Sniffen Packets

With a name like Sniffen, it's got to smell good

Notmuch tags and helm

I spend a bunch of time in Emcas notmuch mode. Great for what it is, but so much opportunity to integrate better with Emacs. For example, it’d be nice if tags were more active:

(defun helm-completing-read-notmuch-tag (prompt collection test require init hist default inherit-input-method name buffer)
  "Completing read on notmuch tags, preferring those on this line"
  (let ((local-tag-list (notmuch-search-get-tags)))
    (or ; voodoo from helm-completing-read-symbols
      :sources `(((name . "Local Tags")
                  (action . identity)
                  (candidates . ,local-tag-list))
                 ((name . "Global Tags")
                  (action . identity)
                  (candidates . ,collection)))
      :prompt prompt
      :buffer buffer
      :input init
      :history hist
      :resume 'noresume
      :default (or default ""))

(add-to-list 'helm-completing-read-handlers-alist '(notmuch-search-filter-by-tag . helm-completing-read-notmuch-tag))

(defun notmuch-search-filter-by-tag-at-point ()
  (notmuch-search-filter-by-tag (thing-at-point 'symbol)))
(define-key notmuch-search-mode-map "T" 'notmuch-search-filter-by-tag-at-point)

13th Age: Two Hour Demo

We tried the two-hour demo of 13th Age last night. Everybody seemed to have fun. I particularly heard appreciation for the One Unique Thing and Background bits—that they let players specify parts of the setting, and seem to work better than the average of such mechanics. In more detail:


We had four characters, chosen from the plentiful pregens available from Pelgrane and its fans:

  • Trip (Andy), a Dark Elf Wizard. Unique: “The only Dark Elf child of the Elf Queen,” which we decided meant he was the heir if the Court shifted from the High to the Dark elves. His backgrounds made him a Member of the Queen’s Darts 5, a Librarian 2, and a Woodland Protector 1.

  • Tweez (Nick), Marquis of Dumberbridge, Draconic Rogue. Unique: “Hatched from a 5000 year egg stolen from the Priestess’s Temple.” His backgrounds mark him as a Fake Courtier 4, an Underground Survivalist 4, and of course a Thief 5.

  • Meither (Danielle), a Draconic Fighter. Unique: “Born to human parents,” but apparently identical to Tweez. Her backgrounds were Emperor’s Son’s arms-master 4 and Well weathered 4.

  • Frederick (Jesse), a Gnome Bard. Unique: “Read the Book of Forbidden Prophecy and didn’t die of it. Remembers some of it in spurts.” His backgrounds were the somewhat wordy Confessor-Cleric of the Traveling Order 5 and Spoiled daredevil carouser known throughout the Empire 3.

All the players figured out that if they can only use one background per roll, they should have a small number of very broad, very backgrounds. I think they played weirdos specifically because it was a one-night game.

Of the 13 icons, these four characters were only interested in five (\(+\) positive, \(\sim\) conflicted, \(-\) negative):

Icon Trip Tweez Meither Frederick
Priestess \(-1\) \(\sim2\)
Elf Queen \(+3\) \(+1\)
The Three \(+1\) (The Red) \(+1\)
Great Gold Wyrm \(+2\)
Prince of Shadows \(+1\)

This says to me something about a game about the long-lived races, and the politics of Dragons and Elves; human involvement (note no human PCs) is complicated or negative and mostly through agents of the human gods.

What happened

Two characters rolled 6s on their initial Icon Relationship Rolls; they started with magic items. The other two started with random potions. We went with the Gnoll fight, because it was labeled as being hard, and we all think we’re good at these games. The PCs started in two pairs: the Dragon-born were adventuring, and the Elf and Gnome were stalking them. Trip, the “Member of the Queen’s Darts,” telling us that the Darts were a group of the Elf Queen’s deniable assassins, was told that the Diabolist had a chess piece1 moving through this area, and to remove it from the board.

Trip had an elven cloak that helped him hide. Tweez and Meither rolled very well to do so as they approached the gnolls’ campfire. As a result, the gnolls saw a solitary gnome in colorful performers’ garb walk in out of a storm, asking to share their fire. Having read the scenario, their rangers opened fire and the savages raced out to engage him. By the end of the first turn, Frederick was Staggered. Whoops.

The Dragon-born started smacking away with sword and dagger, and the Wizard used some cantrips to good effect—knocking open the gnolls’ chest (accidentally freeing the imp) and using a ghost sound to distract a gnoll into wasting a turn of movement—then blazed away with Color Spray on the turns it was safe to use.

As the two-hour mark ticked over, the last of the gnolls fell—astonishingly good timing, really. Two of the PCs were down by then, so we walked through what the quick-rest and long-rest mechanics would be.

