6 ms·

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making W

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Xunjin 2y ago
Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.
- TonyTrapp 2y ago
  Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.
  - Xunjin 2y ago
    Excellent point, how do you see today the industry, security wise?
agoodusername63 2y ago
Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shipping online games. But I'm also kind of disappointed in how much we're forgetting that these people are not infosec nerds. Last year there was a cute fishing game made by a single dude messing around making things. It got popular and a kid found an RCE bug with the multiplayer. The dude got a TON of shit for the flaw, which feels deeply unfair. I don't expect my mom to configure a router correctly. I don't expect video game developers to understand defensive network programming without training. Maybe I'm just a little frustrated at the Internet largely unable to understand that defensive programming is something that isn't in a game devs trained skills. I would expect better of Netease however
- gruez 2y ago
  >These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?
  - sbarre 2y ago
    I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/multiplayer might not be relevant every single time you ship a game. So it's less relevant (if still important)
    - Sleaker 2y ago
      This isn't really true, game devs have had to deal with client-server authenticity issues since the beginning of multiplayer gaming. There's a lot of lessons learned around and why there's whole sets of middleware designed to alleviate/lessen these issues. For as long as multiplayer games have been around this has been an issue. The impact ie: RCE vs just ruining the game experience may be different but the concepts are all the same- adversarial clients. The excuses you listed aren't any different for business apps.
    - skeeter2020 2y ago
      There are no triple A games today that doesn't run in a networked/internet environment, and your code lives on the hostile user; this seems like an even bigger risk than a web app.
      - sbarre 2y ago
        AAA game are a small fraction of the whole games market though (and there are still plenty that don't have multiplayer - Cyberpunk 2077 comes to mind, or the Horizon games, lots of mobile games, etc). Like I said in the other reply, I am not arguing against the need for security, I am saying a lot of game developers don't get, or seek out, security training because single player local games don't have the same network-driven risks.
devmor 2y ago
Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice. I wouldn't expect anything but code that "ships" out of them, and its understandable why.
- pyrolistical 2y ago
  There needs to be at least 1 person to figure out why the game isn’t hitting the performance target. That is real engineering
  - DrillShopper 2y ago
    With DLSS nobody bothers anymore. Just force the punters to buy an overpriced video card and then poor-shame them if they don't
  - mrguyorama 2y ago
    In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor. Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once. A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both Nvidia and AMD patch game shaders at runtime to keep things from being unusable, and hack around broken behavior or wrong usage of APIs. It's exactly reminiscent of the situation Windows 95 had when all sorts of popular programs couldn't even save interrupt flags properly because they straight up did not read the manual which had many sentences and code fragments demonstrating that what they wrote would not work. Also, Titanfall 1 shipped with like 30gb of uncompressed audio. They did this to "reduce CPU load". In 2014.
    - maccard 2y ago
      Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gigabit WiFi, and hangs on scroll. Reddit can’t handle more than one tab open. Slack uses more ram than the game im developing sometimes. Even HN still falls flat on its face with a “moderately” popular link, and can’t handle it if you perform too many operations. > A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. This is because nvidia and AMD offer this as service but without access to your codebase. The days of them being required to function are long behind us. > Titanfall 1 shipped with like 30gb of uncompressed audio. They did this to "reduce CPU load". In 2014. As I’ve said many times, you might disagree but it was intentional. The Xbox one was an 8x1. 75GHz CPU, and some of that was reserved for system use All software is shit, and held together by duct tape. All industries have products that we can point at and call a disgrace - it’s not games that are the problem.
cubefox 2y ago
> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!
- 0cf8612b2e1e 2y ago
  And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.
  - creaturemachine 2y ago
    I dunno, lately they're more interested in pointing you to the store page for skins and loot boxes.
    - ykonstant 2y ago
      True, but even the most vile loot box filled triple A slop game has better UI than the atrocities the OP refers to. At least there you can see some decent density of information and a hint of three-dimensionality, which is more than you can say about the "clean UI" desert landscape.
  - ykonstant 2y ago
    Preach. I often point towards games for examples of good balance of density, as well as elements of modern-looking skeuomorphism in UI. Of course I get all the usual garbage non-arguments in response from designers who don't want to take up a challenge and actually design, and instead fall back on a "tried and true" (except it is shit) fashion.
  - tpxl 2y ago
    Some games, sure, most games, no. There are tons of games out there with dialog options that don't support choosing with numbers, a ton of games where you can't quickloot/drop with shift-click, comparing equipment is a chore, confirmation screens don't have y/enter to confirm or n/esc to cancel, missing/useless tooltips, custom fonts that are unreadable... These things are _trivial_ to implement, it's just nobody thinks about the UI as long as it 'works'.
Thaxll 2y ago
It's not more rotten that your regular backend shop. How many api issues / auth problems / s3 open bucket there are out there exactly?
- bobnamob 2y ago
  s3 open bucket syndrome is basically cured at this point. (Aside from legacy buckets, which should all be exploited by now) The "yes I really want to do this" confirmations you need to go through when opening up a bucket these days are about 4 deep... Authn/z issues are real though, they'll never be fixed
bilekas 2y ago
I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game. > the game runs with admin privileges for the sake of anti-cheat Nobody higher than the devs thought “this might be risky?” Because can assure you, the devs felt it stupid and risky. Your “Everyone thinks their making doom 3”. As I see this is not the developer fault.
- bongodongobob 2y ago
  I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.
  - idiotsecant 2y ago
