3 ms·

I am not a fan of the signature-based techniques used by VAC, et. al. I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) d

I am not a fan of the signature-based techniques used by VAC, et. al. I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) detection of debugging tools attached to totally unrelated processes on the same machine. Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. Ethical hacking and malicious hacking are indistinguishable from the perspective of this kind of machine-wide blind signature detection. Statistical techniques can dramatically reduce false positives in cases like this. If someone at Valve had taken 10 seconds to review my stats during the detected interval, they should have been able to conclude I was not a threat to fair play.

psini 1y ago
I understand the sentiment but I can't bring myself to think valve is to blame or should be doing more. Getting a case of "Yes officer, I have an NO2 bottle in my trunk, but what it is plugged to is not actually the air intake for my car but something entirely unrelated, if you just take 2 hours to dig around and take it apart you'll also realize this"
- MaxikCZ 1y ago
  Thats such a bad example. Ofc you can carry NO2 bottles plugged into something, if its not air intake of your car, and investigation should happen finding you not guilty.
  - PaulHoule 1y ago
    … unless you plug it into your mouth
- mystified5016 1y ago
  When you're accused of breaking the law, your accuser must prove you have broken the law. If they cannot, there are actions you can take to recoup your damages. Valve can ban you for any or no reason with no means of recourse or refund. Totally the same thing, yeah.
  - kube-system 1y ago
    You're right that they're not the same thing. The government has a legal monopoly on the use of force. Valve sells games.
qualeed 1y ago
>If someone at Valve had taken 10 seconds to review my stats It seems super reasonable when it's a one-off thing for your own account. When you think about making it into policy and scaling it up to 1000s of interactions, it quickly becomes unreasonable. >Statistical techniques can dramatically reduce false positives For a period of time, anyways. Until the statistics get gamed by the cheaters (e.g. adjust accuracy of your auto-shoot from 100% to 85% or whatever).
- stoorafa 1y ago
  Computation isn’t likely prohibitive when using the bedrock of predictive models, linear regression, especially w some optimization. Could also vary observation time so you only need a prediction once every ten minutes or whatever The real issue is the cost of false positive detection of cheating is negligible since the vast majority of positives are probably true positives—it’s the cost of doing anti-cheat business (minimal) But yes cheats would be modified to just below thresholds of detection
  - qualeed 1y ago
    >Computation isn’t likely prohibitive when [...] I think this might be in reply to my first comment about scaling? If so, I just want to clarify that I was thinking more along the lines of scaling the customer service/ban appeal side rather than infrastructure. If, for example, every ban had a component of someone at Valve taking 10 seconds to review in-game stats at the time of the ban, and then making a determination of whether or not those stats seem reasonably non-cheater-ish (pretty hard policy question in itself), the process would slow to a crawl.
- bob1029 1y ago
  > adjust accuracy of your auto-shoot from 100% to 85% or whatever Sure - looking at K/D, accuracy, etc., is an important factor in a statistical model. Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player. After a certain point, I don't think it matters if it is publicly known what your signals are. The amount of information becomes overwhelming in aggregate. You can impose the curse of dimensionality on the cheater.
black3r 1y ago
signature detection can also make a false positive if running under Wine or in a VM (that's for example why you can't play League of Legends or Valorant with GeForce Now anymore since Riot revealed their new anti-cheat...)
invokestatic 1y ago
Actually, VAC handles Cheat Engine and the like very well. You won’t get banned for simply having them open, only for having them attached to the game, which I think is reasonable.
- aeonik 1y ago
  I used to use CheatEngine on single player games that I ran through Steam, and I don't recall Steam having a problem with that at the time. Not sure if it's changed, but it was pretty reasonable. Never used it on Multiplayer games though.
  - duskwuff 1y ago
    VAC is only used in multiplayer games. (And even then, only in a limited number of games - https://steamdb.info/charts/?category=8 https://steamdb.info/charts/?category=8)
  - deleted 1y ago
    [deleted]
winkelmann 1y ago
> Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. I think a no-brainer solution here, which I am surprised isn't used, is to just immediately kick the account when a well-known signature, such as CheatEngine, is detected. If the program isn't even attempting to get around VAC, there is no point in doing the whole "delayed ban" thing.
- fc417fc802 1y ago
  Or even banning at all. As you say, kick out of an abundance of caution. Any serious attempt at rule breaking is going to involve at least some basic obfuscation so if that's missing it's a strong indicator of a false positive. That said, my snarky response is "I hope you learned your lesson about the need to restrict proprietary software to a container at all times".
pugworthy 1y ago
> If someone at Valve had taken 10 second to … Looking up some quick stats, Steam has 132 million monthly active users and 69 million people use Steam on a daily basis. Not all those games are using VAC, but just looking at CS2, it routinely has over a million players playing it. Nobody is going to “take 10 second to review” anything with those numbers.