Character by character

When the imp looked like it wanted to escape rather than parley, the Wizard sniped it with an evoked acid arrow—one shot and it fell. In general he seemed to have a lot of flexibility, and while he was constrained (e.g., Color Spray only on even turns), the constraints were predictable and manageable.

The Bard suffered from a terrible typo: the pre-gen sheet said his battle song of blessing was a Standard Action every round. He got bored with it eventually and unloaded a Soundburst that finished off two gnolls. A standard action for a +1 to everyone this round and a +2 to one person next round seemed like a fine way to start a fight—turns out he could have been doing that and throwing knives. Whoops.

The Rogue only got momentum in the last turn of the right. I’m not sure whether he got in a Sneak Attack; I think he was holding back out of a feeling of fragility. But he too had conditional attacks that he could plan around. This is a player who reliably has an amazing line of patter to convince the GM and befuddle NPCs—so it was awfully nice to have a mechanic (Smooth Talk) suggesting he flip a coin to see if it works.

The Fighter’s player may have been a little newer to this, but we were all knocked back a bit to see how many comparisons were required for every attack roll. Did I miss? If so, was it even? Did I hit? Was it even, was it 16+? In all of that, I think Power Attack was lost: just too much going on every turn. I could imagine that smoothing out, but it was a surprising contrast to the momentum and spellcasting mechanics!


The “two hour demo” took 120 minutes to run. Maybe we got lucky, but that feels amazing.

We took pre-gens that didn’t mention any setting, and had characters who felt plugged in with an hour of work—in a way that we usually only see mid-campaign.

Players who’d recently played D&D 4 felt like this was a Fantasy Heartbreaker of 4e. Players who’d lived in 3e and 3.5 for years saw their worst complaints fixed and best features kept. And I—an old Earthdawn GM—feel familiar involvement of story and setting. My hard job now is figuring out whether to use the 13th Age setting as is, or wait for drafts of 13th Age in Glorantha.

  1. Turns out this was an imp in a chest with the gnolls, but I didn’t know that when I said it.

TLS is not for privacy

Transport Layer Security (TLS) is the current best standard for secure communication over the Internet. Almost every web browser, modern VPN, and mail client and server uses TLS to establish a “secure channel” over the Internet. TLS protects the confidentiality and integrity of the data sent through that channel in both directions. It can also be used to authenticate the parties at either end of the channel—this is the certificate check you’ve seen sometimes fail in your browser. Your web browser probably shows you a gold lock or other indicator to tell you that it’s using SSL to authenticate the server, and to ensure confidentiality and integrity.

But there’s a catch: TLS uses cryptography designed by mathematicians and implemented by programmers. The cryptographers have a special meaning for the ordinary words “confidentiality” and “integrity” and “authentication.” They don’t encompass most of what ordinary people mean by those terms. In particular, they don’t mean what many persons who want social effects of TLS want them to mean.

This confusion hurts us all in two important ways. First, it causes us to spend a big pile of work and other resources to use TLS in all sorts of new cases. Second, it gets us in trouble when we rely on benefits that TLS doesn’t really provide. When we pretend that TLS can give us privacy, especially privacy of social interactions from state actors, we may give dangerously bad advice. Anyone who relies on TLS to keep the social habits implied by their Web activity private form their ISP or nation-state may be in for a very sharp surprise.


In TLS, “confidentiality” means that we can keep an adversary from guessing short secrets embedded in other text. We can’t keep the adversary from learning which web site we’re visiting. An eavesdropper can tell—from the size and timing and coordination of who sends which messages—whether we’re visting Facebook or Wikipedia, and can make strong guesses about which pages we’re visiting inside each site. An adversary who can serve a few ads, like your ISP, can make even stronger guesses—all without doing anything to compromise your computer or behave in ways that might trip any of your defenses.

TLS confidentiality guarantees are based on the confidentiality guarantees of symmetric ciphers like AES. These ciphers aren’t proven secure—but nobody publicly admits knowing how to break them. What does it mean to “break” those ciphers? Cryptographers play a game of encrypting two messages, and asking an adversary to guess which message encryption corresponds to which message. If one of the messages is an encyclopaedia, and the other is a credit card number, of course the adversary can guess—they’re wildly different sizes. A web browser using TLS doesn’t just use AES “straight,” in the model in which its designers expected it to be used. A web browser uses TLS and AES for an interactive protocol with lots of messages flying in both directions—and to many parties.

AES doesn’t magically extend to protect confidentiality of every imaginable fact about those multi-party interactive conversations. AES’s and TLS’s designs assume that the adversary can figure out, or is told, the general shape of the conversation. They then try to protect secrets embedded in that conversation like chocolate chips in a cookie. The adversary knows we’re eating a cookie, and knows the location of the chips in the cookie. But he still can’t get the chips.

