6 ms·

While I’m not really a gamer, I do think the conundrum of online games cheating is an interesting technical problem because I honestly can’t think of a “good” s

While I’m not really a gamer, I do think the conundrum of online games cheating is an interesting technical problem because I honestly can’t think of a “good” solution. The general simplistic answer from those who never had to design such a game or a system of “do everything on the server” is laughably bad.

abofh 7mo ago
I think it's somewhere between halting and turing - given infinite resources it's likely solvable, but lacking that it's just narrowing bounds
hakkoru 7mo ago
I think from a purely technical viewpoint, cheaters will always have the advantage since they control the machine the game and anti-cheat is running on. Anti-cheat just has to keep the barrier high enough so regular players don't think the game is infested with cheaters.
- akersten 7mo ago
  > Anti-cheat just has to keep the barrier high enough so regular players don't think the game is infested with cheaters. And even that's the (relatively) straightforward part. The hard part is doing this without injuring the kernel enough that the only sensible solution for the security conscious is a separate PC for gaming.
  - cylemons 7mo ago
    I wonder if dual booting can be used as a middle ground, like have one OS for gaming and other OS for work. Problem is that only works if the two OSes are different (Windows vs Linux) or else they can just stomp each other
- eddythompson80 7mo ago
  I agree, but that’s precisely the interesting ‘technical’ problem. Like bitcoins “proof of work” in 2011 (it took me few years to comprehend) was an eye opening moment for me. While I do believe that it firmly failed to achieve its lofty goals, the idea of “proof of work” was a really captivating and interring technical idea. Can a video game client have a similar zero-trust proof of their authenticity? I personally can’t think of one. I can’t think of a way to have remote random agents (authenticates or not) to proof they are not cheating in a “game”, and like you, I suspect it’s not really possible. But what does that mean? I grew up with star trek and star wars wondering what a “I’ll transfer 20 units to you” meant. Bitcoin was an eye opener in the idea of “maybe this is possible” to me. But it shortly became true to me that it’s not the case. There is no way still for random agents to prove they are not malicious. It’s easier in a network within the confines of Bitcoin network. But maybe I’m not smart enough to come up with a more generalized concept. After all, I was one of the people who read the initial bitcoin white paper on HN and didn’t understand it back then and dismissed it.
  - charcircuit 7mo ago
    You could have replays where all player inputs are signed by the individual players. This replay file could be used as proof to report a cheater. Analysis tools can be developed later to identify what packets are only possible from cheaters. For example you could prove that a player was sending packets that they were flying around.
- cortesoft 7mo ago
  I have never worked on AAA games, but I have developed software for 35 years and play many competitive online games regularly. I have always wondered why more companies don't do trust based anti cheat management. Many cheats are obvious from anyone in the game, you see people jumping around like crazy, or a character will be able to shoot through walls, or something else that impossible for a non-cheater to do. Each opponent in the game is getting the information from the cheating player's game that has it doing something impossible. I know it isn't as simple as having the game report another player automatically, because cheaters could report legitimate players... but what if each game reported cheaters, and then you wait for a pattern... if the same player is reported in every game, including against brand new players, then we would know the were a cheater. Unless cheaters got to be a large percentage of the player population, they shouldn't be able to rig it.
  - max-m 7mo ago
    A couple of years ago the bot situation in casual Team Fortress 2 was so bad that it wasn't uncommon to land in a game where the majority of at least one of the teams was a group of cooperating bots. In those matches you have the possibility to start a kick-vote on your team mates, and those bots would immediately vote “no” if you tried to vote on any of them and because they were the majority of the team these votes always failed. And if these batch were in your enemy team all you could do was to ask the remaining, hopefully real, players on the enemy team to try to kick them. It was especially annoying when you tried to play certain game modes these bots weren't programmed to handle, they had no idea of the objective and the match would stall indefinitely, forcing you to queue for a different match. And if I remember correctly these bots were pretty much headshotting everything they got in sight. Something the server can easily detect. But VAC for example acts intentionally slow, so cheaters don't get immediate feedback. Out of curiosity I did a quick internet search and a couple of months ago a new wave of bots has emerged. Those bots also join as majority group but never fully join the game, they simply take up slots in a team, preventing others from joining. Makes you wonder why the server isn't timing them out.
