Monday, October 31, 2005

Fudge Computer Security

"The grey hat tried to red team my network, but he fell into my iron box! Naturally." -- Agent John Brown, cyber-security

Fudge Computer Security offers simple and comprehensive rules to help you roleplay plausible computer security adventures. Even if you know very little about computers, this article will help you understand how computer security works so that you can feel more in control. It offers both Basic and Advanced rules so that you can start playing right away, or customize to your heart's content.

To find out about grey hats, iron boxes and more...


Fudge Computer Security is a guide to gamemastering roleplaying games in which computer security is featured, as well as a guide to roleplaying a computer cracker or a computer security operative. Adventures can take place in the present or in the future. The projected audience are gamemasters and players that know the basics of computers (e.g. know what files, programs and operating systems are), and want to learn more about how to run (and participate in) plausible computer security adventures.

Readers should be able to use Fudge Computer Security to learn some new computer security terminology (a glossary is included at the end) and then apply the Basic system to quickly handle security situations. Readers can then pick and choose which Advanced features to use -- if and when they want to use them.

These rules are written in Fudge terms both for the benefit of the Fudge community, and so that they can be easily converted into any other game system.

Why Is Computer Security Important?

"An internal IBM study regarding the potential market for a computer called the Tape Processing Machine (a prototype of which had been completed by 1951) estimated that there was a market for no more than 25 machines of its size. Two years later, IBM developed a smaller computer for business use, the Model 650. When it was announced in 1953, those who were backing the project optimistically foresaw a market for 250 machines." [1]

In the early days of computing, computers were toys for universities, the government and large corporations to play around with. Sure, they could be used to help with business data processing, banking, sales, inventory control, etc, but in the 1950s nobody seriously considered that computers would ever amount to anything but a time-saving device. They were sterile, mathematical machines understood by a handful of experts. There simply weren't enough experts to go around, and hence there was a significant practical limit on the number of computers that the world could maintain.

Today, more than fifty years after the dawn of computing, computers and networks are used in the management and operation of every part of our countries' infrastructures, including nuclear power plants, dams, electric power grids, air traffic control systems, and stock markets. Computers are critical to the day-to-day functioning of companies, governments, and militaries. They manage payrolls, track inventory and sales, and help with research and development. Computers and networks are used every step of the way in bringing food to your table and electricity to your home. Most people in the developed world use telecommunications (such as the telephone, email, etc) every day, and today these are all enabled by computers.

Without computers life as we know it would grind to a halt. Computer crackers, whether they're hackers, criminals, military adversaries or terrorists, pose a very real threat to society as we know it.

What Can Go Wrong with a Computer?

There are three basic things that can go wrong with a computer system [2]:

  1. It can become unavailable or slow, making it impossible for useful work to get done (lack of Availability).
  2. It can become corrupted, so that it does the wrong thing or gives the wrong answers (lack of Integrity).
  3. It can become leaky, giving access of confidential materials to unauthorized users (lack of Confidentiality). Confidentiality, Integrity and Availability (often abbreviated to CIA) are the three main security requirements. There are two reasons why the CIA requirements might not be met, and why computers might fail:
  1. By accident.
  2. On purpose.

By far the most dangerous of these two causes is the second. While accidents can cause tremendous damage, it's always limited in scope because it's straight-forward to determine what happened and to fix it. Fixing the damage caused by a lightning strike may be expensive, but it's easy to know what to do (e.g. "We need to replace the server's hard drive because it got fried.") and once you're done you know that everything's okay. On the other hand, deliberate damage may never even be noticed, let alone corrected. This is because crackers are devious, while accidents are not.

What Makes Computer Cracking Fundamentally Different from Conventional Crime?

The main difference between computer cracking and conventional crime is intrusion detection. In conventional theft, damage is easy to ascertain. For example, in the case of house burglary, perhaps the robber broke your window, kicked down your door, or picked your lock. In any case, even if how he got into your house isn't obvious, it's easy to notice that your television is missing, or that he hurt your pet cat, etc. Computer crime is more like identity theft. You can think your identity is secure, when meanwhile someone in another country is very effectively pretending to be you, potentially accumulating debt or committing crimes in your name.

With computers, you may never know that you've been robbed. Secret files can remain on your hard drive and still have been stolen from you. Someone can crack your computer and not even do anything obvious. Instead, he may leave a back door so that he can more easily break in whenever he feels like it in the future. A cracker may repeatedly make strange attacks against your system that seemingly have no effect, but you can never be sure if he's just trying to rattle you, setting you up for a fall, or already owns your system, and he's just sending it commands. An entire country's emergency response system could be compromised right now without its security people even knowing it. That's a scary thought, isn't it? You can prove that a system has been cracked, but you can never prove that it hasn't been cracked.

White Hat, Black Hat... What's the Difference?

In terms of knowledge and capability, there is very little difference between crackers and security personnel. The only real separation between the opposing sides is intent. The black hat wants to break into a computer system, while the white hat wants to stop him, sometimes by cracking the black hat's system! Both the black hat and the white hat will apply virtually the same knowledge and tools to achieve his goal. This amazing similarity between the two opponents means that switching sides is very easy. The hat metaphor is very appropriate -- becoming a bad guy (or vice versa) is as easy as changing hats. The ease of switching sides has special relevance to the security community, where the threat of an evil insider (a sleeper agent, a mole, etc) is a classic scenario. It's said that one evil insider can do as much damage as 10,000 enemy soldiers, and this may very well be true.

One of the few elements that separates black hats from white hats is that having powerful hardware and software is not a big issue for crackers. Crackers can, and do, perform successful attacks with ordinary home computers using programs they wrote themselves for free, which means that a black hat could potentially be anyone with a computer and the knowledge of how to use it. Imagine the consternation of an investigator who has a billion suspects to choose from in a computer crime case. Furthermore, for a computer cracker, one lucky break is all it takes to penetrate a system's security. It doesn't matter if it takes a hundred tries to break into a system (assuming that you don't get caught) -- it's getting in at the end that counts.

In sharp contrast to computer cracking, security is very expensive. A network security officer needs expensive hardware, software and a big paycheck to do his job properly. Without good hardware, a large LAN won't work properly. Good security software makes a security officer's job easier (imagine the difference between a conventional security guard that has a bank of remote camera monitors to look at, and one that doesn't), and also makes a cracker's job more difficult. The harder it is for a cracker to break into a system, the longer it will take him, which gives a security officer a better chance to catch him and stop him. Finally, a poorly payed security person is an unhappy security person, and the last thing a secure network needs is insiders letting in bad guys. Hence, running a secure network is costly. Finally, the stunningly irritating part of being a white hat as that all you need to do is screw up once for your system to be compromised. In other words, the white hat needs to be lucky every time, while the black hat only needs to be lucky once. Also, you can never prove that your system has no vulnerabilities, you can only prove that it does have them.

Basic Computer Security Rules

In Fudge Computer Security, there is only one main skill: Computer Security. This skill is used by both crackers, to break into systems, and by security analysts, to prevent crackers from breaking into their systems. By default, a person has no ability at Computer Security -- it must be learned to be used, but it can be learned by anyone.

In terms of granularity, the Basic rules will deal with whole computer systems (which could be one or more computers). For example, we could consider attacks against an entire organization's internal network (often called an intranet), an important person's personal computer, or even an attack against the entire Internet.

What Can Get Attacked

In general, any computer system that the cracker can reach can be attacked. This usually means computer systems to which the cracker's computer is connected via a network, but it can also mean any computer the cracker can get physical access to.

Network computers are usually either a client or a server. Servers have open network connections, and await client connections so that they can provide them with content or services, like file downloads, or email. Servers are easy targets. It's like being on the phone all the time, where so long as you're on the phone you're vulnerable to attack! Clients, on the other hand, don't necessarily have an open network connection by default. It's only when they contact a server that they become vulnerable (and hence, to complete the analogy, when they pick up the phone). In peer-to-peer networks, everyone is a server, and thus everyone is vulnerable!

It's very important to note that clients make calls to servers, and never the other way around. A pure client computer cannot be called -- and hence cannot be attacked unless it makes itself vulnerable by connecting to a server (and even then it's only vulnerable to that server). Networks like the telephone system are peer-to-peer since everyone can call each other.

Example 1: The cracker Charlie is looking for a victim. He finds Alice's server on the Internet, which she uses to share files with friends. He is able to attack her computer so long as she keeps it on and connected to the Internet.

Example 2: Cyber-police officer Bob is looking for Charlie. Unfortunately, since Charlie is using a pure client computer, he is hard to attack. Bob creates a special server (a honey pot, see the glossary) and tries to fool Charlie into attacking it. Charlie takes the bait and attacks Bob's special server -- now Bob can attack Charlie through his server.

How the Attack Is Made

The mechanisms crackers use to break into systems are complex and interesting. However, in the Basic system we will gloss over most of it and simply deal with a few simple elements. In general, attacking a system is a three-step process:

  1. Obtain a normal user account on the system
  2. Obtain a superuser account on the system
  3. Do your evil deed

To attack a system, a cracker makes an unopposed roll of his Computer Security skill, with the difficulty being the defending system's Computer Security level (see following sections for more on this). If the cracker wins this roll he gets a normal user account on the system. If he succeeds by 3 or more then he gets a superuser account right away. If he fails then nothing happens.

Once a cracker has a user account on a system, he can attempt to upgrade it to a superuser account. This requires another Computer Security roll (same difficulty), but this time the cracker gets a +1 bonus (it's easier to upgrade once you're already on the system). Success means the cracker now has a superuser account, while failure means that nothing happens and he keeps his regular account.