TLS is very useful for protecting those chips—and there are lots of circumstances in which we wish to do just that. TLS lets an adversary know that you’re visiting a bank, but doesn’t leak your password, account number, or balance. If you look at a set of transactions, the adversary can probably tell this—and can tell about how many transactions there are. But the adversary can’t tell what those transactions are—amounts, dates, or payees.


AES-style encryption will never achieve privacy. I don’t know how to get very strong privacy in practical cases; I know about software like Tor and Pond, but those vary in cost from high to wildly impractical.

Privacy advocates have been asking to use more cryptography in TLS. I share the value they place on privacy. Unlike them, I don’t see how to use a technology that protects only chocolate chips to keep private my habit of eating cookies.

Feng Shui Playtest notes

What did we do?

We ran “Baptism of Fire” using the Feng Shui core book and the player aids at—the character sheet, the Fu Schtick diagram, and the Archetype-Juncture map. I, the GM, prepared for about an hour ahead of time: I read the first half of the adventure in detail, skimmed the last scenes—enough to know I wouldn’t need to play Ta Yu until then—jumped in.

We started play about eight thirty, and finished about twelve thirty. We had a Thief (a gang fight interrupted our last job and got my partner killed); a Transformed Dragon (Gangsters stole my family heirloom, the Amulet of Yendor), a Killer (Left my family to try to live an honest life as a college student; they could make me do assassinations if they find me!) with Lightning Reload, Both Guns Blazing, 2x Carnival of Carnage, and Hair-trigger Neck Hairs (and a close family relationship to his guns), and a music-teaching Ghost from 69 (I seek the greatest performer to pass on my gifts) who had haunted this temple until it became the Eating Counter.

Everything up through the meeting with Fast Eddie went as written. After that, the planned fight scenes needed a bit of help to happen—the players were willing to wait for Sneezy to return to the construction site, so the restaurateur paged the Killer to say that his niece had been taken. We did end up running everything in one continuous set of scenes, with no downtime. I think in a movie, there would have been a night in the middle and a day following.

What we needed for a pick-up adventure

For a pick-up game, it would be very nice to have pre-generated characters—even if only as PDFs, so I could print the Killer booklet, hand it to someone, let them make 15 minutes of choices, and play. Dungeon World does a great job with this. We didn’t find it reasonable to pick Fu Schticks in the time we had to start play.

Especially for a pick-up game, but for all games: powers need to be relatively balanced. They don’t have to all be equally good in all combinations, but the Killer felt like a bozo for taking Both Guns Blazing and the Fast Draw schticks, one of which never helped (useless against mooks, worse than useless against Happy, and also useless against Ta Yu because the -2 to hit more than outweighs the damage boost), and the other of which never helped (because he never ran out of ammo).

The Transformed Dragon, by contrast, felt like he made the right choice by taking Dragon—that no set of powers could compare to a +5 on nearly all rolls.

Some players reported disappointment that their high skills didn’t matter much—particularly the Thief. In retrospect, she’d rather that she were told up front that there are two to five real skills (guns, martial arts, sorcery, etc.) and that everything else is a non-combat skill improved with non-combat skill points.

What the gun-bunny needed

The Killer’s first attack was to fire two Glocks, Both Guns Blazing, at two mooks. Oh, he can’t fire two guns in one action—or at least, he can’t take out two mooks that way. Okay, at one mook. Oh, BGB doesn’t help against mooks. Okay, at Happy. That does two less damage points than just shooting him would have done, and has a higher chance to miss. So the quick picks for the Killer include some powers that are worse than useless in the first test fight of the included adventure. Is this just a BGB problem? The Killer player also complained that the half page of guns schticks didn’t feel cool, and the pages of guns felt pointless. More on this later.

Carnival of Carnage x2 triples the opportunities for the Killer player to stall the table. I would much rather treat this like Aim:

Suggestion for an alternate carnival of carnage that preserves it as a good mook-removal, while minimizing the number of dice rolls and decision points:

  • On your tick, you can announce “carnage” – this is a one-tick action that requires no dice rolling (but has special effects of heavy gunfire, or lock&load or whatever)
  • Alternately, you can announce “resolve carnage” and make a die roll targeting (1+ the number of preceding carnage ticks) in mooks. Camera cuts to a line of bodies falling…

This preserves it as approximately “you are removing one mook per tick”. It is somewhat higher variance (in that a single flubbed roll misses them all, so don’t screw up). It seems very action-movieish of you to wait until just before the mooks are ready to charge (ticking off carnage every time until it’s the nook’s action), and then suddenly guns blazing, the mooks all fall at once, somehow unable to react as you fill them with holes…

Now you aren’t die-rolling every tick, the GM isn’t marking something off every tick… and your decision and description is minimized to a single chunk rather than being every tick which mook do you slay and how to describe it.

