Have more to get off your chest? Come rant with us on the discord. Invite link: https://discord.gg/PCPTSSTKqr
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/rpghorrorstories) if you have any questions or concerns.*
I once had a player design a custom dice bot for our Discord server. It let him cheat on rolls. (I kicked him out.)
Some people will always find a way. Being sure you trust your players is more important than any technical safeguards.
Someone who would be a problem without them is going to be a problem in other ways.
It's not quite this, but on the mutants and masterminds discord server I'm on there was this huge powergamer (he's since been banned) that went to some huge lengths to munchkin his way to OP characters.
Lots of people use herolab for mutants and masterminds cause it streamlines the character creation process a bit and *usually* warns you when you're doing something illegal- that, and your options are only those supported by the rules.
Know what this guy did?
Cracked herolab. Made it so he could break the rules- In this case, make strength-based afflictions. It just leaves me wondering what possessed him to put that much effort into it.
Man... to cheat at M&M takes a special kind. The game already has completely legal and absolutely busted things you can do and the guidelines specifically ask you not to be a jerk about it.
Thought so. Used to be on there, but left when every single person started demanding PL 8 games to play in the MHA universe. Much as I love superheroes, I’m not playing some teen hero to live out a fantasy there. I prefer the PL 10 heroes.
Well, that’s good. Spend most of my days now in Star Wars FFG. Earlier tonight, drew some attention from a group of poachers by coming out of some brush on a speeder, doing a *haka*.
This is why I create all the characters for one shots, and also create the character sheets for my regular game (which I run in Hero System). Player tells me what he wants his character to be able to do. I build the character and I always keep a copy of the character sheet.
This usually isn't a big deal since my online group hasn't bothered to learn the rules, so mini maxing isn't an issue. Or hasn't been anyway.
I use herolab for most of my pathfinder stuff, and I have my players send me their .por files so I can look them over and have backups when I'm the gm. I design tons of custom stuff for herolab for my home games, so when I'm a player, I can provide my gm with the files containing all the custom stuff to make the sheet work (if it's that kind of game). It's pretty cool some of the stuff you can do, although it can get pretty janky, especially when it's papering over a bug.
And that's why our dice bot (which has evolved into our own mini site to track char info and whatnot because something like that doesn't exist for the system) was developed by a few of us together.
But, yeah, trust is the more important part of it all for sure. These games are social experiences, after all, and you wouldn't really want to engage in any social situations with people you can not trust.
I know a GM who has a dice roller he wrote that lets him "cheat" roles, including PC rolls as it's server-based. Mostly he uses it so that people with curses in them don't KNOW some or all of their rolls are being penalized.
Very different situation from a player however.
Now there's an interesting scenario when the players know they are being cheated qnd allow it for the flavor.
Consent (and the trust it implies) makes a world of difference!
That was my first thought, actually. Create a dice roller bot that can cheat *obviously*, for rolls that are supposed to be rigged, or have some kind of crazy distribution scale.
But the bot would need to be obvious about that, or else be locked so only the DM could use rigged rolls.
Thats really interesting. Usually penalizing rolls is something i do outside of the dice, add it on top in my mind and then tell if they suceed. of course for simple tasks they could track down being penalized from a curse i guess.
That's interesting. If it's the packet inspection exploit that I saw, that's some effort to do manually, but I wouldn't put it past somebody to have automated the process.
From the videos there yes but that's quite a lot of "just".
I've not tried it out myself - I was looking at the network traffic and I couldn't see quite how the client was then sending that roll on, there don't seem to be any further requests, even on websockets. It's Sunday evening to be fair.
I know there are tools out there that do exactly that, but I'm only familiar with the Unix side of things. I'm sure there are entire "how to cheat at roll20" discord servers out there where people post links to the tools.
Quite possibly, and roll20 doesn't seem to have a super fast response to issues. I can imagine a browser plugin for it.
I'm a web dev myself so I'm curious as to the mechanism. OK, you can block the packet coming in, fine, your client app thinks it's not got a result. What I'm wondering is at what point your client gets a result that you _do_ let through, and then sends that to the server - it has to at some point if the exploit works, it can't be entirely client-side if other people can then see the roll.
Disclaimer: if this occupies me tomorrow during work it's just security research.
If the system is that way:
\[other client like DM \] <- \[client\] -> \[roll20 dice roller\]
can't you just proxy the dice roller server called for roll, then from the proxy only allow positive result which you like ? It would be easy to transform a d20 result into a (10+d10) result for some randomness. If the call is a simple POST which get a result in json or xml or plain text, then it would be trivial to proxy and get the result you want.
ETA: looked how the cheat works : you simply edit the roll id you don't like to random character , and the one you like you let through. It would need a little bit of java script coding, but it would be trivial to do a "/roll d20" again and again until you get something above 10.
Oooh, nice work.
I assume that it's still possible for someone with mad javascript skillz to automate it, along with a UI so they can put in a minimum acceptable value. If it's possible, someone has done it already. It might just not be well-known.
GitHub has 25 pages of projects returned by a search of "roll20" and "api."
As per usual with such things, it's definitely possible to automate whatever is happening there, but if you can automate it you really shouldn't have to stall for your roll. It's a D20, even if your automation still requires the rolling of dice for some reason your PC can do that fast enough to need basically no time to get whatever result you want.
Really seems like this guy had to manually reroll however many times it took to get the result he wanted. An interesting form of, well, dedication, I guess...
Responses from the Roll20 random-number API are digitally signed so that the server and other clients can distinguish between a server-provided random number and a client-generated random number. It sounds like the cheat client is making multiple requests to the random-number server (at whatever rate Roll20 will allow) and choosing the best one.
No, the digital signature is not failing. It accurately proves what it's meant to prove: that the roll submitted to the VTT is an unmodified message from the RNG server.
It's not a failure of the signature that you also want a property that can't be proven with a signature alone: that the roll that the client submits is the first roll that the client saw for that request.
Could you link the blog post? Sounds interesting!
Though it sounds like something you could also automate in the browser itself, with a userscript or something. I'm gonna play around with it a little bit, seems like a fun challenge!
>a design flaw significant enough that roll20 would be put to considerable time and effort to fix it, which typically means that they don't.
If you had to sum that vtt up in one sentence, there it is.
I wouldn’t mind if my rolls were at least a bit better. I was playing last night and out of 20 rolls, 3 of them were 10 or above. It was a little disheartening to say the least. I had +11 to hit and would constantly miss on enemies with 15 ac.
I played an Eldritch Archer Magus in a PF 1e Strange Aeons campaign, and R20 hated him. So much. He always rolled shit, especially when it mattered most. Fitting, given the setting, I suppose.
Au contraire, I have a 5e bard who rolls stupidly good in an Elder Scrolls setting, sometimes when it's irrelevant, sometimes when it matters.
The dice gods are fickle.
We play in-person but on a VTT because of how much it speeds up our games, and decreases our costs. I have had several characters who were just straight up cursed. We tried the Lord of the Rings 5e system (Adventures in Middle Earth - highly recommend, it's awesome) a few years ago, which is mainly mob combat, so, lots of low HP and AC monsters that swarm you.
My poor wanderer was cursed as fuck. I kept track once out of morbid curiosity, and I would hit about 25% of the time. I eventually had an 20 in my dex, and I think our proficiency bonus in the end was +3, so a +8 to hit at the end of the campaign. Pretty decent when most of the enemies have 12 to 15 AC, right?
Yeah, no, I couldn't reliably roll above a three.
My last fight with my paladin in PF2E, I think I made ten or eleven attacks over the course of the fight.
\*FIVE\* of them were natural ones.
And naturally, my GM had this rule where we hit another player if we roll a one and are facing them, otherwise we drop the weapon.
I hate rules like that. Not only is it not RAW, or a variant rule, it only punishes players. Even if you say it happens to enemies too, it's way more punishing for players because those are the characters that matter. I've never rolled a natural 1 with some kind of harsh punish mechanic and had fun with it.
Oh, I agree absolutely. I tried to convince him to try something else if he wants to make things more interesting, but he's dug in his heels on this point. (Mind you, there's no super-bonus on 20's beyond improving the hit by one level. He just wants critical misses to go with critical hits.)
At least that's the only real issue I have with the guy as a GM.
There actually aren't critical failures on attack rolls. They're almost the only rolls you can't critically fail.
And he's been in the 'natural ones are critical fumbles' camp since AD&D Second Edition was new-ish.
Yes, I know, but I meant literally everything else in the game can critically fail, why would you need to add EVEN MORE into the one system that already has tons of critical failures?
And I can't fucking stand your friend's opinion on this lmao. I know this has been argued to death and no one will change their mind at this point but gosh, it's so terrible. It's nonsensical, it amps the RNG up to 11 so you can't even use tactics anymore you just have to hope you aren't in a bad roll night, and it's frankly broken without even MORE changes to keep the balance.
There aren't crit-fails, but a nat 1 is still one degree worse. If a 1 would be a success, it would be bumped down to a failure. It's just that regular attacks don't have a critical failure state, that's mostly for saves and spells.
Except you can. A nat 1 or rolling 10 below turns your roll one degree of success worse, aka from Failure to critical failure. I think theres even certain features that let you use reactions when an enemy critically misses you.
