Botting in Runescape

[Mercifull]

RSBANDBUpdate! 329 Hes a Familiar

http://update.rsbandb.com/2011/10/rsbandbupdate-329-hes-a-familiar/

 

Special botting edition of the RSBandB podcast.

[Rosanante1]

Deal or no deal?

 

Dear Runescape Adventurer,

 

You are obviously aware of the botting issues which currently plague the game. We here at Jagex are wholly committed to the removal of illegal and immoral ways to 'cheat' the game as are its many loyal and honest players.

 

The re-introduction of the wildy and free trade update not only frustrated our attempts to appease the authorities but upset a great many players who feel that the economy and the spirit of the game went rapidly into decline from that moment.

 

We have therefore taken the decision to reverse our update regarding free trade including the wildy, duel arena and other advantages which can be manipulated by 'botters' and cheaters. With this in mind we ask you to be patient and cooperative.

 

At some point in the future we will reinstall the wilderness and other PVP elements of the game which you enjoy so much, but because we do not have a solution to combat the bot-programs and after reading the comments on the many expert forums, neither do you, this appears to be the most preferable solution at this time.

 

Yours in desperation.... Jagex...

[stonewall337]

Simple. Improve the detection system. How to do that? I have no idea, I don't know how their system works but clearly it works to some extent and it wouldn't surprise me if it's actually great at telling if someone's a bot but there's a lack of autodetection in the system so it's relied on player reports. Numerous people have been reporting (especially lately) that they've randomly gained 30k ranks in skills like fishing without gaining any experience so it's clear something's going on and that it's working however it's currently unable to cope with the volume of botters.

 

So simply improving their system to cope with a larger number of bots and to turn over bans quicker would be a great solution. They could also use more stat tracking themselves to see "Ok, this guy has gained a lot of ranged xp recently so lets track what he's actually doing" and such as well as tracking players who are logged in for a long period of time and investigating from there. None of these things change the game at all and are simple to do as I imagine that information is already being logged in some fashion it just needs to be improved upon.

 

This guy could be president. "How to solve all wars? keep people from wanting war!" No duh sherlock. Its pure drivel. I mean, c'mon. Saying the IRS should make the tax system harder to cheat and work better is one think. It having any bearing on anything REMOTELY effective or workable is another. duh.

 

I mean, for [bleep]s sake. How many employes to you think jflex has to track all xp over all characters and compare it to any type of workable detection model? What about people who AFK/semi afk, or those effective who ignore others, or those who play 15+ hours a day? Its a simply idiotic idea to even suggest. Would it work if the game had 10k, 50k, 100k players only? Maybe. But think of it even this way. If it takes one person 30 seconds per character per month...thats a crap ton of time. And a hell of a lot of margin of error.

 

And to the above: Normal wildy+free trade > bot problem. I'd rather have RS as it is with the bots now then RS as it was with bots still there just SLIGHTLY less common.

[DarkDude]

Simple. Improve the detection system. How to do that? I have no idea, I don't know how their system works but clearly it works to some extent and it wouldn't surprise me if it's actually great at telling if someone's a bot but there's a lack of autodetection in the system so it's relied on player reports. Numerous people have been reporting (especially lately) that they've randomly gained 30k ranks in skills like fishing without gaining any experience so it's clear something's going on and that it's working however it's currently unable to cope with the volume of botters.

 

So simply improving their system to cope with a larger number of bots and to turn over bans quicker would be a great solution. They could also use more stat tracking themselves to see "Ok, this guy has gained a lot of ranged xp recently so lets track what he's actually doing" and such as well as tracking players who are logged in for a long period of time and investigating from there. None of these things change the game at all and are simple to do as I imagine that information is already being logged in some fashion it just needs to be improved upon.

 

This guy could be president. "How to solve all wars? keep people from wanting war!" No duh sherlock. Its pure drivel. I mean, c'mon. Saying the IRS should make the tax system harder to cheat and work better is one think. It having any bearing on anything REMOTELY effective or workable is another. duh.

 

I mean, for [bleep]s sake. How many employes to you think jflex has to track all xp over all characters and compare it to any type of workable detection model? What about people who AFK/semi afk, or those effective who ignore others, or those who play 15+ hours a day? Its a simply idiotic idea to even suggest. Would it work if the game had 10k, 50k, 100k players only? Maybe. But think of it even this way. If it takes one person 30 seconds per character per month...thats a crap ton of time. And a hell of a lot of margin of error.

 

Automatic systems, ever heard of them? They probably already track XP in some form and would just need adjusting to look for suspicious behaviour. Then you look into it further, either put the characters into the same system they currently use for telling if someone is botting or not (which clearly works to some extent due to the fact I've never heard of a single person ever being punished for Macroing who was innocent) or have some other way to distinguish between normal players and bots before putting them in the current system. I believe the problem in their system currently is actually them investigating the bots, so having a better detection system would work great towards that. Players who AFK, ignore others and play 15+ hours a day are safe at the moment, how would that make them any less safe? It's simply idiotic to even suggest.