Also, the Killer noted he had half a page of schticks, half of which are useless or worse, while the Sorcerer and any hypothetical Kung Fu characters would have had pages of schticks and special rules. I showed him the pages of guns to pick, and he responded by showing me why that didn’t help him:

Pick a realism level.

The Guns chapter, with tables for range, concealment, cover, and detailed ammo tracking, doesn’t seem to come from the same game as the Sorcery chapter or the Orangutank. It led for us to a feeling of epic-level mismatch, where the Thief and Killer were worried about fiddly details and which gun and reloading, and the Killer couldn’t shoot two guys at once—but the Ghost and the Transformed Dragon were out of a Tsui Hark movie, chucklingly blasting as many mooks as convenient or using Ref 9, Bod 9 to do inhuman things.

and later:

Or let these be gun-specific tricks based on movie guns rather than gun geek trivia. Like, “you can pump a shotgun with a loud KA-CHUNK” and get +1 damage, you could have a trick with the “one in the chamber” guns that emulates hong kong movies rather than real guns. Make “one in the chamber” half as as cool as “KACHUNK” and I’ll stop whining about it.

Consider: when ammunition capacity matters in the movies, it is never because being able to hold 13 rounds instead of 12 gives one character a minor advantage. It’s because of stuff like:

  • The bad guy finally gets the drop on the protagonist. But (click click) he’s out of bullets!
  • The protagonist finally gets the drop on the villain. But (click click) she’s out of bullets!
  • Somebody’s been counting shots and knows when somebody else is out of bullets. (This only works if the audience can count too; I’ve never seen it done in the movies with anything but revolvers. This might be because you could trust an audience to know that cowboys can shoot six times, but not anything about how many times a cop can shoot.)
  • Somebody has to duck to reload, giving somebody else a chance to maneuver!
  • Sombody fumbles the reload!
  • The scene near the end of Yojimbo, where it’s set in late shogonate Japan, and the protagonist doesn’t know anything about guns. He has mortally wounded the one gun-weilding antagonist. The dying antagonist tries to trick him into giving him his gun back, saying he feels naked without it. “Don’t worry,” he says. “I fired twice. There’s no more bullets.” And the trick works. Almost.

Now I’m thinking of watching a bunch of John Woo movies—and maybe some other HK-influenced gunporn movies too (Matrix, Equilibrium, and what else?)—to keep careful track of how reloading and running out of bullets work there.


  • If running out of ammo involves failing a roll: with one of these guns you can get off one more shot after failing the roll.
  • You can pretend to surrender by removing the magazine when in fact you have a round in the chamber. This always works in the movies. It should ALWAYS work for PCs.
  • If you have a gun with an unusual capacity, you can trick people into thinking you’re reloading.
  • Go with your original idea: make ‘gun geek’ a prestige class or schtick or something. But make it based on the PC’s gun geekery, not the player’s. Not sure how this would work. Maybe you can make up stuff about guns and it turns out to be true, but you take an alignment violation and lose all your paladin abilities if you ever confuse “clip” and “magazine” and then you have to go on a quest to gain forgiveness from your god. ;)

Another player wrote, more succinctly:

Instead of a big list of guns, if I were writing the game, all gun schticks would be of the “I use guns with this feature, and use it well” variety – so there’s Autofire schticks for the person with autofire, and aiming for people who bring scopes, and big cannon rounds for people who have a bazooka in their back pocket, and cold-cocking for people who beat people with the butts of their guns, and concealment for the lady who has a derringer you didn’t see until it was in your face, and More Dakka for the person who wears bandoliers of chaingun ammo, etc. If you’re running up several trees (which should be plausible) you have a bunch of guns to switch between (signature armory?) or some well-built custom or special weapons that really do combine the features of a sniper rifle and a bazooka.

John Malkovitch, with the piggy in that one movie, would have “concealed” and “bazooka,” which is just hilarious. Run with it! Shotguns could be Intimidating and Coldcocking and Area Effect! Someone who “plans ahead” could have a gun schtick they could trade out for any other given some prep. Possibilities are endless, and somewhat more fu- or sorcery-like.

Now the gun nuts have something meaningful to brag about, and we go back to one of the core conceats of the game—it’s not the hardware, but the hero using it, that makes the real difference. You get a cool gun because you are cool, not because the gun is cool.

