I wish there was a model for anti-cheat that wasn't "grant irrevocable full control of your hardware via rootkit to the developer and anti-cheat manufacturer via a secure boot chain that you're not allowed to touch (on your device!)"
I don't think trust is a bad thing, but this feels forced and unpleasant.
No. This model doesn't really work for Battle Royale games, plus the userbase of modern gaming is so much larger and more casual than it was back in CS2 days or whatever you're imagining. People who only have time to play a couple matches at the end of the day do not want to spend half the time available hunting around for a "good server" appropriate to their interest/skill level or develop a personal relationship with the mods.
I have been playing online games for 30 years, and you are leaving out a TON of the value you get from centralized hosting and matchmaking.
At any time of day or night, I can just sign in and immediately find a match. In addition, it can match me against players that are close to my skill level so the games I play are fair and challenging. I can keep my statistics to see how I do over time in those fair and challenging games.
This is a very valuable service.
I have played on plenty of community hosted servers, and the experience is hit or miss. Sometimes, you will get power hungry mods who ban anyone who is better than them, or won’t ban the cheaters because they are friends. Without the anti cheat tools, it is often very hard to distinguish people who are really good and people who are cheating, so you leave it up to the whims of the moderators.
Yes, you could tell me to just go and find a different server, but I don’t want to spend my time trying to find a good server I just want to play… and who knows if the good server I find will still be around the next time I play.
I have thousands of hours on both types of games, and for any sort of competing games (whether FPS, RTS, or sports), I get a lot more enjoyment out of centralized matchmaking with anticheat.
It doesn't because server operators don't want a unpaid full time job moderating a server. If anything, community servers have more anti-cheat not less. ESEA and FaceIt servers for CS2 have additional anti-cheat. FiveV community servers for GTAV rolled their own anti-cheat before Rockstar added one recently.
I even remember ICCUP for Starcraft 1 had 'anti-hack'.
Being able to host your own playgroups is generally possible in modern games still. Private lobbies on their public servers exist, but that's still more effort than people are willing to do versus hitting the 'play game' button. We used to call those PUGs.
Any community smaller than 200 people is going to have you typing !add in an mIRC channel and waiting 20 minutes during prime-time for a pickup game between 10 mismatched players. Any community larger than 200 people is going to be unmanageable cheat wise.
If I had the option of Quake 3 Arena-style "matchmaking" and no cheats, or 2024 matchmaking and cheats I'd choose option 2 every time.
Correct. 1000% correct. This is also how you build community.
Also the f2p model isn't doing us any favors by making new accounts cost zero, though iirc cheats can cost like $100/mo so I assume dedicated cheaters would still cheat if games all cost money.
I think they are orthogonal models. With dedicated servers, people sort of self-organize into groups of people they want to play with, maybe based on skill or fun or something else. Maybe you know who runs the server IRL, or you just randomly tried the server. Maybe you just get along with that group of people, maybe they're a group that is dedicated to improving and that's exactly what you want.
I think parent's point is that you don't need skill-based matchmaking and ranking systems if you give players the ability to self-organize.
The question was somewhat facetious. Being able to click "Find Match" and be able to match up against someone close to your skill level in a few seconds is a feature that players want. A ranked leaderboard that's somewhat legitimate and has prestige in climbing is a feature that players want.
You don't need this stuff, of course, but people (who don't play games) love to dismiss these things as if they don't matter.
I honestly feel the exact opposite of you, and think your desire is strange. I want to find games quickly and experience good, fair competition - which seems to me what most people would want.
The problem is that your solution to find "good, fair competition" (whatever that means to you) involves some form of ranking.
The problems start when everyone cares about their damn ranking. And yes, even casuals care about that crap. Everybody follows the same strategies, everyone is whiny and annoying because losing means your ranking is damaged.
Back in the day nobody cared. A match went awry because someone did a completely retarded build on their toon, or didn't know how to play with the class they picked? Oh well, game is over, you find a new one.
I never play with player audio on, so I never hear if anyone else is whining about their ranking. I don’t pay attention at all to what my own ranking is, I just play my best and let it sort itself out. I only want fair matches, and it does seem like I mostly get those.
The ranking itself is meaningless, the only thing important is that it accurately represents my skill so that it can be used to find a match.