[Assume Nothing]

Considering that both parties don't really understand JaGex's systems - purely speculative 'solutions' will be pointless as we cannot be sure if it's even possible for JaGex to use them. The update on account creation is a step in the right direction - but it's a matter of time before they start using workarounds for that too.

 

I shall reiterate - If you want to kill the bots, you have to kill the demand. Try preventing a gunshot, instead of indefinitely patching it with low grade plasters.

[gda_scooby]

What about slightly limiting the number or value of 'free' trades per week? So new players can only receive a gift of say 1mill per week, either in cash or trade value difference?

 

Its up for discussion how you would raise these limts, either on total xp, QP etc, and the values allowed.

 

Realistically, how often do 90% of players give friends large value unbalanced trades? Would you be prepared to go back to restrictive player to player trade (GE can still be free?) in order to make it difficult for farmer bots to trade out there stock?

 

I enjoyed the game a lot more when we were in the period of restrictive trade, and fewer bots.

 

If we agree that its very difficult to detect bots, then we have to either take away the reason to bot (so no exp or GP) or make it as difficult as possible for any transfers to be done.

[SwreeTak]

Simple. Improve the detection system. How to do that? I have no idea, I don't know how their system works but clearly it works to some extent and it wouldn't surprise me if it's actually great at telling if someone's a bot but there's a lack of autodetection in the system so it's relied on player reports. Numerous people have been reporting (especially lately) that they've randomly gained 30k ranks in skills like fishing without gaining any experience so it's clear something's going on and that it's working however it's currently unable to cope with the volume of botters.

 

So simply improving their system to cope with a larger number of bots and to turn over bans quicker would be a great solution. They could also use more stat tracking themselves to see "Ok, this guy has gained a lot of ranged xp recently so lets track what he's actually doing" and such as well as tracking players who are logged in for a long period of time and investigating from there. None of these things change the game at all and are simple to do as I imagine that information is already being logged in some fashion it just needs to be improved upon.

 

Two great ideas put forward here. To track different players with some kind of automatic system and then check up those who have behaved suspiciously like a bot recently will then get extra attention. This would probably be quite hard, but it is still a good idea of what Jagex could do.

[stonewall337]

Considering that both parties don't really understand JaGex's systems - purely speculative 'solutions' will be pointless as we cannot be sure if it's even possible for JaGex to use them. The update on account creation is a step in the right direction - but it's a matter of time before they start using workarounds for that too.

 

I shall reiterate - If you want to kill the bots, you have to kill the demand. Try preventing a gunshot, instead of indefinitely patching it with low grade plasters.

But you can't. People are lazy, and people want gratification now.

 

And to those 2 above: Quite often. Also, there are the "get quickly rich" to consider, dicing and dueling. As well thinks like giving claws/torva/divine is still common among good friends.

[Noxx]

I think D&D's like "The Pit" could potentially be a great way of stopping bots, if you take it one step further. "Force" players to participate in the D&D, and if the player does not, the player get's auto-logged. Upon being auto-logged you will be required to reload/refresh your page and re-log. This would stop the bot from working until it is logged back in. As i understand it, most bot's (if not all) stop with system updates because that can't reload the page and log back in until it is manually done. This will basically function as a system update, which would log out the bot until manually logged back in.

Although the biggest problem is not players botting skills for the sake of gaining levels but rather botting an NPS for gaining GP, i'm sure that with some thinking you could come up with a D&D at bot-hotspots (such as Frosts and Aviansies). After killing a random amount of X-NPC you will be required to do a small random for a small exp reward (similar Exp reward as that of Shattered Hearts or The Pit). It does not have to be an Exp reward though. It could be any type of small reward. The idea here is not to reward the player, but rather break the routine and distract the player.

The Pit is a great example of what could be used. It's not an automatic random, but rather something that requires you to walk to an NCP, click through a conversation and do a random mini-game. It can easily be skipped if you want to, but with an update such as i suggest you will be faced with the option of either doing the D&D or having to reload your page.

 

I know nothing about coding, so i have no idea if this is even possible or if it could be easily fixed by bot-makers.

[Blyaunte]

I think D&D's like "The Pit" could potentially be a great way of stopping bots, if you take it one step further. "Force" players to participate in the D&D, and if the player does not, the player get's auto-logged. Upon being auto-logged you will be required to reload/refresh your page and re-log. This would stop the bot from working until it is logged back in. As i understand it, most bot's (if not all) stop with system updates because that can't reload the page and log back in until it is manually done. This will basically function as a system update, which would log out the bot until manually logged back in.

