NetHack 3.6.6 | Hacker News Reader

NetHack 3.6.6

nethack.org

183 pointsparaiuspau89 comments

Most of those security bugs have been found by using http://lcamtuf.coredump.cx/afl/ for fuzzing the config parser of NetHack.

Also read the hilarious account how neglecting the integer range of parsing a number lead to a config that gives you an almost invincible character from the start:

https://dpmendenhall.blogspot.com/2020/03/nethack-366-or-how...

The C programming language strikes again.

One of the things I love about nethack is that these things effectively amount to magic. Arcane knowledge of how the (virtual) works underneath beneath that which is (virtually) physical allows you to manipulate the world in strange ways that seem logically impossible. Nethack developers are among the few who can claim that a bug is a feature and be half-serious about it :-).

> First, I made the PIC global offset table (GOT) writable by disabling PIE on the link line (-no-pie).

Wait, what?

The great thing about NetHack is that even a +127 cloak of magic resistance still won’t protect you from cockatrice stoning, disease from major demons, choking on food, drowning, nymphs stealing the cloak, poisoning, starvation, drawbridges, disintegration, brainlessness due to mind flayers, angry gods, or level drain.

In short, there’s plenty of ways to die in NetHack!

Also, be aware that today happens to be Friday the 13th, which will make your luck decrease by 1 and increases the difficulty a little bit ;p

It's famous in the roguelike world but I dislike that it is practically pretty much impossible to win without spoilers [0] (which means you have to read about it in wikis and co. to find a strategy that works).

[0 I know there are some people who managed to ascend (win) without reading up, but they are probably in the < 0.01% so it's definitely not the norm.

Thank you! I've been giving up on Nethack for over 20 years because I can't figure out how to play this stupid game. After all this time it wasn't me.

33 years of frustration here.

I kinda like that about Nethack and always have, to be honest. I like that even when I know exactly how it works I have to execute effectively.

Having all the rules right there for thinking through from one turn to the next was really compelling to me. (I've ascended almost every role now, but that started only like four years ago!)

You can win?

I assumed it never ends.

People win it every day.

And publicly too: https://alt.org/nethack/top-3.6.php

Nethacks like most traditional roguelike is amongst these games I like to call checklist tickers, which is to say with a moderate amount of luck, if you plod through the required amount of trivia and perfectly follow the winning moves checklist you should succeed. It kind of ruins the fun for me - playing feels more like a chore than an actual game - but it seems really enjoyable to some.

I would submit that those who enjoy the genre most are probably those who largely attempt to uncover the "winning moves checklist" for themselves.

I enjoy games like this (and also other genres, like city sims or turn-based strategy games) because I enjoy seeing what happens. It's a process of discovery and interaction.

In the case of NetHack, though, it's mostly about how much hilarious stupid stuff happens, like the time I started a dungeon, took my first step, and my kitten triggered a boulder trap and killed my instantly. Thanks, kitten.

NetHack is more about trial and error than simply progressing and winning.

It's definitely a throwback to an era of gaming where it was hard to have a lot of content, and so time was often spent on mastering challenges.

I don't know. I'd say if it's one thing nethack has, it's content. There's a huge number of monsters and items (and an especially huge amount of interactions between them!)

The original Rogue still holds up as a great game. I've played the DOSBox version and found it to be not quite as deep as Nethack, but more fun overall.

Brogue is a great spiritual successor to Rogue:

In nethack it's easy to just grind until you're invincible (barring YASD/"yet another stupid death", a death usually brought on by inattention rather than bad strategy or tactics) and then the endgame is a cake walk.

In Brogue (at least at the skill level I'm at), dashing through the last few levels to the amulet using up a lot of resources to survive and escape is very common.

"It's famous in the roguelike world but I dislike that it is practically pretty much impossible to win without spoilers [0] (which means you have to read about it in wikis and co. to find a strategy that works)."

In my own case, I found the reading of the spoiler documents to be nearly as interesting and fun as playing the game.

Agree. In fact, actually playing the game is rather boring and frustrating. Just enjoy reading the guides and then skip the tedium of playing through.

I appreciate what you're saying, but my strategy is to just enjoy playing badly. :-) #neverascended

I've been playing--and sucking at--roguelikes for years, and I wanted to chime in to suggest "Caves of Qud" for anyone that likes this genre. It's a modern roguelike that's still in active development with a really imaginative universe: "The game features a mix between a post-apocalyptic and a fantasy setting, and is heavily inspired by the pen-and-paper role-playing game Gamma World and Dungeons & Dragons."

