Script: "Reliant" + HTML Script Legality Discussion

[[violet]]

Sorry, I hang out with too many zoomers. What I mean is the super human user endorsing 5-6 nations per second.

Not easily, as I'd have to rebuild my February analysis. I have retained server logs from back then, which identify high-activity IP addresses, but these are linked to dozens or hundreds of different nations -- puppets, no doubt, but I can't tell now which was in use at the time.

[[violet]]

Why would this be considered machine-like at all? This type of speed and optimisation can be see at essentially all of high-level gaming; Starcraft pros regularly crest 6 actions per second

Yes, but that doesn't mean we shouldn't police any HTML bots, since no matter how fast they send requests, they might be Starcraft pros.

I totally agree that this highlights the intrinsic problem with the HTML Script Rules. But we can't let bots run wild -- the server would grind to a halt. This site is regularly hammered by bots, and I ban them with a clear conscience because their traffic looks very different to the vast majority of human traffic.

[[violet]]

This is not even how keybinding works on NS / is not physically possible because NS users are very aware that keydown() is illegal and we don't use that method. Breeze++ and every derivative of it use keyup(), which only fires once, when the user raises the key. Holding down a key will do nothing at all! Instead of making wild assumptions about how users are doing illegal things, you should read code and stick to facts.

Choosing not to implement something like keydown() is not the same thing as being physically impossible. I think you're describing a scenario in which script authors follow the rules, don't accidentally introduce bugs, and share code with NS admin on request. I understand this is what you do, but you have to understand not everyone is like that, and admin can't investigate apparent rule breaches by asking players to provide evidence that proves their guilt. That's not insulting anybody or making wild assumptions; that's just logical.

The HTML script rules are fine and we've been complying with them faithfully for years. What's hopelessly compromised is admin and mod willingness to conduct proper investigations and act on facts rather than knee-jerk conjecture. I was an admin of a game with 1.1 million players in 2007. When I couldn't give that game the attention it deserved, you know what I was told? Resign, so a more active admin could replace me. And so I did that rather than be inactive. If NS staff can't give this game the full attention it deserves, that is a path that should be considered.

Well in my opinion, it's far better for admin to spend time on core NS things, not performing triage on third-party HTML scripts. Or on bots in general, which consume a ridiculous amount of time these days.

You are very well aware that means the end of the defending faction in the R/D metagame, or at least, the end of chasing, the most fun part about defending.

No, I'm not. With the right endpoints, I don't see why a script that currently uses the HTML site couldn't do the exact same thing on the API. And, vice versa, we can implement flood controls and timeouts on the HTML site just like we can on the API. So I don't think there's anything intrinsic to the API that makes it impossible to use.

It's also worth noting that such scripts aren't just for speed necessities - things like Breeze are for quality of life, too. As mentioned in the past, I am a video editor with painful carpal tunnel and spend 10+ hours a night in front of a computer. Thus, I limit mouse usage whenever possible in favor of keybinds that let me do stuff while keeping my wrists elevated and off surfaces. But, a thing like Breeze can't be ported to the API. Ideally, NS itself would let us set keybinds. However, we interact with the site in ways you didn't even comprehend last time it was a discussion, like real humans interacting with the AJAX2 feed simply cause it actually loads fast, and thus native keybinds wouldn't cover our needs.

I do comprehend this. I mentioned it earlier. This is the reason the HTML Script Rules exist. It's why we haven't banned HTML scripts even though they're a constant problem: they provide quality of life improvements.

There's also another obvious problem with banning HTML scripts that use keybinds - you can bind keys to gaming mice, floor pedals, even steering wheels. Would that now be illegal, too? How would you even detect that?

I don't think anyone is talking about banning simple keybinds of that kind. There is, of course, a wide and expanding range of browser tools and add-ons, many of which blur the lines between user and program. But what we're talking about today are scripts that craft and dispatch custom HTML requests.

Those scripts are the source of the great majority of problems, including the fact that it's easy for players and script authors to accidentally break the rules, and hard for admin to tell whether they're broken, which produces situations like this. This is similar to how we used to put all responsibility on players not to sign up to the WA with two nations, before we began forcefully blocking attempts to reregister with the same email address -- it was a constant admin headache to figure out who had multied on purpose, with plenty of well-intentioned players were caught in the crossfire. And back then some people probably thought mods and admin should spend a lot more time investigating all the alleged multi incidents so that each one was judged correctly, but really it was just a bad system that needed to change.