Although the biggest problem is not players botting skills for the sake of gaining levels but rather botting an NPS for gaining GP, i'm sure that with some thinking you could come up with a D&D at bot-hotspots (such as Frosts and Aviansies). After killing a random amount of X-NPC you will be required to do a small random for a small exp reward (similar Exp reward as that of Shattered Hearts or The Pit). It does not have to be an Exp reward though. It could be any type of small reward. The idea here is not to reward the player, but rather break the routine and distract the player.

The Pit is a great example of what could be used. It's not an automatic random, but rather something that requires you to walk to an NCP, click through a conversation and do a random mini-game. It can easily be skipped if you want to, but with an update such as i suggest you will be faced with the option of either doing the D&D or having to reload your page.

 

I know nothing about coding, so i have no idea if this is even possible or if it could be easily fixed by bot-makers.

 

To be honest -- this is what I was HOPING they were going to do with "the Pit" when they announced it ... :unsure:

[Platinum_Myr]

But we know that randoms don't work, bots are programmed to do them after a while. So unless you can make new randoms faster than the bots can program around them....

 

I think the best technical solutions: identify and ban bots, and make the account creation much slower so that you have to spend/waste time doing that.

 

Obviously the issue is how to detect bots, but I don't believe randoms work, as they get programmed around. (the Pit and other similar D&Ds can all be programmed to be performed.) The question is can we identify patterns?

 

I know that most bots hack the client and use ID numbers for pictures, and we know that crowdsourcing the "unbotable" things like captchas can somewhat easily be done. Technical solutions apparently don't work.

[Noxx]

Doesn't matter how slow the account creation is, it's still going to happen by the masses. And i didn't exactly mean a "random" like we have in RS already. If you look at the pit, you are not forced to do it, like random events. Your attention is merely drawn by a text in the chatbox and an arrow above the head of an NPC. Whether or not you want to do the event is totally up to you. This kind of activity gives you the option of either going on with your routine, or doing the D&D. Now what i am suggesting is to take this exact innovation and apply this at popular botting sights, but with a twist. Like i explained before, you will now be forced to do the D&D. If you do not do it within x-amount of time your account will be logged out and you will be required to refresh your browser or what have you.

 

Now i'm not sure how bots react when it is pulled into a random event, but i am fairly certain that they can do it easily but only because it is a forced random and the "bot" recognizes it. If you create a random event that requires you to talk to an NPC to start it, it might be a different story.

 

I'm not sure how easily a bot-maker can adjust to something like that though.

 

EDIT: There's always something else that can be done. Instead of being pulled into a random by the Sandwitch Lady, you could be pulled into a large room. A message could instruct you to "Talk to X-NPC for further instructions" and upon talking to whomever you were supposed to, lets say Leo the Gravedigger, you will be teleported to the graveyard to continue the random.

 

Again, i'm not sure how easily that could be coded around.

[Platinum_Myr]

EDIT: There's always something else that can be done. Instead of being pulled into a random by the Sandwitch Lady, you could be pulled into a large room. A message could instruct you to "Talk to X-NPC for further instructions" and upon talking to whomever you were supposed to, lets say Leo the Gravedigger, you will be teleported to the graveyard to continue the random.

 

Again, i'm not sure how easily that could be coded around.

 

But it can be. The bot can trigger on the textbox line showing up, all it has to be able to do is recognize that the event is necessary. Once this happens, then the bot would simply go attempt it. If a human can do it, it is highly likely that a bot can do it as well. It may become complex enough that bots can't program to do it, but I don't believe so.

 

We already know that a bot can be programmed to check for lines of text, or items, or NPCs, or go to locations. These things have already been done. We even had Captcha style sleeping bags in RS1, that got broken. Even good captcha systems can be "screenshotted/videoed" and outsourced to the internet for cheap. (Not to mention how inconvenient this is for regular players..)

 

The main reason that bots can't automatically log in, is because the user is smart enough not to give the bot their password (since many bots would likely record/transmit the login information to the bot creator.) Granted, they could simply install a keylogger on the machine, and get it that way.

 

The other reason bots can't log in after a system update, is because things have changed, and the login page doesn't use the same IDs. It takes a few hours for the bot makers to respond to the system update.

[Assume Nothing]

The problem we face today is a unique one: JaGex has to be able to describe the anti-botting system in great detail to bot-scripters, yet still prevent bot scripters from scripting it without harming legitimate gameplay. I wonder whether we could come up with something good without resorting to designing a new game entirely, or changing the mechanics so much it would no longer be a browser game.

[xat]

But we know that randoms don't work, bots are programmed to do them after a while. So unless you can make new randoms faster than the bots can program around them....

 

I think the best technical solutions: identify and ban bots, and make the account creation much slower so that you have to spend/waste time doing that.

