Wednesday, January 26, 2011

IT vs goonies

Everybody is following the conflict of course, so no need for background. IT's position is that the loss of X13 and finfleet is just trimming of dead wood; on the other side, mittens just declared that IT is fail cascading and DC will go all in, something that we know they are capable of based on delve war 2.

Two weeks ago I would have put my money on IT cascading (experiencing large-scale loss of space and/or members) by February 1. That seems too early now, but we'll see how it goes -- these things accelerate rapidly once they get under way.

Here's another prediction: Another corp will leave IT by saturday.

Maybe molle will surprise me and manage to hold things together; alliances based on charismatic leaders are surprisingly resilient when the leader is actually leading. I've been through a few cascades though, and internal rot, high-profile military losses and corps leaving are all the ingredients for failure.

Thwarting a macro, part 5: Finding macros using the power of the internet

In previous parts we spent a lot of :effort: to thwart some macros and discovered that we don't actually care that much. Now I'll show you how to find them without having to undock, then without even logging in.

While I was searching for the bots the first time they moved I found that using the 'pilots in space' map overlay ingame you can see which systems have people in them, and using dotlan's regional map it's easy to check those systems for suspicious NPC kill patterns. It's easy to tell the difference between a system where players rat and run anomalies and ones with macros because the former have strong usage spikes while the latter are much more steady, often with downright inhuman ratting runs. Try it in your (0.0) region today!

Bot examples:





Human pve examples:

(actually looks suspicious -- maybe a bot in addition to human players)


(EDIT: Also looks suspicious, with no zero values for two 18+ hour intervals. R-Y is the capital system of our alliance though, and it's possible that it's the first choice for running anomalies, with people basing out of r-y and going to other systems when r-y is saturated with pve-ers; three systems adjacent to r-y have anomaly upgrades, two by jump bridges and one by gates)

Since I can tell the difference between a bot and humans doing pve, I'll bet a computer can do it too. The spikiness found in human pve systems makes them distinct from macros, which have a very steady rate of NPC kills, and this suggests a method for distinguishing them. I don't know what the word means in real math but I'm calling the way I found to measure this "entropy." The measurement is made by taking the NPC kills in the first hour and comparing them to the NPC kills in the second hour. The difference in the two values is recorded. Then the second hour is compared to the third, and the difference is added to the difference from the first hour. Repeat for all 48 hours.

The 4 bots above have entropy values ranging from 400 to 800. A1RR, the human ratting system above with the lowest entropy, has 70% more entropy than the highest-entropy botting system despite having half the number of NPC kills so we're probably on to something. The bots' kills in the previous 48 hours range from 1500 to 2700, and we will use this information as well to help avoid false positives.

With these numbers as a guide I wrote a python program which takes the (full and correctly spelled) name of a system, gets NPC kills data from dotlan and processes it, returning a positive if the number of NPC kills are between 1200 and 3300 AND the entropy is less than 950.

This is strictly a proof of concept tool. It did correctly identify whether bots were being used in 18 out of 19 active pve systems in tenal, but pointing it at some regions with different types of NPCs (stain, drone lands) it produces a lot of false positives. Clearly there are better ways to do it -- looking for long low entropy runs rather than just taking the sum, for example. It is also completely useless for finding bots that operate in the same system as humans ratting or doing anomalies.

Once the program was working, such as it is, I grabbed a partial list of 0.0 systems from eve-wiki and made a new version of the program that would automatically run through the list looking for bots. Running it against systems in 7 guristas regions returned 47 hits, including 19 false positives.

Bot finder finds bots

Anyway, I'm done with this angsting-about-bots shit now. CCP doesn't care, my 53 line toy program is smarter than the entire unholy rage team and the whole thing is a waste of time. Anybody who's interested can download the programs, but you'll probably need basic programming skills to make them run.

Monday, January 24, 2011

Thwarting a macro, part 4: Victory, defeat and apathy

In previous installments I took various steps to make a macro sad. Today is the depressing conclusion of my efforts.

