. The key component of the offense was targeting specific players.

2 Likes

everybody tries to win, obviously, but there is a difference between i) playing to have fun (meaning enjoy a serious high level competition) trying to win, and ii) playing to win, trying maybe to have fun.

With the latter case we end up in the same grey area where rule advocates and general unsportsmanlike behaviour fall.

I disagree. What was done was outside the privacy expectations of netrunnerdb users. There is no doubt that the reason for the sharing toggle was to allow private sharing of decks via links - given that there is a formal ‘publish’ option. I would be equally outraged if the scraping had not been targeted.

The authors of this script have gone on record (including on stream last night) to say that in retrospect what they did was completely unacceptable, and on slack, have said ‘please do not defend us’.

10 Likes

Cheating has a very specific definition. Rules of the game (either in the rulebook or the tournament floor rules) are pretty clear, and hardly cover anything that happens pre-tournament. I don’t know how you can consider it cheating, because cheating refers to violating those things. Colluding (e.g. playing one game to decide a pair of games to avoid splits, or agreement to draw prior to that being legal practice) is cheating. Watching another game to get an idea of deck lists is not cheating (at one point it fell under ‘scouting’ but that was removed from the floor rules). It might be unsportsmanlike, but I’m not going to delve into that.

Copying a deck-list isn’t ‘stealing’ either - it might be some form of intellectual property infringement, but I somewhat doubt those laws are enforceable at this level, and it hardly seems something anyone has ever been concerned about before.

Making use of a software exploit to access user-information that has been stored under the explicit expectation of privacy is a gross violation of personal privacy. Stop this rhetoric about ‘cheating’ and ‘stealing’. Call it what it is. It’s little different than picking up someone’s decks before a tournament without their knowledge and rifling through them, or looking over their shoulder as they write the lists down.

That’s wrong enough. You don’t need to add extra things to it.

9 Likes

Perhaps I’m on the minority on this but I expect basic human decency and sportmanship from the people I game with and would rather not play a game populated by douchebags.

Given that I believe that competitive play should uphold these values and not promote toxic behaviour and violations of privacy, I hope FFG enforces their rules and bans the players involved from participating in Worlds or other Netrunner tournaments.


On a broader matter: Do not let people use gaming, competitive or not, as an excuse for shitty, abusive behaviour.

14 Likes

I think some folks are calling it “cheating” because they consider it “unethical”…which is worse to them than “unsporting”. While it may not be cheating according to the ANR rule book, it may be cheating according to their ethical rule book. Is it t wrong for people to evoke social rules of their worldly environment since ANR is played in their world? On the other hand, we might consider the inner-world of ANR as the proper ethical perspective. If that’s the case, competitive play has a whole new set of risks!

1 Like

I’m not sure why this discussion has devolved into a T debate. No one is arguing that this is a violation of FFGOP policy or something.

I’m a member of the west coast testing team that created and used the NRDB bot. I’m sorry for what we did, the damage it caused to the community, and the shroud it’s cast over Worlds. I don’t think it’s particularly important whether it’s considered cheating, unsporting, unethical, how easy it was to do, part of NRDB’s design, etc.—it was Wrong. We violated the community’s trust and expectation of privacy. Not to cast aside the debates in here, I just want to echo “don’t defend us” and that whatever your outlook is, our behavior was unacceptable.

I’m not going to play in the Worlds main event and I’m going to donate to NRDB as they work on fixing this issue. I hope eventually I can regain the community’s trust but it’s understandable if people don’t want me around. I’m not super competitive, I play this game for fun, and it was a colossal mistake getting involved in this.

30 Likes