7 ms·

I wonder, how would you design an anti-cheat protection? Would you fight for the privacy of cheaters?

ronsor 2y ago
Cheaters are bad, but it's not worth unreasonably harming everyone else to stop them. I wouldn't advocate for surveillance cameras in everyone's homes to reduce crime.
- jdietrich 2y ago
  Valorant took a massive amount of market share from CS:GO, in large part because of a very intrusive but highly effective anti-cheat system. Cheating in online games is a hard problem to solve and can make games completely unplayable. Gamers are generally much more bothered about cheating than about the privacy risks of anti-cheat, whether you agree with them or not. For the paranoid, dual-booting to a games-only OS image would be a reasonable choice.
  - bruce343434 2y ago
    In my experience game engines just suck. How can cheats exist in a server authoritative game engine architecture? But alas, most programmers have apparently no idea what they're doing when it comes to "netcode".
    - mentalfist 2y ago
      Sounds like in your experience, the time is ripe for you to revolutionise the incompetent game industry and solve all their simple problems!
      - bruce343434 2y ago
        I can't fix skill issues in others on a massive scale. I can not remove "crunch time" in the industry. I can not remove lack of care in others. Frankly, I was venting. Because sometimes all you can do is yell the wish for a better world into the void.
    - moe_sc 2y ago
      For performance reasons a lot of stuff has to also be calculated (and guessed) clientside (and corrected when discrepancies are found).
    - pynappo 2y ago
      It can be hard to differentiate between insane aim and clever aim assistance Wallhacks can be mitigated but can't be shut down completely. Valorant for example limits the information provided to clients based on pre-generated tile maps (for example, players in a tile won't have information about enemies on the other side of the map but will have information on the enemies on the adjacent tile within reasonable LoS) but wallhacks still exist because the LoS check has to be overly generous to account for ping and such
    - spartanatreyu 2y ago
      > In my experience game engines just suck. How can cheats exist in a server authoritative game engine architecture? But alas, most programmers have apparently no idea what they're doing when it comes to "netcode". This comment screams: I lack understanding and am overconfident because of it. Ignoring games where all state is known to all parties (e.g. chess, racing, etc...), the fact of the matter is that servers are basically always authoritative... where they can be. MOBAs, MMOs, RTSs, FPSs, Casino, etc... will all hide information not required to run the game on each client on the server to prevent cheaters from getting an advantage. Turn based games or games with low tick rates (MMOs, MOBAs, RTSs) will run all player commands on the server with things that require immediate feedback (UI actions, current player position, animation triggers) smeared out to sync with the server's state and tweened to match the server state. Fast paced games like racing sims will do client side determination with server side validation (to ensure that a player's speed never exceeds a certain value, turn speed/friction is inside a certain range, etc...). FPS games are the trickiest: - They can't do server side kill determination because the game requires a certain level of responsiveness that is faster than internet signals over fiber can allow for. So they use client-side kill determination that runs in real time with server side validation that runs when a server receives events from clients before passing those events to other players. For example: checking that a player didn't shoot another player through a wall, checking that another player wasn't moving too fast / through a wall / flying through the sky / etc... - Components that require randomness are split into what requires syncing between client/server and what doesn't. Things like particle systems, ragdolls, etc... are handled entirely on the client. Things like random rolls in stores are handled entirely on the server. Things like physics systems, and recoil are handled by seeded PRNGs that are run on the client for instant feedback and validated on the server side using that seed. - Depending on the type of FPS game, a client may need to see the positions of all (or a substantial amount) of the other player's characters. This is because a player may suddenly whip around the corner of a door and the client now seeing a new large area needs to be able to display the other characters in that area accurately without the characters only rendering by the time the server can inform the client of their position. This is mitigated by level design that can split a level into multiple chunks and the server only relaying the