It sounds like I might play different kinds of online games than you… I mostly play sports games, which don’t have the issues you describe.
So, then, why not both? The players that want to just jump into a match can deal with the kernel anticheat, and the players that are willing to find a dedicated server don't have to deal with rootkits.
I mean, I know the answer, it's because doing both would be significantly more work for unproven returns, but still, a guy can dream.
You go on a server. You're getting smoked. They kick you or you leave because the people there are way above you. Alternatively, you're too pro and you get bored and look for a server with higher average skill.
I played a game called Wolfenstein: Enemy Territory at the pro level (of course making small amounts of money even as a teenager like things were back then).
A lot of the time in the game was spent scrimming on private servers against other teams. Public games were played on the team’s public server, where people of all skill levels would meet. The highest skilled players would always look to be challenged and would switch to the weaker team all the time. Of course on the scoreboard you’d have people who had a K/D of 40/2 and people who were 1/12.
People who weren’t looking to improve and got stomped would of course leave.
After a while of playing on a server you’d know the good players and they’d also self select to form teams with each other and move to private servers.
On the contrary, skill-based matchmaking is a godsend for casual players, as long as they don't care about their rank. If you're a bottom 50% player, you really don't want to get matched up against a Challenger League of Legends player or Master Street Fighter 6 player or The Wazzler in Marvel vs Capcom 2.
By far, the best time I had in online multiplayer was playing Dota (the WC3 map, not the standalone atrocity that exists nowadays).
No ranked whatever. Every game was a blank slate. Nobody really cared, everyone was having fun. People tried weird builds, odd team composition, etc. You sometimes played with nice people and added them to friends.
With ranked matchmaking everybody is pissy if you are not playing optimally, everyone moans and hisses when they lose, etc.
I played plenty of unranked LoL back in the day, it was generally a better over all experience.
Mostly because ranked games were full of tryhards that raged constantly and in general didn't actually treat the game like a game.
___
In fact now that I think about it... some of my funnest LoL games back in the day was when I got paired with someone way out of my league in unranked and they would spend a lot of the game mentoring teammates.
And when the opposite happened, we would get stomped quickly and would be able to into a new match quickly. No one felt the need to drag out a unfun/mismatched game because their ranking would get hurt. Wasn't really an issue.
1. Allow community-hosted servers, as were common 20 years ago. These can be moderated with greater attention than a massive global server, and tend to eject cheaters quickly.
2. Server-side analysis. This is arguably more expensive to implement than forcing every player to accept a rootkit, but machine learning might reduce the cost. Moreover, it is more effective in at least one dimension: it can't be circumvented* like a rootkit can.
There is. It's a hybrid of recording, cooperative state/action validation and community moderation (overwatch, votekicks, VAC bans on external review). Each of these allows you to see if people are doing things they're able to. The rest is just matchmaking.
But this approach takes up server disk space and client CPU time. It's also reactive.
Snooping at hardware is easy. You don't even have to do it game-by-game. That's the reason.
> “You can freely manipulate the kernel, and there’s no user mode calls to attest that it’s even genuine,” says Koskinas. “You could make a Linux distribution that’s purpose-built for cheating and we’d be smoked.”
These are features, not bugs. Cheating must be detected serverside. Never trust the client, this is basic security. Breaking the user's client security is not a valid solution, and I get increasingly frustrated with these gaming companies that insist that a rootkit is "fine" and "normal" and "something a regular user should install without question"
>Cheating must be detected serverside. Never trust the client, this is basic security.
As long as rendering happens on the client, it's going to require client-side anti-cheat to stop players from looking through walls or adding aimbots.
Client side rendering means the client has information like the location of the opponent even when the opponent is not visible. The server is unable to tell on its own whether the client is using this information inappropriately.
Server side cheat detection is not just about actually detecting active cheating on the server side. It's also about the server providing the client the absolute minimum amount of information needed to function/render.
Yes, for an FPS I don't really see a practical way around having the server do some rendering work, in order to detect occlusion and stop sending visual updates when it's pretty sure the client isn't able to see that object. There's a balance to be struck.
Other techniques include simple statistical analysis: it's usually pretty damn obvious when a player is making inputs that shouldn't be humanly possible consistently, or reacting to information they shouldn't be able to see. That doesn't have to be done in realtime, it can be stored and reviewed later. (That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable.)