Apply the following modifiers to the cracker's Computer Security rolls:

Situation Description Modifier
Unfamiliarity Cracker is unfamiliar with the system and how it works -1 to -3
User Account Cracker already has an account on the system and wants to upgrade to superuser +1
Familiarity Cracker is familiar with the system and how it works +1
Insider Knowledge Cracker is an insider with intimate knowledge of the system +2
Back Door Cracker has a back door on the system +3
Physical Access Cracker can open the computer case or access its disk drives +3

In general, for Familiarity, Insider Knowledge or Back Door the cracker can get either a +1, +2 or +3 bonus, but not all three. The Physical Access bonus only counts if the cracker can access the computer case and mess around with it. In the case of physical access to a terminal where only a monitor and keyboard are available, the cracker gets no bonus since it's no better than network access.

What Can Crackers Do Once They're In?

Once the cracker has a superuser account, he can do whatever he wants with the system that it is capable of doing. For ordinary actions (that a superuser could normally do on the system) no Computer Security roll is required (although the GM may require rolls against other skills). If the cracker wants to do something fancy that pushes the system's capabilities, require a Computer Security roll at a GM-set difficulty.

For regular computers, ordinary actions might mean reading or modifying files, or formatting the hard drive. Fancy actions requiring a roll might include damaging the operating system (i.e. crashing the system), creating a back-door, etc. Generally speaking, it's not possible to cause physical damage to computer completely through software. The exception is for moving parts like hard drives and CPU fans, which the cracker may be able to trick into burning themselves out or turning off.

On more specialized computer systems, especially ones that manage vehicles or facilities, the possibilities are much greater. Depending on what kind of computer the cracker now has control over, he could potentially steal money, steal people's credit card numbers or identities, cause a city-wide blackout, crash a plane, cause a nuclear meltdown, or even start a nuclear war! Needless to say, the computers running critical infrastructures are going to be very secure, and are almost certainly not connected to the Internet, thus requiring the cracker to actually go to the facility in order to compromise it. On the bright side, dangerous systems like nuclear power plants are designed to avoid meltdown, and their security features may make causing one difficult or impossible, requiring a roll at a very high difficulty.

Protecting a System

In general, the best defense for a computer system is to: (1) Not connect to the Internet, (2) Not connect to any other computer at all, (3) Be hidden away under lock and key. Unfortunately, some or all of these options may not be possible, because communication is usually desirable, and often necessary. For example, an online merchant cannot simply choose to disconnect his servers from the Internet in order to protect his customers' credit card data -- if he were to do so he wouldn't have a business anymore!

A System's Security Level

Computer systems have a Computer Security skill rating equal to the average Computer Security skill of the people managing it. Computer systems might come with a built-in minimal level of security, but if it is not kept up to date it is less useful (consider this to be low-quality in the table below). Apply the following modifiers:

Situation Description Modifier
Low-Quality Computer system uses low-quality security software -1 to -3
Common Software Computer system uses a very common operating system or network software -1
High-Quality Computer system uses high-quality security software +1
Active Monitoring Security personnel are actively monitoring system activity +1
Red Teaming Computer system regularly undergoes red team attacks +1

The inherent complexity of cracking into computers means that all systems have a minimum Computer Security level of Poor.

Example 1: David has no computer security skills to speak of. His operating system comes with a Computer Security skill of Mediocre. However, David has never updated his system's security since he bought the computer years ago (-3 penalty), for a total of Terrible-1. Hence, David's computer resists intrusions with a Computer Security skill of Poor (the minimum). Essentially, David's operating system's security is less than useless.

Example 2: An online merchant runs an Internet website (i.e. a server). He has hired several security analysts with an average Computer Security skill of Good. He is using an off-the-shelf security software package that he keeps up to date (no modifier), but is using a very common operating system to run his server (-1 penalty) for a total Computer Security level of Fair.

Example 3: A high-security military facility is running a LAN that is not connected to the Internet. The computer rooms are locked behind steel doors, and their network wires are embedded in thick concrete. The security analysts running the system have Great skill overall, are using high-quality security software (+1), actively monitor the system at all times (+1) and regularly undergo red team attacks and fix any vulnerabilities exposed (+1). Assuming someone could gain access to the computers (a difficult proposition), they would have a Computer Security level of Superb+2 to contend with.

Other Defensive Measures

As previously mentioned (under How The Attack Is Made), there are no intrinsic consequences to the cracker when he fails to break into a system. Hence, it's up to the security team to create consequences.

Detection: Ideally, a security team should be able to find out when their system is being attacked. They can either install detection software (less effective, assign it a low Computer Security skill) or try to detect attacks themselves (but only if they're actively working on it). Every time a cracker fails in an attack against the security system, it gives an active defender a chance to detect it. The defender can make a Computer Security roll at a difficulty equal to the cracker's rolled result. Success means that the defender has detected the intrusion attempt and can act appropriately. This might mean shutting down the server, for example, or in the case of a sophisticated defender it could mean running a trace (see below). Detecting attacks (even successful ones) against otherwise unused systems, such as an iron box or a honey pot, is trivially easy.

Tracing: Crackers are not fools and they have a variety of techniques for avoiding traces, including routing their attacks through other computers and even other countries. Running a trace pits the white hat's Computer Security skill in an opposed roll against the cracker. Success means he now knows where the cracker is, failure means he does not. Failing badly (by 3 or more) means getting false information. The security expert should get a bonus to his roll if the cracker fell into an iron box or honey pot (anywhere from +1 to +3 depending on how badly the cracker fell for it).

House cleaning: Regularly looking over communication logs or security cameras is boring and time consuming, but it can also be life-saving. For compromised systems, every once in a while (say, once a week) allow a security analyst dedicating time to house cleaning to make a Computer Security roll at a GM-set difficulty. Success means that a previous intrusion has been discovered, and some idea of what happened has been determined (depending on how well the roll was made). Back doors, once detected, can be closed (or worse, turned into an iron box).

Advanced Computer Security Rules

In this section I will add some advanced, optional rules. They are there mostly to give you additional ideas and things to think about.

In the advanced rules, the GM can put a finer focus on computer cracking, and handle attacks on a computer-by-computer basis if desired, if the extra detail would make events more interesting.

Exploits and Vulnerabilities

This section gives a little more detail on how cracking works, in case you want to add more detail into your games.

A cracker cracks by writing a computer program (exploit) that will take advantage of a security bug (vulnerability) in the target system. Once a vulnerability becomes known, a bug fix (patch) is usually created in order to patch the hole. Of course, there are always more bugs in software. Exploits, like vulnerabilities, are very specific to a particular version, or range of versions, of a particular program.

Against targets that take security seriously, an exploit will only work once if the intrusion is detected. If the intrusion isn't detected, then the exploit can be used again. Often, however, this won't be necessary. Once the cracker has gotten into the system once, he can leave a back door and get back into it again much more easily.

On the other hand, an exploit could be used constantly for months against insecure computers -- such as home computers.

How does a cracker find vulnerabilities?

  • Script kiddies just download ready-made exploits -- they don't bother finding vulnerabilities.
  • Crackers can join cracker communities where they discuss vulnerabilities and broadcast newly found ones.
  • If the cracker can obtain one of the security programs used on the target system, then it can be reverse-engineered and analyzed for vulnerabilities. This requires a Computer Security roll at a GM-set difficulty. Success means a vulnerability is found and an exploit written. Failure means the cracker must keep looking or find a different program or target.
  • If no copies of the system's security programs can be found, then vulnerabilities can be found by actively testing the system's security. This counts as Unfamiliarity and results in the -1 to -3 attack penalty described under How The Attack Is Made. This is the riskiest way to find vulnerabilities.

Local Area Networks

Local area networks are generally built upon the trust model.

Trust is a fundamental question of computer security. Unfortunately for the paranoid, you have to trust somebody. Trust is simply too efficient. Take for example the special trade relationship that Canada and the US enjoy: because these two countries are peaceful, trustworthy neighbors they have the luxury of being able to apply very few security controls on their trade. This means that there's tremendously less money and energy wasted on security between the two countries, and consequently there's a significant economic advantage for both countries. Similar parallels can be made for many European countries and lots of other countries across the world.

The trusted country analogy applies very effectively to computer security. When you trust a particular computer or a particular network, it means that you can apply far less security in defending against that trusted entity. Less security means lower cost in terms of time (for the users and the security experts), hassle, and money.

Thus, when creating a secure computer network, it's important to know exactly who you trust and who you don't trust. Trusting nobody or trusting everybody are not viable options. Not trusting someone you should trust wastes valuable money and resources that should be spent elsewhere, and yet at the same time trusting foolishly may lead to disaster.

The point of all this is that internal networks are generally designed with a very secure exterior (e.g. a firewall machine) that protects a trusted interior network (e.g. intranet) from an untrusted exterior network (e.g. the Internet). Assuming that the model works and that a cracker is unable to break past the gate, then the internal network is both convenient and secure. Thus, the trick for the cracker is to break the trust model by compromising the internal, trusted computers.

There are two main ways to break the trust model. The first is by creating a new connection from an internal trusted computer directly to the exterior network, thus entirely bypassing the secure gateway. One technique is to install a modem on an internal computer. The second method of breaking the trust model is to infect an internal computer with a Trojan horse, so that its own trusted users turn the computer against the network security, breaking it down from the inside. One technique for this is to trick a user on the internal network into running a Trojan horse program (e.g. on an innocent-looking music CD) that then can easily attack the internal network gateway from the inside.


Once a cracker has control of a system, instead of adding a back door he can instead opt to turn it into a zombie with a successful Computer Security roll. A zombie computer is better than a back door -- the cracker can automatically break into a zombie system (no roll required) whenever desired.