[Flanderlion]

Are the QoL improvements for individuals using their own scripts worth the admin time to police it? Like, sometimes something is a good idea (allowing scripts on the HTML to improve QoL stuff) turns into more work than it's worth. Would it really be the end of the world for a blanket ban, and enforce it only when it goes into mod/admin attention.

[RiderSyl]

So, from what I understand...

Is it reasonable to say that the current state of raiding/defending Gameplay (extensive* automation by bots) does not have a future on this site?

*no semantics pls

[Roavin]

Now, somewhat of a longer post, now that I'm on my lunch break at a computer rather than on my way to work on a phone.

Once again, [v], thank you so much for coming into this thread and giving us this information - it might not seem like it this way for some at first glance, but as the primary tech dude within this thread, your post answers a lot of extant questions that we were having, and (for me at least) vindicates having put the effort into all of this. I also understand and respect that you won't look further into this. I'm okay with this, and don't want to and will not attempt to belabour you further on this now. I do have suggestions moving forward, which I'll get to later in this post.

There is an inconsistency in documentation - Elu's suggested identification via URL-Parameters does not include a mention of contact-info, but that example is what Reliant used as an example to identify itself. With your post, we now know that this was incorrect, as that lacks contact info, as mentioned by OSRS Script Rules. We'll fix that in Reliant immediately, but it might be worth either amending Elu's post or, even better, amending that part of the OSRS script rules to include a "correct" example. (@NS Staff generally: what's the best way to report this, beyond writing it here?)

Ironically, if Reliant had identified itself with contact info rather than just by the provided example, we likely wouldn't have gotten to this point. C'est la vie.

On the bots being banned: You've implied several times that you do this with some frequency, but I haven't witnessed it in the circles I frequent; even with Storm, the unnamed TG tool, and now Reliant, no ban took place but instead other measures; and I know of at least a magnitude more than 3 tools doing a variety of things that have not gotten blocked or banned or whatnot. Is it possible that you have just a bit of reinforcement bias, since the scripts you deal with are the bad ones and the good ones just do their thing as they should?

On adding %D format specifier to access logs: There are quite a few players more than willing to help test this change, if you need it, be it with Reliant, raw, or whatever else.

And generally on moving forward: Without wanting to comment (here) on possible rule changes wrt HTML scripting, I think one quick way to get this out of admin hands is to have a Tech Modling or two from the community that can read and analyze source code and help people get their tools to be compliant, which doesn't require server access (except maybe occasionally getting a dump from Apache access logs) and saves admin time while still providing a service to the user base and, at the same time, making sure the server hamsters don't get needlessly overworked.

[The Blaatschapen]

And generally on moving forward: Without wanting to comment (here) on possible rule changes wrt HTML scripting, I think one quick way to get this out of admin hands is to have a Tech Modling or two from the community that can read and analyze source code and help people get their tools to be compliant, which doesn't require server access (except maybe occasionally getting a dump from Apache access logs) and saves admin time while still providing a service to the user base and, at the same time, making sure the server hamsters don't get needlessly overworked.

I'm personally not very interested in running potentially rogue code on my personal devices. Wait, no that's too weak. It just won't happen.

Helping people out a bit is fine though. But I'm wary of a player then coming and staying "but Blaat said my code was OK!" if I accidentally miss something (which is entirely possible, especially in languages that I'm not familiar with)

[Vylixan]

Can someone define what an HTML bot is and isn't? It's not clear to me what the used terminology refers to.
All the more so when you consider that a Bot by most definitions is an autonomously operating script, and that's already illegal under the current rules.

I've written a ton of QoL scripts that improve the User Experience and Use Interface, and I use a lot of these written by other people. I count 37 active scripts, and a few that are not active because I either use the situational, or they are still in development. There is some overlap between functionality in scripts, and some are being worked on right now. So those numbers are only an indication
I see multiple references to wanting to move all scripts on the HTML site to the API.
Well, exactly 0 of the scripts I wrote and/or use can move to the API, because they provide features, information, functionality etc. to the NS site on the very same HTML pages. Two scripts even pull information from the API to present it on the HTML site.

The last thread about changing HTML site rules already made me fear for most of the QoL scripts I use on a daily basis.
And there was a lot of uncertainty what type of scripts are banned, what interacting with the HTML site even is, and staff telling us that visual script would not fall under the new rules (I'm paraphrasing here, since the terminology used still leaves a lot of things unclear to me), while at the same time a script I've build that adds a simple link to issues was declared illegal under the new rules.

