4 ms·

The issue of cheating is genuinely valid one, but so is being able to use the hardware with a variety of software. And in this case, are you sure open APIs are

by xoa 6y ago

The issue of cheating is genuinely valid one, but so is being able to use the hardware with a variety of software. And in this case, are you sure open APIs are actually in conflict? "Open" doesn't have to mean "forgeable", wouldn't it be possible to have a fully open and documented bike API that also cryptographicly signed output? Software could choose to not care about the signature and just run off the API directly, or to require a signature from a specific set of manufacturer keys, or for that matter both (why not support both casual groups and competitive ones depending on what users want?). Obviously for hardcore competitive types it'd still come down to the security and gameability of the hardware itself, and even if it was fairly solid it'd still mostly be about discouraging lazy cheaters, since as far as home use goes nothing stops someone from attaching an electric motor or something if they really want to screw with things. But I don't think full open APIs any software can use in this case precludes getting as much security as is possible to get out of the software/electronics side of things. And full open APIs would be super useful for longevity, variety of use, etc.

ThePowerOfFuet 6y ago
Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating.
- elliekelly 6y ago
  Is anything stopping someone from doing that with the Peloton hardware? I could absolutely motorize my pedaling if I wanted to (I wouldn’t even need to touch the API!) but it would defeat the entire purpose of buying the bike in the first place: exercise.
  - usrusr 6y ago
    Usually when you want to cheat in virtual races you simply claim to be 20 kg lighter than you actually are. No need for a protocol hack or motors.
- tux1968 6y ago
  Not really relevant though, since that's true whether the API is open or not.
- xoa 6y ago
  >Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating. ...thanks for repeating what I wrote in the fifth sentence, I guess? You could have at least mentioned steroids or something which I didn't cover which would also be easy to use there. But the fact is that like so many things level of effort required matters. Some people will try to cheat anything at any level, either for the rewards or even for the meta challenge of cheating itself. But when talking Big Numbers, millions of people using something, it can still be a big difference if it requires significant effort to cheat vs something trivial, and crypto signed data does raise other active response options too. Even in the electric motor example, is the electric motor output identical in cadence and so on to a human? Does the cheater use it the same way every time? Because if not, that may show up and they can be banned and leader boards recalculated. And cheaters could try to respond in turn, but having to try to hide things via physical systems would be trickier then pure software. And at any rate, I was taking the poster's concern I was responding to as a given. My point was that even then, I don't think that open APIs are in conflict with doing as well as can be done from the electronics side. It's fine to also say "well, I just don't care about cheating and/or our group would socially moderate it" which I also tried to mention, merely signing an open API wouldn't get in the way of that either. It'd just be an extra open data point to use or not use as a given community wished.
- wolco 6y ago
  Holding on to the back of a truck would be cheating. Self reporting only works so far. Leaderboards should be connected to in person events with judges/rules if accurancy is important. At a previous workplace that showed similiar stats the focus was on personal breakthroughs and personal goals. Leaderboards existed within small groups who met up in person and rode together.
mnd999 6y ago
Hidden electric motors have been used to cheat in real pro cycling. If they can’t always catch it there Peleton etc. have no chance. I guess at least that makes it realistic.
- trhway 6y ago
  what gave it away? I'd guess the back of the cyclist's t-shirt looking like a solar panel would be a good telltale sign (such a solar panel would produce probably ~50W under France's summer sun).
  - xnyan 6y ago
    They used lipo cells hidden inside the frame of the battery, the heat output of the batteries lit up on an inferred camera. https://www.schneier.com/blog/archives/2016/04/cheating_in_bic.html https://www.schneier.com/blog/archives/2016/04/cheating_in_b...
- xoa 6y ago
  Just some random theorizing here for fun, this is getting off topic of the cool hack: >Hidden electric motors have been used to cheat in real pro cycling. If they can’t always catch it there Peleton etc. have no chance. Though this is getting off topic, I'm not sure I agree with you. It's not necessary to always catch something in a situation like this after all, as with video games it is more about keeping down the rate, and permabans on discovery with retroactive stat updates may also discourage by raising the risk even if one might get away with any single instance. There is also the fact that stakes are just plain lower, things like Zwift are mostly about fun, getting into shape, and competitions to the extent that competition helps some people with A & B. It's not like there are massive cash prizes and sponsorships and so forth on the line in the same way the pro sports has. So lesser reactions could still work. And the purely electronic world does have some additional potential tools, if we want to theorize about if a given community really got concerned about cheating. While as this example shows right now the needed data is very minimal, it's not as if an open API couldn't have a lot of biometrics, resulting in major data sets that could be kept around indefinitely. Which obviously has major privacy implications too, but purely from a cheating angle I suspect it'd be a challenge to get everything right vs sufficiently powerful ML analysis on a data set like that from millions. I mean, at the end of the day the fact is that a human being assisted by an electric motor just isn't thermodynamically the same system. With sufficient resolution (possibly not feasible on real roads, but quite possible for a contained standalone system) the energy budgets and how they interact with human physiology just won't add up right. Now I personally am not a serious bike rider at all, just casual for exploration of the countryside on my own, and while I have a bunch of family members who are they're all out on roads and aren't into the tech side as much. So I honestly don't have any idea what level of privacy/creep tradeoff people would accept in data collection vs cheating and any other benefits (better personalized AI training suggestions? maybe?). Still though, it's an interesting cat and mouse game, and I'm not sure I'd bet on the mice if the cats have enough data collection, memory and computing power on their side. All of which not merely could but should even more be open, so that people can see exactly what is going out and have full control over it.