Zombies are often created automatically by viruses or worms, thus helping the cracker quickly amass an army of zombies.

Crackers can use zombies to perform distributed attacks by programming each zombie to attack independently (see Denial of Service). He can also use them to create a distributed supercomputer to crack codes and do other fun stuff.

The downside of zombies is that it's impossible to make a computer system that's actively monitored by a security analyst into a zombie -- the attempt is automatically noticed.


A man-in-the-middle attack is when a cracker intercepts communications between other computers over a network. For example, Alice and Bob are trying to communicate, and Charlie the cracker gets in the way. Essentially, a man-in-the-middle attack means that Charlie has tricked Alice into thinking he's Bob, and Bob into thinking he's Alice.

Executing a man-in-the-middle attack requires the cracker to make an opposed Computer Security against each of the intercepted people's Computer Security skills. Only if the cracker succeeds against everyone the move a success, otherwise the cracker is discovered.

At its most basic level, this attack can allow the cracker to listen in on communications. Even worse, it can allow the cracker to block or modify communications at his leisure.


This is when a cracker compromises the network backbone (i.e. the computers and machines running the network). Since the cracker has gained control of the devices through which communication is being transferred, the cracker can read, modify or delete these communications.

To execute this attack, the cracker needs to break into the network backbone itself. This requires a Computer Security roll with a high difficulty.

The result of this technique is similar to the man-in-the-middle attack. Except that the more insecure the network is, the easier this attack is to execute relative to man-in-the-middle, and vice versa.

Needless to say, whoever normally controls the network can sniff whatever communications he wants without needing to make a security roll.

Finally, a form of sniffing called wire tapping is also possible. This involves adding a small monitored connection to the physical wires of the network. While this method only allows reading of communications, it can be very effective since it's very difficult to detect!

Denial of Service

Denial of Service (DOS) is an attack aimed at swamping a server with garbage communications so that it can no longer do useful work (i.e. so that it can't sort real requests from clever fakes). It specifically attacks the A part of CIA: Availability. To accomplish this the cracker makes a Computer Security roll against the Computer Security level of the affected system. Success means that the system has been swamped and is effectively shutdown for a few hours.

A Distributed Denial of Service (DDOS) attack uses an army of zombies to even more effectively swamp a system. These give a +1 to +3 bonus to performing the attack, depending on the number of zombies involved (hundreds, thousands, millions).

On the defense side of things, DOS attacks are automatically detected, but traced normally (i.e. only if the cracker makes a mistake). The defenders can get a +1 to +3 bonus if they have access to configuring the network backbone (i.e. the medium over which the communication takes place), depending on how much control they have.

Sophisticated Superuser Accounts

Most regular operating systems use an all-or-nothing approach to administration. Either you're the administrator or you're not. Either you can do everything (superuser) or you can do almost nothing (user).

Some operating systems use more sophisticated schemes where a certain type of user might have certain administrator privileges but might not have others. What's more, the system can be designed so that multiple superusers must work together to make something major happen. This is analogous to the bank vault that requires two keys to be inserted and turned at the same time.

These sorts of precautions will inevitably make cracking the system more difficult, as the cracker must either break into more accounts to control the system, or must call upon the aid of other crackers. However, fancy operating systems like this will never be mainstream -- this is something likely to remain in the domain of governments and huge corporations, at least in the near future.

Worms and Viruses

Worms and viruses are programs that crackers can write to break into systems automatically. Worms and viruses have a vector and a payload. The vector is the method of transmission, which is some sort of vulnerability (often in email programs or servers). This is what allows the virus or worm to infect the system. The payload is what the virus or worm does, aside from propagating itself. A typical payload is turning the infected computer into a zombie, or installing spyware for detecting what the user is doing and stealing personal information and passwords.

Worms and viruses are hard to create, and even harder to anticipate or control. Creating one requires a Computer Security roll at a -1 penalty for a virus, or a -2 penalty for a worm. Success creates a virus or worm with a skill level equal to the rolled result. Normally viruses and worms are built with a particular purpose in mind, even if it's just mischief. The GM can use the virus' or worm's skill level and his intuition to determine some likely outcomes of the infection.

World Backgrounds

There are a variety of settings where computer security roleplaying may take place. A campaign's setting properties will have a huge impact on computer cracking.



  • The de facto worldwide computer network is called the Internet. There are a lot of unofficial names for it too, but we'll stick to the official name to avoid confusion.
  • Computers control many systems across the globe, but in a patchwork fashion. The developed world is almost entirely run by computers, whereas so-called third-world countries have very few computers. Human brainpower, unaugmented by computers, is still the tool of choice for many applications.
  • Most personal computers and supercomputers are connected to the Internet in some fashion. Most other computer systems are simple and specialized devices that are not connected to the Internet or to each other (e.g. temperature control in your home, a car's onboard computer).
  • Many essential communication services (webpages, telephone, military communications, etc) are at least partially routed through the Internet. The collapse of the Internet would cause widespread communication problems, many businesses would go out of business and many hobbyists would be very unhappy, but it wouldn't necessarily prevent society from functioning.


  • The worldwide computer network is called Cyberspace. If you prefer to call the worldwide network something else, feel free. Alternate names include the Matrix, the Maze, the Lattice, the Labyrinth, the Environment, the Sphere, etc. Let your imagination be your guide.
  • Computers either directly control or are involved in every aspect of human endeavor. Embedded systems, computers contained in other objects, are the norm. From computer-controlled houses to computer-controlled clothing, everything a person does, wears or touches involves computers. Wearable computers are extremely common. Expert systems help doctors, lawyers, etc make their daily decisions.
  • Nearly all computer systems are constantly connected to Cyberspace and to each other. Your toaster talks to your shoes, who consult with your stock portfolio.
  • If Cyberspace ever fell, it would take civilization with it.

Type of Society

Modern (Contemporary or Future Technology)

  • Security is not taken seriously.
  • Security issues and costs are not well-understood, so it's difficult for companies to know how much money to spend and on what kinds of security. Many organizations don't use the best practices available, meaning that security across a society will be a patchwork of effective and ineffective solutions. This makes attacking the society as a whole relatively easy.
  • The fact is that the Internet was originally made by scientists for scientists, all of whom trusted each other. There was no provision for "bad guys" in the protocols that were developed. Hence, the infrastructure of the Internet itself is not very secure, making it easier for crackers to play dirty tricks on their victims.
  • Companies regularly hide the fact that they've been successfully attacked, because they don't want public confidence in them to be undermined. This leaves organizations open to blackmail from enterprising crackers. Hiding information also has a much more serious consequence: this prevents researchers from obtaining accurate statistics on security, thus perpetuating general ignorance of security issues.
  • Security on the level of the home-user is poor. Home users and companies are not responsible if their servers/computers are used as go-betweens in an attack.

Ideal (Future Technology)

  • Security is taken seriously.
  • Security at organizations conforms to the known best practices. This means that a society's security will provide a united front against attackers -- the fact that each potential target is secure will make attacking the society as a whole difficult.
  • The Cyberspace infrastructure has had its major security holes fixed. This makes it more difficult for crackers to perform dirty tricks, and consequently makes everyone more secure.
  • Like modern airports that always report collisions and near-misses alike, companies will always make successful attacks public (to the relevant agencies, at the very least). Failure to do so can result in the government levying serious penalties against the company. It's thanks to this policy that best practices are well-understood and disseminated across the society, since researchers and policy makers have access to large volumes of accurate information on which to base decisions.
  • Software (even user-level software) is relatively secure. Companies and individuals are liable for damages if they were negligent and their computers were used as go-betweens in a crack attempt (i.e. it's criminal negligence to have an insecure computer).

Oppressive (Future Technology)

  • Security is only allowed for the elite. This usually means the rich and the powerful, such as the government and corporations.
  • Since paranoia is the rule and information sharing is non-existent, corporations have no idea how much money to spend on security. Therefore, they spend as much money as they can afford to on all levels of security, in an attempt to minimize the risk of attack. Society is two-tiered: the weak half is extremely easy to attack, while the strong half is very difficult to attack.
  • Corporations never let others know when they've been successfully attacked. Not only would this provide free research data to their competition, but it would be showing a sign of weakness that would surely be exploited by their enemies. Best practices are unknown, as each company does its security research independently of everyone else. Thus while security as a whole among the elite is very strong, precise security implementations will vary greatly from organization to organization.
  • The average home user has no security on his computer. It's illegal for individuals to own, purchase or sell security components. Learning about security and cracking is illegal unless you are one of the elite, or you work for them. In fact, the elite will be able to take over a home computer at any time and for any reason. Big Brother is most definitely watching you. Obviously, home users are not liable if their computers are used as go-betweens in attacks -- instead, they're liable if their computers can't be used as go-betweens!

Glossary of Terms

Please note that the definitions given in this glossary are accurate within the context of computer security. Many of the terms have alternate (but equally valid) meanings. For instance, the term hacker originally meant "someone who makes furniture with an axe", and yet hacker is used here with a completely different connotation.

Most of these entries were adapted from [3].

