Top Mud Sites Forum Return to TopMudSites.com
Go Back   Top Mud Sites Forum > MUD Players and General Discussion > Tavern of the Blue Hand
Click here to Register

Reply
 
Thread Tools
Old 09-26-2011, 02:45 PM   #1
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Using Logs as evidence

During discussions on how to properly handle Player-Player matters in Eternea, the question has been raised about the validity of a Player's Game Log, if they are used as evidence by a player to expose the wrong doing of another player.

On specific arguement is How can you tell if the Log has been altered? has been raised aginst the use of Logs as evidence.

Well, after some poking around with WindowsOffice 2003 I found that by going into EDIT then down to PROPERTIES, gives me the history of the Document in detail--including when any saves to it occured.

My point is, if a Log was altered before being submitted as evidence it would show by searching in Properties as having a very recent save date.

And I right on this?

Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-26-2011, 05:03 PM   #2
Zeno
Member
 
Zeno's Avatar
 
Join Date: Jan 2005
Location: Saratoga, NY
Home MUD: Bleached InuYasha Galaxy
Posts: 188
Zeno is on a distinguished road
Send a message via AIM to Zeno Send a message via MSN to Zeno Send a message via Yahoo to Zeno
Re: Using Logs as evidence

Ultimately there is no way. Even the "date modified" info is editable to whatever someone wants.
Zeno is offline   Reply With Quote
Old 09-26-2011, 05:04 PM   #3
Kiore
New Member
 
Join Date: Oct 2010
Posts: 4
Kiore is on a distinguished road
Re: Using Logs as evidence

What if they edited with another program? If they just copied and pasted the text from the terminal, directly to notepad and saved/sent it, then there will be no changes documented. Also, if it is a newer version of office/word, they default to saving in .docx which is xml, which will keep track of various pieces of information (changes, formatting, etc). It is rather difficult to check the validity of logs submitted by anyone.

How about a command to report a person? Not just simply bring that character to the admin's attention, but how about saving (temporarily) a bit of information surrounding the time the report was filed? For instance:

I am running around playing, and I kill a mob another player needs for a quest (lets say I wasn't being malicious, I was just killing mobs for exp/coin/items/whatever). The other player gets annoyed since they have had to wait for a large amount of time on that particular mob's respawn, and begins berating me, I request for them to stop, but they continue, so I just type "report <person>" and it will send a notice to the admins, and create a log file (maybe create a note to admins with the appropriate information in the note body?). The log would contain information from the last X minutes, or the last X commands sent, possibly also the last X commands received (so you can have two sides of the story). That way, noone can tamper with the log, and it can be investigated thoroughly.

Obviously this was just a basic example, and can contain as little or as much information as needed.

The other idea is to create an in-game "log" command for mortals that will "log" their session temporarily , just in case, but does not save between sessions and such.

Just a few ideas, which are much better than accepting player submitted logs. Some players are trustworthy enough as to not modify a log that they are submitting, however they may modify it to remove personal tells, or information that is not relevant, etc.
Kiore is offline   Reply With Quote
Old 09-26-2011, 10:45 PM   #4
scandum
Senior Member
 
scandum's Avatar
 
Join Date: Jun 2004
Posts: 308
scandum will become famous soon enough
Re: Using Logs as evidence

On my mud I keep an in memory copy of the last 1000 lines of data for each player, with the option for players to dump the copy to file locally.

This provides a fool proof log.
scandum is offline   Reply With Quote
Old 09-27-2011, 02:22 AM   #5
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Quote:
Originally Posted by Zeno View Post
Ultimately there is no way. Even the "date modified" info is editable to whatever someone wants.
But wouldn't this show up on record when examined?

Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-27-2011, 06:33 AM   #6
arden
New Member
 
Join Date: Jan 2011
Posts: 20
arden is on a distinguished road
Re: Using Logs as evidence

no but that doesn't really matter because what you do is you edit it in notepad, the copy and paste to word, there will be no record of the change as there is no feature that records changes in a .TXT file
arden is offline   Reply With Quote
Old 09-27-2011, 06:40 AM   #7
Erisine
New Member
 
Join Date: May 2011
Posts: 21
Erisine is on a distinguished road
Re: Using Logs as evidence

Or you grow up and stop invalidating the entire process by creating fake logs. I sometimes wonder if the fakers out there ever heard of the boy who cried wolf?

I wouldn't go as far as to automatically discount player-submitted logs -- but I would take into account the nature of the player (if he were known) and look at their track record on the game. Is this person well known for crying foul, harassment, or other sorts of shinanigans? In the event of forgeries, have a zero-tolerance policy in place. And of course, look for other supporting evidence.