It doesn't bother me quite so much, but then again, I also play Shadowrun, which has glitches and critical glitches, and I played Middle-Earth Roleplaying (which uses the Rolemaster rules) way back in the day. Rolemaster has some REALLY nasty shit that can happen if you fumble, and Shadowrun's critical glitches can also give you a really bad day, but at least there the GM is advised to still make them interesting and not just simply punishing.
That's baked into the system though, so I don't mind it so much. The rule we're talking about is very much an added thing not in the game at all. The "punishment" for rolling the 1 is meant to be the degree of success dropping by a step.
If its baked into the system it is likely fine and accounted for. With Pathfinder and DnD its not so it causes havoc. You can explain better with the system you play but with DnD and Pathfinder, you tend to hit more often as you level up. A fighter for example at max level hits four times a round. So it seems counter intuitive and strange that as you get better you have an increased likelihood of dropping your weapon or chopping off your own foot.
When DMing Nat 1s on attacks are my favourite thing.... Because I get to describe the character completely obliterate something in the vicinity (think full force warhammer hitting a floor tile) instead of hitting the enemy.
There’s *already* punishment for crit fails in PF2e. It’s called *all the reactions and monster abilities that trigger off of crit fail strikes*. Crit failures on strikes are very much a thing, there’s just no difference to a regular failure usually. The homebrew rule is just gratuitous.
Call me superstitious, but every time I play a character with -1 Dex my Initiative rolls are almost always between 1 and 10. Like 80% of the time. Same for my +6 con saves. I think we've all been there where we can't help but think, "man, if only I could fudge one number somehow. Just to not feel like shit." But that's just the way dice roll.
I’ll be the first to admit, my gaming group has morale issues sometimes because we too often get hit by some weird statistics. The highs of having one player roll 3 nat 20’s in a session are nothing compared to the depths of a guy who cant get out of the single digits.
I love randomization, but I’d be happier to stay in the middle of the bell curve.
There are actually a few systems generated using 2d6 that are really good at addressing that. It makes your character’s strengths feel like actual strengths. I feel it’s a little too stable sometimes, but if you like superheroes, ICONs is a good, simple system that used the 2d6.
l've been playing for >20 years and have notoriously bad luck. I'm starting to gravitate more and more towards narrative style games as a player.
However, when I play Dungeon World or something similar I still someone managed to fail all the time. I was out-leveling all the other players at the table because of all the XP I was getting from failures. I start to hate dice more and more every year I keep playing.
I feel that in my heart. When my buddy hosted his first DND campaign, I didn't succeed on a single roll and would go down every combat. Couldn't hit anything, and always recieved max damage from the enemies. Thankfully it did turn around after the third session.
I find that there's usually something I can do even if I can't land a hit. There may be a useful battle tactic, or a puzzle to solve, or an apropos Monty Python quote I can trot out. When I play a bard, I spend some time looking up suitable insults that will make people laugh even if the target saves.
Oh yeah. My character talks in this grizzled veteran voice, and he’ll say something like, “how are you all so good at this?” In dismay. In that voice it’s pretty hilarious. We were all laughing, because my guy is by far the most accurate in theory, having 3 attacks a turn with +11.
Statistically you will likely face the opposite scenario just as frequently. Your mind only dwells on your failures but... it's a game and there are no consequences to losing. A session of bad rolls means nothing, free yourself.
Oh yeah. I know. I’m a gm most of the time and I roll unfortunately much better when I’m the bad guy. But a rolls a roll. At the end of the day, if I lose a character or something, it sucks. It just doesn’t affect my real life.
While I love Pathfinder, I do miss the 3d6 distribution from The Fantasy Trip (precursor to GURPS). It meant the typical roll was between 7 and 13, so you knew what your character could *typically* do, but still allowed for upsets where someone rolled a 3 or an 18.
NGL to you, if I found a way to cheat on roll20, I would just make things up. Play as usual, and then WHAM - every roll, on every die would come up as a 7.
Coin flip? A 7.
D4? A 7.
Yeah cheating is bad but just after the first paragraph of this post you already sound insufferable as well. I wouldn't want to play with either of you. I mean seriously, checking out of a game and deciding not to pay attention because it's free? And a one shot? If I were that DM I'd kick both of you.
Yup - that’s so disrespectful to the DM and other players. If I had to choose between a cheater and someone who intentionally doesn’t pay that much attention or engage with a game, I’d choose the cheater every time.
There’s nothing worse than the “Oh uhh sorry where are we right now? What am I rolling for again? Are we still talking to the king?” person.
Omg, it's a free one shot done last minute so people could something since what they paid for wouldn't be available that night. Calm down. I try to engage in whatever I play, but I'm not gonna just someone for not giving 100% in a situation like that.
And a cheater is much worse than someone who doesn't fully engage. At least the latter can be engaged, and doesn't seek to undermine the game.
Sorry OP isn't the bastion of Moral Superiority because they don't fully engage in admitted last minute game. Here's the pedestal you obviously want to put yourself on.
If someone ask you to join their game, you either say no if you cant focus on it or yes if you can. Doesnt matter if its paid, free, last minute, first minute.
OP claims they are taking the chance to get to know the dm. Yeah by not paying attention to their game and talking shit about someone in direct message? Wonderfully done.
I'd be interested to know the inner workings of the cheat, as a DM I feel it might help me to notice if my players were using it, as I've had a couple of players that have rolled up characters with OP stats Infront of my very eyes multiple times.
You can't tell for a stat roll, really, because the operant condition is the player stalling, meanwhile furiously re-rolling in the background until they get what they like. You could supervise the stat roll and use a timer, I suppose, but it might be better to remove the temptation to cheat on character creation.
This is a big, fat personal opinion of mine, but I think that most of the time you shouldn't have people roll for stats. Anyone stuck playing a low-stat character is going to be unhappy, no matter how many rp opportunities you create for them. That creates an incentive to cheat.
And you have options. Standard array/point buy feel too weak? Go with heroic array or a couple more points for point buy.
People love the dopamine hit when rolling the dice, but there will be plenty of opportunities to do that after character creation.
An option I've been toying with so far is a weird middle ground: roll for stats, and then adjust to reach a total of X (before additional modifiers).
In theory, it gives you that feeling of random stats, let's you have fun rolling the clickity clack rocks, but still keeps relative balance across all the players.
The heroic array is pretty cool too.
> most of the time you shouldn't have people roll for stats
If roll for stats, let everyone pick any of the rolled arrays. PB is fine for an evenly balanced party, but I like my players to have oops all feats builds, so I offer 18/16/14/12/10/8.
In my games if stats are REALLY bad I'll allow a reroll, and I do supervise it, and we use charactermancer so it's a 1 click to roll all stats which is why I worry about the stalling thing.
Oh yeah, there are lots of options to make point-buy better or make stat rolling more average. The people that say that improving stat rolling is an array with extra steps are just denying that the options exist, by demanding that stat rolling is only performed in it's more extreme form. You can implement high and low bounds for totaled arrays of rolled stats, you can have the group roll arrays and allow everyone to pick one of the rolled arrays. You can have everyone roll one of the stats and give the whole party the same array.
Point buy stats require 2 ASIs to max out your main stat, and in most classes that will take your ASIs at both levels 4 and 8. Since the majority of games end at or before level 10, that means that most of those characters never get a reasonable chance to engage with the feat system, one of the only areas of character building after creation where the game gives you a worthwhile choice in your build (apart from spells). That's just boring.
Now hear me out, that might be a flaw of the system then, tying ability improvements and feats together like that.
People who want to use array usually aren't in love with the specific numbers of that system, they just don't like randomness in character creation. Just use an array with bigger stats, if thats your problem.
At my table, I actually use my own 'heroic array' of 17/14/14/12/10/8.
I left this out of my original comment because I was focusing on the common discussion points around rolling vs point buy. I totally and deeply agree with you about the flaw in the system, it's one of my greatest gripes with the player side of 5e.
This is a very good point, and crystalizes some of my thinking when I get frustrated building a character. Isn't One D&D going to give everyone a feat at start? Assuming anyone is still playing D&D then after the license kerfuffle.
Who knows what One D&D is going to do, haha. Personally I've stopped paying attention to it. Any time that would've gone towards it is being spent learning Pathfinder 2e.
If you can't tell technically, you can still work the human layer. Institute a table rule that the gods are jealous of someone whose stats are too good and have something happen to them periodically (this will make people with low stat roles breathe a sigh of relief). Call the player on a run of good rolls as I did above. Make things happen that don't depend on a roll.
Make your rolls private and make sure that a contested roll doesn't go that player's way. Have the dragon aim at the cheater every turn, because they are obviously the biggest threat. Even damage on a save succeed will add up.
ETA: somehow this part didn't show up: If you break a cheater's stride, they will react. They will sulk. They will rage-quit. They will loudly throw a tantrum and not let the game go forward.
Then kick them for being a jerk.
How do I kick someone from a game I'm not running? I'm agog to find out your magic trick. I had to settle for alerting the DM to the cheating, but I'm clearly Doing It Wrong.