I'm at the moment building two new scripts, beta-testing one script, and improving and fixing a number of other scripts. I enjoy the work I do, but I rather not invest time and energy right now into things that will soon be pointless.

I'm willing to explain what all these scripts do and why I'm using them. Because I feel there is a lack of knowledge about why a lot of users use scripts outside of r/d.
I would hate to suddenly have to play NS without these improvements to the User Experience and Use Interface.

[Roavin]

And generally on moving forward: Without wanting to comment (here) on possible rule changes wrt HTML scripting, I think one quick way to get this out of admin hands is to have a Tech Modling or two from the community that can read and analyze source code and help people get their tools to be compliant, which doesn't require server access (except maybe occasionally getting a dump from Apache access logs) and saves admin time while still providing a service to the user base and, at the same time, making sure the server hamsters don't get needlessly overworked.

I'm personally not very interested in running potentially rogue code on my personal devices. Wait, no that's too weak. It just won't happen.

Helping people out a bit is fine though. But I'm wary of a player then coming and staying "but Blaat said my code was OK!" if I accidentally miss something (which is entirely possible, especially in languages that I'm not familiar with)

I see your point, but sandboxing is easy than it has ever been these days (in fact it's called Windows Sandbox, if you're using Windows ), so I'm less worried about that aspect. And I suppose the point is less to legality check everything, but rather to help people with questions and then investigate when an actual problem is found (rather than having actual site admin do it).

[Wallenburg]

Wallenburg, this is a thread in which people have been begging for admin input from the start. When that finally comes, you responding with outright hostility and rudeness does not help anyone's case. Dial it back, or let someone more reasonable post on your behalf.

The only genuine rudeness in this thread is the months of neglect toward this matter by site staff, and the repeated attempts to pass off BS excuses as genuine explanations. When it's so obvious that site staff jumped the gun and assumed this to be illegal when they can produce no evidence to that effect after 4 months of "investigation", the reasonable follow-up from site staff is to apologize and start being honest with the folks whose engagement with this game is predicated on their ability to use this or similar legal scripts.

[Refuge Isle]

No, I'm not. With the right endpoints, I don't see why a script that currently uses the HTML site couldn't do the exact same thing on the API. And, vice versa, we can implement flood controls and timeouts on the HTML site just like we can on the API. So I don't think there's anything intrinsic to the API that makes it impossible to use.

A primary concern for me would be that, even with new private endpoints, a hypothetical r/d api would need to behave a lot differently than the rules permit now.

My 10-11 refreshes per second aren't for my health, they're because, even with conventional triggering techniques, you can get yourself and your raiding team into a region with a second (and often less than a second) til update. Defenders, then, have less than a second to respond and chase. 100 requests per minute is pretty non-viable for that, as is getting banned for 15 minutes because you refresh too fast.

[Wymondham]

Would that include ad blockers too? Banning those would make many players quit.

Ad blockers aren't going to be banned. If/when scripts are banned from the html site, there would be admin-led discussion with players first in Technical, to clarify details, and work out what can be done to improve the API to mitigate the impact as best possible; also I'd expect a grace period as well.

I know we've raised the prospect of banning scripts from the html site a couple of times here, but it's not the best place to discuss it. When admin feels ready to move ahead with it, there'll be the chance to discuss it in a dedicated thread then.

Seeing as [v] has now come into this thread and raised banning scripts as something that is very seriously being talked about - are we going to be getting a thread on this soon so as not to clutter this thread?

[Sedgistan]

My post was in vain, to the extent that even Violet is having that discussion here, so have at it in this thread.

[Esfalsa]

But what we're talking about today are scripts that craft and dispatch custom HTML requests.

What does... this... mean exactly? Because mentioning plans to:

ban scripts on the HTML site

could easily lend itself to a much broader interpretation where any and all scripts are banned from the HTML scripts, regardless of whether they're sending 'custom' HTML requests, and indeed, regardless of whether they're sending any requests at all.

---

While I personally would be thrilled to see a migration to the API, there have already been concerns raised about when those API updates would be made. It's admittedly a lot easier to change the rules and ban HTML scripts than it is to add a range of new API endpoints (especially while listening and responding to community input like this — and I'm sure there will be a lot more if this is the path that site staff choose to stick with). So, I apologize if this comes off as rude, but promises to "probably write some new API endpoints" to help with script migration can feel like tossing a bone, especially in comparison to more decisively stated (even if not finalized) plans to ban HTML scripts.