  - orbital-decay 7mo ago
    Less skilled players can't distinguish better players from cheaters, and reports are usually abused and used in bad faith. Even a good-faith report really just means "I don't want to see this player for whatever reason". It's used as a signal of something in most systems but never followed outright in good games because players get a ton of useless reports. Players in some games with custom servers run webs of trust (or rather distrust, shared banlists). They are typically abused to some degree and good players are banned across multiple servers by admins acting in bad faith or just straight up not caring. This rarely ends well. I used to run popular servers for PvP sandbox games and big communities, and we used votebans/reports to evict good players from casual servers to anarchy ones, where they could compete, but a mod always had to approve the eviction using a pretty non-trivial process. This system was useless for catching cheaters, we got them in other ways. That's for PvP sandboxes - in e-sports grade games reports are useless for anything.
karmakaze 7mo ago
Do what Netflix did and run servers at ISPs (or at their providers or Cloudflare points). It's kind of weird that we still don't have distributed computing infrastructure. Maybe that will be another thing where agents can run near the data their crunching on generic compute nodes.
- eddythompson80 7mo ago
  Sorry to day this, but I don’t think you understand how any of this works. Whenever someone’s proposed “edge computing” as a way to solve trust problems, I know they are just stringing together fancy sounding words they don’t understand. What “Netflix did” was having dead-simple static file serving appliance for ISPs to host with their Netflix auth on top. In their early days, Netflix had one of the simplest “auth” stories because they didn’t care.
  - deleted 7mo ago
    [deleted]
  - karmakaze 7mo ago
    There's different levels of cheating. We can avoid the worst cases by not putting the game state/Netcode in the users computer which basically makes it like an X Server. It would add some latency but could be opt-in for those that care enough for all players in a match to take the hit.
    - Thaxll 7mo ago
      All the games that use kernel anti cheat have the simulation running on the server. You can't make a competitive fps game with a dumb terminal, it can't work because the latency is too high so that's why you have to run local predictive simulation. You don't want to wait the server to ack your inputs.
      - ThatPlayer 7mo ago
        > All the games that use kernel anti cheat have the simulation running on the server. There's an exception with fighting games. Fighting games generally don't have server simulations (or servers at all), but every single client does their own full simulation. And 2XKO and Dragon Ball FighterZ have kernel anti cheat. Well I'm just nitpicking and it's different because it's one of the few competitive genres where the clients do full game state simulations. Another being RTS games.
theLiminator 7mo ago
The only good long term solution is ML on replays + moderately up to date client side (non kernel) AC (just good enough to deter cheaters).
bee_rider 7mo ago
Preventing cheating is hopeless. Anyway, this isn’t the Olympics, a professional sport, or Chess. It’s more like pickup league. Preserving competitive purity should be a non-goal. Rather, aim for fun matches. Matchmaking usually tries to find similar skill level opponents anyway, so let cheaters cheat their way out of the wider population and they’ll stop being a problem. Or, let players watch their killcams and tag their deaths. Camper, aimbot, etc etc. Then (for players that have a good sample size of matches) cluster players to use the same tactics together. Treating games like serious business has sucked all the fun out of it.
- eddythompson80 7mo ago
  Unfortunately that has been proven to not work. Matching based on skill works only as long as you have an abundance of players you can do that based on. When you have to account for geography, time of day, momentary availability, and skill level, you realize that you have fractured certain players far too much that it’s not fun for them anymore. Keep in mint that “cheaters” are also looking for matches that would maximize their cheats. Maybe it’s 8PM Pacific Time with tons of players there, but it’s 3 AM somewhere else with much limited number of players. Spoof your ping and location to be there and have fun sniping every player in the map. Sign up for new accounts on every play, who cares. Your fun as a cheater is to watch others lose their shit. You’re not building a character with history and reputation. You are heat sniping others while they are not realizing it. It may sound limited in scope and not worth the effort for you, but it’s millions of people out there tht ruin the game for everyone. Almost every game I know of lets players “watch their kill cam”, and cheaters have adapted. The snipped people have a bias to vote the sniper was cheating, and the snipers have a bias to vote otherwise. Lean one way or the other, and it’s another post on /r/gaming of how your game sucks.