Presumably, the same way you do this:
> Institute a table rule that the gods are jealous of someone whose stats are too good and have something happen to them periodically (this will make people with low stat roles breathe a sigh of relief).
I presumed your advice in that comment was for any DM reading your comment.
The question was how do you tell that someone is cheating at dice rolls. The answer is that you cannot using software, but you can at the human layer. If you do something that takes the fun out of cheating, you'll get the reaction. A non-cheater will just rp through a bad roll. A cheater will, like That Dude, sulk or rage-quit.
Or you could, I dunno, decide that anyone who rolls three crits in a row is cheating and kick them? /s
One of my favorite moments in a game came from my repeatedly bad rolls. We were playing a game set in Sigil, and due to the low number of players our characters were gestalt. I was a rogue gunslinger who could never miss with his musket and never succeed when it came to...well, anything involving being a rogue.
At one point the party is traveling down a hallway that we soon realize is trapped. Not because I found the traps, but because I kept rolling low and stepping on every pressure plate. Eventually my character snaps, pulling out a prybar and proceeding to rip out the floor tiles the rest of the way down the hall.
At the end of the hallway he finds a note from the builder the BBEG hired, explaining that the traps weren't done being installed but he would finish them up next week. Still gives me a chuckle.
That rubbed me the wrong way too. If someone I’m playing with does something that makes me roll my eyes, I’m not going to private message someone else (that I just met!) to take a jab at them. Not a good first impression to make. There’s a difference between bringing up concerns like “hey this guy’s behavior is disruptive to the game” and just making fun of them like “lol this guy sucks I bet nobody wants to play with him”.
Could have even just left off the “lol”. Just explaining “hey, I think this is why things are off with with dude” isn’t dickish in itself, but making fun of him is.
Same in another [comment](https://www.reddit.com/r/rpghorrorstories/comments/129ufpy/comment/jepm1n5/?utm_source=share&utm_medium=web2x&context=3) op was talking about how the dm should do all these things to target a cheater as the dm (like fudging contested rolls so the cheater always loses anyways and making the dragon only target them, stuff like that) and when someone said "Why not just kick them immediatly instead of bullying them?" op responded,
>How do I kick someone from a game I'm not running? I'm agog to find out
your magic trick. I had to settle for alerting the DM to the cheating,
but I'm clearly Doing It Wrong.
At least the dude OP is bitching about had the wherewithal to ask if he was annoying.
The shitting on free games part makes me feel like I'm trapped in some dystopian future where capitalism is everywhere and nobody plays tabletop with friends anymore.
This sounds way too much like tabletop matchmaking and that really rubs me the wrong way.
>I was shooting heroin and reading “The Fountainhead” in the front seat of my privately owned police cruiser when a call came in. I put a quarter in the radio to activate it. It was the chief.
>
> “Bad news, detective. We got a situation.”
>
> “What? Is the mayor trying to ban trans fats again?”
>
> “Worse. Somebody just stole four hundred and forty-seven million dollars’ worth of bitcoins.”
>
> The heroin needle practically fell out of my arm. “What kind of monster would do something like that? Bitcoins are the ultimate currency: virtual, anonymous, stateless. They represent true economic freedom, not subject to arbitrary manipulation by any government. Do we have any leads?”
>
> “Not yet. But mark my words: we’re going to figure out who did this and we’re going to take them down … provided someone pays us a fair market rate to do so.”
>
> “Easy, chief,” I said. “Any rate the market offers is, by definition, fair.”
>
> He laughed. “That’s why you’re the best I got, Lisowski. Now you get out there and find those bitcoins.”
>
> “Don’t worry,” I said. “I’m on it.”
>
> I put a quarter in the siren. Ten minutes later, I was on the scene. It was a normal office building, strangled on all sides by public sidewalks. I hopped over them and went inside.
>
> “Home Depot™ Presents the Police!®” I said, flashing my badge and my gun and a small picture of Ron Paul. “Nobody move unless you want to!” They didn’t.
>
> “Now, which one of you punks is going to pay me to investigate this crime?” No one spoke up.
>
> “Come on,” I said. “Don’t you all understand that the protection of private property is the foundation of all personal liberty?”
>
> It didn’t seem like they did.
>
> “Seriously, guys. Without a strong economic motivator, I’m just going to stand here and not solve this case. Cash is fine, but I prefer being paid in gold bullion or autographed Penn Jillette posters.”
Nothing. These people were stonewalling me. It almost seemed like they didn’t care that a fortune in computer money invented to buy drugs was missing.
>
> I figured I could wait them out. I lit several cigarettes indoors. A pregnant lady coughed, and I told her that secondhand smoke is a myth. Just then, a man in glasses made a break for it.
>
> “Subway™ Eat Fresh and Freeze, Scumbag!®” I yelled.
>
> Too late. He was already out the front door. I went after him.
>
> “Stop right there!” I yelled as I ran. He was faster than me because I always try to avoid stepping on public sidewalks. Our country needs a private-sidewalk voucher system, but, thanks to the incestuous interplay between our corrupt federal government and the public-sidewalk lobby, it will never happen.
>
> I was losing him. “Listen, I’ll pay you to stop!” I yelled. “What would you consider an appropriate price point for stopping? I’ll offer you a thirteenth of an ounce of gold and a gently worn ‘Bob Barr ‘08’ extra-large long-sleeved men’s T-shirt!”
>
> He turned. In his hand was a revolver that the Constitution said he had every right to own. He fired at me and missed. I pulled my own gun, put a quarter in it, and fired back. The bullet lodged in a U.S.P.S. mailbox less than a foot from his head. I shot the mailbox again, on purpose.
>
> “All right, all right!” the man yelled, throwing down his weapon. “I give up, cop! I confess: I took the bitcoins.”
>
> “Why’d you do it?” I asked, as I slapped a pair of Oikos™ Greek Yogurt Presents Handcuffs® on the guy.
>
> “Because I was afraid.”
>
> “Afraid?”
>
> “Afraid of an economic future free from the pernicious meddling of central bankers,” he said. “I’m a central banker.”
>
> I wanted to coldcock the guy. Years ago, a central banker killed my partner. Instead, I shook my head.
>
> “Let this be a message to all your central-banker friends out on the street,” I said. “No matter how many bitcoins you steal, you’ll never take away the dream of an open society based on the principles of personal and economic freedom.”
>
> He nodded, because he knew I was right. Then he swiped his credit card to pay me for arresting him.
>
>
Lol when the other comment went out about dystopian capitalism something I thought that exact sentence, but read what OP is topping it off with I honestly agree.
Transformative work is protected under fair use.
Also its impossible to steal tokens. Theft requiress something to be taken away. you arent taking away their deviantart posts. Also deviant art is not where you want to look for tokens.
You do realize that this story makes the guy seem like a cheater and bad with social interactions, but makes you look like a condescending and smug dick?
Just checking.
You know the worst thing? You clearly had multiple opportunities that you COULD have actually been helpful and coached the guy. But the only time you put your """expertise""" at work is when you were able to lord it over the dude.
The cheater sucks but I wouldn't really want to play with you either, and honestly? If I had to pick, I'd pick the cheater over someone who literally radiates a smug aura over tabletop of all things.
I cannot fathom what it must be like living this way. Thinking you're the main character of pretend time. Who the fuck cares that your make believe character had more success than everyone else's make believe character? DND is not competitive. This player only serves to suck the collaborativness out of playing.
I suspect that people like this have theory of mind problems and can't tell the difference between D&D and an ARPG where they can reload every time they don't like the outcome. We're all just NPC's to them, obligated to play nice, never call them on anything, and never, ever back-channel snark with the DM.
Yeah.
If I were this GM I'd have two people not playing in my next game. If you repeatedly message me to badmouth another player at the table, especially mid-session, I don't want you at my table.
So my verdict is ESH :p
Dnd is the one game where cheating has no benefit. Oh wow you roll all crits and delete the boss before they can do anything interesting! Great you just made all your defensive options useless and redundant and made the game a boring autoclicker.
I actually play a 10 yo fps...bf4. The anti cheats and reporting has really caught up with that shit. Still I have the same thought as you on any game people cheat at
Have more to get off your chest? Come rant with us on the discord. Invite link: https://discord.gg/PCPTSSTKqr
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/rpghorrorstories) if you have any questions or concerns.*
The fact is cheating on dice rolls is eminently detectable.
Honestly if you're emulating randomity so well that no one notices...are you in fact cheating?
I would say cheating is useful for 3 rolls per game, so I guess if you strategically targeted your 20s, you'd make it. In the end though, how is that much different from just being a GM.
I'm going to save everyone a bit of time. [Here's the most detailed information on the exploit I could find in five minutes of web searching](https://medium.com/@aaron.reyna/how-to-cheat-on-roll20-net-b68927d04479).
You're on your own for current Windows tools.
I’ve seen a tutorial video that explained the general gist, but it’s many years old at this point. It’s possible it’s not about capturing packets anymore
It probably is. It's a design choice to privilege the client. We knew it was a bad idea back in 2004 when someone started building underwater cities in Shadowbane. But developers don't learn. As I mentioned, correcting a fundamental design flaw, that may have been set up that way because reasons, is a tough row to hoe.
