3 ms·

A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing

A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing the game. Like an incredibly improbable statistic or too fast actions or something else. This is a poor solution: it's the equivalent of blocking spammers by IP address. It works but will also lock out legitimate users.

ajross 9y ago
That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous. You take what clues you can get and you push the fix. This is what all their users not named catbot want.
- revelation 9y ago
  Which is why commercial AV routinely throws up entirely bogus reports. Not a good example. Comparing statistics (accuracy, reaction time, chat messages, what have you) server-side to a not cheating player population seems like a very promising solution, given it doesn't involve the game client (which is assumed compromised). I don't see how that has anything to do with the halting problem.
aceofspad3s 9y ago
Maybe legitimate users shouldn't use the name of a hack as their account name.
- FRex 9y ago
  People names in TF2 and CSGO are all over the place in many languages and get crazy, weird or stupid. Fucking excuse me for not looking up aimbots to know what names I shouldn't use to not lose access to games I paid money for. Why the fuck would a normal user know stuff like that and why is that even remotely reasonable? What crazy planet were you born on?
  - Moter8 9y ago
    You can express most of what you said in normal, clear words, without having to insult the other person.
    - FRex 9y ago
      I can express all I said in timid words (and my insults, if you consider asking "WTF" an insult, are also very clear) but to insults I reply with profanity. To tell me that this is a reasonable protection mechanism on Valve's part and that if I happen to have these two very common English words as part of my Linux login I can get banned out of the games I purchased and it'd be my fault for not knowing these are the words that cheaters use in their scripts is an insult.
- anonymousab 9y ago
  'catbot' is a name I can certainly see being used by for a PC username on a gamer's system. It's certainly not unique if you google around. I don't have steam locally so I can't use their username search to check for similar ones.
  - Moter8 9y ago
    A search gives me 739 results, some appear to be just "duplicate" though. There are 8+ accounts which seem real on the first two pages, so there must be false positives as you implied. http://steamcommunity.com/search/users/?text=catbot&x=0&y=0 http://steamcommunity.com/search/users/?text=catbot&x=0&y=0
jimrandomh 9y ago
This particular detection seems very unlikely to ever have a false positive. The noise about false positives appears to be coming from the authors of the cheat software themselves.
- lakechfoma 9y ago
  It's not about false positives, it's about the half ass solution. The name is just gonna change and it'll be an impossible cat and mouse game
  - rnhmjoj 9y ago
    They have already implemented randomly generated names: https://github.com/nullifiedcat/catbot-setup/pull/11/files https://github.com/nullifiedcat/catbot-setup/pull/11/files
  - throwaway2048 9y ago
    all anti-cheat is fundamentally cat an mouse, when you can control the kernel (applies to both linux and windows) you can lie about anything anticheat tries to detect. There is no bulletproof solutions.
    - lakechfoma 9y ago
      You're right but some statistics analysis on the gameplay by players would do a lot more to reveal bots than analyzing usernames, especially once the bots start using random diceware names
      - paulmd 9y ago
        They do that too, but this was an easy 'tell' for a while.
      - throwaway2048 9y ago
        I'm guessing this is how they determined this was a valid metric, everybody with a catbot user statistically looked like a hacker, and nobody didn't look like a hacker.

ajross 9y ago

That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous. You take what clues you can get and you push the fix. This is what all their users not named catbot want.

revelation 9y ago
Which is why commercial AV routinely throws up entirely bogus reports. Not a good example. Comparing statistics (accuracy, reaction time, chat messages, what have you) server-side to a not cheating player population seems like a very promising solution, given it doesn't involve the game client (which is assumed compromised). I don't see how that has anything to do with the halting problem.

aceofspad3s 9y ago

Maybe legitimate users shouldn't use the name of a hack as their account name.

FRex 9y ago
People names in TF2 and CSGO are all over the place in many languages and get crazy, weird or stupid. Fucking excuse me for not looking up aimbots to know what names I shouldn't use to not lose access to games I paid money for. Why the fuck would a normal user know stuff like that and why is that even remotely reasonable? What crazy planet were you born on?
- Moter8 9y ago
  You can express most of what you said in normal, clear words, without having to insult the other person.
  - FRex 9y ago
    I can express all I said in timid words (and my insults, if you consider asking "WTF" an insult, are also very clear) but to insults I reply with profanity. To tell me that this is a reasonable protection mechanism on Valve's part and that if I happen to have these two very common English words as part of my Linux login I can get banned out of the games I purchased and it'd be my fault for not knowing these are the words that cheaters use in their scripts is an insult.
anonymousab 9y ago
'catbot' is a name I can certainly see being used by for a PC username on a gamer's system. It's certainly not unique if you google around. I don't have steam locally so I can't use their username search to check for similar ones.
- Moter8 9y ago
  A search gives me 739 results, some appear to be just "duplicate" though. There are 8+ accounts which seem real on the first two pages, so there must be false positives as you implied. http://steamcommunity.com/search/users/?text=catbot&x=0&y=0 http://steamcommunity.com/search/users/?text=catbot&x=0&y=0

jimrandomh 9y ago

This particular detection seems very unlikely to ever have a false positive. The noise about false positives appears to be coming from the authors of the cheat software themselves.

lakechfoma 9y ago
It's not about false positives, it's about the half ass solution. The name is just gonna change and it'll be an impossible cat and mouse game
- rnhmjoj 9y ago
  They have already implemented randomly generated names: https://github.com/nullifiedcat/catbot-setup/pull/11/files https://github.com/nullifiedcat/catbot-setup/pull/11/files
- throwaway2048 9y ago
  all anti-cheat is fundamentally cat an mouse, when you can control the kernel (applies to both linux and windows) you can lie about anything anticheat tries to detect. There is no bulletproof solutions.
  - lakechfoma 9y ago
    You're right but some statistics analysis on the gameplay by players would do a lot more to reveal bots than analyzing usernames, especially once the bots start using random diceware names
    - paulmd 9y ago
      They do that too, but this was an easy 'tell' for a while.
    - throwaway2048 9y ago
      I'm guessing this is how they determined this was a valid metric, everybody with a catbot user statistically looked like a hacker, and nobody didn't look like a hacker.