3 ms·

Be very careful about open sourcing a game, especially if it is multi-player. Because people cheat. A lot.

by far33d 18y ago

palish 18y ago
Yeah, very true. I have an idea about how to detect cheaters, if you want to hear about it. Basically, I think the way to detect whether someone is cheating in an online game is by applying spam filtering techniques. First consider that every server-side game state (like a player's position in the game world) can be considered a statistic. So for example, a history of a player's speed at points in time would have certain maximums. (i.e. "players don't usually move at 500MPH. And if they do, they only do so for very short periods of time.") Therefore, by definition, a cheater is a player whose statistics are significantly different from the norm. A speedhacker could be detected because his max speed would become way above the "typical" maximum player speed over a significant amount of time (like, he begins to run at 500MPH for 2 solid minutes). So we can then boil the problem of detecting cheaters down to evaluating probabilities (which is the same way spam email is identified). This type of system would also handle the case where there's a game bug that accidentally causes players to run fast -- the system won't accidentally boot everyone, because everyone is now running fast, so therefore that fast movement speed becomes "normal". Now let me point out that the very same thing could be accomplished much more simply by just writing code to boot players when their speed exceeds a certain hard-coded maximum global speed, then being very careful to not introduce a superacceleration bug. However, that's special-case code, which should typically be avoided. It also doesn't take into consideration that a player's speed could legally be significantly accelerated for a short period of time by physics, for example, or for a number of other reasons. The idea is to analyze samples of a number of different game statistics, then boot any player whose maximum statistic value significantly exceeds the normal maximum value over a significant amount of time. This type of system would prevent a situation where a cheater discovers how to manipulate the timing variables in packets, then tricks the server into thinking he's moving faster than he actually should be. (I believe Counter-Strike: Source is still affected by that particular speedhack problem.) We would also be able to detect and ban players using aimbots, because it is very statistically significant for a player to murder 20 opponents in 10 seconds, for example. So if people modify the client to cheat, the server will identify and ban them. Godda love probabilities and statistics.
- DaniFong 18y ago
  I think it would still be hard to catch cheaters who pushed the limit in ways that are difficult to measure, for example, 'map-hacks', or 'aim-bots'. How can you tell if someone is cheating or is merely so good that they have a preternatural sense of the game? And if people know what the statistical checks are, by virtue of them being open source, why can't they push the limits while still staying well away from what's detectable as 'bootable cheating?'
  - palish 18y ago
    They could. And cheaters using "sensor hacks" or "map hacks" can't be detected server-side because those hacks just provide information to the cheater client-side, without actually affecting gameplay directly (they don't alter the cheater's speed, aim, etc). But the way to beat those type of hacks is to minimize the amount of information the server sends to the client. If an opponent is just around the corner, then that fact shouldn't be transmitted to the client until the client is just about to turn that corner. So the client-side "sensor hacks" aren't very useful in that regard because the cheater isn't actually receiving extra information until it's basically too late to act on it. But here's the thing. The goal is not to detect all cheaters. That's not really possible. The goal is to eliminate all seriously disruptive cheaters. For example, the guys who run around with a speedhack plus an aimbot and annihilate every opponent in just a few seconds. That would quickly ruin the game, so those are the most important type of hacks to prevent. And I could just let the community report each offense then ban the cheater afterward, but that doesn't really scale, and at that point the cheater might have already ruined the game for a lot of people. So it would be advantageous to implement a way to detect cheaters realtime. The server-side anti-cheat code would remain closed-source, so it wouldn't be known which probabilities were being monitored. Other parts of the server code also have to remain closed-source, actually, because otherwise people would be able to examine the game's rules to gain tactical knowledge. (i.e. a player could read the game rules source code to learn where and when creatures will spawn, then that player would go around and camp all the right spots to gain maximum benefit.) However, that's a fundamentally different motivation for keeping the source code closed. At that point, it's not closed because we're worried about the competition; it's closed to ensure that the game will stay enjoyable. So that type of thing doesn't seem like it would go against the spirit of open-source. Consider this -- if people are cheating by pushing their statistics to the point just before they would get banned, then those cheats don't actually impact other players very much, because the cheater's statistics are still within acceptable ranges. At that point, the cheaters are using the cheats so infrequently that they don't statistically affect gameplay. So in that regard, it isn't necessarily worth the extra effort to stop them, because the goal of enforcing reasonable gameplay statistics has been achieved, so the overall game experience is mostly fine from other players' point of view. Also, your blog posts are great. Please keep on writing them. One specific part of your writing I'm interested in is this: "Increasing my effective working memory has an impressively super-linear effect on my problem solving ability, how fast I can learn things, and also how much fun I’m having." I have working memory problems, so it would be really fantastic to learn how you improved yours. I didn't know it was even possible to do that.