From this I read several points. One is about ammo tracking and reloading, very detailed; it says to go look at games like Diaspora and Burning Empires for how they handle this. But that’s almost entirely overshadowed by:

Please present a game where the core archetypes can play together. If a Sorcerer with Blast and Influence can enter game, then a gun-bunny has to be able to engage with the PCs’ problems with the same efficacy and flexibility as that Sorcerer. That doesn’t require the same level of mechanical complexity—anyone who wants trees of prereqs and a year-long process of a character becoming his best self will play a Fu character. But it does mean similar support for Guns

What the thief needed

The thief reported being overshadowed in action scenes—why can’t she use Intrusion or Seduction in fights, to take out mooks or put aspects on named GMCs?—but then she felt bad taking time into prep scenes, away from combat. But she needed to plan and have other PCs help to make her skills relevant, while the Ghost’s Sorcery, the Killer’s Guns, and the Transformed Dragon’s kung fu seemed to be relevant without work.

What all the players needed

The variability of damage was very surprising. It was described as “Glass Ninja,” even though this doesn’t inherit TORG’s problem with using the whole Action Value in a damage result. Happy hit one PC for 17 points of damage. That player was scared he might lose his character, and proposed that damage results shouldn’t open-end against PCs (But it’s okay to do so against NPCs—other PCs disagreed with that, as having a Windling take out a Dragon on a very lucky roll doesn’t seem right to them).

Schtick-heavy characters needed the book open to their schticks. We had no Kung Fu characters because Fu didn’t seem available for pick-up games, but the Killer had the gun-schtick page open, and the Ghost was flipping back and forth between Creature Powers, Sorcery schticks, and general Sorcery rules like -1 per extra target.

All the players wanted fortune points; they wanted a way to invest player-level resources in the success or survival of their characters at critical junctures without having to explain that with character effort in the narrative.

From the Dragon:

Something that is somewhat solvable for the pickup game by doing pre-gen characters – within a party, it feels like there should almost be a rule “everyone’s primary combat stat needs to be within one point of each other”. A guns-16 and a guns-12 in the same party is getting close to making the guns-12 guy feel useless; not only are they going to miss a lot more often, but because margin-of-hit goes into damage, when they do hit, they’re going to usually be doing four points less of damage. That is a lot! Similarly, my character’s speed being five above someone else’s meant I was frequently going to move twice before they got to move at all in combat. That felt poor.

What the GM needed

None of our combats lasted longer than one sequence. The fight in the tenement could have, but we resolved the aerial battle between the Ghost and Ta Yu with just a couple more shots. The GM wishes for pacing advice that tells him how to open the fight with names and mooks, and how to spend and hold back his mooks to draw out the fight.

Some players wondered why the cops didn’t show up to the Eating Counter while the PCs were interrogating a Thorn in the kitchen. The answer is either that they’re on Fast Eddie’s payroll, or they were dealing with a murder a few blocks away, or that it’s a Kung Fu movie and cops wouldn’t have improved it. This worked fine for us, though some players were surprised by it working fine. Guidance for GMs on that could help.

This adventure provided good guidance about how many mooks to use per PC. But given some PCs have powers that are good against mooks and others are good against named characters, some players asked for advice to GMs on what ratio of mooks to named GMCs to use!

When 12-24 mooks are acting on the same shot, it would be nice to be able to roll for them en masse—either give them single dice, so I can roll just the positive die, say—or give me some way to say that three mooks combine to attack, and hit for 0-3x their normal damage, etc. Give me some way to manage buckets of mooks. I’m only going to narrate the actions of a few of them in detail, anyway—so I should only roll once per narration.


Some PCs rolled 9+6=15 for initiative, others rolled 5+1=6. Those people got really bored waiting for the Dragon to move on 15, 12, 9, 6, and for the Killer to move on 13, 12, 11, 10, 9, 8, 7, 6—even though the Killer was being really good about moving fast, Carnival of Carnage may not have added to the fun of the game compared to letting him take out multiple mooks on his normal every-three-shots action.

One player wrote:

Something that a lot of gaming systems have trouble with: “How does combat start?” Ok, we kick in a window [in the tenement, rapelling down from the floor above after sneaking past the Poison Thorns in the lobby], catching most of the enemies by surprise…. and they roll better than us on initiative, so they get to act multiple times before our thief does anything (they did fail to act on the initiative tick that would have put them ahead of any party member, but they still were acting before most of the party, making the attempt to get surprise feel somewhat pointless).

That is, the PCs saw Ta Yu gesturing wildly at Sneezy, leapt out their window on ropes, and crashed in the windows. Ta Yu had been trying to explain that he’d divined the coming of the heroes, but Sneezy hadn’t bought it. So we rolled for a normal sequence, and the NPCs didn’t do anything specifically useful until after they’d seen (been shot at by) a PC. Continuing:

Um… Ok, that just felt odd. Roll-for-initiative as a combat start thing is standard, and makes sense in an approach-scenario or a mutual-surprise-scenario, but in an ambush sort of scenario, I feel like it should have been something more like “the party members coming through the window pick the order they come through; you go on tick N, N-1, N-2, N-3 in whatever order you are coming through the window in. Enemies with precog can go no faster than N; enemies without precog can go no faster than N-3, and there’s some sort of roll based on speed to find out how much slower than those ideals they actually are…” I’m not sure of exactly what to propose, not knowing the other schticks and powers and such in the system, but what I’m generally getting at is that how combat starts matters for feel, and is part of how you can reward pre-combat prep and out of combat skills and planning; by having it just come down to the speed stat, it cheapens those things and feels strange. So… Need a good system there.