    No, it's because the average IT infrastructure is abysmal and getting things done without admin is it's own full-time job filing and following up on tickets and trying to plead your case for the ten thousandth time to the exalted security dieties that you just want to do your job gets old. Am i bitter? Nah
    - bongodongobob 2y ago
      Totally get it dude.
  - bilekas 2y ago
    This is a different case, if I don’t have permission to talk to the graphics card, sound card, even ram, I’m a restricted engineer. > I believe they don’t get it/don’t care. You’re right, anything that’s not obstructive is never worried about. To me that says you’re doing a good job giving permissions, it’s also your job to manage those permissions, not the developers.. > It's just not their wheelhouse. Your absolute bang on. And I can say from experience, it’s good you guys are there.
TeMPOraL 2y ago
The problem in big part stems from the business culture upstream. They're trying to produce a game, but what they're really after is e-sports money. They design multiplayer to be about organized pro play, which brings in all the cheating problems of professional sports, so they end up subjecting every player to e-sports-grade security like those anti-cheat systems, despite 99.9% of the player base not caring about pro play in the first place. This is the worst possible combination: players are forced to accept first-party invasive rootkits that are disruptive and ineffective, while cheaters still cheat. IMHO the only sensible solution is to separate out e-sports angle from the game itself. People who want to "go pro" would be free to subject themselves to anti-cheats and drinking verification cans and past some point might as well buy company-authorized computers to play on. Everyone else should just be allowed to play casually and enjoy the game without the anti-cheat nuisance (and a looming threat of false positive). With main incentive for serious cheating separated out, non-pro players would only have to worry about griefers. Those are a problem too, but they can be dealt with by simpler and less invasive measures than a kernel-level rootkit. As it is, AAA multiplayer games are basically like if FIFA was to micromanage Town Recreational Leagues and hold them to the World Cup standard, because cheating is a Big Deal so every kid needs to take regular blood tests before the match.
- ThatMedicIsASpy 2y ago
  Nobody wants to play multiplayer (only) games with cheaters. It is that simple. Esports money...? Micro transactions is the money. Publisher driven esports is advertising.
  - TeMPOraL 2y ago
    Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it. > Publisher driven esports is advertising. Yes, of course. E-sports is advertising. All professional sports are advertising. That's what makes money. Sales of tickets, merch, guides, coverage, etc. A successful sport is a self-sustaining money printing machine. Now, traditional sports are "frozen in time" relative to business timescales; meanwhile, in e-sports, it's entirely possible for a company to introduce a new game and turn it into a worldwide phenomenon over a couple of years, and then keep getting a cut from aforementioned money printer for many more years still, all while trying to introduce a new game to keep the money running. And it's okay, I honestly don't mind. As far as the advertising-driven economy goes, sports (traditional or otherwise) is one of the more benign fields. The problem I see is the relentless focus on building a game optimized for professional play ruins it for vast majority of players, and I fail to see why companies keep doing it instead of bifurcating the multiplayer aspect into "casual play" and "pro play", allowing for the latter while also letting the former have their fun. > Nobody wants to play multiplayer (only) games with cheaters. My point is that most of the cheating comes from structuring the game around pro-play. You get a global ladder, which establishes an ordinal ranking that invites cheaters who just want to score higher for less effort. All those cheaters end up ruining the game for regular people, who don't care that much about the ranking. Most of those cheaters would go away if the ladder was removed - but that ladder is critical to the company and wannabe progamers precisely because the top levels of that ladder are a gateway to pro-level play. You can't eliminate all cheating - there's always some people who, for whatever reason, enjoy ruining the game for others. Fortunately, such people are a very small fraction of the playerbase, and most of them don't enjoy it enough to bother if you throw some small obstacles their way. It's manageable. Competitive rankings, on the other hand, are something cheaters love much more than regular players, so by adding it, you're basically creating the problem. This is true for all competitive endeavors - the bigger the reward, the more it attracts competitive players, some of which are going to resort to cheating, and attempts at fighting cheating further ruin things for those who don't care about competing in the first place. And yes, it applies to the market economy too.
maccard 2y ago
It’s definitely games that are the problem. There’s no way that websites are still embedding third party code that is just slopped together shit and wildly vulnerable [0]. Or that domain registrars, one of the core points of trust of the internet would lie about their security practices and be sued by the FTC almost a decade after it[1]. Or that an endpoint management system would take down multiple airports due to basic bounds checks missing [2]. How about a massive software company used by huge enterprises for storing their knowledge bases having an RCE [3]. A global CDN definitely wouldn’t break DNS and take down half the internet [4]. Now you might say, those companies are irresponsible and that well maintained open source software doesn’t have this issue. That would mean no 0 days for linux [5], and that the most battle tested libraries in the world are immune from basic issues [6][7]. Software engineering is broken, it’s not just games. (Although, if you think physical construction is any better I suggest you stick a T square in the corners of your house and figure out how many of your walls aren’t square ). You [0] https://mrbruh.com/chattr/ https://mrbruh.com/chattr/ [1] https://news.ycombinator.com/item?id=42849632 https://news.ycombinator.com/item?id=42849632 [2] https://en.m.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages https://en.m.wikipedia.org/wiki/2024_CrowdStrike-related_IT_... [3] https://www.csoonline.com/article/2138177/atlassians-confluence-hit-with-critical-remote-code-execution-bugs.html/amp/ https://www.csoonline.com/article/2138177/atlassians-conflue... [4] https://techcrunch.com/2021/07/22/a-dns-outage-just-took-down-a-good-chunk-of-the-internet/ https://techcrunch.com/2021/07/22/a-dns-outage-just-took-dow... [5] https://www.indusface.com/blog/rce-zero-day-vulnerabilities-linux-systems https://www.indusface.com/blog/rce-zero-day-vulnerabilities-... [6] https://en.m.wikipedia.org/wiki/Log4Shell https://en.m.wikipedia.org/wiki/Log4Shell [7] https://heartbleed.com/ https://heartbleed.com/