Back Door
A hole in the security of a system deliberately left in place by designers or maintainers. This could be for sinister reasons (e.g. to allow the designer to easily crack the security at a later date) or legitimate ones (e.g. to allow service technicians easy access). A back door can also be created after the fact by a cracker, for later use. A Trojan horse usually serves as a back door into a system.
Black Hat
A cracker. The term originates from formulaic Westerns where the bad guy always wears a black hat.
Breaking in
The process by which a cracker gains illicit access to the superuser's account on a computer or network.
The three main requirements of computer security: Confidentiality, Integrity, and Availability.
A computer that connects to a server for the purpose of receiving content or services.
A person that electronically breaks into computer systems. Coined circa 1985 by hackers in defense against the journalistic misuse of the term hacker.
A cracker program that takes advantage of a vulnerability.
Either software or hardware whose purpose is to monitor communication channels (both incoming and outgoing), and possibly direct or block traffic if necessary. This is usually a network or computer's first line of defense.
Firewall Machine
A firewall machine is a dedicated computer (i.e a computer that does nothing else) that combines the concepts of the firewall and the proxy, and is used to service outside network connections. The idea is to protect a cluster of more lightly protected machines, which are hidden behind it, from crackers.
Grey Hat
Someone with cracker skills that operates within the law. His skills could be used for red teaming, or to crack electronic locks under legal pretense.
1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. 2. A person who enjoys programming, and/or is good at programming quickly.
Honey Pot
A computer designed to attract crackers so that they can be observed in action. It is usually well isolated from the rest of the network, and carefully monitored. Different from an iron box in that its purpose is to attract, not merely observe.
A large LAN, usually refers to an organization's private, little Internet.
IP Address
A number that uniquely identifies a particular computer on a network. The "IP" part stands for Internet Protocol, although this is a misnomer, since IP addresses are used on LANs too.
Iron Box
A special environment set up to trap a cracker logging in over a remote connection long enough to be traced. May include a modified operating system restricting the cracker's movements in obscure ways, and "bait" files designed to keep him interested and logged on.
An acronym that stands for Local Area Network. In other words, a collection of interconnected computers which is entirely located in one area (typically a single building). For example, a corporate intranet.
Software that intercepts communications (especially login transactions) between users and hosts and provides system-like responses to the users while saving their responses (especially account IDs and passwords). A special case of a man-in-the-middle attack.
Two or more computers connected together so that they can communicate with each other. This connection is typically made by telephone, network cable, wireless connection (radio), satellite uplink or (less commonly today) fiber optic cable.
A temporary addition to a piece of code, usually as a quick-and-dirty remedy to an existing bug. A patch may or may not work, and may or may not eventually be incorporated permanently into the program. Patch can be used as a noun or a verb.
A communication system in which each participant (a peer) acts as both a client and a server.
A program that modifies other programs or databases in unauthorized ways; especially one that propagates a virus or Trojan horse. A phage could, for example, modify a police database to remove one particular person's criminal record.
This is the gateway to a network. All communications to and from the network must pass through the proxy. This protects a network by creating only one point of entry that needs to be thoroughly secured. It has a side benefit of making any communications from the inside of the network appear to be coming from the proxy -- thus making it more difficult for crackers on the outside to know which particular internal computer a specific piece of information is coming from.
Red Team
A group of one or more grey hats whose job is to crack a network's security, with the permission of the network administrator (or his boss). The goal of this is the eventual improvement of the network's security by revealing vulnerabilities.
Script Kiddy
Someone that does mischief with programs written by others. Script kiddies usually have a minimal impact on secure networks, but given a very effective exploit, a script kiddy could do as much damage as the genius cracker that wrote the exploit.
A computer that leaves one or more communication channels open, in the hope that clients will connect to it so that it can provide them with content and/or services. Servers are the computers that are the most vulnerable to computer cracking.
The administrator of a computer system. Typically, the superuser has all of the powers of an ordinary user, plus much more. Superusers typically have (at the very least) the ability to create new user accounts and edit or delete their accounts.
Tiger Team
Similar in concept to a red team. Tiger teaming is when a facility's physical security is tested by a team of good guys.
Trojan Horse
A malicious security-breaking program that is disguised as something benign, such as a screen saver, or a virus scanner.
An ordinary user of a system. For example, a person with an email address at, or a website at
A cracker program that searches out other programs and infects them by embedding a copy of itself in them. When these programs are executed, the embedded virus is executed too, thus allowing the virus to propagate itself. While a virus can be benign, in the sense that all it does is waste system resources by propagating itself, viruses usually carry a payload and transform infected files into Trojan horses. This normally happens invisibly to the user. Unlike a worm, a virus cannot infect other computers without assistance.
An error in a software's design or implementation, or a failure in a software's operation that can be used for breaking security or otherwise attacking a computer (usually over a network). In other words, a bug that a cracker can take advantage of.
An acronym that stands for Wide Area Network. In other words, a collection of interconnected computers that spans a large area (such as an entire country or the entire world). For example, the Internet.
White Hat
The opposite (and counterpart) of a cracker. A security operative who aims to protect a network from unauthorized intrusion. The term originates from formulaic Westerns where the good guy always wears a white hat.
A cracker program that propagates itself over a network, reproducing itself as it goes. Unlike a virus, a worm doesn't need outside assistance to operate. Being autonomous makes a worm much more dangerous, but also much more difficult to control and anticipate. Worms typically crack into low-security computers via a common vulnerability and then turn the computers into zombies.
A computer, especially a home PC, that has been cracked and taken over by a cracker "master," who may control hundreds, thousands or more zombies. The image that comes to mind is of a veritable army of zombies mindlessly doing the bidding of a necromancer. Zombies offer computing resources that crackers can take advantage of, such as for performing attacks, or the cracker can simply steal those resources for himself. As a side-benefit, attacking through a zombie helps a cracker mask his identity.


  1. Ceruzzi, Paul. "An Unforeseen Revolution: Computers and Expectations, 1935-1985." Technology and the Future. Ed. Albert H. Teich. 8th ed. New York: Bedford/St. Martin's, 2000. p 192
  2. Computer Science and Telecommunications Board. Cybersecurity Today and Tomorrow: Pay Now or Pay Later. Washington, D.C.: National Academy Press, 2002.
  3. The Jargon File (The New Hacker's Dictionary).
Read the full article...
Monday, October 24, 2005

Fudge for Young Kids

The kids are at home and they're bored. They play "Let's Pretend" and end up running to Mom and Dad because the they can't agree on the some outcome in their game. Now's your chance to nurture that natural habit of roleplaying, sharing the fun hobby that you already love -- and what better way to do it than with Fudge? Find out how to ease them into it with the gradual introduction of all the tools of the gaming table. Soon, you'll be gaming together.


One of the first things I thought of after discovering Fudge was, "Wow, this would be great to play with the kids!" (The very first thing was probably something like, "Hey, you could make any kind of character you wanted in Fudge.") But since at the time my kids were approximately four and zero years old, it was still a little much for them; and by the time they were old enough to play, I had already hauled out my old TSR Marvel Super Heroes stuff for my son.

That game was pretty fun for kids -- it had neat dice (d10s), a colored Universal Table to resolve all your actions on, and best of all, lots of full color cards with the characters on them -- not to mention the giant maps. I'd never been a miniatures kind of guy myself, but while watching my son play with the little cardboard standups of Iceman and Dr. Doom, something kind of clicked.

There is already some advice online for gaming with kids. The kids-rpg mailing list run by Sam Chupp has some good info in the FAQ and is a great place to ask questions. My suggestions are geared specifically towards two things: gaming with younger kids (rather than teens or pre-teens), and gaming with Fudge.

Playing the Game

Rules can be tough for pre-readers. My attempts to get my six year old son to make his own characters never really got off the ground. But role-playing, they understand. In fact, most of the games my daughters play on their own are pretty similar to LARPs, but with conflict resolution mechanics that boil down to 1) yelling at each other and 2) ask Mom or Dad for help. Most of my gaming with kids has really just been adding rules to "let's pretend."

First of all, I found it was helpful to start out with some of my daughters' toys, using them in the place of miniatures. There's a lot of stuff out there you could use: we used a My Little Pony once, and we've used Lego minifigs; but we mostly use Polly Pocket. Barbie seems a little too big for tabletop play, although that scale would open up the world of action figures.


Along with the toys, I came up with a very simplified version of Fudge. Characters come up with their name and description, then they get three Skills and one Fault. The Skills are at Good (+1), with everything else being treated as Fair (+0). The Fault could be a Skill that the character is somewhat incompetent in (it's at Poor (-2) rather than Fair (+0)), or could even be something like "Doesn't like to play sports" or "Allergic to flowers". The GM should try to make sure the Faults come up in play. Action resolution was just fudged all the way: the player would roll the dice and add their Skill level (or subtract it if one of the character's Faults are involved in the action), then as GM I just adjudicated the level of success. We later evolved to using Fudge Points, starting with three that regenerate every session. One Fudge Point can be used to get a re-roll or dictate a detail of the setting. For example, one of the players might use a Fudge point to say that the Wicked Witch had left the oven door open behind her.

Since I only had one set of Fudge Dice, I also printed the 3d6 and d% charts from Section 3.22 of the Fudge rules on Other Dice Techniques. My son (who is older, eight to ten years old while we used these rules) seemed comfortable with all three dice methods (Fudge Dice, 3d6, or d%), but my daughters seemed uncomfortable with the subtracting needed with the Fudge Dice. (I think it may have been the negative numbers they didn't like.) They liked counting the pips on the six-siders best. Since that took nearly a minute, the table lookup didn't add much time. I also had relatively few rolls compared to what I would do with an adult group, saving it for either direct character conflicts or to add suspense to an important action. Even combat was usually resolved with only one or two rolls rather than with the damage track.

As the kids got older and more experienced with the rules, I added more to them. First we got Attributes (Intelligence, Magic, Strength, Agility, Stamina, Will -- I had to define about three of those terms for the kids.) Then we started using wound levels, though the characters still weren't getting hurt very much. Eventually, for the Fudge Harry Potter game that my son and his friend were in, we were using rules for magic too. We used a very heavily modified version of "The Gramarye". I found that the kids were able to handle and remember more rules than I first thought they would be able to. After reflection, I remembered that they can also list off the vital statistics of all four hundred Pokemon. So the magic rules weren't much of a stretch.