I like the way we ran this, because it works to show the players that a high Reflex is an effective effective defense against being surprised even by NPCs. That in turn cuts down on their turtling and defensive planning (a.k.a. “The Shadowrun Problem” at our table), because they can trust their stats to take care of them from minutiae. It’s similar to how in D&D, when the players want to execute an orc with a crossbow bolt to the head, it shouldn’t work—because this is how you show it won’t work against them, so they are then willing to be taken captive, trusting that they’ll get to use the combat system to preserve access to their characters.

Other questions and comments

Why does the thief have a giant shotgun? Some of the weapon and schtick picks don’t fit with the images we get from the Hong Kong movies we know, or the text on the page. Citations would help (e.g., Thief, 1996, Mossberg 590, just like Sidney Poitier in Sneakers—not that he’s a thief there, nor is it a Hong Kong movie). The Internet Movie Firearms Database seems helpful here: In fact, I’d love to see citations or marginalia for every schtick!

One player reported that we seemed to have the Shadowrun planning problem: we could sit around and discuss ideas for a while. Other players said, “but it never lasted long,” and the GM pointed out that whenever this happened, he had the Bad Guys make a move: send in zombies, have Kar-wai call to say Carissa’s been kidnapped, etc.

Active parrying with Guns was really hard to describe.

We looked for ways to understand this game’s preferred stance on mooks relative to Wushu and Weapons of the Gods: are the mooks an environmental effect to make sure that the whole area of the fight feels hostile? Are they the real timer for the encounter, since the named GMCs will depart quickly after about half of the mooks go down? Or are they a sort of weapon you can learn to wield with social skills?

One player wrote:

In hindsight: did the mooks ever hurt us? Could the mooks ever have hurt us without multiple open-ending in a positive direction? I feel like we wasted a lot of time on mook removal which felt dramatic, but ultimately we’d have been way better off focusing firepower on trying to do more damage to Happy during the first fight, rather than minions that wouldn’t have done anything anyway. I guess with a dozen mooks all rolling, statistically you will get some open-ending and they’ll hit you…

There were 12-18 mooks per encounter, and they had enough time to act 2-3 times each per combat, so on average somebody gets hit by a mook about every combat, usually for about 10 damage from a gun. Hey, there’s an idea to take back into the GM advice / encounter design chapter: mooks should be hitting one PC about once per encounter. If they’re doing much less or much more, change how you’re using mooks. At this level, the PCs can’t quite ignore them forever, but can always ignore them right now to do something more important (save the cash register, kiss a MOTAS, etc.)

Also, this player’s thinking in terms of killing most opponents in the fight in which you meet them. That doesn’t sound quite right for HK cinema to me; the named NPCs are worth naming because they leave and return, and are fighting for territory control, intimidation, tempo, or simple larceny—not to the death. On the gripping hand, the Killer writes:

I’m fine with “Kill enough stormtroopers and the others run away.” I’m also fine with “Kill even more stormtroopers and the others might run away, even if Darth Vader is there too.” But “Kill enough stormtroopers and Darth Vader runs away” seems like parody.

Dramatic Hooks are a good idea if the players run with them. The Killer played an openly reluctant character with a list of excuses and some big hooks that the other players got in on pulling. That was awesome, although if multiple people were playing reluctant at once, that could be an issue.

The sorcery writeup (influence was the one used) was great for inspiring creative play. I needed the whole writeup in front on me [another reason for playbooks], but I’m still occasionally spinning out ideas of what I should have done (OK, first use the Illusion application to make Happy think the window is somewhere else on the wall, then inspire him to take a charge at my flying ghost…)

In particular, the skills could have greatly benefitted from a sorcery-style writeup, or even using something like the sorcery mechanic – you have a Social skill AV, and take the Seduction, Leadership, Intimidation, etc. schticks to apply it in clearly spelled out, genre appropriate ways (and this is part of what defines genre). You can also easily say “OK, I’m taking the Intimidating schtick, if you’ve a social character, grab one of the others!” which feels like an intuitive way to do party differentiation. This could even be used to parcel out current schticks that are unique to archetypes, allowing more flex while keeping niche specialization open. Our Thief, as described, could totally have benefitted from the “scrappy” schticks and the Techie unique schtick, and I took the detective skill and would have played it more if “deduction” was available as a schtick. It would also help spell out how these things are supposed to work, in an action sequence, in genre, and allow the GM to disallow certain ones that strain his credibility beforehand, and not call them out in play. In other words – get your social contract up front, so you don’t have power plays and dickering over it in the middle of the action.