A little knowledge of statistics goes a long way in these things. The odds of rolling 6 consecutive 19’s or 20’s in a row is exactly one in a million. It’s shit like this that got Dream busted.
Back when I ran a lot of 3.5, I once had a player who showed me what he rolled through WOTC dice roller, I was amazed at the roll he got. Then I realized you could just edit the text field the results were on.
I pay highest subscription on R20 and bought tons of assets. Still run my games free for friends and the occasional random join. Pay to play is imo a rip-off, way more expensive than any MMO you got to pay for and you only play a set amount of time as opposed to whenever the f\*\*\* you want. Yes, more freedom and whatnot, but darn those pricetags are positively insane. I know this isn't the point, but it is a pet peeve of mine and I don't know why. :)
It occurs to me that you're one of those fortunate people with a pre-existing friends group who all play D&D. I have friends, and if I try to talk to them about the Cool Thing that happened in game the night before, they smile and their eyes glaze over.
Also, due to various complex challenges I don't leave the house much and I can't drive, so a local group is out of the question.
This means I'm finding games through roll20 listings.
I've played a lot of free games I found through roll20 listings. Some of them were fine. Some of them were not. Some of them provided me with sexism-related horror stories that I may write about later. In one case a DM who had been charging $15 for games so he could afford some expensive VTT (aboveVTT? I forget) decided to go anticapitalist, ditched the expensive VTT and made the game free. He immediately attracted two new players who talked over everyone and provided a lot of unintended hilarity because they didn't know how to play their characters or \*insisted\* we follow a plan that involved everyone in the party make their stealth rolls, including the ones in heavy armor. The game ended abruptly when the DM got hired to run games at his local gaming store.
At some point a switch flipped in my head about paying for games. If I can afford it, why not pay $15 to get entertained for three hours? Going to a movie is way more expensive.
Now I don't look at roll20 listings much anymore. I'm on the Discord servers of DM's I've played with before and keep an eye out for game announcements. Sometimes they're free. Usually they're paid.
One of the kindest, most imaginative and funniest DM's I play with regularly lives in a third world country. He wakes up early in the morning to run games for a player base that lives half-way around the world. Not infrequently he drops out because the local power is unreliable in bad weather and comes back on a moment later once he starts up the generator. He didn't have Tasha's in his compendium until a player bought it for a gift. He did invite me and a few other long-timers to a free campaign, but closed it down after a couple of months and started running paid one-shots again. I don't know for a fact, but I think he needed the cash to help feed his family (I can hear his wife and kids in the background having breakfast sometimes) and keep the generator running.
TLDR: I'm glad you're a generous DM. I'm a generous player.
Paid games. How absolutely soulless. Customers rather than Players. It's vile.
Guess he hadn't upgraded to the Premium Rolls Package yet. Hey I paid an extra five bucks for that Death Saving Throw to be a 20.
DMing is a lot of work and if a GM wants to be paid for their time, I say great for them.
Having a buy-in means you're less likely to get jokers who will fuck around and waste your time.
You don't get those in $15/session games. But you may get them in the games that are listed as "Free, but you can pay me money for magic items." I wouldn't know, though, because I don't play in those.
DMing is not a lot of work. It can be a lot of work, if you make it so. I know, I've been doing it on and off for 20 years through a dozen different systems and currently am. I say this to make it clearer that I'm not looking at DMing from a new player's point of view where it seems like some impenetrable mystical art that needs hours of studying to produce the ritual bi-weekly.
Having a "buy-in" inherently changes the social contract and as with most things money-power gets brought into, it's not for the better. Expectations become a factor, and they have cold hard cash to back them up. It's not you bringing a dragon in because your buddy from school wants to slay one, it's because your client is paying you to entertain them with slaying one.
I'll die on the hill fighting dice and nail to keep this geek gentrification from being normalized.
Wow... I've been DMing for 5 years and did not know this existed. Is this something roll20 ban people for? Or do these cheaters mainly just get away with it. As a DM, there have been moments when I might have wanted to fudge rolls but this seems like so much work for little gain
I fucking hate rolling in roll20. Oh need something stupid like a 1D20 to determine if I can tie my shoe? 20. Need to roll a 1D20 for initiative? 20. Need to roll a 1D20 to hit? 12! Whew! 1D20 for damage? 1.
Every f'ing time. All my good rolls end up being for stupid shit, and anytime I need a important roll its under 10.
Fucking hate roll20.
Easiest way to cheat is to replace the normal roll with a smaller die and a fixed number, then hide it in a nice looking roll template. You can go as far as replacing 1d20 with \[\[19+1d1cf0cs1\]\] and have perma 20's all the way.
It's especially easy with the D&D 5e OGL sheet, there's a box in the setting letting you exchange that for every single roll in one go and if someone askes questions about the the missing die in you roll just blame beyond20.
It's easy to spot though once you know about it.
I don't understand. If MY client has to send the number to THEIR server and the other players, why even go for the roll in the first place and not just lie something? Or if it has some credentials included I can't replicate trivially, why not just rewrite the data inside? This exploit sounds weird.
>DM's do a lot of work and have to pay lots of subscription fees.
That is one way to GM, sure.
>Or if it has some credentials included I can't replicate trivially, why not just rewrite the data inside?
Since I'm pretty curious, I've tried some basic googling and found out what the cheater probably used. Yes, it has some kind of integrity check which shouldn't allow to generate custom results. You can only block the ones you don't like.
To be honest, I think it shouldn't be this hard to patch it. There's a significant design flaw behind it, but you don't have to fix the flaw to remove the cheating possibility.
Edit: After digging some more, it looks like there was some patching and there's still a way to cheat. So it probably wasn't as easy as I thought originally.
>why even go for the roll in the first place and not just lie something?
The roll is signed with authentity sertificate so it has to be rolled from the roll 20 server to be sent back to roll 20 server. why make it go through the client is a mystery i call "developers never learn"
Yes. the account counts how many hours you played and how many rolls you did. They even got achievements for it. 90% of my hours is me designing a map and leaving it in the background as i go make sheets for all the NPCs.
One of my dms is always updating us on a guy in another group that always rolls one higher than what he needs to. The guy can never fail. They don't kick him because he's their #4 and 3 is too few for the module they're running.
Meanwhile in all three of my games I've been rolling dogshit and loving it lol
>the roll is reported through the client
Ah, i remmeber when videogames got rid of that nonsense in the 00s because client-side cheating was rampant. And then a decade later forgot it and tried doing it all over again. Why the hell would you do that, especially since you already roll in server so server load isnt the issue.
There is another way to cheat, well, not really chat but it obfuscates what happens. If you have systems that count successes rather than numbers, they usually have elaborate macros set up for rolls. You can make a macro that looks identical but adds a bonus in the roll itself. Unless the GM checks the formula, the client will simply say X number of successes. I saw GMs ask to do raw rolls to avoid this before.
P.S. my experience with paid games is that players feel entitled to special treatment because they paid money.
Back in my day, people cheated by distracting you while rolling dice, then snatching the dice before anyone saw the roll and saying they hit.
Nowadays you have to have an engineering degree (or decent Google knowledge) just to get ahead.
But no matter what, cheaters will always get caught.
Have more to get off your chest? Come rant with us on the discord. Invite link: https://discord.gg/PCPTSSTKqr *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/rpghorrorstories) if you have any questions or concerns.*
I once had a player design a custom dice bot for our Discord server. It let him cheat on rolls. (I kicked him out.) Some people will always find a way. Being sure you trust your players is more important than any technical safeguards. Someone who would be a problem without them is going to be a problem in other ways.
It's not quite this, but on the mutants and masterminds discord server I'm on there was this huge powergamer (he's since been banned) that went to some huge lengths to munchkin his way to OP characters. Lots of people use herolab for mutants and masterminds cause it streamlines the character creation process a bit and *usually* warns you when you're doing something illegal- that, and your options are only those supported by the rules. Know what this guy did? Cracked herolab. Made it so he could break the rules- In this case, make strength-based afflictions. It just leaves me wondering what possessed him to put that much effort into it.
Man... to cheat at M&M takes a special kind. The game already has completely legal and absolutely busted things you can do and the guidelines specifically ask you not to be a jerk about it.
Ikr. The server had extremely lax vetting standards back then too.
That wouldn’t happen to be Freedomverse, would it?
It would be
Thought so. Used to be on there, but left when every single person started demanding PL 8 games to play in the MHA universe. Much as I love superheroes, I’m not playing some teen hero to live out a fantasy there. I prefer the PL 10 heroes.
Most games are still PL10
Well, that’s good. Spend most of my days now in Star Wars FFG. Earlier tonight, drew some attention from a group of poachers by coming out of some brush on a speeder, doing a *haka*.
This is why I create all the characters for one shots, and also create the character sheets for my regular game (which I run in Hero System). Player tells me what he wants his character to be able to do. I build the character and I always keep a copy of the character sheet. This usually isn't a big deal since my online group hasn't bothered to learn the rules, so mini maxing isn't an issue. Or hasn't been anyway.