- chrisfosterelli 7mo ago
  Well it is a professional sport -- there's tournaments worth tens of millions of dollars. But honestly it is probably easier to catch cheaters in that environment. The real issue is that cheaters suck the fun out of the game, and matchmaking doesn't fix this because cheaters just cheat the matchmaking (smurf accounts, etc) until they're stomping regular players again. I don't think throwing our hands up and letting the cheaters go on is a real solution.
Morromist 7mo ago
The only solution that seems to work well that I've seen is having very active and good server admins who watch the gameplay and permaban cheaters. Requires a lot of man hours and good UI and info for them to look at, as well as (ideally) the ability to see replays. That solution only works on servers hosted by players - I've never seen huge game companies that run their own servers (like GTA) have dedicated server admins. I guess they think they can just code cheaters out of their games, but they never can.
- keyringlight 7mo ago
  It's interesting how often accuracy problems fall back to requiring humans in the loop, and in the case of big consumer systems that means employing people in low wage parts of the world. For playing a match of a video game I don't think there's that much money involved balanced against the amount of playtime to pay for enough monitoring or to ensure a timely response to reports. Gamers always wheel out community run servers and admins because it's pushing the cost onto someone else (I don't think I've ever seen someone volunteer themselves for it), and they'd mostly refuse pay to play if that meant employing a staff that scaled as their online games are popular.
raincole 7mo ago
The solution is purely cultural. We should collectively think people who cheat online are losers. (Not being sarcastic.)
- piotrkaminski 7mo ago
  By and large we do. Unfortunately, the losers don't care unless you identify them personally. For them, the thrill of cheating and griefing others easily overcomes some generalized cultural zeitgeist.
  - jack_pp 7mo ago
    Or bad players might get owned by better ones, conclude the other guy was cheating and the only way to compete is for them to cheat as well. Sort of like nuclear weapons
    - seanhunter 7mo ago
      This has happened in online chess, with some people admitting to using engines (ie cheating) to "confirm their suspicion that the other guy is cheating".
- seanhunter 7mo ago
  Remember you're living in a world where people idolize Elon Musk, a person who employed someone to play path of exile and diabolo to boost his account (ie a cheater). Also a lot of people don't care (or claim not to care) whether people see them as losers as long as they wreck other folks day. https://www.forbes.com/sites/paultassi/2025/01/20/elon-musk-finally-admits-to-path-of-exile-2-account-boosting-in-dms/ https://www.forbes.com/sites/paultassi/2025/01/20/elon-musk-...
  - bigstrat2003 7mo ago
    I don't know a single person who doesn't think that the PoE thing was super cringe. To the extent that people idolize Elon, it's because they think his accomplishments outweigh him making a massive fool of himself in that instance.
charcircuit 7mo ago
Mac OS with remote attestation has proven strong enough for anticheat on Mac OS without needing kernel anticheat.
hrmtst93837 7mo ago
[flagged]
- tonyhart7 7mo ago
  sorry but kernel anti cheat is actually good I play fps competitively and valorant is by far the most least cheater fps game on the market
  - PowerElectronix 7mo ago
    Except for the risk of the game being compromised and everything in your computer along with it.
    - tonyhart7 7mo ago
      its like saying game piracy is bad because you can get hack in your pc if your pc is so important then maybe don't install these particular software its all about trade off
      - PowerElectronix 7mo ago
        I don't install games that require kernel level anticheat. I wish those games would stop using them because without that I'd play a few of them. Kernel level anticheat isn't a silver bullet, either. It just simplifies the work of the anticheat programmers. I personally think that the silver bullet is behavioral anticheat and information throttling (don't send the player information about other players that he can't see/hear)
        tonyhart7 7mo ago
        Yeah but this is our current best tool yet if you can design a better one without drawback then you could try to release a better one
  - bigstrat2003 7mo ago