As another individual stated, there are ways that you can put the responsibility of logging into the hands of the MUD itself -- automatically dumping players' last 1000 commands after the use of a report command could come in handy.
Erisine is offline   Reply With Quote
Old 09-27-2011, 11:10 AM   #8
dentin
Member
 
Join Date: Apr 2008
Home MUD: Alter Aeon
Posts: 245
dentin is on a distinguished road
Re: Using Logs as evidence

One of the first rules of computer security is that if the hardware is under physical control by the attacker, all data on it has been compromised. If it came from a player, it's suspect. The best you can do is assign probabilities to the evidence you receive from players, and try to piece together as best you can what happened. Some players will be less suspect than others. See lesswrong.com for the math on calculating bayesian probabilities if you care that much.

All this said, I have never received a fake log, or a log that grossly conflicts with other logs, or even a log where someone claims strongly that "that didn't happen". This is in a 15+ year time period I've been running Alter Aeon.

Usually, lack of logs is a bigger problem. There's a lot of replay and history sorts of information on players, and some problem players are fully logged just in case, but occasionally you just have to ask people what happened and sort out the details as best you can. Fortunately, problem players are quite often their own worst enemy - I've had players lie right to my face about something, then brag to their friends minutes later not knowing they're logged. Most jerk players do it for the ego, and if they can't tell anyone there's no point.

-dentin

Alter Aeon MUD
http://www.alteraeon.com
dentin is offline   Reply With Quote
Old 09-27-2011, 12:33 PM   #9
camlorn
Member
 
Join Date: Aug 2011
Posts: 144
camlorn is on a distinguished road
Re: Using Logs as evidence

Ok, a few misconceptions about logs that need clearing up (this doesn't refer to you dentin).
All files are bytes on your hard drive. I can alter anything about it, including change histories. I have seen tools that go so far as to let you erase parts of the hard drive by byte addresses, and the windows api has a ton of functions to change last modified dates; not to mention, i've had a lot of oddities with that anyway.
If you want to be absolutely sure you're not getting fake logs, make certain things markers; if you say that any log submitted must have color codes recorded in it to be even considered as real, you can use that as a verification. Alternatively, a modification on the previously stated, make a plugin:

So, essentially, if you want players to be able to have and view logs with little chance of faking, use encryption. If you use public and private keys, you can encrypt the log with the public one and send it to the player via a plugin in your favorite mud client; there's now virtually no way for the average player to modify it. For viewing, a web interface that lets you send it to a script with the private key for decryption is an option; there's probably a security hole in this, but most players wouldn't even know what is going on. For common logs to be shared, don't use it, but it makes a way to give logs to players for archival purposes, in case they want an offline copy of any log the server's holding; in this system, the player can be responsible for keeping the log. A word of note, one of the keys has to remain private, or the whole system comes crashing down.
camlorn is offline   Reply With Quote
Old 09-27-2011, 01:00 PM   #10
Tristan1992
Member
 
Join Date: May 2010
Home MUD: GateWay
Home MUD: Rocky
Home MUD: MUME
Posts: 75
Tristan1992 is on a distinguished road
Wink Re: Using Logs as evidence

Quote:
Originally Posted by Darren Brimhall View Post
During discussions on how to properly handle Player-Player matters in Eternea, the question has been raised about the validity of a Player's Game Log, if they are used as evidence by a player to expose the wrong doing of another player.

On specific arguement is How can you tell if the Log has been altered? has been raised aginst the use of Logs as evidence.

Well, after some poking around with WindowsOffice 2003 I found that by going into EDIT then down to PROPERTIES, gives me the history of the Document in detail--including when any saves to it occured.

My point is, if a Log was altered before being submitted as evidence it would show by searching in Properties as having a very recent save date.

And I right on this?

Darren Brimhall
Sorry but I log in MS-DOS to TEXT files. It would not work on my logs.
Tristan1992 is offline   Reply With Quote
Old 09-27-2011, 02:15 PM   #11
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Quote:
Originally Posted by dentin View Post
One of the first rules of computer security is that if the hardware is under physical control by the attacker, all data on it has been compromised. If it came from a player, it's suspect. The best you can do is assign probabilities to the evidence you receive from players, and try to piece together as best you can what happened. Some players will be less suspect than others. See lesswrong.com for the math on calculating bayesian probabilities if you care that much.

All this said, I have never received a fake log, or a log that grossly conflicts with other logs, or even a log where someone claims strongly that "that didn't happen". This is in a 15+ year time period I've been running Alter Aeon.

