Brute forcing an online resource, such as a web server, eats up bandwidth and CPU cycles. This can leave the people running the server (in our case, the Puppet Masters) with excessive bandwidth charges. It also means that other players trying to access the machine are getting a slow response because of the CPU utilization. This is a bad situation for everyone involved and should be avoided at all costs. There is always a more elegant and less intrusive way of solving something than this kind of brute force.

On the other hand, brute forcing an offline resource, such as the MD5 hashes found in Marketing Week, may be the only way to solve a puzzle. In this case, you will need to use your own judgement. If you think of a puzzle as a lock, you will earn much more praise and respect for discovering a cunning and ingenious method of picking the lock, than you would for smashing it with a sledgehammer.

Always use your common sense. If you are unsure whether an action is potentially good or bad, stop and think. How is it going to effect the game? The other players? The PMs? If you are still struggling with it, try dropping a note in the forums (make it anonymous, if you need to). There are plenty of friendly people online who are looking for something to discuss between puzzles. ::grin::

Often times, sites include embedded Flash or Java applets. Quite a few tools exist out there to decompile these mini-programs, so you can see the original source code. The security community finds this useful, as it can show flaws in an application. The ARG community might also find this useful, as sometimes there is data hidden in the Flash files that leads to more game knowledge.

The question arises: is this a proper thing to do in an ARG? Often times, poorly designed sites leave things in the flash that the original designers did not want you to know. There are many people who are unaware of the fact that this data can be reversed out of Flash. The old-school ARG players will say that it is the same as cheating, and is therefore off-limits. Others say that if it runs on their computer, they should be able to see what it is doing--either by decompiling a program or watching network packets as they flow into and out of the computer. ARG player Diandra notes: "The general etiquette regarding Flash file decompiling has been that the PMs can't stop you from doing it. However, it's considered bad form to post solutions derived purely by decompilation of Flash files to any ARG forum."

Currently, there is no solid answer to this question. It is still being debated. Be warned, though, that in the US it is technically illegal to decompile a program, except under very specific circumstances, because of the DMCA. Other countries have DMCA-like legislation. My personal opinion is that the web follows standard client/server architecture. If secret data needs to be calculated, it should be done server-side, where the client cannot see it. If Flash and Java are utilized to do something like check a password, it should be sent to the server (possibly hashed to protect from eavesdropping) and tested server-side, instead of a "IF $password = "secret" THEN GOTO 100" sort of scheme. Be advised, the previous statement is this author's opinion. The jury is still out as to whether this stuff is acceptable ARG practice and generally gets decided upon by the community on a case-by-case basis.

Do not put up a fake website that claims to be part of the game. Similarly, do not pretend to be an in-game character in chat, on Blog posts, by forging email headers, or by any other mechanism. Unraveling the plot and puzzle solutions can be difficult as it is, without mean-spirited people inserting a bunch of intentional red herrings.

A fan site, on the other hand, may just add to the flavor and immersive quality of the game. If you want to start up a fan site, please try to be a responsible person and think about its impact on the in-game sites.

If some aspect of the ARG requires hacking to solve, it will be obvious. Don't hack a server just because you can. Breaking in to an ARG's computer system just to see what is there can be similar to skipping to the last page of a murder mystery. Sure, you have all the answers, but you end up losing the story and the interactive experience.

Again, if hacking is required, it will be obvious from the clues and plot. Also, nearly every ARG puzzle instance that has required hacking has been a "custom web page" system and not an "off the shelf" piece of software. In general, SquirrelMail, telnet, FTP, secure shell, and a number of other services come pre-installed on servers and allow the Puppet Masters and hosting administrators to update the websites and monitor system status. These are rarely, if ever, the intended target of hacking. Usually, ARG hacking is simply guessing passwords on a custom web login form.

See: Legality

A great many informational tools are available on the internet that will tell you about a domain name. Generally, a simple DNS lookup is considered acceptable. Usually, it will just give some useless information about who registered the domain name. Occasionally, it a clue will exist in the DNS data. On the other hand, using a reverse-DNS tool to enumerate all of the domain names attached to a specific webserver is frowned upon. Often, this will show domain names that were registered for the game, but are not yet available for plot reasons. This is akin to peeking ahead a few chapters in a mystery novel. It does not necessarily tell you whodunnit, but it might prematurely reveal a piece of the plot that would have been more fun to discover through an engaging story.

Are you considering taking some action? Is it illegal in your jurisdiction or that of the ARG or its servers? Then don't do it. Period. ARGs are not here to get you in trouble or make you break the law. If you feel you have to do something illegal, I would suggest finding another pastime.

See: Hacking

Keep private information private. If the Puppet Masters of a particular ARG do not wish to be known, but you happen to accidentally discover their identity, keep that information "behind the curtain." Do not blab about it to anyone and everyone. If you really must tell someone, perhaps you should send a little note to the PMs explaining how you obtained this supposedly private knowledge. At the very least, it will help them plug the security or information leak so that more people do not find out. Do not simply think about yourself and how "cool" you will look announcing the identity of the PMs. Think about the other players and how knowing that information may just break the reality of their ARG experience. Besides, they think you are to blame for messing up that experience, they are less likely to think of you as "cool" and more likely to think of you as "that lamer who ruined the game."