psini 1y ago

I understand the sentiment but I can't bring myself to think valve is to blame or should be doing more. Getting a case of "Yes officer, I have an NO2 bottle in my trunk, but what it is plugged to is not actually the air intake for my car but something entirely unrelated, if you just take 2 hours to dig around and take it apart you'll also realize this"

MaxikCZ 1y ago
Thats such a bad example. Ofc you can carry NO2 bottles plugged into something, if its not air intake of your car, and investigation should happen finding you not guilty.
- PaulHoule 1y ago
  … unless you plug it into your mouth
mystified5016 1y ago
When you're accused of breaking the law, your accuser must prove you have broken the law. If they cannot, there are actions you can take to recoup your damages. Valve can ban you for any or no reason with no means of recourse or refund. Totally the same thing, yeah.
- kube-system 1y ago
  You're right that they're not the same thing. The government has a legal monopoly on the use of force. Valve sells games.

qualeed 1y ago

>If someone at Valve had taken 10 seconds to review my stats It seems super reasonable when it's a one-off thing for your own account. When you think about making it into policy and scaling it up to 1000s of interactions, it quickly becomes unreasonable. >Statistical techniques can dramatically reduce false positives For a period of time, anyways. Until the statistics get gamed by the cheaters (e.g. adjust accuracy of your auto-shoot from 100% to 85% or whatever).

stoorafa 1y ago
Computation isn’t likely prohibitive when using the bedrock of predictive models, linear regression, especially w some optimization. Could also vary observation time so you only need a prediction once every ten minutes or whatever The real issue is the cost of false positive detection of cheating is negligible since the vast majority of positives are probably true positives—it’s the cost of doing anti-cheat business (minimal) But yes cheats would be modified to just below thresholds of detection
- qualeed 1y ago
  >Computation isn’t likely prohibitive when [...] I think this might be in reply to my first comment about scaling? If so, I just want to clarify that I was thinking more along the lines of scaling the customer service/ban appeal side rather than infrastructure. If, for example, every ban had a component of someone at Valve taking 10 seconds to review in-game stats at the time of the ban, and then making a determination of whether or not those stats seem reasonably non-cheater-ish (pretty hard policy question in itself), the process would slow to a crawl.
bob1029 1y ago
> adjust accuracy of your auto-shoot from 100% to 85% or whatever Sure - looking at K/D, accuracy, etc., is an important factor in a statistical model. Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player. After a certain point, I don't think it matters if it is publicly known what your signals are. The amount of information becomes overwhelming in aggregate. You can impose the curse of dimensionality on the cheater.

black3r 1y ago

signature detection can also make a false positive if running under Wine or in a VM (that's for example why you can't play League of Legends or Valorant with GeForce Now anymore since Riot revealed their new anti-cheat...)

invokestatic 1y ago

Actually, VAC handles Cheat Engine and the like very well. You won’t get banned for simply having them open, only for having them attached to the game, which I think is reasonable.

aeonik 1y ago
I used to use CheatEngine on single player games that I ran through Steam, and I don't recall Steam having a problem with that at the time. Not sure if it's changed, but it was pretty reasonable. Never used it on Multiplayer games though.
- duskwuff 1y ago
  VAC is only used in multiplayer games. (And even then, only in a limited number of games - https://steamdb.info/charts/?category=8 https://steamdb.info/charts/?category=8)
- deleted 1y ago
  [deleted]

winkelmann 1y ago

> Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. I think a no-brainer solution here, which I am surprised isn't used, is to just immediately kick the account when a well-known signature, such as CheatEngine, is detected. If the program isn't even attempting to get around VAC, there is no point in doing the whole "delayed ban" thing.

fc417fc802 1y ago
Or even banning at all. As you say, kick out of an abundance of caution. Any serious attempt at rule breaking is going to involve at least some basic obfuscation so if that's missing it's a strong indicator of a false positive. That said, my snarky response is "I hope you learned your lesson about the need to restrict proprietary software to a container at all times".

pugworthy 1y ago

> If someone at Valve had taken 10 second to … Looking up some quick stats, Steam has 132 million monthly active users and 69 million people use Steam on a daily basis. Not all those games are using VAC, but just looking at CS2, it routinely has over a million players playing it. Nobody is going to “take 10 second to review” anything with those numbers.