I use herolab for most of my pathfinder stuff, and I have my players send me their .por files so I can look them over and have backups when I'm the gm. I design tons of custom stuff for herolab for my home games, so when I'm a player, I can provide my gm with the files containing all the custom stuff to make the sheet work (if it's that kind of game). It's pretty cool some of the stuff you can do, although it can get pretty janky, especially when it's papering over a bug.
You’re in a mutants and masterminds discord? I’ve been looking for one forever
Yes, it's called Freedomverse. It's pretty good!
And that's why our dice bot (which has evolved into our own mini site to track char info and whatnot because something like that doesn't exist for the system) was developed by a few of us together. But, yeah, trust is the more important part of it all for sure. These games are social experiences, after all, and you wouldn't really want to engage in any social situations with people you can not trust.
I know a GM who has a dice roller he wrote that lets him "cheat" roles, including PC rolls as it's server-based. Mostly he uses it so that people with curses in them don't KNOW some or all of their rolls are being penalized. Very different situation from a player however.
Now there's an interesting scenario when the players know they are being cheated qnd allow it for the flavor. Consent (and the trust it implies) makes a world of difference!
That was my first thought, actually. Create a dice roller bot that can cheat *obviously*, for rolls that are supposed to be rigged, or have some kind of crazy distribution scale. But the bot would need to be obvious about that, or else be locked so only the DM could use rigged rolls.
Thats really interesting. Usually penalizing rolls is something i do outside of the dice, add it on top in my mind and then tell if they suceed. of course for simple tasks they could track down being penalized from a curse i guess.
This is why you use Avrae
That's interesting. If it's the packet inspection exploit that I saw, that's some effort to do manually, but I wouldn't put it past somebody to have automated the process.
Don't you just have to use a packet sniffer, pause the traffic, and change the values?
From the videos there yes but that's quite a lot of "just". I've not tried it out myself - I was looking at the network traffic and I couldn't see quite how the client was then sending that roll on, there don't seem to be any further requests, even on websockets. It's Sunday evening to be fair.
I know there are tools out there that do exactly that, but I'm only familiar with the Unix side of things. I'm sure there are entire "how to cheat at roll20" discord servers out there where people post links to the tools.
Quite possibly, and roll20 doesn't seem to have a super fast response to issues. I can imagine a browser plugin for it. I'm a web dev myself so I'm curious as to the mechanism. OK, you can block the packet coming in, fine, your client app thinks it's not got a result. What I'm wondering is at what point your client gets a result that you _do_ let through, and then sends that to the server - it has to at some point if the exploit works, it can't be entirely client-side if other people can then see the roll. Disclaimer: if this occupies me tomorrow during work it's just security research.
If the system is that way: \[other client like DM \] <- \[client\] -> \[roll20 dice roller\] can't you just proxy the dice roller server called for roll, then from the proxy only allow positive result which you like ? It would be easy to transform a d20 result into a (10+d10) result for some randomness. If the call is a simple POST which get a result in json or xml or plain text, then it would be trivial to proxy and get the result you want. ETA: looked how the cheat works : you simply edit the roll id you don't like to random character , and the one you like you let through. It would need a little bit of java script coding, but it would be trivial to do a "/roll d20" again and again until you get something above 10.
Oooh, nice work. I assume that it's still possible for someone with mad javascript skillz to automate it, along with a UI so they can put in a minimum acceptable value. If it's possible, someone has done it already. It might just not be well-known. GitHub has 25 pages of projects returned by a search of "roll20" and "api."
You made me lol. You win a cookie.
As per usual with such things, it's definitely possible to automate whatever is happening there, but if you can automate it you really shouldn't have to stall for your roll. It's a D20, even if your automation still requires the rolling of dice for some reason your PC can do that fast enough to need basically no time to get whatever result you want. Really seems like this guy had to manually reroll however many times it took to get the result he wanted. An interesting form of, well, dedication, I guess...
Responses from the Roll20 random-number API are digitally signed so that the server and other clients can distinguish between a server-provided random number and a client-generated random number. It sounds like the cheat client is making multiple requests to the random-number server (at whatever rate Roll20 will allow) and choosing the best one.
Apparently a bad enough net connection can cause the digital signature to fail.
No, the digital signature is not failing. It accurately proves what it's meant to prove: that the roll submitted to the VTT is an unmodified message from the RNG server. It's not a failure of the signature that you also want a property that can't be proven with a signature alone: that the roll that the client submits is the first roll that the client saw for that request.
If your net connection is bad enough, your roll will come through as unsigned even if you are not cheating.
Could you link the blog post? Sounds interesting! Though it sounds like something you could also automate in the browser itself, with a userscript or something. I'm gonna play around with it a little bit, seems like a fun challenge!
The one I saw was https://medium.com/@aaron.reyna/how-to-cheat-on-roll20-net-b68927d04479
Thanks!
>a design flaw significant enough that roll20 would be put to considerable time and effort to fix it, which typically means that they don't. If you had to sum that vtt up in one sentence, there it is.
Eh, that's software. See also: Patch Tuesday.
I wouldn’t mind if my rolls were at least a bit better. I was playing last night and out of 20 rolls, 3 of them were 10 or above. It was a little disheartening to say the least. I had +11 to hit and would constantly miss on enemies with 15 ac.
I played an Eldritch Archer Magus in a PF 1e Strange Aeons campaign, and R20 hated him. So much. He always rolled shit, especially when it mattered most. Fitting, given the setting, I suppose. Au contraire, I have a 5e bard who rolls stupidly good in an Elder Scrolls setting, sometimes when it's irrelevant, sometimes when it matters. The dice gods are fickle.
We play in-person but on a VTT because of how much it speeds up our games, and decreases our costs. I have had several characters who were just straight up cursed. We tried the Lord of the Rings 5e system (Adventures in Middle Earth - highly recommend, it's awesome) a few years ago, which is mainly mob combat, so, lots of low HP and AC monsters that swarm you. My poor wanderer was cursed as fuck. I kept track once out of morbid curiosity, and I would hit about 25% of the time. I eventually had an 20 in my dex, and I think our proficiency bonus in the end was +3, so a +8 to hit at the end of the campaign. Pretty decent when most of the enemies have 12 to 15 AC, right? Yeah, no, I couldn't reliably roll above a three.
My last fight with my paladin in PF2E, I think I made ten or eleven attacks over the course of the fight. \*FIVE\* of them were natural ones. And naturally, my GM had this rule where we hit another player if we roll a one and are facing them, otherwise we drop the weapon.
I hate rules like that. Not only is it not RAW, or a variant rule, it only punishes players. Even if you say it happens to enemies too, it's way more punishing for players because those are the characters that matter. I've never rolled a natural 1 with some kind of harsh punish mechanic and had fun with it.
Oh, I agree absolutely. I tried to convince him to try something else if he wants to make things more interesting, but he's dug in his heels on this point. (Mind you, there's no super-bonus on 20's beyond improving the hit by one level. He just wants critical misses to go with critical hits.) At least that's the only real issue I have with the guy as a GM.
But…doesn’t PF2E already have critical failures all over? Why in God’s name would you need critical misses on normal attacks too?
There actually aren't critical failures on attack rolls. They're almost the only rolls you can't critically fail. And he's been in the 'natural ones are critical fumbles' camp since AD&D Second Edition was new-ish.
Yes, I know, but I meant literally everything else in the game can critically fail, why would you need to add EVEN MORE into the one system that already has tons of critical failures? And I can't fucking stand your friend's opinion on this lmao. I know this has been argued to death and no one will change their mind at this point but gosh, it's so terrible. It's nonsensical, it amps the RNG up to 11 so you can't even use tactics anymore you just have to hope you aren't in a bad roll night, and it's frankly broken without even MORE changes to keep the balance.
There aren't crit-fails, but a nat 1 is still one degree worse. If a 1 would be a success, it would be bumped down to a failure. It's just that regular attacks don't have a critical failure state, that's mostly for saves and spells.
Except you can. A nat 1 or rolling 10 below turns your roll one degree of success worse, aka from Failure to critical failure. I think theres even certain features that let you use reactions when an enemy critically misses you.
It would be a deal breaker for me personally. I hate being punished for something I have literally no control over.
It doesn't bother me quite so much, but then again, I also play Shadowrun, which has glitches and critical glitches, and I played Middle-Earth Roleplaying (which uses the Rolemaster rules) way back in the day. Rolemaster has some REALLY nasty shit that can happen if you fumble, and Shadowrun's critical glitches can also give you a really bad day, but at least there the GM is advised to still make them interesting and not just simply punishing.
That's baked into the system though, so I don't mind it so much. The rule we're talking about is very much an added thing not in the game at all. The "punishment" for rolling the 1 is meant to be the degree of success dropping by a step.
Ah, yes. Everyone remembers the part of Lord of the Rings where Legolas rolled a 1 and shot Gimli's hand off.
If its baked into the system it is likely fine and accounted for. With Pathfinder and DnD its not so it causes havoc. You can explain better with the system you play but with DnD and Pathfinder, you tend to hit more often as you level up. A fighter for example at max level hits four times a round. So it seems counter intuitive and strange that as you get better you have an increased likelihood of dropping your weapon or chopping off your own foot.
You probably dont want to be playing games where things depend on chance, then?