Usually, lack of logs is a bigger problem. There's a lot of replay and history sorts of information on players, and some problem players are fully logged just in case, but occasionally you just have to ask people what happened and sort out the details as best you can. Fortunately, problem players are quite often their own worst enemy - I've had players lie right to my face about something, then brag to their friends minutes later not knowing they're logged. Most jerk players do it for the ego, and if they can't tell anyone there's no point.

-dentin

Alter Aeon MUD
Alter Aeon

while I understand the lack of logging by players, and having them lie to you that they didn't (as I strongly suspect its occured to me), but how can yo tell if a Log is fake or not?


Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-27-2011, 02:20 PM   #12
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Quote:
Originally Posted by camlorn View Post
Ok, a few misconceptions about logs that need clearing up (this doesn't refer to you dentin).
All files are bytes on your hard drive. I can alter anything about it, including change histories. I have seen tools that go so far as to let you erase parts of the hard drive by byte addresses, and the windows api has a ton of functions to change last modified dates; not to mention, i've had a lot of oddities with that anyway.
If you want to be absolutely sure you're not getting fake logs, make certain things markers; if you say that any log submitted must have color codes recorded in it to be even considered as real, you can use that as a verification. Alternatively, a modification on the previously stated, make a plugin:

So, essentially, if you want players to be able to have and view logs with little chance of faking, use encryption. If you use public and private keys, you can encrypt the log with the public one and send it to the player via a plugin in your favorite mud client; there's now virtually no way for the average player to modify it. For viewing, a web interface that lets you send it to a script with the private key for decryption is an option; there's probably a security hole in this, but most players wouldn't even know what is going on. For common logs to be shared, don't use it, but it makes a way to give logs to players for archival purposes, in case they want an offline copy of any log the server's holding; in this system, the player can be responsible for keeping the log. A word of note, one of the keys has to remain private, or the whole system comes crashing down.

We are considering using a Alice-style or Flash input window for players to play the Game.
How would we be able to utilize color codes you've mentioned to insure the validity of the Log's 'truthfullness' ?

Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-27-2011, 02:22 PM   #13
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Quote:
Originally Posted by scandum View Post
On my mud I keep an in memory copy of the last 1000 lines of data for each player, with the option for players to dump the copy to file locally.

This provides a fool proof log.

I'll pass this along to Maya...Thank you for the suggestion.

but I do have two questions; first, how much space would a Dump use, and second; could the information be E-mailed an Admin's personal E-mail?


Darren Brimhall

Last edited by Darren Brimhall : 09-27-2011 at 02:28 PM.
Darren Brimhall is offline   Reply With Quote
Old 09-27-2011, 02:56 PM   #14
dentin
Member
 
Join Date: Apr 2008
Home MUD: Alter Aeon
Posts: 245
dentin is on a distinguished road
Re: Using Logs as evidence

Darren,

There is no certainty that something hasn't been faked, merely evidence. In rough order:

1) If the log contains obvious typos and inconsistencies that the game is incapable of producing, then it's probably been edited. I have received numerous logs that had inconsistencies, and for every one editing was confirmed on asking.

2) If a log conflicts with other logs, indicating events that did not happen or removing events that did happen, then it has probably been edited. Several times I've cross-correlated player logs with system logs and other information, noticed inconsistencies, and had the player verify that the logs had been edited prior to submission.

3) I've never had a player, who when faced with a logfile, said "that didn't happen, the log is wrong". If the defending player basically admits that the log is correct, then the log is probably correct.

Again, it comes down to evidence, and making the best decision available to you with the information provided. It's an awful lot like the adversarial court system - if adversarial parties agree on a fact, then it can probably be considered a fact in that instance. If there's disagreement, as admin you have to weigh all the evidence available to you to make a proper determination. You're never going to get certainty.

In my opinion, this quest for 'verifiable integrity of logs collected and submitted by players' is a red herring, and your time would be vastly better spent improving the logging facilities of the server:

- Questionable game related features that are a potential problem should be logged
- Illegal actions that are theoretically impossible should be logged, because they can probably happen
- Actions that have a large impact on any single player should be logged (death, large amounts of gold/equipment moving, password changes, summoning, pet killing, etc)
- Actions that have a small impact on many players should be logged (channel spamming, auction spamming, group spamming, group death marches.)
- The top ~1% of players that have a history of being social whores/drama queens should be player logged, as they are stupidity attractors
- The top ~1% of players that have a history of being assholes or jerks should be player logged, as they are stupidity producers
- Anyone who has a history of being near the center of more than a small number of events should be player logged, because it's likely they'll be near yet another event in the future. Bystander logs have been a critical factor in several cases

AA generates about 6000 lines in its system logfile daily, at an average of about 50 players logged in and busy. Between the system logs and system generated player logs, it's enough to deal with nearly all of the questionable game related activity that surfaces, and I only have to fall back to more messy methods for the small remainder. It is exceptionally rare that I request a player log for any reason other than server debugging.