Agree! Caves of Qud is quite fun. It can be difficult, so I often turn off permadeath just so I can wander around and enjoy the crazy worlds it has to offer on each run

Very neat what it has done with ASCII-style interface too

I'd also recommend Cataclysm: Dark Days Ahead for a good post-apocalyptic/zombie themed rougelike.

https://github.com/CleverRaven/Cataclysm-DDA/

I am still a hardcore fan of Angband:

https://rephial.org/

Different types of information (inventory, map, monster info, etc) can all be put in separate windows, so my screen is plastered with Angband windows when I play. Makes for great immersion, and the windows all retain their position and size between program starts.

It may even be older than Nethack.

Angband is 1990, Nethack is 1987

If you dig into the version history of Angband[0] you will find that it was derived from the Moria[1] code, which was released in 1983. So depending on what your concept of "origin" is it might or might not be older.

[0] http://www.thangorodrim.net/history/version.txt

[1] https://en.wikipedia.org/wiki/Moria_(video_game)

Nethack, in turn, descends from Hack, released in 1982, but first published to Usenet in 1984. Hack and Moria are likely simultaneous.

I mean, if we're going to play this game, they're all roguelikes and thus they're all descended from Rogue. Which, in turn, descends from Colossal Cave Adventure and Dungeons & Dragons, which is descended from traditional war-gaming, and if we continue down far enough we're back at the Royal Game of Ur.

It's more than that. Both Angband and NetHack are forks of their ancestors.

There is an unbroken line of continous development of the same code base coming from the 80s. Hack and Moria OTOH were clones of Rogue and didn't share any source code with it.

There is still non trivial code from 1984 in NetHack: https://i.imgur.com/H4HpjYf.png

With Angband, the case is a bit more complicated as the original Moria was written in Pascal but it was already converted to C in 1987 and Angband decends from that code.

I seriously love this whole discussion. It's "well, actually"ism at its best—and actually useful.

Don't forget multi-player mAngband. :) https://mangband.org/

It pretty much ruined my life in college and I haven't touched it since. After I stopped playing I still loved reading all those YACD posts on Usenet.

It's of course a similar game but they're so different.

Angband is one of those games that are about endless grind, trying to get those rare item drops that allow you to descend a bit further by offering some form of elemental resistance you lacked. And then you can continue grinding. Also, later on, many fights with unique monsters with extremely powerful attacks.

Nethack is much more about getting a collection of items and then trying to figure out how to identify them until you have enough of the important ones,and not running into random deaths. And a lot of fun because all the obscure interactions that can happen.

This is the old way to play Angband, and consensus on the forums is that it's incorrect (not to mention extremely boring).

Rather, you want to dive as deep as possible, pick your battles very carefully, and get loot off the ground or from occasional fightable monsters. Hilariously, people have found that Ironman play (never leaving the dungeon, and always descending) is easier because it forces you to play like this.

When grinding, you will still run into out-of-depth monsters that will wreck you, so there is no way to play the game safe.

That's probably true, but I don't like that cautious way of playing where you avoid the monsters. I want to kill them all,or most of them anyway. Of course that doesn't have to be too cautious all the time as that does become boring, there's something in between of course.

I love Nethack, and have returned to it time and time again since the 80's. However, much as I love it, for about 6 years now I've been drawn away to Dungeon Crawl Stone Soup[1], which has in some ways evolved past Nethack.

One of the main draws to DCSS for me has been its autoexplore feature, which makes exploring the dungeon much less of a chore than it was in Nethack. It also has much better use of color in text mode (the only mode I play both games in). Then it has an enormous variety of gods, powers, races, classes, and spells.

Unfortunately, it does have some downsides compared to Nethack. The interactions with gods, shops, and pets tends to be richer and more complex in Nethack. The things you can do to and with items is as well. The trend in DCSS has been to kind of dumb it down over the years, taking away friction points that made it more complex and thus (arguably) less fun for a certain kind of player. My own taste is for more complexity and more options, so I'm not a huge fan of going in that direction, but I still stick with DCSS because it's great despite that.

You can play and watch other people play the game by ssh'ing in to crawl.akrasiac.org, with a username and password of "joshua" (a reference to the classic 80's hacking movie Wargames).

Another game, in some ways very different but in other ways very much in the spirit of both of these games that I've really enjoyed has been Path of Exile.[2] It's not minimalist like Nethack or DCSS, but it definitely has a lot of roguelike elements and is pretty complicated for a mainstream, modern game of this sort, and is a worthy successor of both of these games, in my eyes. It's free to play too, so if you have the slightest interest, give it a go.

[1] - https://crawl.develz.org/

[2] - https://www.pathofexile.com/

> The interactions with gods, shops, and pets tends to be richer and more complex in Nethack. The things you can do to and with items is as well.