Plots and Complications

With the kids, game play was pretty simple and straight forward. I usually didn't have wildly branching plot lines or multiple NPC factions. For Marvel Super Heroes, I almost played it as a super-hero combat game: this bad guy is here, these good guys are here, they fight.

With younger kids, it's even easier -- they love repetition. You know how a three-year old can watch the same video six times a day for a month and a half? They don't mind if you recycle their favorite fairy tales as gaming sessions, either. That's what they're into. It's like playing Star Wars d20 with Star Wars fans. A lot of kids' books and entertainment is surprisingly gameable. It tends to have clearly labeled problems or antagonists, and coming up with solutions to them is easy for the kids, too.

For example, my daughters love Polly Pocket, who is a little (about 2" high) doll with rubber clothes and some cars and a bunch of friends...kind of like a mini-Barbie. So when they wanted to play some Fudge, we got together a couple of the dolls, made the character sheet, and started playing. It was pretty similar to their usual play with the toys, except that instead of fighting about who got to do what, we rolled Fudge dice for it. The first plot was just a Hansel and Gretel rip-off where an NPC friend of theirs was captured by the witch, and the girls also had the help of a magical pony.

Later we had a Fudge game using Lego characters, where the characters were just quickly designed on what they looked like. They had four stats: Attack, Defense, Ranged Attack, and was mostly Fudge as a wargame. The wide variety of Lego available (we had Space people, Ninjas, kids from Hogwarts, some Arctic explorers, and one guy who looked like Indiana Jones) made for an interesting session. For the next one, we brought in a few small Pokemon figures, too.

How It Worked

Overall, my son, who is older than my two daughters, was the most interested in Fudge. The girls liked it too, but the younger one (who was only three the first time we started playing) would sometimes be very disappointed if she missed a roll. She didn't usually get like that if she rolled low or missed a turn in a board game, and I wonder if possibly the greater investment in her Fudge character might have made setbacks more disappointing to her.

My son was also more interested in the combat and action parts of the game, so he ended up rolling more dice. My two daughters seemed just as happy to play with their "miniatures", with only the occasional dice roll and me playing the part of the antagonists making it any different from their regular pretend play. I also noticed that of the three children, my oldest daughter was the most interested in adding things to the game world, suggesting new ways for the bad guys' powers to work, or new plans for them.

None of the kids used Fudge Points very much. I reminded them about them a few times, and twice we even used small glass beads to represent them. In retrospect I think this may have been due to my tendency to take it easy as a GM -- the PCs were mostly successful in their actions, and rarely even got injured.

For most of the games, I didn't even use Experience Points or any other form of advancement. A lot of the ones with the girls were one- or at most two-shot games and didn't need it. The Harry Potter Fudge game was an exception. I followed the guidelines from section 5.2 of the Fudge rules, but I think I may have handed out too many points, since the characters were powering up in their most-used abilities a little too quickly for comfort.

We also tried using music twice during the Harry Potter Fudge game, playing the sound track to Harry Potter and the Prisoner of Azkaban. It added a little bit to the atmosphere, but I didn't really miss it after we rearranged things so that we couldn't play CDs in the gaming area any more. The kids didn't have any comments about the music, either.

Most of our gaming sessions lasted for between one hour to an hour and a half with the younger girls, to up to three hours with my older son and his friend. Like with regular players who you don't have a long history of gaming, you just need to watch for signs of flagging interest and wrap it up before it gets boring. The youngest daughter often didn't even last that long, wandering off part way through the game and leaving her older siblings -- but that was also something we'd accounted for in-game.

Ultimately, Fudge was a good game to use as an introduction to roleplaying games for my two daughters, and it's one we'll return to in future.

Some Untested Ideas

Some recent Fudge Factor articles have suggestions which seem like they'd work really well in games with kids. "Building Stories on the Fly" would be great with kids, especially since lots of times they'll never have heard of the story you're borrowing from in the first place. I also think a simplified version of "Fudge On the Fly" would work well with kids -- getting right into playing rather than spending a long time on working up a character is definitely more appealing.

While I haven't tried playing Fudge with any children that I didn't already know fairly well, the simple rules are easy to explain to even the pre-readers in our group, and there should be no problem with any kids that are old enough to sit down and play a board game. Using toys as miniatures seem to help with the younger kids, but may be unnecessary with the older kids.

Read the full article...
Monday, October 17, 2005

Spontaneous Joint Gamemastering

It happens to most groups - after a time, the gamemaster wants to play the game too, or perhaps some of the players want to GM. Normally this would cause the creation of multiple games, one for each GM, perhaps alternating games each session. Unfortunately, that standard solution slows down both games and can cause a myriad of other issues. But what if these could be merged together -- so that everyone is GMing and playing at the same time? Yes, it can be done.

Spontaneous Joint Gamemastering (SJ GMing) is a different way of running a roleplaying game. It is an incredibly dynamic form of roleplaying which involves a lot of spontaneous (by the seat of one's pants) play. It is not recommended for groups of very passive players, as each individual becomes involved in running the game. That being said, games tend to be more flexible, freeform and unpredictable. As such, it does lend itself to games with lightweight rule systems, such as Fudge.

In the standard format of roleplaying, there are two groups: the players, who have near-exclusive control of a single character (within system rules), and the GM, who controls the setting, NPCs, plot, rewards, and can even supersede the actions of the players (with discretion). In SJ GMing, that distinction is blurred because each player is also a gamemaster. Since each player has a GM's power, each person is responsible for more than just their single character. The tasks of plot and setting, NPCs and outcomes, fall upon the shoulders of every player. There are rules to handle this, and it is not as complex as it may seem. One result of this is that the style of play is not predictable. Since no one person is in total control, anything can happen - just like real life. To paraphrase Mark Twain, "Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities. Truth isn't." All the players create their own plot hooks for the group, creating entire storylines on the fly which interleave with the ongoing stories of others.


Because all games, regardless of style, must take place somewhere, it is important to recognize how that "somewhere" is chosen. At the beginning of the game or campaign, around the time of character creation, the setting of the game must be created. Normally, all aspects of setting would be chosen solely by the GM, with considered input from the players. In SJ GMing, all the players should be involved in the creation of the setting to ensure equal knowledge of the game world. However, this is not a disclosure of all the world's secrets, making so that there will be no secrets for the players to discover. It is solely to ensure that each player has adequate knowledge to play. The level of setting detail and potential plot secrets disclosed will vary by group. The world may be created in a brainstorming style session or any other method desired by the players. Each player may add any information to the setting so long as the addition does not contradict elements already added to the setting. Incredibly significant additions, such as adding blunderbusses or flying machines to a fantasy setting, may be subject to group approval. And like most roleplaying styles, elements which involve the back-story of PCs are encouraged. Players may add as much detail to the world as desired, from the addition of standard or monstrous races, to plotting the layout of the city. Each detail must be written down for later reference. Remember, since there is no single GM to say what the world is or is not, the group as a whole chooses and enforces the integrity of the setting. When more elements are later added to the world, they should be added to the list, hereafter known simply as the Setting.


Joan, Heather, Gary, and Colin are deciding the setting in which they want to play. Before creating their characters, they decide what type of game they want to play. Joan is interested in a fantasy based game -- somewhere where she can have her character learn necromancy. Gary wants more of a small, simple feeling for the start of the game, and so adds that the characters could start in a small town. Colin wants the opportunity for adventure on the high seas, and decides that the small town could be a small farming and fishing town on the shore of a large ocean -- a place that would be easy to leave (or to invade). Meanwhile, Heather still wants to encounter villains close at home and says that there are monster nests in the forests near the small town. They will determine the type of monsters later. Now Joan says that she wants all the characters to be from a race of sentient ducks, but the other three veto it, saying that it would be just too hard to play. Instead, they decide that their characters will start as farmers in this small community. So, after a short discussion, they have jointly created is a small, medieval town on the ocean, surrounded by lush, monster-filled forests.

With a general idea of the setting, the world can now expand as adventures progress. Players will add to their setting as they play, simply describing elements they wish to incorporate, thus dynamically creating their world.

There are two ways of adding to the setting: GM narration or character dialog.

GM Narration

When a player describes a scene or event as the GM - a 3rd person narrative.


Heather: (in her GM voice) As you walk into the pub, you get glared at by the one-armed man behind the counter and the cold fireplace offers no comfort due to the current wood shortage.

Here, Heather has declared the facts that the bartender appears to have only one arm, and that there is a current wood shortage in the area. They should be accepted verbatim by the other players and characters - they were told so by the GM. These facts should be noted down.

Character Dialogue

When a character says something, it may be true - but not everything that a character says is truth. A character could be lying or simply ignorant of the reality of the world. Just because Johan the Brave remarks that he's killed a hundred men single-handedly or that a specific plant is edible does not mean that it is true. However, when a character states a fact of major significance to the setting, like that there is another city within a week's travel to the south, the player of that character may attempt to add that fact to the setting. There are two ways in which this may be done.

Dialog Method 1

The first method is by making a die roll - normally a knowledge roll. The difficulty of the roll is determined by how rational the fact is - how much evidence there is to support it. This is determined by how much the fact contradicts current setting information. This rule is based solely on the facts listed in the setting, regardless of character knowledge. The greater the success of the role yields a greater strength to the fact.

Evidence Difficulty
None Fair
Related supporting facts Mediocre
Related counter facts Good
Direct supporting facts Poor
Direct counter facts Superb

The above table can be used to determine the difficulty of additions according to the facts that already exist about the setting.


