2 ms·
Not trusting the client can only get you so far, in some types of game it's unavoidable that the client must have enough information and control that a cheat ca
by jsheard 4y ago
Not trusting the client can only get you so far, in some types of game it's unavoidable that the client must have enough information and control that a cheat can enhance human play or replace the human altogether. It will always be possible to enhance aiming in a shooter, or automate repetitive tasks in an MMO, or script perfect blocks and parries in a fighting game, or feed the state of an online chess game into Stockfish and have it play for you, even if you trust the client to the minimum possible extent.
The only things that can be done in those cases are loosely "detecting" cheaters through heuristics and human review of suspicious behaviour, which won't catch more careful cheaters and may lead to false positives, and client side solutions like EAC which frustrate less skilled cheat developers and sometimes catch the more skilled ones off guard. Alternatively, give up on PC and focus on consoles which are sufficiently locked down that cheating is currently impossible regardless of how much you trust the client.
- kllrnohj 4y agoOr server-side automated review using machine learning models, which is what Valve is trying with "vacnet" (with then manual review to confirm the model's results are accurate - something most tech companies should learn from) Great talk on it here: https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc
- jsheard 4y agoIt's an interesting idea, but it's hard to say if it's really effective against anything besides blatant ragehacking. AFAICT the general consensus in the community is that Valves own CS:GO servers are still infested with cheaters, and to avoid them you need to go to ESEA or FACEIT (third party CS:GO matchmaking services) or Valorant (Riots CS:GO clone) which all primarily rely on very aggressive clientside scanning solutions.
- kllrnohj 4y agoI suspect for ESEA & FACEIT the most effective aspect of their anticheats is just that they are paid services. If I'm going to cheat at a game, I'm generally going to bias towards minimal consequences if I do get caught. I can say that Valorant's anti cheat is the singular reason I've never tried it, even though I love counter-strike and similar games. Giving game devs (especially those owned by Tencent) ring 0 access is, uh, a step too far I think.
- jsheard 4y agoValve took away the methods of getting into Prime Matchmaking without paying (you must pay $15 now) and it doesn't seem to have improved the situation much if at all. The ship has sailed on ring0 really, all of the major anticheat players plug into ring0 on Windows. If you play online games on Windows there's almost no avoiding it. Interestingly Proton acts as a loophole, EAC and BattlEye don't touch ring0 on Linux even though they do on Windows. Gamedevs have to opt-in to allowing Linux clients though.
- kllrnohj 4y agoFunnily enough I also stopped playing Destiny 2 when they added ring 0 requirements and primarily focus on single player games now :) If steam deck is successful enough I wonder how long until kernel modules become a requirement...
- jsheard 4y ago> If steam deck is successful enough I wonder how long until kernel modules become a requirement... Yeah, there's already Linux-specific cheats in the wild which abuse the fact that the Linux anticheats are oblivious to anything happening outside of the current user, so they can manipulate the games memory with complete impunity simply by doing it from root or a kernel module. Developers may become more hesitant to allow Linux clients as abuse becomes more common, unless the anticheats start extending into ring0 on Linux the same way they do on Windows.