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Xunjin 2y ago

Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.

TonyTrapp 2y ago
Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.
- Xunjin 2y ago
  Excellent point, how do you see today the industry, security wise?

agoodusername63 2y ago

Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shipping online games. But I'm also kind of disappointed in how much we're forgetting that these people are not infosec nerds. Last year there was a cute fishing game made by a single dude messing around making things. It got popular and a kid found an RCE bug with the multiplayer. The dude got a TON of shit for the flaw, which feels deeply unfair. I don't expect my mom to configure a router correctly. I don't expect video game developers to understand defensive network programming without training. Maybe I'm just a little frustrated at the Internet largely unable to understand that defensive programming is something that isn't in a game devs trained skills. I would expect better of Netease however

gruez 2y ago
>These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?
- sbarre 2y ago
  I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/multiplayer might not be relevant every single time you ship a game. So it's less relevant (if still important)
  - Sleaker 2y ago
    This isn't really true, game devs have had to deal with client-server authenticity issues since the beginning of multiplayer gaming. There's a lot of lessons learned around and why there's whole sets of middleware designed to alleviate/lessen these issues. For as long as multiplayer games have been around this has been an issue. The impact ie: RCE vs just ruining the game experience may be different but the concepts are all the same- adversarial clients. The excuses you listed aren't any different for business apps.
  - skeeter2020 2y ago
    There are no triple A games today that doesn't run in a networked/internet environment, and your code lives on the hostile user; this seems like an even bigger risk than a web app.
    - sbarre 2y ago
      AAA game are a small fraction of the whole games market though (and there are still plenty that don't have multiplayer - Cyberpunk 2077 comes to mind, or the Horizon games, lots of mobile games, etc). Like I said in the other reply, I am not arguing against the need for security, I am saying a lot of game developers don't get, or seek out, security training because single player local games don't have the same network-driven risks.

devmor 2y ago

Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice. I wouldn't expect anything but code that "ships" out of them, and its understandable why.