---

I think it's also worth belaboring one more time that a lot of the suspicious, bot-like traffic from Reliant looks a whole lot like normal R/D gameplay these days. Consider:

• Refreshing the same (reports) page over and over — it's the fastest way to see new happenings as they are generated, which is critical for chasing raiders into their targets. (The raiders here probably know of better ways to do it, but I've also called triggers before for practice from refreshing the reports page.)
• The "machine-like" behavior of repeated requests — as waste's first post noted, it's not that hard to perform repeated actions quickly. Even without scripts, anybody can click the refresh button, or hold down the Ctrl key and press the R key, as fast as they can. It doesn't take 'superhuman' speed to click or press a key six or more times per second; and if that traffic from an ordinary R/Der is now indistinguishable from bot-like traffic, the issue doesn't lie with scripts. I can send requests as fast as my computer's key repeat allows simply by holding down Ctrl+R, no scripts needed.
• Multiple moves into the same region within the same second — this is just how any triggered jump works. Someone calls out a GO order, and everyone moves as fast as they can. It's common to, say, have a browser window on the left half of the screen and an instant messaging window on the right half, and just move (by clicking the move button, pressing a keybind, etc.) when the GO order appears on the instant messenger. I don't think moves within the same second are particularly suspicious in a set-up like this.

I can understand why site staff can feel frustrated with HTML scripts. That said, if the issue is that the network traffic in this case feels too similar to a bot — well, because that traffic looks an awful lot like normal R/D activity, it's also easy to feel that HTML scripts are being made a scapegoat.

[Free Algerstonia]

Wallenburg, this is a thread in which people have been begging for admin input from the start. When that finally comes, you responding with outright hostility and rudeness does not help anyone's case. Dial it back, or let someone more reasonable post on your behalf.

wallenburg is fully in their rights to post that way after this episode and a myriad of other episodes of moderation and administration making persistent bad decisions. come on.

[Sandaoguo]

Will there be a thread open to discuss or solicit RFCs for HTML rules changes? I’ve had many thoughts since the possibility was discussed, but haven’t posted them here because they aren’t directly related to this script. HTML scripts are used by almost every delegate and high-endo government official in GCRs.

[Sedgistan]

Wallenburg, this is a thread in which people have been begging for admin input from the start. When that finally comes, you responding with outright hostility and rudeness does not help anyone's case. Dial it back, or let someone more reasonable post on your behalf.

wallenburg is fully in their rights to post that way after this episode and a myriad of other episodes of moderation and administration making persistent bad decisions. come on.

When a Moderator gives a player instruction on tone, they should follow it. With your record, you are the last person to have a useful contribution on the matter, and it is not your place to discuss it. Either post on-topic here, or don't post at all.

Will there be a thread open to discuss or solicit RFCs for HTML rules changes? I’ve had many thoughts since the possibility was discussed, but haven’t posted them here because they aren’t directly related to this script. HTML scripts are used by almost every delegate and high-endo government official in GCRs.

Use this one; the thread has evolved past its original intent into a dsicussion on HTML script legality in general.

[Refuge Isle]

Will there be a thread open to discuss or solicit RFCs for HTML rules changes? I’ve had many thoughts since the possibility was discussed, but haven’t posted them here because they aren’t directly related to this script. HTML scripts are used by almost every delegate and high-endo government official in GCRs.

Use this one; the thread has evolved past its original intent into a dsicussion on HTML script legality in general.

If that's the case, I'd like to suggest the thread title be renamed to something more appropriate and accurate.

[Syberis]

wallenburg is fully in their rights to post that way after this episode and a myriad of other episodes of moderation and administration making persistent bad decisions. come on.

When a Moderator gives a player instruction on tone, they should follow it.

There's no rule against a frustrated or angry tone, unless I missed something in the OSRS, and Moderation does not exist to tell us how to speak. In fact, I would argue that a Moderator going in and going "Watch your tone, because I said so" is thus immensely inappropriate, considering that a substantial portion of the anger and frustration in this thread is the seeming pervasive belief that everyone involved here is operating in bad faith, and a dismissive attitude towards player input in general, when there even is enough response to be able to tell that there is attitude.