abofh 7mo ago

I think it's somewhere between halting and turing - given infinite resources it's likely solvable, but lacking that it's just narrowing bounds

hakkoru 7mo ago

I think from a purely technical viewpoint, cheaters will always have the advantage since they control the machine the game and anti-cheat is running on. Anti-cheat just has to keep the barrier high enough so regular players don't think the game is infested with cheaters.

akersten 7mo ago
> Anti-cheat just has to keep the barrier high enough so regular players don't think the game is infested with cheaters. And even that's the (relatively) straightforward part. The hard part is doing this without injuring the kernel enough that the only sensible solution for the security conscious is a separate PC for gaming.
- cylemons 7mo ago
  I wonder if dual booting can be used as a middle ground, like have one OS for gaming and other OS for work. Problem is that only works if the two OSes are different (Windows vs Linux) or else they can just stomp each other
eddythompson80 7mo ago
I agree, but that’s precisely the interesting ‘technical’ problem. Like bitcoins “proof of work” in 2011 (it took me few years to comprehend) was an eye opening moment for me. While I do believe that it firmly failed to achieve its lofty goals, the idea of “proof of work” was a really captivating and interring technical idea. Can a video game client have a similar zero-trust proof of their authenticity? I personally can’t think of one. I can’t think of a way to have remote random agents (authenticates or not) to proof they are not cheating in a “game”, and like you, I suspect it’s not really possible. But what does that mean? I grew up with star trek and star wars wondering what a “I’ll transfer 20 units to you” meant. Bitcoin was an eye opener in the idea of “maybe this is possible” to me. But it shortly became true to me that it’s not the case. There is no way still for random agents to prove they are not malicious. It’s easier in a network within the confines of Bitcoin network. But maybe I’m not smart enough to come up with a more generalized concept. After all, I was one of the people who read the initial bitcoin white paper on HN and didn’t understand it back then and dismissed it.
- charcircuit 7mo ago
  You could have replays where all player inputs are signed by the individual players. This replay file could be used as proof to report a cheater. Analysis tools can be developed later to identify what packets are only possible from cheaters. For example you could prove that a player was sending packets that they were flying around.
cortesoft 7mo ago
I have never worked on AAA games, but I have developed software for 35 years and play many competitive online games regularly. I have always wondered why more companies don't do trust based anti cheat management. Many cheats are obvious from anyone in the game, you see people jumping around like crazy, or a character will be able to shoot through walls, or something else that impossible for a non-cheater to do. Each opponent in the game is getting the information from the cheating player's game that has it doing something impossible. I know it isn't as simple as having the game report another player automatically, because cheaters could report legitimate players... but what if each game reported cheaters, and then you wait for a pattern... if the same player is reported in every game, including against brand new players, then we would know the were a cheater. Unless cheaters got to be a large percentage of the player population, they shouldn't be able to rig it.
- max-m 7mo ago
  A couple of years ago the bot situation in casual Team Fortress 2 was so bad that it wasn't uncommon to land in a game where the majority of at least one of the teams was a group of cooperating bots. In those matches you have the possibility to start a kick-vote on your team mates, and those bots would immediately vote “no” if you tried to vote on any of them and because they were the majority of the team these votes always failed. And if these batch were in your enemy team all you could do was to ask the remaining, hopefully real, players on the enemy team to try to kick them. It was especially annoying when you tried to play certain game modes these bots weren't programmed to handle, they had no idea of the objective and the match would stall indefinitely, forcing you to queue for a different match. And if I remember correctly these bots were pretty much headshotting everything they got in sight. Something the server can easily detect. But VAC for example acts intentionally slow, so cheaters don't get immediate feedback. Out of curiosity I did a quick internet search and a couple of months ago a new wave of bots has emerged. Those bots also join as majority group but never fully join the game, they simply take up slots in a team, preventing others from joining. Makes you wonder why the server isn't timing them out.
- orbital-decay 7mo ago
  Less skilled players can't distinguish better players from cheaters, and reports are usually abused and used in bad faith. Even a good-faith report really just means "I don't want to see this player for whatever reason". It's used as a signal of something in most systems but never followed outright in good games because players get a ton of useless reports. Players in some games with custom servers run webs of trust (or rather distrust, shared banlists). They are typically abused to some degree and good players are banned across multiple servers by admins acting in bad faith or just straight up not caring. This rarely ends well. I used to run popular servers for PvP sandbox games and big communities, and we used votebans/reports to evict good players from casual servers to anarchy ones, where they could compete, but a mod always had to approve the eviction using a pretty non-trivial process. This system was useless for catching cheaters, we got them in other ways. That's for PvP sandboxes - in e-sports grade games reports are useless for anything.