 

Obviously the issue is how to detect bots, but I don't believe randoms work, as they get programmed around. (the Pit and other similar D&Ds can all be programmed to be performed.) The question is can we identify patterns?

 

I know that most bots hack the client and use ID numbers for pictures, and we know that crowdsourcing the "unbotable" things like captchas can somewhat easily be done. Technical solutions apparently don't work.

 

They have bots to make accounts xD

[Blyaunte]

Back in 2005, there was an accidental plague that was launched as a result of some over-zealous players messing around with an in-game bug/glitch in WoW – it effectively killed off a (then) relatively large enough population within the game to make it a news-worthy event.

 

At that time, somewhere on here – or it may have been on the RSOF – I had suggested that a possible way to combat bots would have been to establish a similar "plague" within the Runescape realm – one which would require a reasonably difficult quest, or series of quests, or combination of quests that would either make you invulnerable to the plague or cure it – either temporarily or permanently – provided that you undertook to complete certain other quests thereafter to remain invulnerable/cured.

 

It wouldn't have to be just quests, either – it could be just about anything: tasks, combat/skill levels, etc.

 

Those characters unable to solve the plague would perish and never return – an effective ban – while those that do, could be rewarded additionally in some other way.

 

Depending on how fast-acting this plague was – it could effectively eliminate a certain percentage of bots, provided that the "cure" was sufficiently complicated that it could not, in and of itself, be "botted" in order to complete it.

 

Furthermore, like a real life plague, if you tend to frequent certain spots (i.e. botting hot spots) continually, you will be re-infected, and be forced to undertake further action to re-cure yourself.

 

You could forestall the inevitable reduction of your character by hitting certain "goal targets" within a certain amount of time – which would earn you a temporary cure – however, again, consistently frequenting the same spots will cause you to be re-infected and need to be cured again.

 

In the meantime, during your plague-struck condition, you're an infection hazard to those around you – and you'd suffer from reduced stats (particularly those stats that, say, are generally used for specific "botting" accounts) ...

 

:unsure:

[Assume Nothing]

That sounds like a perfect solution for removing a significant amount of the playerbase.

[Blyaunte]

That sounds like a perfect solution for removing a significant amount of the playerbase.

 

 

You say that like it's a bad thing ... :rolleyes:

[Sona]

Something I've wondered about: What'll happen to the guys right now who are handling anti-bot mechanics if Jagex actually came up with something useful? If bots are effectively removed, doesn't this mean they're now out of a job?

 

... Wouldn't be in their best interests to do a half-hearted job, enough to prevent them from getting fired but not enough to eliminate the issue, ensuing that they'll have job security in the future?

[Assume Nothing]

I'm sure they don't specialize in purely bot-busting - they're likely to have been originally engaged in another role, but have diverted attention towards combating bots as it has become such a big issue.

[pal2002]

Randoms do work - if jagex just have update them once in a blue moon...aaand..actually ban bots who spend hours in randoms.

 

The problem is still no real enforcement. The cheaters gets away with pretty much everything.

[michel555555]

So bots go off of item ID's for leaving randoms right? What if every month or so jagex would change the exit portal on randoms. Say one month have it be a portal another be a cave, rope, trap doors ect. would that change an items ID and mess up bots enough for jagex to be able to distinguish them from other people? It would only take out bots for a few hours every month if it would work but jagex could then do mass bans on people who get stuck in the random.

 

then if jagex would do something to prevent the creation of bots such as:

only so many accounts able to use the same email

bring back tutorial island but make it longer to complete

a manditory period where an account can not use free trade or wild say a week or two

or all of the above

 

would that deter bot makers enough if it will take a week or two time investment for a bot to be viable. Then have that account banned in another week or two when the next update to randoms comes along.

[Riptide Mage]

then if jagex would do something to prevent the creation of bots such as:

only so many accounts able to use the same email

bring back tutorial island but make it longer to complete

a manditory period where an account can not use free trade or wild say a week or two

or all of the above

 

Absolutely none of these would have any affect on bots at all. There is a limitless number of emails accounts on the web, tutorial island was easily completed by bots, and a two week waiting period would only be a minor delay.

[Platinum_Myr]

Absolutely none of these would have any affect on bots at all. There is a limitless number of emails accounts on the web, tutorial island was easily completed by bots, and a two week waiting period would only be a minor delay.

 

Increased account creation time was helpful against ad bots, because when one gets banned, another cannot replace it as quickly. However, it does not stop RWT or other types of bots.

[gspbeetle]

That sounds like a perfect solution for removing a significant amount of the playerbase.

 

 

You say that like it's a bad thing ... :rolleyes:

 

Hey, but doom saying is easy.

Less resources for R&D and new contents (although a large portion goes to stellardawn or yet another random funorb project).

Player level up slower, less motivation for end game content, some player get bored of leveling and rage quit.