required info for the visible chunks. With extremely large levels where the groups of players are too far away to interact, the server can be sharded across multiple threads or offloaded to other servers. For types of FPS games that are built in a way that requires the server to not hold as much information hidden (e.g. an open arena level where everyone can see each-other anyway), the clients include replay systems where the players can report suspicious behavior. - Really tricky things like vehicle physics are usually done with a mix of client side determination, server side validation + redetermination, and careful client side state tweening. The fact of the matter is that cheaters are only a problem in: 1. A handful of games where the developers didn't do the right thing 2. Games where the only way they could ever be completely cheat-free would be on a physically impossible 0 latency network and instead they have to rely on mitigation instead of prevention where certain information can't be prevented from being available to clients. ---------------------------------------- Addendum: There is the possibility of hosting and processing hidden information client-side while keeping it hidden where needed by using homomorphic encryption but that requires a lot of processing power that's usually better spent on running the rest of the actual game, but it is something that more of the industry will be able to move towards as machines become more powerful.
    - bakugo 2y ago
      > How can cheats exist in a server authoritative game engine architecture I don't follow. How does the game being server-authoritative stop clients from running software that automatically aims at people's heads?
      - chainingsolid 2y ago
        It doesn't. But it does allow preventing stuff like like seeing through walls. Although it would have to fail around corners for a short distance so players don't pop into view. Server authoritative solves less and less cheating problems the more sensitive to latency the game is. Non twichy RTS games could not send everything in the fog of war for example, and after checking for super human input, you'd have solved a good chunk of cheats.
  - hobs 2y ago
    The problem is that games often install rootkits and the hackers are good enough to exploit those for RCE - just look at Apex Legends, they recently had active tournaments canceled because someone took over streamers boxes during live play - absolutely bonkers.
    - musjleman 2y ago
      it was the game itself that got exploited, not the anti-cheat that is a "rootkit".
  - squigz 2y ago
    > Valorant took a massive amount of market share from CS:GO It doesn't appear to have. https://steamcharts.com/app/730#All https://steamcharts.com/app/730#All
croes 2y ago
Would you sacrifice the privacy of all just to catch cheaters in a game?
- self_awareness 2y ago
  Yes.
  - purple-leafy 2y ago
    This is the common thinker folks. This is why we have no privacy anymore
littlestymaar 2y ago
1. The cheaters are a tiny minority, this is violating privacy of millions of people in order to catch a small group. 2. It doesn't even work!
throwaway81523 2y ago
You sort of can't. No idea about video games but it's a big issue for chess. Really top games (world championship) are played person to person in a sealed environment with moves relayed out of the room after a 15 or 30 minute time delay. Online games of any importance require you to set up TV cameras in your playing room, etc.
rincebrain 2y ago
Fundamentally, like with any defense in depth/security system, you need to accept you can't build a solution that stops all cheating, it's all about making the cost sufficiently high that it's so rare people have an acceptable online gameplay experience most of the time. So at each step, you weigh how much the cost is for the mitigation (in terms of upfront and ongoing dev costs, and player problems), and the benefit (in terms of how much higher you make the barrier). For example, conceptually, you could sell a dedicated machine that requires gov't ID and credit card linked to your account to purchase and melts down if you ever are detected tampering with it, requires a mic and camera on 24/7 to make sure you're not tampering with it once purchased, dies if it loses internet ever once turned on, etc etc, but then nobody is going to buy it because you have made the cost in terms of disruption to players too high for anyone to bother. I'm not sure you can usefully solve it other than trying to keep the barrier for entry higher than a lot of people will bother, and possibly making the barrier much higher for something like ranked play, b/c otherwise, if you do things like if you ever close their DRM after boot, you need to reboot to play the game, you're going to cannibalize your player base, because it's too much of a pain in the ass, and they will (correctly) blame you for this.

