Easter eggs and Scripts?

If you're using my item hilighter sheet, it only highlights items for you within the MAP itself on the city page, nowhere else; and it of course is not even capable of clicking for you.

So unless eggs are gonna spawn on the city map, mine is fine to use.

uhm. It's highly unlikely that eggs would even be spawning on the map in the first place. Since map items stay put until you pick them up, and eggs don't. That's what we were trying to politely tell you - since the scripts you're concerned about are confined to alerting you about map items (city finds) they won't have any bearing or effect on easter eggs.

On a related note, if one of the scripts are found to be interfering with egg finds, will we be notified? Id hate to be unknowingly reducing my chances.

Thanks-ChanZ71

Edit: Post wasnt relevant, misread.

I didn't find any client-side script detection. I'm guessing the announcement was a warning for programmers NOT to try to manipulate "competition.php" calls -- the way it works, that url is called once per page load, and it's the one responsible for spawning easter eggs. If you try to automate it, it's trivial for the server to notice.

Be aware: while I didn't find any client-side detection, it may be added, or perhaps it's only being loaded at times. If you are gonna mess with it, it's at your own risk.

The the message on the Announcement seems to have been removed now, guessing thats because its completely infeasable to detect scripts without knowing specific scripts to look for.

The way the current anti-scripting method works is by making some of the eggs invisible thus meaning if they managed to click the fake decoy egg that they are more than likely automatically clicking this. Unfortunately it seems the oversight is any JS dev worth their salt can easilly detect if its invisible or not.

The second method seems to be by randomizing the class name, unfortunately the issue here again is it seems to be the only thing on the page with this randomized class name making it easy to just check for IIRC the suffix on the end of the class name. The other issue with this is all the egg links use the competition.php?access_token URL which means they just have to use:

document.querySelectorAll("a[href^='competition.php?access_token']")

Which totally makes it useless.

At the end of the day detecting scripts in any meaningful way is pointless, just look for those that have an abnormal amount of eggs compared to the rest of the users and manages to find an egg within seconds of being on a page and you will most likely have your cheater. Otherwise this will purely turn into an arms race with the scripter winning by just intercepting requests before they even render on the client machine simply bypassing any possible checks at all, torn wont even know a script is running on the page. By stating that they are taking this stance they will just cause someone to say "Challenge Accepted" and show them up.

Edit: Offtopic, your sig is pretty cool >.>

Completely agree with you on all fronts.

This is consistent with Torn's history on hacking: loads of false positives, minimal actual prevention.

I have always felt Torn's stance on anything related to hacking to be pretty flawed. The number of legit users that end up being annoyed by their "anti-hacking" policies is far too great. Take, for instance, the captcha and IP blocks. Both incredibly annoying. Both trivial to circumvent (why the hell did they create the easy text questions captcha? blows my mind..). If every multiplayer game took these kinds of "safety" measures, I can only image the chaos that would ensue. Heck, games' DRM take a lot of criticism and it isn't even that intrusive!

But it really doesn't matter. They've presented their case so well that -even players- support these measures. Chances are, someone would reply to me saying "but at least that blocks most of the malicious users! the ones without too much technical knowledge!" :/

If only they introduced far less intrusive methods of dealing with those (of which there are plenty).


Edit: Actually, let me clarify something. It's not really "minimal prevention." It does probably prevent a lot, given that why would anyone really want to hack Torn? It's "minimal prevention" in the sense that, if one were to try to bypass those, it'd be trivial (eg. I, for one, had fun trying to disable captcha. It was a pastime. I don't use it, but I assure you could not prove otherwise if I did).

@signature: Thanks! You're probably one of the two people that have enjoyed it, heh. :)

I asked hydr0 if eggs would appear on the City Map.

He said he doesn't know, but even if they did, the scripts related to City Finds can still be used as they are legal, and only apply to the city map. Also he said what I already thought, which is that the anti script thing is regarding any scripts that help you specifically find EGGS on the website. Those aren't allowed.

The only thing I forgot to ask is what he thinks of cupcakes and Legend of Zelda. Geez, I really gotta get my priorities straight when pestering admin! :p

TLDR: Hydr0 said city finds scripts are fine and you won't get in trouble for using them, even if eggs were to appear on the map.

Too long to read, even the last part was too long to read!

Make it shorter!!!

hydr0 agreed with me that MnC sucks!

A yellow EE keeps appearing in the above posts. It is obvious that it is a fake egg because when I click on it I get a notice: "Page is unavailable while traveling". What is going on with this yellow egg?


Also in some of the other forum posts a green egg appears that link you to a U-tube page. I just hope that these eggs are not a result of my years past resilient scrips that are long forgotten and not wanted.

People think it's funny to put easter egg pictures in their forum sigs, and some people in their posts, so that it annoys people who think it's an actual easter egg. That's why some of them link to youtube vids and the like, because they're put there by the poster.

:(

I'm gonna keel you!