by xoa 6y ago

ThePowerOfFuet 6y ago

Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating.

elliekelly 6y ago
Is anything stopping someone from doing that with the Peloton hardware? I could absolutely motorize my pedaling if I wanted to (I wouldn’t even need to touch the API!) but it would defeat the entire purpose of buying the bike in the first place: exercise.
- usrusr 6y ago
  Usually when you want to cheat in virtual races you simply claim to be 20 kg lighter than you actually are. No need for a protocol hack or motors.
tux1968 6y ago
Not really relevant though, since that's true whether the API is open or not.
xoa 6y ago
>Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating. ...thanks for repeating what I wrote in the fifth sentence, I guess? You could have at least mentioned steroids or something which I didn't cover which would also be easy to use there. But the fact is that like so many things level of effort required matters. Some people will try to cheat anything at any level, either for the rewards or even for the meta challenge of cheating itself. But when talking Big Numbers, millions of people using something, it can still be a big difference if it requires significant effort to cheat vs something trivial, and crypto signed data does raise other active response options too. Even in the electric motor example, is the electric motor output identical in cadence and so on to a human? Does the cheater use it the same way every time? Because if not, that may show up and they can be banned and leader boards recalculated. And cheaters could try to respond in turn, but having to try to hide things via physical systems would be trickier then pure software. And at any rate, I was taking the poster's concern I was responding to as a given. My point was that even then, I don't think that open APIs are in conflict with doing as well as can be done from the electronics side. It's fine to also say "well, I just don't care about cheating and/or our group would socially moderate it" which I also tried to mention, merely signing an open API wouldn't get in the way of that either. It'd just be an extra open data point to use or not use as a given community wished.
wolco 6y ago
Holding on to the back of a truck would be cheating. Self reporting only works so far. Leaderboards should be connected to in person events with judges/rules if accurancy is important. At a previous workplace that showed similiar stats the focus was on personal breakthroughs and personal goals. Leaderboards existed within small groups who met up in person and rode together.

mnd999 6y ago

Hidden electric motors have been used to cheat in real pro cycling. If they can’t always catch it there Peleton etc. have no chance. I guess at least that makes it realistic.

trhway 6y ago
what gave it away? I'd guess the back of the cyclist's t-shirt looking like a solar panel would be a good telltale sign (such a solar panel would produce probably ~50W under France's summer sun).
- xnyan 6y ago
  They used lipo cells hidden inside the frame of the battery, the heat output of the batteries lit up on an inferred camera. https://www.schneier.com/blog/archives/2016/04/cheating_in_bic.html https://www.schneier.com/blog/archives/2016/04/cheating_in_b...
xoa 6y ago
Just some random theorizing here for fun, this is getting off topic of the cool hack: >Hidden electric motors have been used to cheat in real pro cycling. If they can’t always catch it there Peleton etc. have no chance. Though this is getting off topic, I'm not sure I agree with you. It's not necessary to always catch something in a situation like this after all, as with video games it is more about keeping down the rate, and permabans on discovery with retroactive stat updates may also discourage by raising the risk even if one might get away with any single instance. There is also the fact that stakes are just plain lower, things like Zwift are mostly about fun, getting into shape, and competitions to the extent that competition helps some people with A & B. It's not like there are massive cash prizes and sponsorships and so forth on the line in the same way the pro sports has. So lesser reactions could still work. And the purely electronic world does have some additional potential tools, if we want to theorize about if a given community really got concerned about cheating. While as this example shows right now the needed data is very minimal, it's not as if an open API couldn't have a lot of biometrics, resulting in major data sets that could be kept around indefinitely. Which obviously has major privacy implications too, but purely from a cheating angle I suspect it'd be a challenge to get everything right vs sufficiently powerful ML analysis on a data set like that from millions. I mean, at the end of the day the fact is that a human being assisted by an electric motor just isn't thermodynamically the same system. With sufficient resolution (possibly not feasible on real roads, but quite possible for a contained standalone system) the energy budgets and how they interact with human physiology just won't add up right. Now I personally am not a serious bike rider at all, just casual for exploration of the countryside on my own, and while I have a bunch of family members who are they're all out on roads and aren't into the tech side as much. So I honestly don't have any idea what level of privacy/creep tradeoff people would accept in data collection vs cheating and any other benefits (better personalized AI training suggestions? maybe?). Still though, it's an interesting cat and mouse game, and I'm not sure I'd bet on the mice if the cats have enough data collection, memory and computing power on their side. All of which not merely could but should even more be open, so that people can see exactly what is going out and have full control over it.