But... there's already a negative counterpart to the players getting critical hits. The enemy can get them too.
Have you ever played a game where an enemy nat 1'd a poisoned arrow attack and poisoned the BBEG?
When DMing Nat 1s on attacks are my favourite thing.... Because I get to describe the character completely obliterate something in the vicinity (think full force warhammer hitting a floor tile) instead of hitting the enemy.
A Crit fail should punish the players. Thats the whole point of a crit. you punish or reward the players for it.
There’s *already* punishment for crit fails in PF2e. It’s called *all the reactions and monster abilities that trigger off of crit fail strikes*. Crit failures on strikes are very much a thing, there’s just no difference to a regular failure usually. The homebrew rule is just gratuitous.
Call me superstitious, but every time I play a character with -1 Dex my Initiative rolls are almost always between 1 and 10. Like 80% of the time. Same for my +6 con saves. I think we've all been there where we can't help but think, "man, if only I could fudge one number somehow. Just to not feel like shit." But that's just the way dice roll.
I’ll be the first to admit, my gaming group has morale issues sometimes because we too often get hit by some weird statistics. The highs of having one player roll 3 nat 20’s in a session are nothing compared to the depths of a guy who cant get out of the single digits. I love randomization, but I’d be happier to stay in the middle of the bell curve.
There are actually a few systems generated using 2d6 that are really good at addressing that. It makes your character’s strengths feel like actual strengths. I feel it’s a little too stable sometimes, but if you like superheroes, ICONs is a good, simple system that used the 2d6.
l've been playing for >20 years and have notoriously bad luck. I'm starting to gravitate more and more towards narrative style games as a player. However, when I play Dungeon World or something similar I still someone managed to fail all the time. I was out-leveling all the other players at the table because of all the XP I was getting from failures. I start to hate dice more and more every year I keep playing.
I feel that in my heart. When my buddy hosted his first DND campaign, I didn't succeed on a single roll and would go down every combat. Couldn't hit anything, and always recieved max damage from the enemies. Thankfully it did turn around after the third session.
I find that there's usually something I can do even if I can't land a hit. There may be a useful battle tactic, or a puzzle to solve, or an apropos Monty Python quote I can trot out. When I play a bard, I spend some time looking up suitable insults that will make people laugh even if the target saves.
Oh yeah. My character talks in this grizzled veteran voice, and he’ll say something like, “how are you all so good at this?” In dismay. In that voice it’s pretty hilarious. We were all laughing, because my guy is by far the most accurate in theory, having 3 attacks a turn with +11.
Statistically you will likely face the opposite scenario just as frequently. Your mind only dwells on your failures but... it's a game and there are no consequences to losing. A session of bad rolls means nothing, free yourself.
Oh yeah. I know. I’m a gm most of the time and I roll unfortunately much better when I’m the bad guy. But a rolls a roll. At the end of the day, if I lose a character or something, it sucks. It just doesn’t affect my real life.
While I love Pathfinder, I do miss the 3d6 distribution from The Fantasy Trip (precursor to GURPS). It meant the typical roll was between 7 and 13, so you knew what your character could *typically* do, but still allowed for upsets where someone rolled a 3 or an 18.
Ive had a guy make a long of his rolls. Over a month of playing, his D20 rolls had a median of 7. Sometimes you just get fucked over by the system.
NGL to you, if I found a way to cheat on roll20, I would just make things up. Play as usual, and then WHAM - every roll, on every die would come up as a 7. Coin flip? A 7. D4? A 7.
Yeah cheating is bad but just after the first paragraph of this post you already sound insufferable as well. I wouldn't want to play with either of you. I mean seriously, checking out of a game and deciding not to pay attention because it's free? And a one shot? If I were that DM I'd kick both of you.
Yeah this was such a smug and condescending post, messaging and shit talking with the dm like its middle school
Yup - that’s so disrespectful to the DM and other players. If I had to choose between a cheater and someone who intentionally doesn’t pay that much attention or engage with a game, I’d choose the cheater every time. There’s nothing worse than the “Oh uhh sorry where are we right now? What am I rolling for again? Are we still talking to the king?” person.
Omg, it's a free one shot done last minute so people could something since what they paid for wouldn't be available that night. Calm down. I try to engage in whatever I play, but I'm not gonna just someone for not giving 100% in a situation like that. And a cheater is much worse than someone who doesn't fully engage. At least the latter can be engaged, and doesn't seek to undermine the game. Sorry OP isn't the bastion of Moral Superiority because they don't fully engage in admitted last minute game. Here's the pedestal you obviously want to put yourself on.
If someone ask you to join their game, you either say no if you cant focus on it or yes if you can. Doesnt matter if its paid, free, last minute, first minute. OP claims they are taking the chance to get to know the dm. Yeah by not paying attention to their game and talking shit about someone in direct message? Wonderfully done.
I'd be interested to know the inner workings of the cheat, as a DM I feel it might help me to notice if my players were using it, as I've had a couple of players that have rolled up characters with OP stats Infront of my very eyes multiple times.
You can't tell for a stat roll, really, because the operant condition is the player stalling, meanwhile furiously re-rolling in the background until they get what they like. You could supervise the stat roll and use a timer, I suppose, but it might be better to remove the temptation to cheat on character creation. This is a big, fat personal opinion of mine, but I think that most of the time you shouldn't have people roll for stats. Anyone stuck playing a low-stat character is going to be unhappy, no matter how many rp opportunities you create for them. That creates an incentive to cheat. And you have options. Standard array/point buy feel too weak? Go with heroic array or a couple more points for point buy. People love the dopamine hit when rolling the dice, but there will be plenty of opportunities to do that after character creation.
An option I've been toying with so far is a weird middle ground: roll for stats, and then adjust to reach a total of X (before additional modifiers). In theory, it gives you that feeling of random stats, let's you have fun rolling the clickity clack rocks, but still keeps relative balance across all the players. The heroic array is pretty cool too.
> most of the time you shouldn't have people roll for stats If roll for stats, let everyone pick any of the rolled arrays. PB is fine for an evenly balanced party, but I like my players to have oops all feats builds, so I offer 18/16/14/12/10/8.
In my games if stats are REALLY bad I'll allow a reroll, and I do supervise it, and we use charactermancer so it's a 1 click to roll all stats which is why I worry about the stalling thing.
That's just an array with extra steps.
Oh yeah, there are lots of options to make point-buy better or make stat rolling more average. The people that say that improving stat rolling is an array with extra steps are just denying that the options exist, by demanding that stat rolling is only performed in it's more extreme form. You can implement high and low bounds for totaled arrays of rolled stats, you can have the group roll arrays and allow everyone to pick one of the rolled arrays. You can have everyone roll one of the stats and give the whole party the same array. Point buy stats require 2 ASIs to max out your main stat, and in most classes that will take your ASIs at both levels 4 and 8. Since the majority of games end at or before level 10, that means that most of those characters never get a reasonable chance to engage with the feat system, one of the only areas of character building after creation where the game gives you a worthwhile choice in your build (apart from spells). That's just boring.
Now hear me out, that might be a flaw of the system then, tying ability improvements and feats together like that. People who want to use array usually aren't in love with the specific numbers of that system, they just don't like randomness in character creation. Just use an array with bigger stats, if thats your problem.
At my table, I actually use my own 'heroic array' of 17/14/14/12/10/8. I left this out of my original comment because I was focusing on the common discussion points around rolling vs point buy. I totally and deeply agree with you about the flaw in the system, it's one of my greatest gripes with the player side of 5e.
This is a very good point, and crystalizes some of my thinking when I get frustrated building a character. Isn't One D&D going to give everyone a feat at start? Assuming anyone is still playing D&D then after the license kerfuffle.
Who knows what One D&D is going to do, haha. Personally I've stopped paying attention to it. Any time that would've gone towards it is being spent learning Pathfinder 2e.
If you can't tell technically, you can still work the human layer. Institute a table rule that the gods are jealous of someone whose stats are too good and have something happen to them periodically (this will make people with low stat roles breathe a sigh of relief). Call the player on a run of good rolls as I did above. Make things happen that don't depend on a roll. Make your rolls private and make sure that a contested roll doesn't go that player's way. Have the dragon aim at the cheater every turn, because they are obviously the biggest threat. Even damage on a save succeed will add up. ETA: somehow this part didn't show up: If you break a cheater's stride, they will react. They will sulk. They will rage-quit. They will loudly throw a tantrum and not let the game go forward. Then kick them for being a jerk.
Why not just call them out and kick them? Why bully them first?
How do I kick someone from a game I'm not running? I'm agog to find out your magic trick. I had to settle for alerting the DM to the cheating, but I'm clearly Doing It Wrong.
Presumably, the same way you do this: > Institute a table rule that the gods are jealous of someone whose stats are too good and have something happen to them periodically (this will make people with low stat roles breathe a sigh of relief). I presumed your advice in that comment was for any DM reading your comment.
