3 ms·

Never trust the client. Trying to install a rootkit on your users' computers won't change the reality of client-server security.

• AnIdiotOnTheNet 5y ago
  I agree, and I think that like DRM anti-cheat is generally a customer-hostile losing battle. The big problem is that companies are trying to solve a social problem (cheating) with a technological solution and, predictably, failing. Partly this is motivated by profit: if you required online gamers to be real verifiable people, with all suspected cheating was judged by a human being, and bans were permanent and landed you on a watch list for other games, cheating would probably drop dramatically but so would sign-ups and your ability to resell the game to the new account of a cheater who's old account was banned. Personally, I'm completely fed up with online competitive multiplayer for other reasons so it doesn't really affect me. I just don't by the games that would use kernel-level anti-cheat to begin with.
  • CaptainZapp 5y ago
    > I agree, and I think that like DRM anti-cheat is generally a customer-hostile losing battle. The big problem is that companies are trying to solve a social problem (cheating) with a technological solution and, predictably, failing. I don't disagree with your general take, but you can't accuse Valve Anti Cheat of being a failure.[0] [0] https://en.wikipedia.org/wiki/Valve_Anti-Cheat https://en.wikipedia.org/wiki/Valve_Anti-Cheat
  • vintermann 5y ago
    I think a lot of the prevalence of cheating has to have some economic roots. A certain kind of cheater, the kind who buy new accounts (maybe with new cosmetics) every time they are banned, isn't necessarily someone a company wants to get rid of permanently. The benefits of this sort of income may be high compared to the benefit of being a "serious competitive game". I think Minecraft servers are instructive, because they're often run just as cynically as free to play games, but with less competence, so it's easier to see what's going on. You do see a lot of pay-to-unban there, for instance.
• charcircuit 5y ago
  We have to trust the client to an extent. How can a server tell if a player clicked their mouse or if a triggerbot did?
  • oauea 5y ago
    It can't. There's not much more to say, even with the current anticheat it's no way to be certain a real human being clicked a real mouse. As the other comment shows, you can start adding more and more invasive monitoring solutions but this likely won't be tolerated by many and will eventually be bypassed anyway.
  • dagw 5y ago
    The officially approved mouse timestamps and signs the click using a hardware embedded cryptographic key (only slightly joking).
    • anamexis 5y ago
      That's when you just rig up a solenoid to click the real mouse :P
      • dagw 5y ago
        fingerprint/palmprint sensor on the mouse... plus of course timestamped continuous video stream of your face and both hands at all times.
        • anamexis 5y ago
          Pssh, that's when you just rig up a hyper-realistic android.
• dagw 5y ago
  Never trust the client I wonder if we'll eventually end up at a point where all competitive gaming is run entirely sever side and IO is streamed to cryptographically signed and verified hardware.