I'm shocked and appalled that seemingly no lessons were learned here. However, I'm well aware this is an issue that kind of bridges Moderation and Technical, though may stand on the Moderation side. Would you suggest we move this tangent into Moderation to discuss how the tone of moderation makes Gameplay and player developers consistently feel like staff believes we're criminals waiting to get caught, instead of good-faith players attempting to benefit the game?

[Sedgistan]

If that's the case, I'd like to suggest the thread title be renamed to something more appropriate and accurate.

Done.

When a Moderator gives a player instruction on tone, they should follow it.

There's no rule against a frustrated or angry tone, unless I missed something in the OSRS, and Moderation does not exist to tell us how to speak. In fact, I would argue that a Moderator going in and going "Watch your tone, because I said so" is thus immensely inappropriate, considering that a substantial portion of the anger and frustration in this thread is the seeming pervasive belief that everyone involved here is operating in bad faith, and a dismissive attitude towards player input in general, when there even is enough response to be able to tell that there is attitude.

I'm shocked and appalled that seemingly no lessons were learned here. However, I'm well aware this is an issue that kind of bridges Moderation and Technical, though may stand on the Moderation side. Would you suggest we move this tangent into Moderation to discuss how the tone of moderation makes Gameplay and player developers consistently feel like staff believes we're criminals waiting to get caught, instead of good-faith players attempting to benefit the game?

Moderators routinely give players instructions on tone, usually when their posts are disruptive to a thread, as was the case here. If you want to discuss this further, Moderation is the appropriate place, not this thread.

[Wymondham]

wallenburg is fully in their rights to post that way after this episode and a myriad of other episodes of moderation and administration making persistent bad decisions. come on.

When a Moderator gives a player instruction on tone, they should follow it. With your record, you are the last person to have a useful contribution on the matter, and it is not your place to discuss it. Either post on-topic here, or don't post at all.

Would you prefer we discuss the extremely troubling implication this post creates here or would the moderation team prefer that I made a forum thread in moderation about it?
Edit: you posted between me starting my post and posting that so nvm

[Fort Concord]

If that's the case, I'd like to suggest the thread title be renamed to something more appropriate and accurate.

Done.

Is the site staff willing to consider further editing the thread title to reflect that it has been stated that they are no longer confident/asserting that Reliant is illegal?

I'm not trying to be snarky or disrespectful, to be clear. I think the appeal granting post makes it clear that the name is not suitable anymore.

[Sedgistan]

Is the site staff willing to consider further editing the thread title to reflect that it has been stated that they are no longer confident/asserting that Reliant is illegal?

I'm not trying to be snarky or disrespectful, to be clear. I think the appeal granting post makes it clear that the name is not suitable anymore.

Reliant was technically illegal in the user agent it set (a relatively minor separate issue, though a nuisance to admins investigating scripts). I don't think changing the title achieves much, as anyone who is going to pay attention to the thread already knows where things stand... but if people feel better with it out, I'll remove it.

[Free Algerstonia]

If that's the case, I'd like to suggest the thread title be renamed to something more appropriate and accurate.

Done.

There's no rule against a frustrated or angry tone, unless I missed something in the OSRS, and Moderation does not exist to tell us how to speak. In fact, I would argue that a Moderator going in and going "Watch your tone, because I said so" is thus immensely inappropriate, considering that a substantial portion of the anger and frustration in this thread is the seeming pervasive belief that everyone involved here is operating in bad faith, and a dismissive attitude towards player input in general, when there even is enough response to be able to tell that there is attitude.

I'm shocked and appalled that seemingly no lessons were learned here. However, I'm well aware this is an issue that kind of bridges Moderation and Technical, though may stand on the Moderation side. Would you suggest we move this tangent into Moderation to discuss how the tone of moderation makes Gameplay and player developers consistently feel like staff believes we're criminals waiting to get caught, instead of good-faith players attempting to benefit the game?

Moderators routinely give players instructions on tone, usually when their posts are disruptive to a thread, as was the case here. If you want to discuss this further, Moderation is the appropriate place, not this thread.

wanna change your answer here?

[Reploid Productions]

wanna change your answer here?

Rant about a specific mod decision =/= a moderation discussion thread. If you'd like to start a moderation discussion about mod tone or moderation issuing instructions on tone, that's fine. If you just want to rant about Sedge trying to ride herd on this thread and reduce disruption by directing people on their tone, you already have been given instructions on where to make that report.