Gary: (in his PC's voice) See that bartender over there? His name's Ol' Markov. He used to be a pirate from some foreign country across the sea [rolls a die against the difficulty according to the setting table and succeeds, but barely], but settled down here after losing his arm. Don't mention it to him though, or he won't serve us!

Here, Gary's character mentions many facts: facts about the bartender, as well as that there is another country across the sea. Since Gary didn't roll on any of the facts regarding the bartender, they could all be wrong - but the other characters will most likely believe them, just like real life. He DID roll against the fact regarding the foreign county, a potentially significant addition, and the role succeeded. This means that there is some country across the sea, but no other details are known about it.

Dialog Method 2

Players may wish to simply call out the estimated likelihood of a fact before the die is rolled. This is simply a more freeform approach to using the setting table above. Players are essentially guessing what type of result the above table would give should they put in the time to check it. Depending on the size of the list, the list may take too long to check anyway. This method is recommended for any group that has played together for a few games and whose players are starting to get an intuitive feeling for the world. Should others disagree with the level of difficulty set, the other players should give a quick thumbs up or thumbs down to show that the difficulty should be higher or lower, respectively.


Gary: (in his PC's voice) See that bartender over there? His name's Ol' Markov. He used to be a pirate from some foreign country across the sea. [He picks up his die and looks to the other players.]

Colin: (in his own voice) I don't see why not. Roll standard difficulty.

Gary: [Rolls the die and succeeds, but barely]. (in his PC's voice) He settled down here after losing his arm. But if you mention that to him he won't serve us!


Because this style is a different allocation of responsibilities than most players are used to, a few new terms must be created for this section.

In the standard format of roleplaying, there are two types of characters - player characters (PCs) and non-player characters (NPCs). Players need only be cognizant of their own characters and their surroundings while the GM handles the NPCs. For our purposes, the NPC category can be broken into four distinct types of characters. Listed in order of individual control, they are: Story Characters (SCs), Expendable Characters (ECs), and Autonomous Characters (ACs). In SJ GMing, since everyone plays a part as GM, these distinctions are important to the group as a whole. There is also the standard Player Character (PC), which is much the same as would be expected in other roleplaying games. Characters can change from one class of character to another under the right circumstances.

  • Personal Characters (PCs): Each player creates her own personal character, which is completely under her control. No other player may dictate the actions of that character, just like in a standard RPG. These characters are considered the protagonists of the game. There is generally only one PC per player.

The NPC types

  • Expendable Characters (ECs): All non-PC characters in the game are controlled by the group as a whole. Any player may dictate the actions of any EC in a scene, so long as the EC's actions are reasonable for that character. It is expected that each character is played "in character." Trusting the other players is crucial with this mechanic, as a character may do something that seems totally irrational because the cause of his/her action is not yet known to the other players - just the one who dictated that character's action. This yields a certain amount of control to the current player of that character, as no one else could reasonably roleplay that character without having a valid explanation for the characters actions as well. However, this means that if another player has a different explanation for the seemingly irrational action, that player may try to implement their own idea by modifying the situation.
    At any point during a scene, a player may begin controlling any currently autonomous character (see below for definition and example). Until the end of that scene (unless the player becomes indisposed for some reason), that player is in charge of that character. Should a character leave the scene, upon entering, they will be again considered autonomous. Any player not actively involved in roleplaying their main character is encouraged to control ECs.
  • Autonomous Characters (ACs): In most stories there are multiple people around at any given time. In a bazaar there is any number of shoppers and merchants present who could actually be anyone and know anything. In a store or a mercenary group, there will be people who are just going about their business, and without disruption from the story, would continue on that way. These are autonomous characters. They are not being controlled by any player, and are just there as background. Essentially, ACs are simply ECs which are not being controlled.
  • Story Characters (SCs): Story characters are expendable characters with a perk - potential immunity to death. What sets them above the standard EC is that a player has gone though the effort of writing down that characters statistics on a character sheet. This sheet is usable by all the players of that character to aid in roleplaying them appropriately. Essentially, any non-PC that is detailed on a character sheet is an SC, and a player may choose to create the sheet for any non-PC character of their creation at any time. The reason for this perk is to grant players a certain amount of story control. Game Masters often have the opportunity to flub rolls regarding characters crucial to a story. As each player is a GM, SCs grant them a certain amount of power to do this. Any outcome regarding an SC's death belongs solely to the SC's creator - though appropriate restraint must be applied to keep the outcome believable.

Example: Heather had a great idea for a recurring villain named Molvin. She wrote the character down and detailed him with statistics, background, and a personality. Molvin was added to the story and was controlled by various players throughout the game. Then, during a fight with the protagonists, Molvin received a blow powerful enough to kill him. At this point, Heather could let the dice decide, and roleplay out his death, or fudge the result. She chooses to veto that outcome and "fudge the result" - the blow was vicious but glanced off his rib, severely wounding, but not killing him. He collapses to the ground, painfully pulling something from his pocket. Then, with a wave of his magic wand, a puff of smoke explodes around him. By the time it clears, he is gone.


At the beginning of each session, players should voice their most desired plot lines involving the PCs. The most distant and general plotlines should be mentioned first, to allow for easier integration of mini-plots and specific scenes. It is likely that some of the ideas will be incompatible with each other - this is normal. The purpose of this pre-game exercise is not to plot out the story, but merely to provide direction ideas to the spontaneous play that will follow.

Play starts in the same fashion as a standard roleplaying game, with a chosen player starting as GM. As play progresses, other players fill in information for the current GM and/or replace her as the scenes progress. It may be found that some players prefer to occupy themselves with specific tasks - roleplaying non-PC dialog, or describing locations or action outcomes.


Colin: I'd like to eventually bring the characters on a quest into another plane of existence. So, they must get strong enough to do big tasks, like retrieve a portion of a dead God from the astral plane.

Joan: Ooh, that sounds good. So, we'd need some sort of priests scouting prospects then.

Heather: And probably something nasty going on to tip people off that there is something wrong with the Gods.

Colin: Well, maybe the Gods were warring, and one of them, the protector of the town or forest, was killed. And that's why the priests want a piece of the God - to bring her back to life!

Gary: That's cool. What about an invasion from another country. If the come by sea, this little fishing town would make a good landing spot to stage an attack!

Joan: Maybe they're related! The country invading worships one of the gods that won the battle in heaven. Maybe they attack with skeletons and necromancy! They're not evil, just misguided. [Joan grins]

Heather: Or, there's a plague that's sweeping the country side of this quite town. Its origins are unknown, but everyone infected changes into horrible monsters!...

Each Idea is noted down as potential plot devices, and once everyone is satisfied, the game begins.


The best part about this style of roleplaying is that it is guaranteed to provide freedom of action. Railroading a story becomes less important and much more difficult. Fewer events in the game are certain, since any piece of knowledge that is not written down is uncertain and open to change. Any un-established fact could be false if there are reasons for it, while anything unspoken could very well be true.

Example: One player may start off a story by hiring the players to retrieve some item with the overtones that the employer will use it for foul means, but until this is disclosed in game, another player could let it drop that the item is really a cure the patron intends to use to heal a sick child.

Some players may find it awkward to think of plot devices or story lines on the fly. In these cases, especially for starting players, it is recommended to provide a list of potential hooks, scenarios or devices. These resources can be found online at various gaming sites. One fantastic resource is the storytelling card game, Once Upon A Time, which is made up of cards containing characters, places, items, and events. These can be used to stimulate ideas when players are trying to create a story on the fly.

Example of Play

Joan: Okay, so the day starts off much like any other day in your boring farmer's life. You are plowing fields and sowing grains when a young boy runs up to you [points to Heather]. You don't recognize him, but face is bruised and blood is streaming from a gash on his head. He seems in severe pain.

Heather: (in her PC's voice) Boy! Are you okay?

Dave: (in a young boy's voice) No, it hurts! It really hurts! (switching to normal voice) And the boy collapses.

Gary: (in his PC's voice) Quick, we must take him to a healer.

Joan: (in her PC's voice) I'll wrap his shirt around his head to stem the bleeding! [makes a roll, looks at the Dave, who is playing the boy.] I did a Good job.

Dave: (in his GM voice) And it was enough. You wrap it tight enough to slow the bleeding but not stop it.

Gary: (in his PC's voice) It's not working! The bleeding stopped but he is getting cold! We must take him to the healer!

[The players all look at each other and voice their approval.]

Dave: You get to the healer's hut, carrying the now unconscious boy, and smoke is streaming from the chimney, showing that she is inside.

Heather: (in her GM voice) Everyone make a spot roll. [players do so, including her. Joan is the only one who succeeds.] Joan, as we approach the hut, you notice that some odd hoof prints near it, they don't look like human or domestic.

Gary: (in an old woman's screaming voice) How many times do I have to tell you? I won't buy your stupid monster repel...(in his GM voice) The old healer steps out of the hut to the sight of the heroes and stops when she sees the boy...(quiet old woman voice) Oh dear! What has happened?

In the above example, Joan started off with the story hook of the hurt boy. She may or may not have thought about what caused the injury - either way, it is open for another player to choose. If the boy wakes up, whomever playing him could have him tell the group anything... Of course, whether it would be true or not depends on how the story runs out. Was he hurt by wild animals, mercenaries, monsters, or a simple accident? And what about the marks on the ground that Joan found?

Continuing the example...

Gary: (in his PC's voice) We're not sure, but he seems to have lost a lot of blood. (in his GM voice) Someone take the Healer - I don't want to talk to myself.

