3 ms·

Anti-cheat is physically an uphill battle, because, in the end, it's all just numbers. Anti-cheat is basically trying to say "you can send these numbers but you

by jerf 2y ago

Anti-cheat is physically an uphill battle, because, in the end, it's all just numbers. Anti-cheat is basically trying to say "you can send these numbers but you can't send those numbers". But I can send "those" numbers. I can send any numbers I want. You can make it difficult to send the right numbers, but I've got your numbers that describe how to send the numbers right in front of me, which is a rather large help. That's not to say it's hopeless. Sibling comments point out various options that can be run purely server-side. But there's no perfect solution. Even cloud gaming can't prevent cheating because I can take the resulting video stream and run computer vision algorithms on it and still send wrong-numbers back up as my input stream. This may not let me see through walls but is still plenty to implement an aimbot, for instance. Push it into a DRM'd device and I can grab the HDMI stream and hack apart my controller to directly apply voltages to the controller. DRM the HDMI stream and I can point a camera at my TV. Detect my aimbot through machine learning and I can put together a machine learning network with a few hundred of my buddies to precisely characterize the thresholds the server is using and stay below them while still having a cheat system that plays better than I do. And so forth. (And do not underestimate the extent that people will go to to cheat. I don't really consider "get together with a hundred of my buddies and use machine learning to characterize your machine learning ban algorithm" to be something that could not happen. The amount of effort people will put into cheating is not bounded by your credulity. Weirder things have already happened.) The deck is fundamentally stacked against preventing cheating. You can certainly take a bite out of it but precisely hitting the exact right contour to exactly nail the cheaters and never hit anyone by mistake is effectively impossible.

sillysaurusx 2y ago
It always seemed strange that anticheat wasn’t based on statistics. If you send too many number Ns, then you get banned. Then tuning the false positive rate is an exercise for an ML model. It won’t work perfectly, or perhaps even well, but maybe it’d work well enough to avoid rooting your customers’ PCs.
- FreakLegion 2y ago
  The ones I'm familiar with (e.g. Riot's) do use statistics, along with just about anything else you can think of. Code that does nothing but act as a honeypot for cheaters? Of course that's a thing. I'm actually surprised that people focus so much on the kernel part given the scale of the data collection, though the collected data is pretty innocuous.

by jerf 2y ago

sillysaurusx 2y ago

It always seemed strange that anticheat wasn’t based on statistics. If you send too many number Ns, then you get banned. Then tuning the false positive rate is an exercise for an ML model. It won’t work perfectly, or perhaps even well, but maybe it’d work well enough to avoid rooting your customers’ PCs.

FreakLegion 2y ago
The ones I'm familiar with (e.g. Riot's) do use statistics, along with just about anything else you can think of. Code that does nothing but act as a honeypot for cheaters? Of course that's a thing. I'm actually surprised that people focus so much on the kernel part given the scale of the data collection, though the collected data is pretty innocuous.