Lag compensation makes the absolute minimum relatively high. For example you need the client to know about an enemy player behind them that doesn't get rendered, because the client can turn around faster than the server can tell them about that player. Otherwise it can lead to a super frustrating experience where the enemy player pops into existence on the client in the middle of the screen, and you couldn't have reacted because there was nothing there.
So if you're sending that data to the client, well now cheats can look for that and detect if there's a player behind you and warn you, giving an advantage.
The same thing applies to corners and other occlusions, just less extreme, but still just as frustrating.
That are hacks that change the behavior and historic skill of a player, could be detected server side too. Also a client side anticheat couldn't detect modern aim hacking via external camera and custom hardware mouse.
Don't be a snarky ass, especially when you are wrong.
The community HAS figured it out. If you want cheating reduced you do server side cheat detection not just client side and/or you release real dedicated servers.
Neither of which shitty game companies are interested in, because it either cost more money to implement or means a minor loss of control.
The increase in bots and cheaters got progressively worse as matchmaking took over and ate away at the ability of private servers to maintain a community. Also before that, TF2 becoming a giant microtransaction experiment certainly didn't help.
Still though even today I can open up TF2 and still have a few favorited servers that have been going for a decade+. I can join those servers and play bot and cheater free for the most part.
The increase in bots and cheaters got progressively worse as matchmaking took over and ate away at the ability of private servers to maintain a community. And before that, TF2 becoming a giant microtransaction experiment certainly didn't help.
Also the mailing list I spoke of are basically dead at this point as the number of invested server admins has dwindled.
Still though even today I can open up TF2 and still have a few favorited servers that have been going for a decade+. I can join those servers and play bot and cheater free for the most part.
No current level of server-sided classification can discriminate between good players and humanized aimbots. Similarly, no instantaneous window of input scrutiny can detect informational cheats (like ESP). You'd need days/weeks of data, and oops too late—they're radiant already.
Also, server-sided anti-cheat is far cheaper than client-sided. I see the inverse quoted everywhere, but it's just not true.
I imagine in the future as the internet improves and compression algorithms improve, games will be streamed. This would probably be cheaper for the consumer since hardware follows economy of scale for the game companies. Also, you won't be required to run any special software on people's computers. Porting to new platforms is trivial, game consoles become super cheap, and everyone can play together.
The downside is you don't own the game. But this is more or less the case right now, with DRM and all. And for online games, you're already beholden to the servers.
Typically by things like reaction time, input latency, smoothness of motion, etc. A real human is surprisingly nondeterministic about these things, and their hardware adds all sorts of other interesting noise to the data. A naive aimbot will look unnaturally smooth and linear.
You can somewhat cat-and-mouse this by attempting to humanize the inputs, but it's surprisingly difficult to replicate "natural" motion as input by a human. The humanized aimbot will end up with its own detectable signature. Besides that though, don't let perfect be the enemy of good enough. Catching the low-hanging-fruit (the stuff that is easy to detect) is *most* of the problem. Leave the crazy advanced stuff to the professional leagues, where players are under higher scrutiny anyway.
Mind that I don't meant to argue against clientside cheat detection. You can still do a lot of that in userspace, and you really should. It's more data to analyze and it raises the bar for casuals. But since you inherently can't trust the client, you need to also do serverside detection, and really the serverside stuff (being remote, unknowable, and much harder to exploit) is going to be the stronger signal.
I feel like eventually most genres of competitive game will just have to end up adopting the model that the fighting game community came up with organically. Online play is fine for practice and unofficial tournaments, but if you really want to get good and make a name for yourself, you need to play at weeklies, monthlies, and in-person tournaments where the hardware and software are controlled by the tournament organizers.
It does help that cheating can only help so much in fighting games. I haven't thought about it much, but I guess you could have a macro that executes a devastating combo? Even then you need to be skilled enough at defense and hit confirming to even know when to press the "win the game" button. And most of the games I play have enough defensive options[0] that the player executing the combo might still need to react to something.
The FGC has a really interesting history with online play. Besides having a long tradition of in-person PvP in arcades, online fighting games were largely unplayable until the mid-late 2010s until GGPO/rollback[0] became popular. For a long, long time, the FGC largely (and rightfully) didn't see online play as legitimate.