Be very careful about open sourcing a game, especially if it is multi-player. Because people cheat. A lot.

by far33d 18y ago

Be very careful about open sourcing a game, especially if it is multi-player. Because people cheat. A lot.

Yeah, very true. I have an idea about how to detect cheaters, if you want to hear about it. Basically, I think the way to detect whether someone is cheating in an online game is by applying spam filtering techniques. First consider that every server-side game state (like a player's position in the game world) can be considered a statistic. So for example, a history of a player's speed at points in time would have certain maximums. (i.e. "players don't usually move at 500MPH. And if they do, they only do so for very short periods of time.") Therefore, by definition, a cheater is a player whose statistics are significantly different from the norm. A speedhacker could be detected because his max speed would become way above the "typical" maximum player speed over a significant amount of time (like, he begins to run at 500MPH for 2 solid minutes). So we can then boil the problem of detecting cheaters down to evaluating probabilities (which is the same way spam email is identified). This type of system would also handle the case where there's a game bug that accidentally causes players to run fast -- the system won't accidentally boot everyone, because everyone is now running fast, so therefore that fast movement speed becomes "normal". Now let me point out that the very same thing could be accomplished much more simply by just writing code to boot players when their speed exceeds a certain hard-coded maximum global speed, then being very careful to not introduce a superacceleration bug. However, that's special-case code, which should typically be avoided. It also doesn't take into consideration that a player's speed could legally be significantly accelerated for a short period of time by physics, for example, or for a number of other reasons. The idea is to analyze samples of a number of different game statistics, then boot any player whose maximum statistic value significantly exceeds the normal maximum value over a significant amount of time. This type of system would prevent a situation where a cheater discovers how to manipulate the timing variables in packets, then tricks the server into thinking he's moving faster than he actually should be. (I believe Counter-Strike: Source is still affected by that particular speedhack problem.) We would also be able to detect and ban players using aimbots, because it is very statistically significant for a player to murder 20 opponents in 10 seconds, for example. So if people modify the client to cheat, the server will identify and ban them. Godda love probabilities and statistics.

DaniFong 18y ago
I think it would still be hard to catch cheaters who pushed the limit in ways that are difficult to measure, for example, 'map-hacks', or 'aim-bots'. How can you tell if someone is cheating or is merely so good that they have a preternatural sense of the game? And if people know what the statistical checks are, by virtue of them being open source, why can't they push the limits while still staying well away from what's detectable as 'bootable cheating?'
- palish 18y ago
  They could. And cheaters using "sensor hacks" or "map hacks" can't be detected server-side because those hacks just provide information to the cheater client-side, without actually affecting gameplay directly (they don't alter the cheater's speed, aim, etc). But the way to beat those type of hacks is to minimize the amount of information the server sends to the client. If an opponent is just around the corner, then that fact shouldn't be transmitted to the client until the client is just about to turn that corner. So the client-side "sensor hacks" aren't very useful in that regard because the cheater isn't actually receiving extra information until it's basically too late to act on it. But here's the thing. The goal is not to detect all cheaters. That's not really possible. The goal is to eliminate all seriously disruptive cheaters. For example, the guys who run around with a speedhack plus an aimbot and annihilate every opponent in just a few seconds. That would quickly ruin the game, so those are the most important type of hacks to prevent. And I could just let the community report each offense then ban the cheater afterward, but that doesn't really scale, and at that point the cheater might have already ruined the game for a lot of people. So it would be advantageous to implement a way to detect cheaters realtime. The server-side anti-cheat code would remain closed-source, so it wouldn't be known which probabilities were being monitored. Other parts of the server code also have to remain closed-source, actually, because otherwise people would be able to examine the game's rules to gain tactical knowledge. (i.e. a player could read the game rules source code to learn where and when creatures will spawn, then that player would go around and camp all the right spots to gain maximum benefit.) However, that's a fundamentally different motivation for keeping the source code closed. At that point, it's not closed because we're worried about the competition; it's closed to ensure that the game will stay enjoyable. So that type of thing doesn't seem like it would go against the spirit of open-source. Consider this -- if people are cheating by pushing their statistics to the point just before they would get banned, then those cheats don't actually impact other players very much, because the cheater's statistics are still within acceptable ranges. At that point, the cheaters are using the cheats so infrequently that they don't statistically affect gameplay. So in that regard, it isn't necessarily worth the extra effort to stop them, because the goal of enforcing reasonable gameplay statistics has been achieved, so the overall game experience is mostly fine from other players' point of view. Also, your blog posts are great. Please keep on writing them. One specific part of your writing I'm interested in is this: "Increasing my effective working memory has an impressively super-linear effect on my problem solving ability, how fast I can learn things, and also how much fun I’m having." I have working memory problems, so it would be really fantastic to learn how you improved yours. I didn't know it was even possible to do that.