Cheaters are bad, but it's not worth unreasonably harming everyone else to stop them. I wouldn't advocate for surveillance cameras in everyone's homes to reduce crime.

jdietrich 2y ago
Valorant took a massive amount of market share from CS:GO, in large part because of a very intrusive but highly effective anti-cheat system. Cheating in online games is a hard problem to solve and can make games completely unplayable. Gamers are generally much more bothered about cheating than about the privacy risks of anti-cheat, whether you agree with them or not. For the paranoid, dual-booting to a games-only OS image would be a reasonable choice.
- bruce343434 2y ago
  In my experience game engines just suck. How can cheats exist in a server authoritative game engine architecture? But alas, most programmers have apparently no idea what they're doing when it comes to "netcode".
  - mentalfist 2y ago
    Sounds like in your experience, the time is ripe for you to revolutionise the incompetent game industry and solve all their simple problems!
    - bruce343434 2y ago
      I can't fix skill issues in others on a massive scale. I can not remove "crunch time" in the industry. I can not remove lack of care in others. Frankly, I was venting. Because sometimes all you can do is yell the wish for a better world into the void.
  - moe_sc 2y ago
    For performance reasons a lot of stuff has to also be calculated (and guessed) clientside (and corrected when discrepancies are found).
  - pynappo 2y ago
    It can be hard to differentiate between insane aim and clever aim assistance Wallhacks can be mitigated but can't be shut down completely. Valorant for example limits the information provided to clients based on pre-generated tile maps (for example, players in a tile won't have information about enemies on the other side of the map but will have information on the enemies on the adjacent tile within reasonable LoS) but wallhacks still exist because the LoS check has to be overly generous to account for ping and such
  - spartanatreyu 2y ago
    > In my experience game engines just suck. How can cheats exist in a server authoritative game engine architecture? But alas, most programmers have apparently no idea what they're doing when it comes to "netcode". This comment screams: I lack understanding and am overconfident because of it. Ignoring games where all state is known to all parties (e.g. chess, racing, etc...), the fact of the matter is that servers are basically always authoritative... where they can be. MOBAs, MMOs, RTSs, FPSs, Casino, etc... will all hide information not required to run the game on each client on the server to prevent cheaters from getting an advantage. Turn based games or games with low tick rates (MMOs, MOBAs, RTSs) will run all player commands on the server with things that require immediate feedback (UI actions, current player position, animation triggers) smeared out to sync with the server's state and tweened to match the server state. Fast paced games like racing sims will do client side determination with server side validation (to ensure that a player's speed never exceeds a certain value, turn speed/friction is inside a certain range, etc...). FPS games are the trickiest: - They can't do server side kill determination because the game requires a certain level of responsiveness that is faster than internet signals over fiber can allow for. So they use client-side kill determination that runs in real time with server side validation that runs when a server receives events from clients before passing those events to other players. For example: checking that a player didn't shoot another player through a wall, checking that another player wasn't moving too fast / through a wall / flying through the sky / etc... - Components that require randomness are split into what requires syncing between client/server and what doesn't. Things like particle systems, ragdolls, etc... are handled entirely on the client. Things like random rolls in stores are handled entirely on the server. Things like physics systems, and recoil are handled by seeded PRNGs that are run on the client for instant feedback and validated on the server side using that seed. - Depending on the type of FPS game, a client may need to see the positions of all (or a substantial amount) of the other player's characters. This is because a player may suddenly whip around the corner of a door and the client now seeing a new large area needs to be able to display the other characters in that area accurately without the characters only rendering by the time the server can inform the client of their position. This is mitigated by level design that can split a level into multiple chunks and the server only relaying the required info for the visible chunks. With extremely large levels where the groups of players are too far away to interact, the server can be sharded across multiple threads or offloaded to other servers. For types of FPS games that are built in a way that requires the server to not hold as much information hidden (e.g. an open arena level where everyone can see each-other anyway), the clients include replay systems where the players can report suspicious behavior. - Really tricky things like vehicle physics are usually done with a mix of client side determination, server side validation + redetermination, and careful client side state tweening. The fact of the matter is that cheaters are only a problem in: 1. A handful of games where the developers didn't do the right thing 2. Games where the only way they could ever be completely cheat-free would be on a physically impossible 0 latency network and instead they have to rely on mitigation instead of prevention where certain information can't be prevented from being available to clients. ---------------------------------------- Addendum: There is the possibility of hosting and processing hidden information client-side while keeping it hidden where needed by using homomorphic encryption but that requires a lot of processing power that's usually better spent on running the rest of the actual game, but it is something that more of the industry will be able to move towards as machines become more powerful.
  - bakugo 2y ago
    > How can cheats exist in a server authoritative game engine architecture I don't follow. How does the game being server-authoritative stop clients from running software that automatically aims at people's heads?
    - chainingsolid 2y ago
      It doesn't. But it does allow preventing stuff like like seeing through walls. Although it would have to fail around corners for a short distance so players don't pop into view. Server authoritative solves less and less cheating problems the more sensitive to latency the game is. Non twichy RTS games could not send everything in the fog of war for example, and after checking for super human input, you'd have solved a good chunk of cheats.
- hobs 2y ago
  The problem is that games often install rootkits and the hackers are good enough to exploit those for RCE - just look at Apex Legends, they recently had active tournaments canceled because someone took over streamers boxes during live play - absolutely bonkers.
  - musjleman 2y ago
    it was the game itself that got exploited, not the anti-cheat that is a "rootkit".
- squigz 2y ago
  > Valorant took a massive amount of market share from CS:GO It doesn't appear to have. https://steamcharts.com/app/730#All https://steamcharts.com/app/730#All

croes 2y ago

Would you sacrifice the privacy of all just to catch cheaters in a game?

self_awareness 2y ago
Yes.
- purple-leafy 2y ago
  This is the common thinker folks. This is why we have no privacy anymore

littlestymaar 2y ago

1. The cheaters are a tiny minority, this is violating privacy of millions of people in order to catch a small group. 2. It doesn't even work!

throwaway81523 2y ago

You sort of can't. No idea about video games but it's a big issue for chess. Really top games (world championship) are played person to person in a sealed environment with moves relayed out of the room after a 15 or 30 minute time delay. Online games of any importance require you to set up TV cameras in your playing room, etc.

rincebrain 2y ago

Fundamentally, like with any defense in depth/security system, you need to accept you can't build a solution that stops all cheating, it's all about making the cost sufficiently high that it's so rare people have an acceptable online gameplay experience most of the time. So at each step, you weigh how much the cost is for the mitigation (in terms of upfront and ongoing dev costs, and player problems), and the benefit (in terms of how much higher you make the barrier). For example, conceptually, you could sell a dedicated machine that requires gov't ID and credit card linked to your account to purchase and melts down if you ever are detected tampering with it, requires a mic and camera on 24/7 to make sure you're not tampering with it once purchased, dies if it loses internet ever once turned on, etc etc, but then nobody is going to buy it because you have made the cost in terms of disruption to players too high for anyone to bother. I'm not sure you can usefully solve it other than trying to keep the barrier for entry higher than a lot of people will bother, and possibly making the barrier much higher for something like ranked play, b/c otherwise, if you do things like if you ever close their DRM after boot, you need to reboot to play the game, you're going to cannibalize your player base, because it's too much of a pain in the ass, and they will (correctly) blame you for this.