Heather: (in healer's voice) Oh my, we'll have to take a look at that. Bring him in. (in her GM voice) She looks at the kid, licks her lips, and wanders back into her home, motioning the farmers forward.

Joan: (in her own voice) I wait back as the others enter so that I can take a closer look at the tracks.

[Colin, Gary and Heather all agree to have their characters enter the house with the healer]

Colin: (in his GM voice) Joan, as you're walking over to the spot on the road where you saw the tracks, you hear the telltale sounds of fast moving coaches coming from within a town block of you. You find the tracks but before you get a chance to inspect them, the coach comes bowling around a corner from behind the building next to you. Make a dodge roll to leap out of the way.

Joan: (in her own voice) Okay. [rolls dice, succeeds] I do so.

Colin: (in his GM voice) You easily avoid the coach as it flies down the road. But you quickly see that it's followed by another one, and another one, and another one - a caravan of some sort... By now the tracks are completely destroyed. [Colin stops talking, looking waiting for a response from Joan.]

Joan: (in her PC's voice) Son of a...!

Gary: (in his GM's voice) The coaches start slowing, with the one of them stopping in front of you. The door swings open and from the depths of the darkness you faintly see a fat, blue skinned man wearing the adornments of a Priest of G'lothanra, smiling at the destroyed remains of the odd tracks...

The above is an example of the meta-game that is played between the players. Since Gary's character was talking to the Healer, he gave up his control of her to avoid acting out multiple personalities at the same time. So, Heather took control of the healer and gave her own twist to the character. Was she licking her lips out of anticipation, or are they simply dry? Then Colin destroyed the tracks that Heather made, keeping their nature and origin a mystery. Then, seeing an opportunity, Gary started a confrontation with what may have been the coach owner. He has also created a new religion, that of G'lothanra, as well as the possible existence of a blue skinned people. Now, it is unlikely that Heather had intended this type of confrontation when she putting those tracks in the road. She may have intended them to herald the arrival of a performing group from another town. And until it is said otherwise, she still can.

And so it goes, with players freely alternating gamemastering duties, creating new people, places and events as the game progresses. It may be awkward at first, but if you keep at it, you'll find that it flows smoothly. If more than one player wants to narrate at the same time, simply agree on a way to decide who gets to go first: pick the least-talkative player, let the other players vote, roll some dice to randomly decide, or whatever works for your group. Cooperation is lubricant that makes this machine run smoothly. But don't be afraid to "stick it" to the PCs once in awhile. Conflict is what turns a Mediocre story into a Great one. If you "play nice" all the time, your game will get boring fast. So have fun, but don't play too nice.

Read the full article...
Monday, October 10, 2005

Warriors of Legend

Have you ever read a book of myths and wished you could be one of the heroes in those ancient stories? Well, here's your chance! Find out how to create an adventure in the lands of legend that you've dreamed about, as well as information on running the adventure, and creating heroes, monsters, weapons and magical devices of legend.

The young ronin has been waiting patiently for the man responsible for his parents' death to pass by. Finally, his patience is rewarded. The crime lord is approaching down the road, but he's not alone! His two bodyguards accompany him. Twins, they specialize in coordinated destruction.

With a piercing yell, the ronin somersaults out from the bushes and drives his foot squarely into the jaw of the first bodyguard, landing directly in the path of the second! With a spinning, tornado-like attack, he slams his fist into the belly of the second bodyguard, flinging him into a large rock next to the well-traveled road. Without warning, the ronin drops to a crouching position, hearing the Thunk! Thunk! Thunk! of shuriken sinking themselves into the tree behind him.

Lifting one hand, the young ronin motions to the bodyguard. Bring it on...


This is your chance to play the larger-than-life heroes that we can only read and dream about. You could be a Greek hero fighting against the wrath of the gods, the legendary ninja out to avenge an offense to his honor, the stealthy thief who's fighting against the injustices of the evil Prince. There are so many possibilities! Only this time, you get to write the legends instead of read about them... Legends! Adventure of heroic proportions! It's time to spend an evening in far off lands, fighting for honor and justice, as well as lots of gold. Welcome to the lands of myths and legends!

The setting for an adventure like this is the historical lands of legend. These lands could be just about any country. Your heroes can adventure in remote locations such as China, Greece, Rome, and India. Characters can travel all over the world, righting wrongs and righteously smiting evil. The remote locations will help give the adventure an exotic feel.

So, How Do I Do This?

How does a gamemaster go about setting up something like this? You'll find it's very similar to any other standard adventure, but you'll have to keep some things in mind when designing this kind of adventure:

Don't take the setting too seriously. It's meant to be a night (or more) of adventure and fun. Legends are going to be written this night! There should be a cinematic feel to the actions as well as the stories. Let the adventure have a relatively simple story and keep the action flowing. Don't let the adventure get caught up in too many details. Be loose with the rules and let the players show off a bit. Excitement is the name of this game!

In Fudge terms, you can use a rules-light system. Combat especially should be very action oriented. One of the best choices for this would be the Story Element style of combat, with the players describing in detail what they are going to do. Character creation can involve only a few basic attributes. (You may even want to consider using all skills instead of attributes!) Be sure that you have the skills players will need to run a heroic adventure. You may want to use some detail with the skill listings. Five Point Fudge will also work with this type of setting.

While the characters will have fantastic abilities, be sure not to make them invincible. Character balance is still important. Now's a good time to try some of those Gifts and Faults that you may not usually use. Maybe you have a fighter but he's clumsy. Perhaps a hero in the party can't ride a horse, or animals don't like him. Maybe your mage is obese. Try out some different possibilities and give them a try. You'll get some interesting characters to play around with. It will only add to the fun of the adventure.

Every adventurer needs to have a place to adventure in! Legendary heroes will sometimes have their adventures in far-away, exotic lands. But, what are these lands like? You're not going to be doing strict historical roleplaying. You have the freedom to embellish the setting to provide a rich adventure for your players. This is roleplaying in the lands we read about in adventure stories, myths, and legends. These lands could be just about any country, such as China, Greece, Rome, or India. Characters can travel all over the world, righting wrongs and also dealing with the various evils found in the world. Don't feel bound by "official" history. Use the setting as a backdrop for the adventure. Use it to give flavor to the adventure. You're not trying to exactly recreate an ancient society and don't be afraid to let some of the finer details of the setting slip so you can run a good story. Even if something is historically inaccurate, if you want it in the adventure then just let it go!

Related to this is the use of comedy during the adventure. If your gaming party is having fun, they may start making wisecracks during the adventure. If it's fitting to their characters, then let them make all the puns and jokes they need. In this kind of setting, you can combine comedy and legendary adventure with little trouble.

Feel free to use some of the adventuring cliches that we've all heard about. Go ahead and start the adventure with a good old-fashioned bar fight! Have the heroes get their information from a shadowy figure in a hooded cloak. Let the heroes pull off a last minute rescue. This can also work against the heroes. The bad guys always had a tendency to pull off those last-minute escapes....

If you're having difficulty coming up with ideas for adventures, take some from popular movies and books. Just put them into the adventure setting and let the characters run with it. Break the movie into basic story plots and put them into your adventure. Action-adventure types of stories such as Indiana Jones, Zorro, The Mask, Remo Williams, and various superhero stories make good basic plots.

Sample Characters

You can reasonably use any fantasy setting for a campaign like this, but you still need characters. Your characters should have a few amazing skills. This kind of adventure will be similar to fairy tales and mythological tales. The heroes of those stories were all larger-than-life, with abilities that easily set them apart from normal people.

Here is a listing of some example characters for you to use. They will be pretty powerful characters and your referee may only want to use them as Non-Player Characters. They should help give an example of the kinds of characters that can be used in a setting like this.

*Note:* I have used a lot of attributes to describe the characters, but I wouldn't recommend using them all in a game. They are only included to give a better over-all description of the types of characters I'm talking about. Please modify them to fit your own campaign. The attributes used in my examples are:

  • Strength - physical strength of the character
  • Agility - overall character agility
  • Dexterity - manual dexterity of the character
  • Balance - how well they can balance on things like tightropes, etc.
  • Speed - how fast the character is
  • Health - the character's overall health
  • Intelligence - raw intelligence
  • Knowledge - learned information and wisdom
  • Willpower - strength of will
  • Appearance - their overall appearance
  • Charisma - how charismatic they can be in dealing with other people

The Silent Ninja - This master of the night is used when a covert warrior is needed. Swift as the wind and deadly as the cobra, this fighter can get to places most people cannot. Rumor has it that they possess mystical powers to help them accomplish their tasks!

Attributes Skills
Strength Fair Bow Fair
Agility Great Ninja Sword Great
Dexterity Fair Shuriken Good
Balance Great Thrown Weapons Good
Speed Good Acrobatics Good
Health Good Move Quietly Great
Intelligence Fair Climbing Fair
Knowledge Good Detect/Disarm Traps Fair
Willpower Fair Pick Locks Good
Appearance Fair Poisons Good
Charisma Mediocre Botany Fair
  Hide Traces Great
  Observation Fair
Gifts Quick Reflexes, Keen Senses, Night Vision
Faults Secret Identity (nobody can know they are a ninja), Vow, Obsession
(any other professional skills that will help maintain public identity)

The Heroic Princess - This is a female fighter who is one of the best of her tribe. Maybe she left her home to seek adventure in the world. She is an accomplished fighter but is far from being "lady-like," especially in her own culture.