Agreed about all of these except for gods. In NetHack you can't easily choose your god during the game (though you can sometimes not-easily choose your god during the game) and the difference in behavior from one god to the next is minimal. In Crawl, you can usually choose your god and thereby get different abilities, status effects, and effectively mini-conduct challenges based on what each god disapproves of. I think that's more interesting than the NetHack religion stuff, although it's true that NetHack has a slightly more complex model of gods' feelings toward you.

I've been gradually writing up a document about differences between Crawl and NetHack and I think the items behavior you mention is a huge one.

NetHack has a substantial minigame about item identification, plus various ways that items can be damaged, destroyed, or modified (beyond magical enchantment), plus ways that they can be combined with one another (including an entire "alchemy" system of mixing potions to get other potions), plus ways that one item can be turned into another item. Also, some items give status effects when carried, while others must be equipped, or applied or invoked. Also, some items have a nonintuitive or humorous use -- one of many examples is that some harmful potions can be used offensively by throwing them at monsters or by hitting the monsters with them. Monsters can also often make intelligent use of items against you.

In Crawl, every item has essentially one and only one appropriate use, and every item is immediately fully identified when used or equipped. (Item identification is still not completely trivial because some items are harmful to use, or are consumed by use, so you might not want to use everything you find.) Items can never be permanently changed¹ except by enchantment or curses, and items can't be damaged, nor can they be destroyed except by using them up or dropping them into deep water or lava. Also, monsters make comparatively minimal use of items and don't pick them up.

You can see where various people might prefer one style or the other!

¹ The one counterexample I can think of is the dragon-slaying lance that becomes more powerful every time it kills a dragon.

"Agreed about all of these except for gods. In NetHack you can't easily choose your god during the game (though you can sometimes not-easily choose your god during the game) and the difference in behavior from one god to the next is minimal. In Crawl, you can usually choose your god and thereby get different abilities, status effects, and effectively mini-conduct challenges based on what each god disapproves of. I think that's more interesting than the NetHack religion stuff, although it's true that NetHack has a slightly more complex model of gods' feelings toward you."

In Nethack you can do a ton of different things at altars. In Crawl altars are useless except for converting to that god's religion. After your conversion you can pretty much safely ignore altars in Crawl unless you want to change your religion. The options are much greater in Nethack.

Good point, I wasn't thinking about altars. They absolutely have the character that you mention.

Conversely, in NetHack you can pretty much ignore which specific god you worship over the course of the game, which is less true for Crawl.

I don't know, cannibalism for chaotics is pretty good. But so is having peaceful angels on the astral pland as lawful. Neutrals get shafted, as ever.

Yeah, in DCSS they certainly trade tactical depth and crazy combinations of Nethack for what they call streamlining, aggressively cutting features from the game. Autoexplore in particular feels to me like a plug for the lack of micro, which is less important in DCSS than in Nethack. Not to say one is better or worse than another - DCCS is a great entry point into the "big four" of roguelikes - they just follow different principles.

What are the other 3?

The big 4 is what classics sometimes called. Angband, NetHack, Dungeon Crawl, and Ancient Domains of Mystery.

DCSS has definitely been dumbed down over the years which is kind of saddening. I remember it was really fun in the 2014-2015 era but I haven't really checked in since.

Path of Exile on the other hand has only gotten more and more baroque, which is awesome if you love the theorycrafting aspect of it

My first experience with NetHack was in college, when my roommate convinced me to give it a try. I took about 10 steps in and saw "a rock falls on your head. you die." After several more failures (who knew eating kobolds was bad for you?), starvation, and death, I found the most fun in gaming the character creation system until I got a ring of teleport, going to the nearest shop, taking everything I could, and escaping without paying :D

Nethack is great, is there a server where people can watch someone play the game and have a (audio) chat while watching?

There's so much stuff to learn, I'd love to chat with an experienced players while they are venturing deeper into the dungeons.

Check it out:

    ssh nethack@alt.org

EDIT: no audio, obviously, but you can send mail to players you're spectating

OT: Why can't I put ssh://nethack@alt.org in my browser? Why isn't the browser a ssh client?

I'm sure there's an extension or some such, and I know there are a lot of admin portals that have ssh accessible from the browser.

edit: for instance here's is one such extension: https://chrome.google.com/webstore/detail/secure-shell-app/p...

The browser is already a browser, mail client, download manager, office suite, multimedia player, game console, chat client, videoconferencing system…

I'm okay with the browser being allowed to not do things sometimes, even if that thing is basically encrypted Telnet.

Personally I would like to see shttp:// (http over ssh) as a valid protocol.

Realistically, I know this would end up being just as bad and broken as every other web tech.

