Community Forums: [BUG] @{target|attribute} accesses information I'm not sure I'm supposed to have.

1409366126

Edited 1409366919

Occurs as: Player Role Setup: I am a player in a game. Assume a character, not mine, with a token, whose name is Jim, with AC 14. Actions to produce bug: enter into chat Type: @{target|character_name}'s AC is [[@{target|ac}]]. Click on Jim's token Expected Result: "No attribute was found for @{Jim|ac}" "Jim's AC is Jim|AC." Actual Result: "Jim's AC is 14." Since you can't access Jim's AC by directly piping the request to "Jim", I'm not sure I understand why piping the request through the "target" operator would allow you to access it.

1409397136

Lithl

Pro

Sheet Author

API Scripter

Permalink Quote

@{target} wouldn't be much use otherwise.

1409403171

Stephen W.

Permalink Quote

Is there a way for the GM to turn off this ability or to choose what he exposes? No GM I've ever played with wanted the players to know the vitals of his NPCs.

1409404438

Sky

Permalink Quote

The GM can use obfuscated variables to prevent that from happening, but no... there's no actual way to block it. I have requested an option for that, but nothing has been done about it yet.

1409448516

Riley D.

Roll20 Team

Permalink Quote

We have thought about blocking this before. I think the main concern was that you could use @{target} in a whisper and whisper the stats to yourself (so the GM wouldn't know you were doing it). To some degree this is like "lifting up the paper when the GM leaves the room" -- it's cheating, plain and simple. And we've said in the past that our stance on that is "Roll20 does not prevent cheating," just like a physical tabletop doesn't. But I can see how this is to some degree a special case. The last time we discussed this I think we were coming down on doing something like you could prefix a variable with an underscore (e.g. call it "_AC" instead of "AC") and anything that started with an underscore could not be targeted by players who don't control that token. Does that still seem like a good fix for this to you guys?

1409451458

Sky

Permalink Quote

Sounds good to me.

1409455166

OldSchoolChris

Permalink Quote

Although I wouldn't ever cheat like that, I can say I know people that would. If a DM has players like that, they need to be able to be blocked. +1 Sounds like a good plan Riley.

1409463321

Diana P

Pro

Sheet Author

Permalink Quote

How would this work with the character sheets? name="attr__AC" instead of "attr_AC" ? Or will this not work with it at all?

1409465372

Edited 1409465506

Stephen W.

Permalink Quote

Riley D. said: We have thought about blocking this before. I think the main concern was that you could use @{target} in a whisper and whisper the stats to yourself (so the GM wouldn't know you were doing it). To some degree this is like "lifting up the paper when the GM leaves the room" -- it's cheating, plain and simple. And we've said in the past that our stance on that is "Roll20 does not prevent cheating," just like a physical tabletop doesn't. But I can see how this is to some degree a special case. The last time we discussed this I think we were coming down on doing something like you could prefix a variable with an underscore (e.g. call it "_AC" instead of "AC") and anything that started with an underscore could not be targeted by players who don't control that token. Does that still seem like a good fix for this to you guys? I like that idea. But yes, I do wonder what would happen with character sheets. I should've searched the archives. I didn't realize this had been discussed before. My bad. Some other possible fixes: GM sees all whispers GM gets an alert whenever @{target} is implemented which includes the player name and the command string. With this, the GM would be able to see whether it was a legitimate use of the @{target} function. If not, the GM could enact whatever anti-cheating rule he had in place - warning, booting, etc.. Perhaps it could be at the GM's discretion. "[x] Turn on @{target} alerts"

1409466596

Sky

Permalink Quote

I'd rather just be able to hide attributes than get alerts and absolutely no to seeing all whispers.

1409468015

Edited 1409468087

Phnord Prephect

Permalink Quote

While I agree with not-seeing whispers, I would hate to have to go through and rebuild all my NPC sheets... heck, ALL sheets... to implement the "_AC" thing. It would make everything substantially more complicated and difficult; essentially, ALL stats would end up being GM-only! I think StephenW's idea of a toggleable option for alerts would be the best option. -Phnord, who relies on his players being honest and trustworthy. edit: If the AC were set as GM-only, all the automatic targeting calculations would be unusable. Double-NO-vote on this!

1409470656

Sky

Permalink Quote

Find, replace.

1409477510

Phnord Prephect

Permalink Quote

Riley D. said: ... anything that started with an underscore could not be targeted by players who don't control that token. Which implies to me that a player would be unable to use any function that attempted to call a GM-only value. For example, a target's AC value. Which would mean that for every attack roll, the GM would have to manually determine that value themselves - the players could not in any way call that value up for the GM, even in a GM-only 'whisper'. The result is that all my macros, which include a GM whisper showing the target's AC value, would lose that ability. I'm sure this would be useful in some cases for some people. Not me, as my system relies heavily on a single player-generated macro to display a large amount of GM-only information. If this were implemented, every attack (for example) would require either a second script run by the GM for the needed info, or for the GM to have to find this info in another manner. Either one causes at least a 100% increase in GM hassle. I won't say don't make this change; I will say that if you do, make it so I don't have to use it. Big NO vote from me. -Phnord the Lazy

1409488672

Sky

Permalink Quote

It would be optional. You have to set the attribute to GM only by naming it _Name instead of just Name.