karmakaze 7mo ago

Do what Netflix did and run servers at ISPs (or at their providers or Cloudflare points). It's kind of weird that we still don't have distributed computing infrastructure. Maybe that will be another thing where agents can run near the data their crunching on generic compute nodes.

eddythompson80 7mo ago
Sorry to day this, but I don’t think you understand how any of this works. Whenever someone’s proposed “edge computing” as a way to solve trust problems, I know they are just stringing together fancy sounding words they don’t understand. What “Netflix did” was having dead-simple static file serving appliance for ISPs to host with their Netflix auth on top. In their early days, Netflix had one of the simplest “auth” stories because they didn’t care.
- deleted 7mo ago
  [deleted]
- karmakaze 7mo ago
  There's different levels of cheating. We can avoid the worst cases by not putting the game state/Netcode in the users computer which basically makes it like an X Server. It would add some latency but could be opt-in for those that care enough for all players in a match to take the hit.
  - Thaxll 7mo ago
    All the games that use kernel anti cheat have the simulation running on the server. You can't make a competitive fps game with a dumb terminal, it can't work because the latency is too high so that's why you have to run local predictive simulation. You don't want to wait the server to ack your inputs.
    - ThatPlayer 7mo ago
      > All the games that use kernel anti cheat have the simulation running on the server. There's an exception with fighting games. Fighting games generally don't have server simulations (or servers at all), but every single client does their own full simulation. And 2XKO and Dragon Ball FighterZ have kernel anti cheat. Well I'm just nitpicking and it's different because it's one of the few competitive genres where the clients do full game state simulations. Another being RTS games.

theLiminator 7mo ago

The only good long term solution is ML on replays + moderately up to date client side (non kernel) AC (just good enough to deter cheaters).

bee_rider 7mo ago

Preventing cheating is hopeless. Anyway, this isn’t the Olympics, a professional sport, or Chess. It’s more like pickup league. Preserving competitive purity should be a non-goal. Rather, aim for fun matches. Matchmaking usually tries to find similar skill level opponents anyway, so let cheaters cheat their way out of the wider population and they’ll stop being a problem. Or, let players watch their killcams and tag their deaths. Camper, aimbot, etc etc. Then (for players that have a good sample size of matches) cluster players to use the same tactics together. Treating games like serious business has sucked all the fun out of it.

eddythompson80 7mo ago
Unfortunately that has been proven to not work. Matching based on skill works only as long as you have an abundance of players you can do that based on. When you have to account for geography, time of day, momentary availability, and skill level, you realize that you have fractured certain players far too much that it’s not fun for them anymore. Keep in mint that “cheaters” are also looking for matches that would maximize their cheats. Maybe it’s 8PM Pacific Time with tons of players there, but it’s 3 AM somewhere else with much limited number of players. Spoof your ping and location to be there and have fun sniping every player in the map. Sign up for new accounts on every play, who cares. Your fun as a cheater is to watch others lose their shit. You’re not building a character with history and reputation. You are heat sniping others while they are not realizing it. It may sound limited in scope and not worth the effort for you, but it’s millions of people out there tht ruin the game for everyone. Almost every game I know of lets players “watch their kill cam”, and cheaters have adapted. The snipped people have a bias to vote the sniper was cheating, and the snipers have a bias to vote otherwise. Lean one way or the other, and it’s another post on /r/gaming of how your game sucks.
chrisfosterelli 7mo ago
Well it is a professional sport -- there's tournaments worth tens of millions of dollars. But honestly it is probably easier to catch cheaters in that environment. The real issue is that cheaters suck the fun out of the game, and matchmaking doesn't fix this because cheaters just cheat the matchmaking (smurf accounts, etc) until they're stomping regular players again. I don't think throwing our hands up and letting the cheaters go on is a real solution.