pyrolistical 2y ago
There needs to be at least 1 person to figure out why the game isn’t hitting the performance target. That is real engineering
- DrillShopper 2y ago
  With DLSS nobody bothers anymore. Just force the punters to buy an overpriced video card and then poor-shame them if they don't
- mrguyorama 2y ago
  In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor. Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once. A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both Nvidia and AMD patch game shaders at runtime to keep things from being unusable, and hack around broken behavior or wrong usage of APIs. It's exactly reminiscent of the situation Windows 95 had when all sorts of popular programs couldn't even save interrupt flags properly because they straight up did not read the manual which had many sentences and code fragments demonstrating that what they wrote would not work. Also, Titanfall 1 shipped with like 30gb of uncompressed audio. They did this to "reduce CPU load". In 2014.
  - maccard 2y ago
    Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gigabit WiFi, and hangs on scroll. Reddit can’t handle more than one tab open. Slack uses more ram than the game im developing sometimes. Even HN still falls flat on its face with a “moderately” popular link, and can’t handle it if you perform too many operations. > A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. This is because nvidia and AMD offer this as service but without access to your codebase. The days of them being required to function are long behind us. > Titanfall 1 shipped with like 30gb of uncompressed audio. They did this to "reduce CPU load". In 2014. As I’ve said many times, you might disagree but it was intentional. The Xbox one was an 8x1. 75GHz CPU, and some of that was reserved for system use All software is shit, and held together by duct tape. All industries have products that we can point at and call a disgrace - it’s not games that are the problem.

cubefox 2y ago

> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!

0cf8612b2e1e 2y ago
And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.
- creaturemachine 2y ago
  I dunno, lately they're more interested in pointing you to the store page for skins and loot boxes.
  - ykonstant 2y ago
    True, but even the most vile loot box filled triple A slop game has better UI than the atrocities the OP refers to. At least there you can see some decent density of information and a hint of three-dimensionality, which is more than you can say about the "clean UI" desert landscape.
- ykonstant 2y ago
  Preach. I often point towards games for examples of good balance of density, as well as elements of modern-looking skeuomorphism in UI. Of course I get all the usual garbage non-arguments in response from designers who don't want to take up a challenge and actually design, and instead fall back on a "tried and true" (except it is shit) fashion.
- tpxl 2y ago
  Some games, sure, most games, no. There are tons of games out there with dialog options that don't support choosing with numbers, a ton of games where you can't quickloot/drop with shift-click, comparing equipment is a chore, confirmation screens don't have y/enter to confirm or n/esc to cancel, missing/useless tooltips, custom fonts that are unreadable... These things are _trivial_ to implement, it's just nobody thinks about the UI as long as it 'works'.

Thaxll 2y ago

It's not more rotten that your regular backend shop. How many api issues / auth problems / s3 open bucket there are out there exactly?

bobnamob 2y ago
s3 open bucket syndrome is basically cured at this point. (Aside from legacy buckets, which should all be exploited by now) The "yes I really want to do this" confirmations you need to go through when opening up a bucket these days are about 4 deep... Authn/z issues are real though, they'll never be fixed

bilekas 2y ago

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game. > the game runs with admin privileges for the sake of anti-cheat Nobody higher than the devs thought “this might be risky?” Because can assure you, the devs felt it stupid and risky. Your “Everyone thinks their making doom 3”. As I see this is not the developer fault.

bongodongobob 2y ago
I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.
- idiotsecant 2y ago
  No, it's because the average IT infrastructure is abysmal and getting things done without admin is it's own full-time job filing and following up on tickets and trying to plead your case for the ten thousandth time to the exalted security dieties that you just want to do your job gets old. Am i bitter? Nah
  - bongodongobob 2y ago
    Totally get it dude.
- bilekas 2y ago
  This is a different case, if I don’t have permission to talk to the graphics card, sound card, even ram, I’m a restricted engineer. > I believe they don’t get it/don’t care. You’re right, anything that’s not obstructive is never worried about. To me that says you’re doing a good job giving permissions, it’s also your job to manage those permissions, not the developers.. > It's just not their wheelhouse. Your absolute bang on. And I can say from experience, it’s good you guys are there.

TeMPOraL 2y ago

The problem in big part stems from the business culture upstream. They're trying to produce a game, but what they're really after is e-sports money. They design multiplayer to be about organized pro play, which brings in all the cheating problems of professional sports, so they end up subjecting every player to e-sports-grade security like those anti-cheat systems, despite 99.9% of the player base not caring about pro play in the first place. This is the worst possible combination: players are forced to accept first-party invasive rootkits that are disruptive and ineffective, while cheaters still cheat. IMHO the only sensible solution is to separate out e-sports angle from the game itself. People who want to "go pro" would be free to subject themselves to anti-cheats and drinking verification cans and past some point might as well buy company-authorized computers to play on. Everyone else should just be allowed to play casually and enjoy the game without the anti-cheat nuisance (and a looming threat of false positive). With main incentive for serious cheating separated out, non-pro players would only have to worry about griefers. Those are a problem too, but they can be dealt with by simpler and less invasive measures than a kernel-level rootkit. As it is, AAA multiplayer games are basically like if FIFA was to micromanage Town Recreational Leagues and hold them to the World Cup standard, because cheating is a Big Deal so every kid needs to take regular blood tests before the match.