1409495263

Edited 1409495388

Lithl

Pro

Sheet Author

API Scripter

Permalink Quote

While the attribute prefix solution functions in the general sense, I don't think it's a very good one for games with character sheets. Each character sheet author would need to update the sheets, and not all GMs want to hide that information, or only want to hide some of it, so you can't simply do a blind find/replace. With the proposed change and the way character sheets currently work, you would have to make two attributes for each value, one with a leading underscore and one without, and then implement some fashion to present some or all inputs as the basic or private version of the attribute. (And then train the users to utilize the presentation appropriately.) Further, it's worth noting that character attributes aren't the only critical information that a player might glean from @{target}. Consider: /w Brian @{target|token_name}'s HP: @{target|bar_1}/@{target|bar_1|max} This is not a technological issue, it is a social one. If there is information your player's "shouldn't" know, you should be able to trust them to not know it, even with potential access to it. If you can't trust your players, they shouldn't be your players. Stephen's suggestion for notifications at least wouldn't disrupt the status quo of character sheets, although for some campaigns and for some kinds of macros, it might cause quite a bit of chat spam for the GM. Such a notification system would definitely need to be toggleable.

1409532276

Edited 1409532362

Riley D.

Roll20 Team

Permalink Quote

Hmmm...I agree that the Character Sheets would present an issue with the underscore idea. However, to be honest this isn't something that I see most or even many GMs using. Are there some folks playing with players they don't trust not to cheat? Yes. But I think it's a minority. So to some degree even if it makes it a bit unwieldy I'm okay with that since the use would be limited....and we've always been in the business of optimizing for trust rather than us having to enforce rules. The "notify the GM on use of @target" would be rather difficult to implement given our current setup. Not impossible. I'll consider that as an alternative. We have no desire to notify the GM of the content of any whispers (beyond possibly just saying "So and so player used @{target} to find out the AC of Enemy A.") It definitely seems like the character sheets have made this more complicated than I realized, so I'm not sure if there is an easy solution. I'll keep thinking on it. In the mean time, since this Bug Report was basically just someone saying "Hey am I supposed to be able to do this?" and the answer is "Yes you are but it's cheating so you probably shouldn't", I'm moving it out of the Bugs forum. I do wonder how much of this is just speculation (i.e. "Look what *could* happen!") and how many GMs would actually *need* to use this feature. Again, our stance in general has tended to agree with what I said earlier and Brian re-iterated -- there are ways to cheat in Roll20 just like there are ways to cheat in real life. It's a necessity of being a platform for playing lots of different games rather than a specific implementation of a single game. How much we can and should get involved down that path of preventing that type of cheating is something we're still working to figure out. But it's definitely something we're talking about constantly behind-the-scenes.

1409559513

Jacquesne J.

Permalink Quote

I wouldn't use it. Everyone's already playing on a computer. Unless you're playing something homebrew or often change things around monster stats are simply a Google search away. Honestly, though, this type of "meta knowledge", while it sounds like a problem, really isn't. Knowing a monster's AC doesn't change your rolls, and assuming you are fighting stuff around your level, a 10+ is probably going to hit, and a 9 or less is likely to miss. The functional difference between a monster having 14 and 16 AC isn't that big a deal and doesn't really affect play (unless Grog the barbarian routinely says "Well, I'd attack that monster, but I know it has 16 AC, and I'm only confident I can hit 14!). Not to mention it's generally easy to figure out after a couple rounds (well, I have a +5 to hit, and my 10 missed, but my 12 hit...so it has an AC of 16 or 17). For things like Pathfinder and 4e, I almost can't play without meta knowledge, since I know most common monster's main stats (HP, AC, etc) by heart. You pick it up really fast as a DM. I encourage my players to use targeting macros since it gives instant feedback on whether or not their roll hits. If there's enough people out there who are legitimately concerned that their players might secretly read the DMG behind their back, and find out something's AC mid-fight, I guess it might be worth having the option. It just seems like a minor issue that doesn't really make a difference since knowing how much you have to roll doesn't actually make you able to roll that high.

1409567700

Edited 1409567772

Alex L.

Pro

Sheet Author

Permalink Quote

Jacquesne J. said: If there's enough people out there who are legitimately concerned that their players might secretly read the DMG behind their back, and find out something's AC mid-fight, I guess it might be worth having the option. It just seems like a minor issue that doesn't really make a difference since knowing how much you have to roll doesn't actually make you able to roll that high. There are some points where know that you are X away from hitting can help but I would normally confirm if X more would hit before they use a power that changes a to hit value. But I agree I don't think Roll20 needs to deal with this.

1409568022

Sky

Permalink Quote

It could be useful for board games where something needs to remain secret from the other side.

1409595289

Jacquesne J.

Permalink Quote

Do board games normally have character sheets created for tokens? None of the ones I've tried have. No sheet means no target function (and thus no "cheating"). I just think that meta-game knowledge is a problem that tabletop players have dealt with for years and the ability to check a token's stats versus look them up online (or old school read the Monster Manual before the session) is a fairly minor issue. If you want to "fix" it right now just create unusual names for your stats and set them up as abilities (not the character sheet). That way the players won't know what to target but you can still use them internally. Creating a "special" naming convention (like the aforementioned '_') creates the same amount of work (you have to rename everything anyway). Anyway, I wouldn't be opposed to it, I'd just never use it.

Cookie Preferences

[BUG] @{target|attribute} accesses information I'm not sure I'm supposed to have.