Morromist 7mo ago

The only solution that seems to work well that I've seen is having very active and good server admins who watch the gameplay and permaban cheaters. Requires a lot of man hours and good UI and info for them to look at, as well as (ideally) the ability to see replays. That solution only works on servers hosted by players - I've never seen huge game companies that run their own servers (like GTA) have dedicated server admins. I guess they think they can just code cheaters out of their games, but they never can.

keyringlight 7mo ago
It's interesting how often accuracy problems fall back to requiring humans in the loop, and in the case of big consumer systems that means employing people in low wage parts of the world. For playing a match of a video game I don't think there's that much money involved balanced against the amount of playtime to pay for enough monitoring or to ensure a timely response to reports. Gamers always wheel out community run servers and admins because it's pushing the cost onto someone else (I don't think I've ever seen someone volunteer themselves for it), and they'd mostly refuse pay to play if that meant employing a staff that scaled as their online games are popular.

raincole 7mo ago

The solution is purely cultural. We should collectively think people who cheat online are losers. (Not being sarcastic.)

piotrkaminski 7mo ago
By and large we do. Unfortunately, the losers don't care unless you identify them personally. For them, the thrill of cheating and griefing others easily overcomes some generalized cultural zeitgeist.
- jack_pp 7mo ago
  Or bad players might get owned by better ones, conclude the other guy was cheating and the only way to compete is for them to cheat as well. Sort of like nuclear weapons
  - seanhunter 7mo ago
    This has happened in online chess, with some people admitting to using engines (ie cheating) to "confirm their suspicion that the other guy is cheating".
seanhunter 7mo ago
Remember you're living in a world where people idolize Elon Musk, a person who employed someone to play path of exile and diabolo to boost his account (ie a cheater). Also a lot of people don't care (or claim not to care) whether people see them as losers as long as they wreck other folks day. https://www.forbes.com/sites/paultassi/2025/01/20/elon-musk-finally-admits-to-path-of-exile-2-account-boosting-in-dms/ https://www.forbes.com/sites/paultassi/2025/01/20/elon-musk-...
- bigstrat2003 7mo ago
  I don't know a single person who doesn't think that the PoE thing was super cringe. To the extent that people idolize Elon, it's because they think his accomplishments outweigh him making a massive fool of himself in that instance.

charcircuit 7mo ago

Mac OS with remote attestation has proven strong enough for anticheat on Mac OS without needing kernel anticheat.

hrmtst93837 7mo ago

[flagged]

tonyhart7 7mo ago
sorry but kernel anti cheat is actually good I play fps competitively and valorant is by far the most least cheater fps game on the market
- PowerElectronix 7mo ago
  Except for the risk of the game being compromised and everything in your computer along with it.
  - tonyhart7 7mo ago
    its like saying game piracy is bad because you can get hack in your pc if your pc is so important then maybe don't install these particular software its all about trade off
    - PowerElectronix 7mo ago
      I don't install games that require kernel level anticheat. I wish those games would stop using them because without that I'd play a few of them. Kernel level anticheat isn't a silver bullet, either. It just simplifies the work of the anticheat programmers. I personally think that the silver bullet is behavioral anticheat and information throttling (don't send the player information about other players that he can't see/hear)
      - tonyhart7 7mo ago
        Yeah but this is our current best tool yet if you can design a better one without drawback then you could try to release a better one
- bigstrat2003 7mo ago