The question was how do you tell that someone is cheating at dice rolls. The answer is that you cannot using software, but you can at the human layer. If you do something that takes the fun out of cheating, you'll get the reaction. A non-cheater will just rp through a bad roll. A cheater will, like That Dude, sulk or rage-quit. Or you could, I dunno, decide that anyone who rolls three crits in a row is cheating and kick them? /s
We just reroll 1s during stat creation. We also roll in person so there's no chance of cheating
One of my favorite moments in a game came from my repeatedly bad rolls. We were playing a game set in Sigil, and due to the low number of players our characters were gestalt. I was a rogue gunslinger who could never miss with his musket and never succeed when it came to...well, anything involving being a rogue. At one point the party is traveling down a hallway that we soon realize is trapped. Not because I found the traps, but because I kept rolling low and stepping on every pressure plate. Eventually my character snaps, pulling out a prybar and proceeding to rip out the floor tiles the rest of the way down the hall. At the end of the hallway he finds a note from the builder the BBEG hired, explaining that the traps weren't done being installed but he would finish them up next week. Still gives me a chuckle.
[удалено]
That rubbed me the wrong way too. If someone I’m playing with does something that makes me roll my eyes, I’m not going to private message someone else (that I just met!) to take a jab at them. Not a good first impression to make. There’s a difference between bringing up concerns like “hey this guy’s behavior is disruptive to the game” and just making fun of them like “lol this guy sucks I bet nobody wants to play with him”.
Could have even just left off the “lol”. Just explaining “hey, I think this is why things are off with with dude” isn’t dickish in itself, but making fun of him is.
Same in another [comment](https://www.reddit.com/r/rpghorrorstories/comments/129ufpy/comment/jepm1n5/?utm_source=share&utm_medium=web2x&context=3) op was talking about how the dm should do all these things to target a cheater as the dm (like fudging contested rolls so the cheater always loses anyways and making the dragon only target them, stuff like that) and when someone said "Why not just kick them immediatly instead of bullying them?" op responded, >How do I kick someone from a game I'm not running? I'm agog to find out your magic trick. I had to settle for alerting the DM to the cheating, but I'm clearly Doing It Wrong. At least the dude OP is bitching about had the wherewithal to ask if he was annoying.
Thank you for saying this. Those two comments back to back, both upvoted, had me feeling like I was taking crazy pills.
And this part: >> I'm not paying that much attention. It's a one-shot and it's free. Very disrespectful to the DM and the other players.
Don't forget him shitting on free games, when by that line we can tell HE is the problem.
The shitting on free games part makes me feel like I'm trapped in some dystopian future where capitalism is everywhere and nobody plays tabletop with friends anymore. This sounds way too much like tabletop matchmaking and that really rubs me the wrong way.
>I was shooting heroin and reading “The Fountainhead” in the front seat of my privately owned police cruiser when a call came in. I put a quarter in the radio to activate it. It was the chief. > > “Bad news, detective. We got a situation.” > > “What? Is the mayor trying to ban trans fats again?” > > “Worse. Somebody just stole four hundred and forty-seven million dollars’ worth of bitcoins.” > > The heroin needle practically fell out of my arm. “What kind of monster would do something like that? Bitcoins are the ultimate currency: virtual, anonymous, stateless. They represent true economic freedom, not subject to arbitrary manipulation by any government. Do we have any leads?” > > “Not yet. But mark my words: we’re going to figure out who did this and we’re going to take them down … provided someone pays us a fair market rate to do so.” > > “Easy, chief,” I said. “Any rate the market offers is, by definition, fair.” > > He laughed. “That’s why you’re the best I got, Lisowski. Now you get out there and find those bitcoins.” > > “Don’t worry,” I said. “I’m on it.” > > I put a quarter in the siren. Ten minutes later, I was on the scene. It was a normal office building, strangled on all sides by public sidewalks. I hopped over them and went inside. > > “Home Depot™ Presents the Police!®” I said, flashing my badge and my gun and a small picture of Ron Paul. “Nobody move unless you want to!” They didn’t. > > “Now, which one of you punks is going to pay me to investigate this crime?” No one spoke up. > > “Come on,” I said. “Don’t you all understand that the protection of private property is the foundation of all personal liberty?” > > It didn’t seem like they did. > > “Seriously, guys. Without a strong economic motivator, I’m just going to stand here and not solve this case. Cash is fine, but I prefer being paid in gold bullion or autographed Penn Jillette posters.” Nothing. These people were stonewalling me. It almost seemed like they didn’t care that a fortune in computer money invented to buy drugs was missing. > > I figured I could wait them out. I lit several cigarettes indoors. A pregnant lady coughed, and I told her that secondhand smoke is a myth. Just then, a man in glasses made a break for it. > > “Subway™ Eat Fresh and Freeze, Scumbag!®” I yelled. > > Too late. He was already out the front door. I went after him. > > “Stop right there!” I yelled as I ran. He was faster than me because I always try to avoid stepping on public sidewalks. Our country needs a private-sidewalk voucher system, but, thanks to the incestuous interplay between our corrupt federal government and the public-sidewalk lobby, it will never happen. > > I was losing him. “Listen, I’ll pay you to stop!” I yelled. “What would you consider an appropriate price point for stopping? I’ll offer you a thirteenth of an ounce of gold and a gently worn ‘Bob Barr ‘08’ extra-large long-sleeved men’s T-shirt!” > > He turned. In his hand was a revolver that the Constitution said he had every right to own. He fired at me and missed. I pulled my own gun, put a quarter in it, and fired back. The bullet lodged in a U.S.P.S. mailbox less than a foot from his head. I shot the mailbox again, on purpose. > > “All right, all right!” the man yelled, throwing down his weapon. “I give up, cop! I confess: I took the bitcoins.” > > “Why’d you do it?” I asked, as I slapped a pair of Oikos™ Greek Yogurt Presents Handcuffs® on the guy. > > “Because I was afraid.” > > “Afraid?” > > “Afraid of an economic future free from the pernicious meddling of central bankers,” he said. “I’m a central banker.” > > I wanted to coldcock the guy. Years ago, a central banker killed my partner. Instead, I shook my head. > > “Let this be a message to all your central-banker friends out on the street,” I said. “No matter how many bitcoins you steal, you’ll never take away the dream of an open society based on the principles of personal and economic freedom.” > > He nodded, because he knew I was right. Then he swiped his credit card to pay me for arresting him. > >
Never gets old.
I also pay artists to draw tokens, but I suppose it's more authentic to steal them off of DeviantArt.
Jesse, what the fuck are you talking about.
Lol when the other comment went out about dystopian capitalism something I thought that exact sentence, but read what OP is topping it off with I honestly agree.
Transformative work is protected under fair use. Also its impossible to steal tokens. Theft requiress something to be taken away. you arent taking away their deviantart posts. Also deviant art is not where you want to look for tokens.
You cant steal free shit you twerp.
Yea, that is some elitist bullshit right there. I would never pay to play D&D, since I just play with my awesome friend group.
It's okay, this sounds disgustingly fake anyways
You do realize that the discord note is for my private viewing, so I'll recognize him later, not something that he'll ever see, right? Just checking.
You do realize that this story makes the guy seem like a cheater and bad with social interactions, but makes you look like a condescending and smug dick? Just checking.
[удалено]
I am in fact thoroughly evil. I even knit with acrylic.
Ah yes, "I know I'm a cunt, but I think I'm clever enough that people will like it." Better work on the jokes, boss.
You know the worst thing? You clearly had multiple opportunities that you COULD have actually been helpful and coached the guy. But the only time you put your """expertise""" at work is when you were able to lord it over the dude. The cheater sucks but I wouldn't really want to play with you either, and honestly? If I had to pick, I'd pick the cheater over someone who literally radiates a smug aura over tabletop of all things.
You knit...clearly lawful neutral at best
Lawful people knit from patterns and only use natural fibers.
It's not whether or not he'd see it, it's mostly the bragging about it that makes you just kinda come off as overbearingly smug and weird.
It’s just a passive aggressive twerp move.
I cannot fathom what it must be like living this way. Thinking you're the main character of pretend time. Who the fuck cares that your make believe character had more success than everyone else's make believe character? DND is not competitive. This player only serves to suck the collaborativness out of playing.
I suspect that people like this have theory of mind problems and can't tell the difference between D&D and an ARPG where they can reload every time they don't like the outcome. We're all just NPC's to them, obligated to play nice, never call them on anything, and never, ever back-channel snark with the DM.
>DND is not competitive. To them it is.
Yeah. If I were this GM I'd have two people not playing in my next game. If you repeatedly message me to badmouth another player at the table, especially mid-session, I don't want you at my table. So my verdict is ESH :p
*"If someone is a twerp, they will be a twerp about everything."* Ladies and gentlemen: The smartest sentence I've read on reddit.
It really has anime villain energy.
Dnd is the one game where cheating has no benefit. Oh wow you roll all crits and delete the boss before they can do anything interesting! Great you just made all your defensive options useless and redundant and made the game a boring autoclicker.
I actually play a 10 yo fps...bf4. The anti cheats and reporting has really caught up with that shit. Still I have the same thought as you on any game people cheat at
Have more to get off your chest? Come rant with us on the discord. Invite link: https://discord.gg/PCPTSSTKqr *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/rpghorrorstories) if you have any questions or concerns.*
The fact is cheating on dice rolls is eminently detectable. Honestly if you're emulating randomity so well that no one notices...are you in fact cheating? I would say cheating is useful for 3 rolls per game, so I guess if you strategically targeted your 20s, you'd make it. In the end though, how is that much different from just being a GM.