After a week of me afk cloaking 23/7, preventing the bots from making any money, the controller started moving the them around. First they moved them 1 or 2 systems and I followed. Then they started moving together, first swapping out of their tengus somehow (I suspect a new neutral I spotted was a carrier alt) then they were spotted moving down the pipe toward venal in drakes. For several days they were mostly logged off and I figured the controller was waiting for a convenient time to get them set up again.

Shortly thereafter I checked my watch list and found that they were logged in again. Refreshing dotlan's t-k and 7d system data I found that the systems showed bot patterns, and checking them I found that the bots are back -- and so are the giant secure containers. I could go back to afk cloaking them, but there's no money in it. I could possibly stop by and kill the containers whenever I get bored, but the controller will probably get smart eventually and make finding them a challenge... plus it's a waste of time in the first place.

We've learned how to shut down a 0.0 ratting macro, but since we now have conclusive evidence that CCP has no interest in banning macros there's no point treating it like a moral issue any more. Usually the EULA defines a universal moral code within a game, but not enforcing a rule is no different than allowing it in the first place.

In part 5 I will present a method to find bots in your own 0.0 region without even undocking, then automate it to check every 0.0 systems for possible bots.

Sunday, January 23, 2011

Thwarting a macro, part 3: Kekekeke

In part 2 we found that both of the systems the macros are using contain giant secure containers, which we suspect they might be using to store ammo and loot.

Cans are totally unprobeable, but a dscan ninja can get an idea of where they are, and sometimes that information can be used to actually locate them. Through judicious use of dscan I was able to determine that the cans were located at safe spots between two objects -- a belt and the nearest planet in both cases. In the first system the cans were about 5500 and 6500 km from the belt, a distance which could be covered in an interceptor, but in the second they were around 8 million kilometers off, again at different safe spots.

Here's how you find an unprobeable object between two other objects: Warp to one object and use dscan to see which direction the unprobeable object is in and how far it is. Warp to the other object and then back, making a bookmark closer to the object you are trying to find. Warp to the bookmark and repeat, making progressively closer bookmarks. Eventually you will end up on grid with the object you are trying to find.

Getting the bookmark in a useful position can be tricky, but as a rule of thumb when your ship is decelerating you can multiply the distance from the point you are warping to to the object you are trying to find by 6 and drop a bookmark when the "distance to warp bubble collapse" is about that number. In one case the can was 3500 km from the bookmark I was warping to, and dropping a bookmark when "distance to warp bubble collapse" was 18,000 put it on grid with the can.

With the 5500 km cans it took me 4 bookmarks before I ended up on the same grid as the first can. With the 8 million kilometer cans it took 14 for the first and 10 for the second, plus several that I deleted due to bad positioning.


Showing info on the cans I discovered that they were owned by a month-old character in an NPC corp, 'Enterprisse'. It's improbable that anybody would anchor GSC in deep 0.0, much less just happen to pick the two systems inhabited by macros run by the same person, so we can be confident that they are connected. The timer on the cans was 29 days when I found them, meaning that they are being used by somebody else. My suspicion is that Enterprisse is an RMT fence, since there are few other reasons to use such a new character.

Whatever the case, when the macros logged off for a while one day I picked up a bomber and killed the cans. They have 500,000 hit points and took about 15 minutes each to kill.

Enterprisee, and killing cans

Having done all we can on our end, the ball is now in the bots' controller's court. The psychology at this stage is interesting -- since the bots' controller is motivated by money I seem to have the advantage, as there is no point keeping them here if they're not making isk; on the other hand, I have seen people do plexes in the same systems as me and the bots so I know for a fact that they are not a threat while I'm doing exploration. It's a lose-lose scenario -- we have no no conflict of interest, but both parties are losing isk because I decided to be here.

I am getting some small return though, in the form of luls and a few blog posts. Taking it out on the botter is also some small consolation for CCP ignoring my petitions, though I'm not sure I care at this point.

Tomorrow, part 4: Victory, defeat and apathy.