Attributes Skills
Strength Good Sword Great
Agility Great Whip Fair
Dexterity Good Knife Good
Balance Superb Brawling Great
Speed Great Pressure Points Great
Health Good Acrobatics Great
Intelligence Fair Jumping Good
Knowledge Good Tactics Good
Willpower Good Fishing Fair
Appearance Great Swimming Fair
Charisma Good Survival Fair
--------------------- First Aid Good
Navigation Good Riding Good
Seduction Good Disguise Fair
Intimidate Great Dancing Fair
Seamanship Fair Stealth Good
  Geography Great
Gifts Contacts, Combat Reflexes, Leadership
Faults Reputation, Enemy (other warlords, Ares, etc.), Quick Tempered, Tactless

The Powerful God of War - In many mythology stories, the gods and goddesses of that land would interact with characters, especially heroes. If your adventure's pantheon does this, then you may need to provide stats for the gods as well as the heroes. The gods are not infallible, they can be beaten...just not easily!

Attributes Skills
Strength Great Sword Superb
Agility Good Edged Weapons Superb
Dexterity Good Blunt Weapons Superb
Balance Great Acrobatics Great
Speed Fair Ambush Good
Health Superb Quick Draw Good
Intelligence Good Stealth Fair
Knowledge Great Tactics Great
Willpower Superb Cultures Good
Appearance Great Geography Superb
Charisma Great Seduction Fair
--------------------- Bluff Fair
Intimidate Great Flattery Good
Persuade Good  
Gifts Combat Reflexes, Immortal, Many people owe favors, Rapid Healing, Reputation, Strong Will
Faults Ambitious, Blunt and Tactless, Enemies (various "good guys"), Obsession (ruling Olympus, Asgard, etc.), Overconfident, Quick Tempered

The King of Thieves - Here is the swashbuckling hero that seems to fill these sorts of adventures. This guy (or girl) is the best there is...and they know it! Cocky and arrogant, they will never pass up an opportunity to show off or proclaim their skills. If someone tries to prove they are the best thief, he will spend almost every waking moment trying to do it one better. A lovable rogue with a heart of gold.

Attributes Skills
Strength Fair Brawling Great
Agility Great Sword Fair
Dexterity Superb Knife Good
Balance Great Lockpicking Superb
Speed Good Acrobatics Great
Health Good Climbing Fair
Intelligence Good Acting Good
Knowledge Good Detecting Traps Great
Willpower Fair Disarming Traps Great
Appearance Good Disguise Fair
Charisma Great Pickpocketing Superb
--------------------- Slight of Hand Good
Bluff Great Tactics Good
Lying Good Escape Great
Persuade Great Appraisal Good
Disguise Good Seduction Good
Gifts Ambidextrous, Danger Sense, Keen Senses, Perfect Timing, Quick Reflexes
Faults Ambitious, Full of Bluff, Greedy, Outlaw, Reputation

What's He Carrying?

You can also apply this idea of legends to weapons and magical artifacts. In a game of myth and legends, they usually are very basic items, but powerful. They are also difficult to find. The hero should consider a quest of some kind to find these weapons of legend.

  • The Sword of Hades: magical longsword
  • Flame Blast: Great, 20 ft. range
  • can melt other swords on contact if the player rolls a natural +4
  • Gem of Monster Summoning: magical artifact
  • Summoning: Good
  • monster appears within 10 feet of the mage, will follow one basic command given by holder of the gem, can only be used once in 24 hours
  • Ring of Flying: magical jewelry
  • Flying: Superb
  • user can fly with the speed of an eagle, can fly to the limit of the clouds, can take off from a standing position

The Final Chapter

The main thing about an adventure such as this is to have fun! Let the characters rescue the damsel in distress, save the kingdom, and make the world safe for everyone. These are the stories that bards will tell for centuries. Gather the hearty band of warriors, give them an exciting adventure and sit back to watch the fun. Their exploits will live on in legends forever!

Read the full article...
Monday, October 03, 2005

Converting d20-Based Skills to Fudge

Do you have d20 material that you want to use in your Fudge games? From D&D's vast spell lists, to the plethora of adventures available, d20 has more published resources than any other system. With this article's simple system, you will be able to access that entire world of d20 products with no difficlty. Do you want to know if your characters can handle that DC 25 trap or climb that DC 18 cliff? No problem! How hard is a level 6 spell, and can my Good Wizard cast it? Simple to determine. So, grab your books and get ready to expand your adventures!

From time to time people ask about converting between d20-based RPGs and Fudge. This article presents a simple, play tested method, for doing so. The emphasis here is on converting d20-based skills to Fudge, but the information here could just as easily be used to convert from Fudge to d20-based games.

General Approach

The core of this approach is to "map" the Fudge trait ladder to the range of d20 results. At first glance this might seem absurd, since the trait ladder only has seven entries and a sharply curved probability distribution. But if you look at the middle of the range of the cumulative Fudge distribution (-2 to +2), you'll find that they correspond roughly to 20%-40%-60%-80%. Fudge is by nature inexact, and since around 85% of the dice results fall on one of these values, I feel comfortable just saying that each +1 on the Fudge Dice is roughly +20% probability.

From there it is very easy to construct an open-ended conversion, based on the idea that +1 Fudge level is +4 d20 ranks (20%). The tricky part is trying to decide the specific correspondence.

In Fudge, you have a 60% chance to roll your skill level or better. I take Poor as equal to +0 rank in d20, since both are the default skill when no training has been received. You have a 60% chance to roll 9 or better on d20, so DC 9 is the equivilant of a Poor (unskilled) character attempting a Poor task. The average attribute in d20 is 12-13 (based on 4d6 drop lowest). So the average character has a +1 skill bonus due to her ability modifier. Thus, he only needs to roll an 8 or better if his skill is untrained (0 ranks).

The ability modifier drops the d20 equivilant for a Poor task to a DC 8, which a completely unskilled character can succeed at 60% of the time. I consider this as the "minimum" -- you're guaranteed at least a 60% chance of success, regardless of skill. So, I'd say DC 8-11 corresponds to Poor. Thus,

d20 DC Fudge Difficulty
DC 0-3 Nonexistent
DC 4-7 Terrible
DC 8-11 Poor
DC 12-15 Mediocre
DC 16-19 Fair
DC 20-23 Good
DC 24-27 Great
DC 28-31 Superb
DC 32-35 Legendary
DC 36-39 Legendary+1
DC 40-43 Legendary+2
DC 44-47 Legendary+3
DC 48-51 Legendary+4

This also seems a good intuitive fit for d20... most skill checks seem to be in the DC 15 to 25 range, which is Fair to Great.

We can also do a few reality checks here. A beginning adventurer can have +4 ranks in his starting skills, have an average of a +1 ability modifier, so his overall skill is +5; by taking an automatic 10 on his die roll, he can succeed at a Fair task, while he can succeed at a Great task by taking a 20.

In Fudge terms, he has Mediocre (+4) skill. I'd consider "taking 10" to be an automatic +0 Fudge result (both are close to 50% chances), and "taking 20" to be a +3 Fudge result (both close to 95% chances). Thus in Fudge, a character "taking 10" will succeed at a Fair task, and when "taking 20" he'll succeed at a Superb task. Not an exact match, but reasonably close.

Maximum natural human potential in d20 is character level 20, skill rank of +24, and an ability modifier of +5, for a total skill of +29. By adding a +2 skill focus, we get a skill of +31, which could succeed at a DC 51 task if you took 20. In Fudge, maximum human skill is Legendary, and the maximum die result is +4, so the ultimate achievement for a natural human is Legendary+4... which equates to DC 48-51. Perfect match!

That gives us our DC equivalence, but we can also determine a skill equivalence. If 24 ranks can at most succeed at DC 51, the maximum human potential, and each Fudge level is 4 ranks, than Legendary must equate to rank 21-24. Working backwards we can construct a chart of skill ranks and character levels:

d20 Skill Character Level Fudge Skill
Rank 0   Poor
Rank 1-4 Level 1-4 Mediocre-Fair
Rank 5-8 Level 5-8 Fair-Good
Rank 9-12 Level 9-12 Good-Great
Rank 13-16 Level 13-16 Great-Superb
Rank 17-20 Level 17-20 Superb-Legendary

A range is suggested for the Fudge equivalence, since a d20 character of a given level or skill rank may also have attribute and skill focus modifiers from -3 to +7. A 20th level character will only be Superb unless he also has the talent to push his skill to Legendary.

You'll note that the given level progression in the above table makes spell difficulties very easy to convert to Fudge difficulties as well:

Character Level 1-4 = Spell Level 1-2 = Mediocre
Character Level 5-8 = Spell Level 3-4 = Fair
Character Level 9-12 = Spell Level 5-6 = Good
Character Level 13-16 = Spell Level 7-8 = Great
Character Level 17-20 = Spell Level 9 = Superb
Character Level 21+ = Epic Spells = Legendary

(Zero-level cantrips would be Poor spells in Fudge)

As for attributes, since d20 abilities average to 12-13 with the recommended rolling method, I'd normalize them so that 12-13 = Fair. That puts 18 at Superb and 20 at Legendary, which seems right.

Unified Conversion Table

Fudge Level DC Rank Level Spell Ability
Nonexistent 0-3        
Terrible 4-7       7 or less
Poor 8-11 0     8-9
Mediocre 12-15 1-4 1-4 1st-2nd 10-11
Fair 16-17 5-8 1-8 3rd-4th 12-13
Good 20-23 9-12 5-12 5th-6th 14-15
Great 24-27 13-16 9-16 7th-8th 16-17
Superb 28-31 17-20 13-20 9th 18-19
Legendary 32-35 21-24 17-20   20 or more
Legendary+1 36-39        
Legendary+2 40-43        
Legendary+3 44-47        
Legendary+4 48-51        
Read the full article...