Speaking of flashbacks, there was a point where the GM said “so, did you tie the knot that catches when too much weight is applied, or the one that gives a few extra feet but slips at the end?” Which was a choice with a clear retroactive answer – after the fact, of course you didn’t pick the thing that screws you – but would actually have been the perfect spot for, say, an Intrusion check to see if you already did the clever thing when the option presented itself pre-scene. The “wasn’t it lucky that I always…” bit is great in action movies, with or without a lot of foreshadowing.

That last bit would also have been a good “You’re awesome at intrusion – go you” moment. Letting people know when what they have is cool is important. When our Transformed Dragon did a piddly three or four points of damage to Happy, the GM spent a while emphasizing the fact that this kick would have torn through most walls, and Happy was pretty surprised (and a little pissed) that someone could hit him enough that he noticed, which was really a good thing to do so that we didn’t just feel wimpy.

Baiting Hollow Scout Camp graces

When I was a boy, I attended Baiting Hollow Scout Camp with Troop 301 of Saint James, New York. On the outer wall of the dining hall were three knotwork boards, each with a grace to be sung for one meal. I’ve never found them in any hymnal or book. Here they are, as best as I can reconstruct:

I found a sketch of these from Kenneth Spiegel, Assistant Scoutmaster, Troop 80, Farmingville, NY, but with the repeats missing and some of the timing—well, it doesn’t agree with my memory’s ear. You can also have this in PNG, PDF, MIDI, or Lilypond if you’d like to edit it or use it in something else.

Sourdough muffins

I’ve been playing with Sourdough again. I caught a nice strain of yeast off of Ariel’s grape vines, and it’s the frothiest starter I’ve ever used. What do I do when I need to use three cups of starter or vacate the kitchen to its new grey-goo overlord?


The original recipe is from a sourdough site I found more or less at random; it’s the highest starter-to-flour ratio I could find. Their recipe is a third of what’s below (can you tell?) but only makes eight muffins. Who has an eight-muffin pan?

Preheat oven to 425.

In a medium bowl, mix:

  • 3/4 tsp salt
  • 3 c whole wheat flour
  • 3 tsp baking soda
  • 3/4 cup sugar

When well mixed, stir in 3/2 c blueberries.

In a large bowl, mix:

  • 3 eggs
  • 3 tsp vanilla
  • 3 c sourdough starter
  • 3/4 cup canola oil

When the oven is hot, mix the dry ingredients into the wet. Spoon them into 24 muffin cups, filling each to jut below the line. Bake for 20 minutes.

Makes 24 muffins, each about 200 kcal.

Emacsclient AppleScript

I like Emacs. Maybe you like Emacs. I almost always have Emacs running on my Mac. I’d like to use Emacs as a general text editor. My Mac expects to use the open protocol handler, and lots of Mac programs expect to be able to use open or AppleEvents generally to ask for a file to be edited.

But how to connect that to emacsclient -n? Well, Brian McCallister’s blog has a proposed way. It works well enough to work with Marked, at least. Build the following as an AppleScript application called Emacsclient, drop it in /Applications/, and away you go.

on open of finderObjects
    tell application "Terminal"
            -- we look for <= 2 because Emacs --daemon seems to always have an entry in visibile-frame-list even if there isn't
            set frameVisible to do shell script "/usr/local/bin/emacsclient -e '(<= 2 (length (visible-frame-list)))'"
            if frameVisible is not "t" then
                repeat with i in (finderObjects)
                    -- there is a not a visible frame, launch one
                    set p to POSIX path of i
                    do shell script "/usr/local/bin/emacsclient -n " & quoted form of p
                end repeat
            end if
        on error
            -- daemon is not running, start the daemon and open a frame
            do shell script "/Applications/ --daemon"
            repeat with i in (finderObjects)
                set p to POSIX path of i
                do shell script "/usr/local/bin/emacsclient -n " & quoted form of p
            end repeat
        end try
    end tell
end open

-- bring the visible frame to the front
tell application "Emacs" to activate

Having now built this, Nicholas Kirchner seems to have something similar—his is also careful to use the quoted form of POSIX path.

Around the River

How to get from Home to Kendall

Head east on Route 20, Main Street. The bike line starts within a mile. Drop in to Watertown Square, taking a lane as necessary. You must take a lane for the 100’ between the electric bus terminal and the lights—you’re going mostly straight across, headed for the Arsenal/North Beacon Street exit, but traffic in the right lane splits between that and the Charles River Road. Take the right fork for North Beacon. Climb one hill at the Perkins school, then drop to the river. Do not cross the river—instead, turn left onto Greenough, and take the bike path. You’ve done about 3.5 miles on streets; now do 6.5 on trails.