Saturday, January 22, 2011

PL vs NC: Nyx down in supercapital skirmish

Today we formed up caps to reinforce some towers in venal. We didn't have a support fleet, and after half an hour of forming we only had only 70 capitals in fleet. A corpmate commented on this, and I speculated that our numbers would increase quickly if we got a fight.

After we reinforced the first tower PL cynoed in their standard abaddon fleet and warped it to some caps that were near the shield. We started melting them with fighters as they slowly took down a couple of dreads. Then they cynoed in a bunch of supercarriers.

Red supers jumping in as we kill abaddons

Red supers warped to the edge of the pos shield, we went siege green and I crashed again. This is the second cap fight in a row that has happened, and both times were when I was changing overview settings. I detect a pattern.

Anyhow, we started with 70 in fleet and one titan. By the time I logged back in we had 256 in fleet, 10 titans and PL were inside pos shields. It looks like we lost 6 dreads and 2 carriers, and killed a few BS and a shitfit nyx.

Killboard -- 37 billion killed, 14 lost

EDIT: All cap kills are showing on both sides. Should be 23 killed, 14 lost.

Friday, January 21, 2011

Thwarting a macro, part 2: ~Detective work~

In part 1 we started afk cloaking to stop some macros which were operating in my alliance's space from earning isk. Today we examine the two systems they operate in, looking for something we can use against them.

System 1: 7d-

7d contains the following objects of interest:

1. Large moon mining tower "7d naughty step detention area" owned by RG corp. Has reaction array, corp hangar and an industrial inside pos shield.
2. Large moon mining tower "kilo's death slide" owned by RG corp. Identical to #1.
3. Small mining tower "d7 feeder" owned by RG corp . Probably mines something for reactions on the large tower. No corp hangar or cans.
4. Small mining tower "kilo's treehouse" owned by RG corp. Similar setup to d7 feeder.
5. Two giant secure containers anchored at a safe spot. These will be a topic for part 3.

System 2: t-k

t-k contains the following objects of interest:

1. Large mining tower "rantanplan" owned by ZET corp. Has corp hangar.
2. Small mining tower "t-k feeder" owned by RG corp. Identical to 7d feeder.
3. Large mining tower "caldari control tower" owned by MYTH. corp.
4. Two giant secure containers anchored at a safe spot.

A pipe in player-sov space is an odd spot to put a macro, and seeing that the systems had towers with the same naming scheme, and large mining/reaction towers with corp hangars, I was expecting to find evidence that the macros were owned by somebody in my alliance -- anchored containers in a pos, or even neutral ships inside pos shields. A neutral pos that I could kill would have been better yet.

None of these things were present. What we did find was that each system contains two giant secure containers which are not at a pos. This is probably not a coincidence; GSC are cheap and cannot be probed down, which makes them perfect for macros to use for ammo and loot storage. Tomorrow in part 3, we'll see what we can do about these.

Excuse me, Incarna FUD lemmings

The idea that CCP might move existing station functions to incarna-only is ridiculous, and your chicken little impression got old months ago. Please shut up.

Thursday, January 20, 2011

Thwarting a macro, part 1: No, CCP doesn't care. Also AFK cloaking.

For the last several months a couple of neutral macros have been hanging out in tenal, my alliance's carebear region, in the 7d- and t-k solar systems. I decided to do something about it. The players in our little drama are as follows:

1. Monki Payton. The 7d- macro. Flies a tengu, cloaks at a safe when someone enters system. Member of PROCE corp.
2. Kamem Chamem. The t-k macro. Identical to Monki Payton. Member of PROCE corp.
3. Killbill. A character in a PVP-fit tengu who is known to attack people who mess with the bots.
4. Ziystaszek. CEO of bots' corporation.
5. Enterprisse. Month-old newbie corp character, apparent logistics alt for macros. More about him in part 3.
6. CCP, who are apparently too busy releasing pve content to ban macros.
7. My carebear alts, who will be doing the thwarting.