ThatMedicIsASpy 2y ago
Nobody wants to play multiplayer (only) games with cheaters. It is that simple. Esports money...? Micro transactions is the money. Publisher driven esports is advertising.
- TeMPOraL 2y ago
  Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it. > Publisher driven esports is advertising. Yes, of course. E-sports is advertising. All professional sports are advertising. That's what makes money. Sales of tickets, merch, guides, coverage, etc. A successful sport is a self-sustaining money printing machine. Now, traditional sports are "frozen in time" relative to business timescales; meanwhile, in e-sports, it's entirely possible for a company to introduce a new game and turn it into a worldwide phenomenon over a couple of years, and then keep getting a cut from aforementioned money printer for many more years still, all while trying to introduce a new game to keep the money running. And it's okay, I honestly don't mind. As far as the advertising-driven economy goes, sports (traditional or otherwise) is one of the more benign fields. The problem I see is the relentless focus on building a game optimized for professional play ruins it for vast majority of players, and I fail to see why companies keep doing it instead of bifurcating the multiplayer aspect into "casual play" and "pro play", allowing for the latter while also letting the former have their fun. > Nobody wants to play multiplayer (only) games with cheaters. My point is that most of the cheating comes from structuring the game around pro-play. You get a global ladder, which establishes an ordinal ranking that invites cheaters who just want to score higher for less effort. All those cheaters end up ruining the game for regular people, who don't care that much about the ranking. Most of those cheaters would go away if the ladder was removed - but that ladder is critical to the company and wannabe progamers precisely because the top levels of that ladder are a gateway to pro-level play. You can't eliminate all cheating - there's always some people who, for whatever reason, enjoy ruining the game for others. Fortunately, such people are a very small fraction of the playerbase, and most of them don't enjoy it enough to bother if you throw some small obstacles their way. It's manageable. Competitive rankings, on the other hand, are something cheaters love much more than regular players, so by adding it, you're basically creating the problem. This is true for all competitive endeavors - the bigger the reward, the more it attracts competitive players, some of which are going to resort to cheating, and attempts at fighting cheating further ruin things for those who don't care about competing in the first place. And yes, it applies to the market economy too.

maccard 2y ago

It’s definitely games that are the problem. There’s no way that websites are still embedding third party code that is just slopped together shit and wildly vulnerable [0]. Or that domain registrars, one of the core points of trust of the internet would lie about their security practices and be sued by the FTC almost a decade after it[1]. Or that an endpoint management system would take down multiple airports due to basic bounds checks missing [2]. How about a massive software company used by huge enterprises for storing their knowledge bases having an RCE [3]. A global CDN definitely wouldn’t break DNS and take down half the internet [4]. Now you might say, those companies are irresponsible and that well maintained open source software doesn’t have this issue. That would mean no 0 days for linux [5], and that the most battle tested libraries in the world are immune from basic issues [6][7]. Software engineering is broken, it’s not just games. (Although, if you think physical construction is any better I suggest you stick a T square in the corners of your house and figure out how many of your walls aren’t square ). You [0] https://mrbruh.com/chattr/ https://mrbruh.com/chattr/ [1] https://news.ycombinator.com/item?id=42849632 https://news.ycombinator.com/item?id=42849632 [2] https://en.m.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages https://en.m.wikipedia.org/wiki/2024_CrowdStrike-related_IT_... [3] https://www.csoonline.com/article/2138177/atlassians-confluence-hit-with-critical-remote-code-execution-bugs.html/amp/ https://www.csoonline.com/article/2138177/atlassians-conflue... [4] https://techcrunch.com/2021/07/22/a-dns-outage-just-took-down-a-good-chunk-of-the-internet/ https://techcrunch.com/2021/07/22/a-dns-outage-just-took-dow... [5] https://www.indusface.com/blog/rce-zero-day-vulnerabilities-linux-systems https://www.indusface.com/blog/rce-zero-day-vulnerabilities-... [6] https://en.m.wikipedia.org/wiki/Log4Shell https://en.m.wikipedia.org/wiki/Log4Shell [7] https://heartbleed.com/ https://heartbleed.com/