One icon to the right of the bucket, just below A

A friend of a friend recently had some accounts vandalized. Most of the following started as a response to her, with advice about how to handle this situation. I hope that some of it can be of use to others. She had accounts on several web sites. One was broken into. Those users with shared account names and passwords across several sites had their other accounts vandalized. Those who had different usernames but the same password between sites still had some problems—particularly if they had links in forum posts or image tags for signatures that revealed the links between accounts.

She changed all her passwords immediately after noticing the attack. It sounds like she did exactly the best thing she could have done, both before and after this violation. She kept different passwords for different places, and she changed her passwords immediately afterwards. Having a stronger password would not have protected her against this sort of attack, but it is something that would help her against other common attacks.

She did ask what could be done about this vandalism: are police or the FBI going to help? What about if there’s real money involved? Since there have been news stories covering the group responsible, why haven’t they been punished and their communities shut down? Is there some code of silence? Are they an online Mafia?

As far as the people who act like this: they’re not the Mafia. They’re hoodlums. They’re the electronic equivalent of kids egging a schoolmate’s house. Just like those kids, they attack those who are different with the goal of eliciting visible pain. They attacked her social groups because you’re artsy, cultured types and these jerks have a record of getting visible moaning and wailing out of such communities.

Her response, which appears to have been a quick clean-up and professional demeanor, may be her best defense: she’s not a fun target, so they’ll move on to pick on somebody else. Alternately, they’ll move on to 10th grade or meet members of the appropriate sex or otherwise find a less corrosive hobby.

Indeed, she’s identified exactly the relevant line for police intervention. The FBI, USSS, and even local police can and will care about such matters, just as soon as they cross the line into an interesting crime. A cop or a DA wants to leave a trail of big, interesting criminals. They will stop shoplifters, but not jaywalkers—and they’d rather catch car thieves. Just so, they’d rather go after people who are stealing thousands of dollars or applying for fraudulent mortgages across state lines. Scribbling graffiti over an artist’s work—or a hundred artists’ works—isn’t going to attract police attention. If there is demonstrable financial damage, she might have success talking to the cops if she mentions that dollar amount up front. Anything over $10000 can easily attract Federal help. I think $1000 is around the threshold for local police. It’s typical to bill your own time at your professional rate for clean-up work. So if she spent more than ten hours cleaning up her own computers and her accounts at others, or can surpass a few hundred hours of collective clean-up in her communities, she might find a sympathetic DA. If not, she probably won’t.

It’s important to remember that these are analogous to the local hoodlums who egg houses and knock over mailboxes. This is a gang of weak people who enjoy hurting others to gain a few minutes of perceived strength. The best that you can do is:

  1. Keep offline backups. Update them regularly. “Offline” means that no amount of software hacking can hurt them or, through them, you: For example, mine are on a drive in a safe. It comes out of the same to be plugged into my computer only when the network is off. The safe is fire-resistant.

  2. Use passwords that are hard to guess, even for someone who knows your real name and your login names on every site you use.

  3. Use different passwords in different places. The administrators of sites like web fora and your communities are only human. They will make mistakes, and the tools they use will fail them. Your passwords and account data will be leaked. I expect about one of my own accounts to spill its data each year. I do not write down anything I don’t want to risk seeing published.

    One good way to do this is a password schema. Consider a common phrase, like “Once I was the King of Spain.” You might use that to remember a password like “111IwtKoS.” Now you can replace arbitrary letters with references to particular accounts. For example, your amazon account might have the password “111Iw@KoS” while your paypal account might have the password “1$f11wtKoS,” where “paypal” reminds you of “dollar friend” and you remember the rest as your general password schema. Then you might change schemas once every year or so. To do that well, you’d have to maintain a list of everywhere you have an account—something best not to do on the computer itself, but not a terrible thing to keep in a drawer near your computer.

  4. When you do suffer from attacks like this, clean up quickly. Present the online persona of a responsible adult and you’ll be treated like one, even by bozos like this. Don’t let them think that they cost you more than a minute or two of time, and they’ll find somebody else to pick on. That means don’t post responses to them in their fora, or even acknowledge it in your own spaces beyond a brief apology to your readers.

From what she wrote to me and how she wrote it, I have the impression that she already knows all of this. But I do hope that it’s of use to others. Most of all, remember that this isn’t a vast new Metaverse unconstrained by ordinary social laws. It’s just people talking and writing. They’re driven by the same needs as the people you meet in the ordinary course of life.