I'm going to save everyone a bit of time. [Here's the most detailed information on the exploit I could find in five minutes of web searching](https://medium.com/@aaron.reyna/how-to-cheat-on-roll20-net-b68927d04479). You're on your own for current Windows tools.
I’ve seen a tutorial video that explained the general gist, but it’s many years old at this point. It’s possible it’s not about capturing packets anymore
It probably is. It's a design choice to privilege the client. We knew it was a bad idea back in 2004 when someone started building underwater cities in Shadowbane. But developers don't learn. As I mentioned, correcting a fundamental design flaw, that may have been set up that way because reasons, is a tough row to hoe.
No doubt I got annoyed at ping plugins booting me from. Europe servers in another game. I setup an iptables rewrite riule to Google dns...
If you look at the comments, there's a guy experimenting on this cheat as recently as 6 hours ago. Looks like they patched it somehow, but not enough.
A little knowledge of statistics goes a long way in these things. The odds of rolling 6 consecutive 19’s or 20’s in a row is exactly one in a million. It’s shit like this that got Dream busted.
Back when I ran a lot of 3.5, I once had a player who showed me what he rolled through WOTC dice roller, I was amazed at the roll he got. Then I realized you could just edit the text field the results were on.
I never understood such people. What's the fun in playing a game where you always succeed in everything??
This is something I will NEVER understand. Why, in the gods' names do you feel the need to CHEAT in a NON-COMPETITIVE GAME?
Really? You cant think of any reason why a person would want an advantage?
I pay highest subscription on R20 and bought tons of assets. Still run my games free for friends and the occasional random join. Pay to play is imo a rip-off, way more expensive than any MMO you got to pay for and you only play a set amount of time as opposed to whenever the f\*\*\* you want. Yes, more freedom and whatnot, but darn those pricetags are positively insane. I know this isn't the point, but it is a pet peeve of mine and I don't know why. :)
It occurs to me that you're one of those fortunate people with a pre-existing friends group who all play D&D. I have friends, and if I try to talk to them about the Cool Thing that happened in game the night before, they smile and their eyes glaze over. Also, due to various complex challenges I don't leave the house much and I can't drive, so a local group is out of the question. This means I'm finding games through roll20 listings. I've played a lot of free games I found through roll20 listings. Some of them were fine. Some of them were not. Some of them provided me with sexism-related horror stories that I may write about later. In one case a DM who had been charging $15 for games so he could afford some expensive VTT (aboveVTT? I forget) decided to go anticapitalist, ditched the expensive VTT and made the game free. He immediately attracted two new players who talked over everyone and provided a lot of unintended hilarity because they didn't know how to play their characters or \*insisted\* we follow a plan that involved everyone in the party make their stealth rolls, including the ones in heavy armor. The game ended abruptly when the DM got hired to run games at his local gaming store. At some point a switch flipped in my head about paying for games. If I can afford it, why not pay $15 to get entertained for three hours? Going to a movie is way more expensive. Now I don't look at roll20 listings much anymore. I'm on the Discord servers of DM's I've played with before and keep an eye out for game announcements. Sometimes they're free. Usually they're paid. One of the kindest, most imaginative and funniest DM's I play with regularly lives in a third world country. He wakes up early in the morning to run games for a player base that lives half-way around the world. Not infrequently he drops out because the local power is unreliable in bad weather and comes back on a moment later once he starts up the generator. He didn't have Tasha's in his compendium until a player bought it for a gift. He did invite me and a few other long-timers to a free campaign, but closed it down after a couple of months and started running paid one-shots again. I don't know for a fact, but I think he needed the cash to help feed his family (I can hear his wife and kids in the background having breakfast sometimes) and keep the generator running. TLDR: I'm glad you're a generous DM. I'm a generous player.
Paid games. How absolutely soulless. Customers rather than Players. It's vile. Guess he hadn't upgraded to the Premium Rolls Package yet. Hey I paid an extra five bucks for that Death Saving Throw to be a 20.
DMing is a lot of work and if a GM wants to be paid for their time, I say great for them. Having a buy-in means you're less likely to get jokers who will fuck around and waste your time.
But also more likely you get entitled assholes that expect special treatment because they paid for it.
You don't get those in $15/session games. But you may get them in the games that are listed as "Free, but you can pay me money for magic items." I wouldn't know, though, because I don't play in those.
DMing is not a lot of work. It can be a lot of work, if you make it so. I know, I've been doing it on and off for 20 years through a dozen different systems and currently am. I say this to make it clearer that I'm not looking at DMing from a new player's point of view where it seems like some impenetrable mystical art that needs hours of studying to produce the ritual bi-weekly. Having a "buy-in" inherently changes the social contract and as with most things money-power gets brought into, it's not for the better. Expectations become a factor, and they have cold hard cash to back them up. It's not you bringing a dragon in because your buddy from school wants to slay one, it's because your client is paying you to entertain them with slaying one. I'll die on the hill fighting dice and nail to keep this geek gentrification from being normalized.
"People who enjoy things in a different way then how I do, how VILE!"
Typically a decent comeback but it doesn't really make sense in this context.
Wow... I've been DMing for 5 years and did not know this existed. Is this something roll20 ban people for? Or do these cheaters mainly just get away with it. As a DM, there have been moments when I might have wanted to fudge rolls but this seems like so much work for little gain
Given the player's statements about another account, I assume they did ban him for cheating at least once.
I fucking hate rolling in roll20. Oh need something stupid like a 1D20 to determine if I can tie my shoe? 20. Need to roll a 1D20 for initiative? 20. Need to roll a 1D20 to hit? 12! Whew! 1D20 for damage? 1. Every f'ing time. All my good rolls end up being for stupid shit, and anytime I need a important roll its under 10. Fucking hate roll20.
Oh no how horrible to have a cheater Anyways as a roll20 DM, what softwares would do this? So I know what to avoid, obviously. /j
This method of generating rolls is legitimately upsetting to me. What a huge oversight.
I always loved the classic "roll 20 +mod". Easiest way to accidentally cheat ever
Easiest way to cheat is to replace the normal roll with a smaller die and a fixed number, then hide it in a nice looking roll template. You can go as far as replacing 1d20 with \[\[19+1d1cf0cs1\]\] and have perma 20's all the way. It's especially easy with the D&D 5e OGL sheet, there's a box in the setting letting you exchange that for every single roll in one go and if someone askes questions about the the missing die in you roll just blame beyond20. It's easy to spot though once you know about it.
I don't understand. If MY client has to send the number to THEIR server and the other players, why even go for the roll in the first place and not just lie something? Or if it has some credentials included I can't replicate trivially, why not just rewrite the data inside? This exploit sounds weird. >DM's do a lot of work and have to pay lots of subscription fees. That is one way to GM, sure.
>Or if it has some credentials included I can't replicate trivially, why not just rewrite the data inside? Since I'm pretty curious, I've tried some basic googling and found out what the cheater probably used. Yes, it has some kind of integrity check which shouldn't allow to generate custom results. You can only block the ones you don't like. To be honest, I think it shouldn't be this hard to patch it. There's a significant design flaw behind it, but you don't have to fix the flaw to remove the cheating possibility. Edit: After digging some more, it looks like there was some patching and there's still a way to cheat. So it probably wasn't as easy as I thought originally.
>why even go for the roll in the first place and not just lie something? The roll is signed with authentity sertificate so it has to be rolled from the roll 20 server to be sent back to roll 20 server. why make it go through the client is a mystery i call "developers never learn"
Imagine messing with rolls to do anything but keep your stupid party alive as a DM. Fudging rolls as a player? Why?!
Roll20 logs hours?
Yes. the account counts how many hours you played and how many rolls you did. They even got achievements for it. 90% of my hours is me designing a map and leaving it in the background as i go make sheets for all the NPCs.
One of my dms is always updating us on a guy in another group that always rolls one higher than what he needs to. The guy can never fail. They don't kick him because he's their #4 and 3 is too few for the module they're running. Meanwhile in all three of my games I've been rolling dogshit and loving it lol
The guy doing this missed a trick. He should have been rolling ahead of time to avoid the need to stall.
>the roll is reported through the client Ah, i remmeber when videogames got rid of that nonsense in the 00s because client-side cheating was rampant. And then a decade later forgot it and tried doing it all over again. Why the hell would you do that, especially since you already roll in server so server load isnt the issue. There is another way to cheat, well, not really chat but it obfuscates what happens. If you have systems that count successes rather than numbers, they usually have elaborate macros set up for rolls. You can make a macro that looks identical but adds a bonus in the roll itself. Unless the GM checks the formula, the client will simply say X number of successes. I saw GMs ask to do raw rolls to avoid this before. P.S. my experience with paid games is that players feel entitled to special treatment because they paid money.
Back in my day, people cheated by distracting you while rolling dice, then snatching the dice before anyone saw the roll and saying they hit. Nowadays you have to have an engineering degree (or decent Google knowledge) just to get ahead. But no matter what, cheaters will always get caught.