On entering the bots' systems one can see tengus on dscan, until they safe up and cloak, and wrecks on scan show that they are belt ratters. Checking dotlan's system NPC kills graphs on several occasions revealed their usage pattern, indicating that that either they are macros or their owner has a habit of belt ratting without eating or sleeping for days at a time.

I do exploration for money, and doing this I run across hostiles quite a lot. IRC losers often rat in southern tenal, and it's not uncommon to see neutral macros in dead-end systems. Usually I just bypass them and keep going, and macros usually disappear after a few weeks.

These two, however, have been unusually persistent. I've petitioned them of course, and later learned that multiple others have done the same to no effect (which makes me feel like it was worth my time to earn all this money legitimately...). They are also more annoying than most macros, being located in a pipe which is important to my exploration circuit -- I don't really feel comfortable jumping my golem into a systems with hostiles in them.

One of my petitions

I'm okay for money right now and thought it would be interesting to thwart them. After an unproductive conversation with their CEO, in which he openly stated that they were macros (yes, I petitioned the screenshot too) I decided to start AFK cloaking. 0.0 ratting macros are programmed to safe up and cloak when another player is in the system, so all I have to do to stop their income stream is AFK cloak in the same systems.

CEO convo

Wine can be a little tricky when it comes to running multiple eve instances from the same installation, but after a little fiddling I was able to run two small clients inside a virtual desktop, on their own workspace, on my right-hand monitor, which is on a separate graphics card from my main monitor and thus does not affect performance. All I have to do is start the clients after downtime and occasionally check dotlan in case they get disconnected.

afk clients

T-K NPC kills history after 10 hours of afk cloaking

7d- NPC kills after 48 hours

That seems to work. The bots continue to be logged in 23 hours a day, but now they aren't making any money. Tomorrow in part 2 we will investigate both solar systems for hints about how the bots operate.

Thursday, January 13, 2011

Screenshot thursday: Some ships and bubbles


The title sort of says it all. Interesting scene because the bubbles make all the ships visible. I think this is from the big LXQ fight.

Friday, January 7, 2011

Yet another PL titan down

It happened at 1 a.m. local so I wasn't involved personally, but it is surely worth mentioning; this is the 8th titan PL have lost in combat in the last nine days. The NC are also continuing the venal purge, and currently 23 PL towers are reinforced and due to come out over the course of 14 hours on saturday.

Apparently molle has announced a grand op today to attack cloud ring in order to take pressure off their pets in fountain. This could become interesting.

EDIT: It looks like this was an actual fight and we lost about 34 capitals though no supers. This should make the fight nearly even by isk, but I would take a titan kill over an equivalent number of capitals for insurance/replacement/morale reasons.

Tuesday, January 4, 2011

PL vs NC: Venal purge

Combat Your Quad 3500mm Siege Artillery I perfectly strikes ... wrecking for 56467.8 damage.

My post about who is winning in venal probably should have been posted a little earlier, because it sure became outdated in a hurry. After killing their titans we started one of our trademark region purges of venal. As one FC put it, "I'm [bleep]ing sick and tired of [bleep]ing around with [bleep]ing PL and their [bleep]ing towers."

Goons, angered that PL broke The Bropact, along with test, have been essential for providing US time coverage, while friendly russians stella polaris and rebellion have provided cover in russian time. We've killed a couple of dozen towers, which has been boring since PL can't compete with our ~massive blob~.

Recent tower kills

As a high point, we did get to drop supercarriers on some PL triage carriers and kill shadoo, who is an FC or leader or something.


I also, for the first time ever, encountered an unstronted pos during this operation. Thanks PL.

Saturday, January 1, 2011

PL looses another titan

I had just gotten home when a jabber ping for supers went out. I logged in, jumped to h-pa... and the PL titan we had tackled was already dead. Oh well.

On the way home PL bridged their subcaps on our subcap return fleet on a gate (again) and we jumped all our capitals in (again). Unfortunately they deagressed and jumped out rather than dropping supers, but I got a nice screenshot out of it (plus a phreeze killmail).

Always remember rule 37