-dentin

Alter Aeon MUD
http://www.alteraeon.com
dentin is offline   Reply With Quote
Old 09-28-2011, 02:00 AM   #15
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Dentin,

Could I use your example below as the basis of a Staff Rule on how to handle such matters in Eternea?

Its very well written and easy to understand.


Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-28-2011, 06:06 PM   #16
camlorn
Member
 
Join Date: Aug 2011
Posts: 144
camlorn is on a distinguished road
Re: Using Logs as evidence

As usual, dentin's right on everything, including why bother going this overboard on it. There are advantages, but the truth is that the advantages aren't worth the drawbacks. You're going to end up spending more time on this than actually just using your own judgement and reviewing the evidence, at least on a small mud, and such a system can always be added later.


As for imbedding color codes for verification and flash clients, why is your flash client allowing logging? In my experience, everyone generally doesn't use the web play; they use their favorite mud client instead. That said, logging the raw data from the mud is essentially what I'm suggesting, and if you're writing a flash client, you should be able to figure this out.
camlorn is offline   Reply With Quote
Old 09-29-2011, 11:43 AM   #17
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

Quote:
Originally Posted by camlorn View Post
As usual, dentin's right on everything, including why bother going this overboard on it. There are advantages, but the truth is that the advantages aren't worth the drawbacks. You're going to end up spending more time on this than actually just using your own judgement and reviewing the evidence, at least on a small mud, and such a system can always be added later.


As for imbedding color codes for verification and flash clients, why is your flash client allowing logging? In my experience, everyone generally doesn't use the web play; they use their favorite mud client instead. That said, logging the raw data from the mud is essentially what I'm suggesting, and if you're writing a flash client, you should be able to figure this out.

well, if I could sript, I would write a flash client. But Flash looks like what we're going with.

but I have made the proposal to utilize dentin's suggestions married with scandum's data dump to my boss at Eternea...

Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 09-30-2011, 11:17 PM   #18
Newworlds
Legend
 
Newworlds's Avatar
 
Join Date: Aug 2007
Name: NewWorlds
Home MUD: New Worlds
Posts: 1,382
Newworlds will become famous soon enoughNewworlds will become famous soon enough
Re: Using Logs as evidence

I think if you have such problems it is time to play a game with mature players.
Newworlds is offline   Reply With Quote
Old 10-01-2011, 03:01 AM   #19
Darren Brimhall
Member
 
Join Date: Jun 2010
Posts: 241
Darren Brimhall is on a distinguished road
Re: Using Logs as evidence

I'm trying to think of ways of avoiding another Castle Marrach.

I want to players in Eternea to beable to trust that the Game will be fair.

So, you'll forgive me for erring on the side of immaturity and paranoia

Darren Brimhall
Darren Brimhall is offline   Reply With Quote
Old 10-01-2011, 12:45 PM   #20
Newworlds
Legend
 
Newworlds's Avatar
 
Join Date: Aug 2007
Name: NewWorlds
Home MUD: New Worlds
Posts: 1,382
Newworlds will become famous soon enoughNewworlds will become famous soon enough
Re: Using Logs as evidence

Quote:
Originally Posted by Darren Brimhall View Post
I'm trying to think of ways of avoiding another Castle Marrach.

I want to players in Eternea to beable to trust that the Game will be fair.

So, you'll forgive me for erring on the side of immaturity and paranoia

Darren Brimhall
In that case just have a help file that says the game will be fair and be fair.

The only real issue NWA has is people sometimes becoming friends or enemies outside of the game through facebook/skype/msn, what have you (which happens in any roleplay intense game). They then try to utilize ooc conversations as reasons for action by the administration.

We have help files that address this and do not deal with ooc issues. We also have detailed help files on things that become intensive issues in the game which also makes staff action more precise.

Give it time Darren, you will learn what works for you and your game as all games and players are different.
Newworlds is offline   Reply With Quote
Reply


Thread Tools


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off

All times are GMT -4. The time now is 08:18 AM.


Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
Style based on a design by Essilor
Copyright Top Mud Sites.com 2014