Need input on these. Please note that these are ONLY applicable to Hacking on the Fly.
2a) Detecting a Hacker who is Hacking on the Fly requires the Device to make an Analyze Rating + Firewall Rating Opposed Test vs the Hacker's Stealth Rating + Spoof Rating each time he takes a Hacking action. This is a change from the previous Extended Analyze+Firewall (Stealth) Test mechanic. This means that there is a –3 dice pool modifier if the command requires a security account and a –6 dice pool modifier if it requires an admin account (since it's an Opposed rather than an Extended Test). This rule makes it more likely that the Hacker will not be found (since he can add Spoof to the dice pool), but will remove the possibility of effectively guaranteed hacking attempts on moderate-to-low-rating Devices.
OR
2b) Detecting a Hacker who is Hacking on the Fly requires the Device to make an Analyze Rating + Firewall Rating Extended Test vs the Hacker's Stealth Rating each time he takes a Hacking action. This threshold to be detected is reduced by -1 if the hacker wants a Security Account, and by -2 if the Hacker wants an Admin account. The hacker still suffers the normal threshold modifiers to his Hacking+Exploit test to Hack on the Fly if the command requires a security or admin account.
OR
2c) Hacking on the Fly is done as normal, but if the System's (Analyze+Firewall)/2 is greater than the Hacker's Stealth Rating, the system will automatically detect the intruder. Essentially, a Hacker with a Rating 4 Stealth Program is simply unable to break into a Rating 5 or 6 System on such short notice. Get better gear, n00b.
.............
I'm looking at the maths behind hacking, and from what I can tell, if a decent Hacker (Hacking 5, Exploit 4, misc stuff to get a 12 dice pool) has a Rating 4 Stealth program, and is hacking on the fly, he's almost guaranteed to get through a SOTA Rating 6 System in 2 turns (12 dice pool, avg of 3 hits/turn, needs 6 hits). Meanwhile, the system is unlikely to detect him (12 dice pool to detect, needs 4 hits, avg of 3/turn) before the Hacker manages to get in and reassure the system that he's supposed to be there. For legwork, I can see this working, but for hacking on the fly, getting through a Rating 6 system this easily seems...a bit much. A SOTA system should be FAR harder to breach on the fly than how the RAW supports. Hell, Hacking's already simple enough to do via long-term legwork (take a day to break into a system, and you're almost guaranteed to do so). What are people's thoughts on any of these ideas? I'm rather partial to 2c, just for simplicity...