Game Guides Archive
Thread: On Exploits, Creative Weirdos, A Hypothesis And A burgled House. [REPOST]
This is a repost of a post I put up in the discussion forum in january 2004. (The fact that after all this time there is another credit dupe reminded me of it.)
The Story About How My House Was Burgled
In ultima Online, I had a large brick house. In one of the rooms I placed some locked boxes near the north wall and 'locked them down'. Then I placed a row of small tables three rows south of that, from the west wall to the east wall of the room and locked those down too. Because nobody could move through a small table and locked down items could not be moved, no thief could go beyond that wall of tables. And therefor the locked boxes could not be lockpicked are opened because they were too far away. The idea was that I, as the owner, would 'release' a table, pick it up, move trough the gap and then put the table down again and lock it down. That way I could access my items and nobody else.
This worked fine for a while but I still got robbed. Somehow a group of thieves had unlocked and emptied all my chests. And the wall of tables was still there, untouched.
To explain how they did it, I must first explain a few other UO facts.
In UO it was possible to cut up an NPC or player corpse into two arms, legs, a head and a torso. This was both done to be able to roleplay bad guys (getting low karma, displaying body parts in your house) and also a way to collect the bounty on a murderer. A murderer was someone who deliberately killed other players more than several times a day. If you killed a murderer and then handed over the head to a town guard you would get the bounty.
Most items in UO either had no height (you could walk over them), blockable height that was too high to step onto (like the tables in my house) or a little height that increased your z-axis (used for steps, ladders and stairs). The increased height made you enter houses, whose floors tiles were slightly above the surrounding terrain, allowed you to enter the floors above or made you walk across a slightly elevated bridge.
There were two kind of spells that could be used to get OUT of a building, but not into. One was called 'recall' and it worked for one person. The other was called 'gate' and it worked for multiple persons.
Now comes the weird part. Unknown by the UO devs, the torso part of cut up players had a tiny bit of height. The way that the house break-in exploit worked was that the exploiters actually created steps using those torsos. They then simply stepped ONTO the tables and stepped off on the other side. After looting all my stuff the simply recalled or gated out.
End of the story.
Why I bring this up is because of the fact that it really took a very creative person to create that exploit. When you actually walked over one of those torsos the z-axis of the avatar (character, toon) increased but very, very slightly. Almost but not totally unnoticable. You'd have to pile up quite a few to actually get a 'step' higher. So this exploit could only have been thought up by someone collecting the torsos of killed players.
The point I'm trying to make is that that exploit was sheer impossible to prevent from the devs point of view. And even impossible to find on the test server.
And that is the flaw behind the 'fix the bugs and the exploits go away'. There will always be sick minds who come up with something else to use as an exploit. And some exploits are possible because of an oversight and not an actualbug. The use of two game mechanics that work as intended but when used together become an exploit. Or even one game mechanic like spamming knockdown or miss-using /citywarn. The reason those were overlooked was because the devs put too much trust into the players. "We never thought it could/would be used like that!" is acommon thing when it comes to devs and some exploits.
The sad thing is that most of the players on the Test Server are actually good and trustworthy people. Most of them will NEVER come up with any of the more creative exploits because it's just not in their character. Those few on the Test Server who ARE devious and creative enough to find exploits will most possibly not report them because they want to save them for their own advantage.
Lets, for the sake of argument, assume that, with a new patch, there are four ways to dupe credits.
The first method is easy to find and the Test Server players report it.
The second takes certain actions that take a little creativity to work out and can be done solo and rather easily. Some TS players have heard of it through rumors but can't reproduce it in time for the patch comes out.
The third method takes a more creative way to find and is not easily done. It's known by thethe players that actually look for exploits on TS for personal gain.
The fourth method requires a weird way to act and can't be done solo. It's only found by the most creative of exploiters.
The first method is fixed with the patch and most people think all duping is fixed.
The second is used by a few people and after some people either hear from it or figure it out themselves, it gets reported and it gets hotfixed. Now all but the real exploiters think the duping is fixed and so think the devs.
A few people start using method number three. When this is eventually found out by players on the live servers the screaming starts that duping was NOT fixed. This goes on until the devs figure out how it is done, by watching the exploiters that get reported or found by looking at logs. It then gets hotfixed.
Most of the people using method two andthree on a live server get banned. Those few that escaped lay low for a while and then start using method four carefully. Because it can't be done solo they didn't use it before. And because they can't do it solo, it gets known by more people and sooner or later people hear rumors and start shouting "They are STILL using the exploit and the devs said it was fixed." Eventually, the devs find out about it by watching the exploiters and deal with it.
Unfortunately, only the exploiters and the devs know that there were four different ways to dupe. All the player saw was ONE exploit that never got fixed although the devs and the TS players said it was.
Conclusion: there will always be exploits as long as there are creative people looking for them for personal gain. From greedy kids to weirdos with a twisted mind. And it is next to impossible to come up withALL the ways a bug or game feature might get abused. And sometimes it actually takes a whole lot of investigating by the devsto actually know how an exploit is actually done if it doesn't get reported.
(In Beta 3 it went even so far that they actually had to ask the players if there was a way to 'overfeed' a factory with resources becausethat actually crashed the server every time it was done. It was actually just ONE person using nested containers in a creative way who was totally unaware he crashed the server.)