However due to the superb openssh implementation I tend to view ssh as the superior transport technology vs tls

Different audiences mean very different constraints, policy and technology for success between TLS and SSH.

Most obviously for trust. TOFU is simple and while not fool-proof it's at least easy to think about the consequences. Using SSH with certificates (which somebody is bound to mention) is an afterthought and it shows.

There's also a very different default thinking about who is authenticating to who and why. In TLS the server must authenticate and clients largely do not. In SSH the server's "authentication" is often limited to just proving possession of some private key corresponding to a public key, but the client must provide a username and state up front how they're planning to authenticate before proceeding.

This is why that FIDO OpenSSH integration results in a file on your laptop (or whatever client) with local information whereas WebAuthn (FIDO integration for HTTPS) doesn't do anything like that.

As you'd expect although the underlying primitives aren't dissimilar (Diffie-Hellman style key agreement, AES encrypt everything, bind identity to encrypted session using public key signatures) the details are tailored to their application. TLS isn't a better SSH and SSH isn't a better TLS.

It doesn't have to be. Mail the keys.

> Why can't I put ssh://nethack@alt.org in my browser?

Try KDE Konqueror, see http://enwp.org/KIO

I can't edit anymore, but I've thought about this all day, and I think it comes back to trust. It is easy to configure weak keys or keys without passphrases or all sorts of things that you don't want exposed to the internet. Or your server may have poor config so you don't even want people to know that your server exists.

I do wonder, though if it is possible to do use whitelisted features of ssh, like strong keys with strong passphrases, good crypto libraries, etc.

I mean people already type their passwords into a browser.

Not audio, but there is a community in #NetHack on FreeNode (IRC) where player deaths, ascensions, etc. are announced by a bot.

alt.org has online nethack play via telnet:

https://alt.org/nethack/

There might be some Twitch streams, but I am not sure.

Yes, either via ssh or telnet or even in your browser. The wiki lists several available public servers: https://nethackwiki.com/wiki/Public_server#List_of_public_se...

The public server with most forks hardfought.org. Info on how to connect is on https://www.hardfought.org/nethack/

You can watch in your browser: https://www.hardfought.org/nethack/hterm/

There are 3 servers in Europe, the US, and Australia.

Most people are in various channels (e.g. #nethack, #hardfought) on Freenode but the #hardfought channel is also bridged to a channel on the Roguelike discord server (https://discord.gg/xUPxRe).

Matt Colville did a number of twitch streams of NetHack. I don't think he does them regularly but his archived streams were a great introduction for myself.

He goes by MCDM on twitch and youtube.

I've always considered Nethack to be almost unplayable without spoilers and/or "Use the Source, Luke." Yes, I know there are people who at least claim have ascended without them, but I don't think I'd have ever done it without some inside dope.

Related, here's a video of an ascension w/ commentary in ~ 1hr 50mins by Mikko Joula (aka Adeon): https://www.youtube.com/watch?v=rIB0y_kwFuY. It was filmed at the annual Roguelike Celebration at GitHub HQ.

Another entertaining talk from that event, more focused on the code: https://www.youtube.com/watch?v=5y_IAdOwaYs&t=1258s

All of the talks (if you like roguelikes, gamedev, or programming in general): https://www.youtube.com/channel/UCKv_QzXft4mD6TXmQBZtzIA/vid...

https://www.nethack.org/security/CVE-2020-5254.html Never considered nethack as part of my security model

Everything with a setuid/setgid should be viewed with suspicion.

Years ago I reported a security bug (CVE-2004-0103) in the nethack-like game "crawl". In that case it involved copying the contents of an environmental variable into a fixed size buffer.

I've just checked my bug report, where I wrote:

Demonstrating this bug is quite challenging as it involves:

* Finding pizza.

* Eating the pizza and having a two in three chance of your message (getenv( "CRAWL_PIZZA")) being used.

Fun memories; I should audit some more code soon.

There were (and probably still are) some shared *nix systems that allowed you to connect and play/spectate Nethack games.

I often play with ssh nethack@hardfought.org . Multiple variants available.

Just wanted to say, the nethack and unnethack android ports have probably the best controls and interface you could have for a roguelike as complex as them. They're smooth and easy to play, well as far as nethack goes and honestly probably my preferred way to play them these days.

And as far as mobile games go, can't think of any others that offer so much depth, gameplay and replayability without iap's and bullshit for free.

Sorry if this sounds like an ad, but I love nethack and getting to carry it around in my pocket and have it play well is just fucking awesome.

How is Nethack like the Grand Prix? Anyone who says they won without a spoiler is a liar.

So, if you were wondering what to do the next, say, fourteen days...