Now rollback is basically standard and you do see competitive tournaments happening online frequently. Obviously the big events like EVO are still offline, but you could say the same about the majors for DotA, LoL, even Brood War, which are all very "online-first" games.
Online play has definitely gotten bigger in the FGC, but the people I know in the community[0] still largely consider offline play king. In a game scene where individual frames matter, the preferred way to play for keeps is offline on a CRT. But, you know, halfway decent online play is fun and good for making sure you don't get too rusty.
I think the big difference between EVO and e.g. DoTA offline majors[1] is that anyone can show up at EVO and jump into the pools. For other esport events, to play in an offline event, you first have to have qualified online. If the whole process were offline beginning to end, that would be closer to the FGC model.
[0] I myself only dabble, somewhere between filthy casual and semi-serious
[1] and do correct me if I'm wrong, I don't know that much about the competitive MOBA and FPS scenes
Oh for sure offline is still king. But I mean, you look at the top of the SF6 rankings and it's Daigo, Fuudo, Tokido, Punk, Endingwalker... all the players who are winning offline, too. There's a tight correlation between being a top ranked SF6 player online and being really good at the game, to the point of winning offline tournaments. When you think about it, being able to (theoretically) get good enough that you can get matched up against the EVO champ in online play, even if you live in rural Arkansas and could never make it to an NYC local, and play a legitimate competitive game against him, is pretty sweet.
While fighting games are extremely technical in nature, they're also strategic.
I can only speak to smash really, but in smash your tech is not the most important factor. Your adjustments, reads, and mixups are. If you cover roll get up every time, you will lose. You need to, very quickly, understand your opponent's play style and capitalize on it. In addition, you need to be aware of when YOU are being exploited and strategically drop in mixups.
Many, maybe most, of the best players can't parry with high accuracy. But they don't need to either. They're the best because they're mind readers.
Because of rollback, I think it is possible cheats to work in online fighting games: you always have the ability to rollback a couple of frames and inject a block. I'm into Tekken 8 right now and have seen a few youtube videos of opponents auto-blocking/parrying/low-profiling everything.
Fighting games are also unique in that they're the cheapest to run. You just need a console and a 60hz display, and can share between opponents. While FPS gamers usually ask for at least 120hz, maybe even 240hz, and you need one per player, which can get pretty high with team 5v5 games.
Cheating would help in fighting games mostly by just having a bot play the game. No way a human can compete with a computer that always has frame-perfect inputs.
An overwhelming majority of players (not the noisy ones on internet forums) prefer anti cheat and don't care about the details of how the software is installed.
I might be old or something, but I really don’t give a fuck if someone’s cheating in a video game.
It was basically the norm when I was growing up, there was always someone using wall hacks or whatever, it was just kinda funny and never ruined the fun.
You are just old. Hacks absolutely ruin the game even for casual players, especially in the newly popular Battle Royale games where you might not run into the hacker until the very last part of the match. It feels bad to invest 20 minutes into a match, be feeling good about the finale showdown, only for them to aimbot you from nowhere - you never stood a chance.
The issue you're missing is the scale of the cheating.
When it is some small percentage of games you might shrug, hope you don't run into the cheater again, and move on to the next game where nobody is cheating. A few matches of your day get ruined but you still get to enjoy >95% of them so it's overall still a good experience. It has a very small impact on your enjoyment but you can move on and still enjoy most of your time.
It becomes a problem when there are so many cheaters that you encounter one in nearly every single game you play. Making it nearly impossible to play or win because the aim botting, wall hacking, infinite ammo, one-hit-kill, teleporting, invincible hacker is mowing down you and your entire team and the round ends in a few minutes. Except now it is 5 out of every 6 games you play and you hardly get to enjoy playing.
Additionally, back in the day you could leave matches without really getting punished for it. If you encountered an obvious hacker you could just leave and rejoin a new game. Now you get punished for leaving matches and might have to sit out a 15-60 minute timer if you leave too many games. Mix that with some high percentage of cheaters and you might be sitting in lobby waiting to play the game more than you're actually playing the game.
Let's say you enjoy playing Chess. How long would you enjoy playing against Alpha Zero - especially when expecting to play against someone your own ELO? At what ratio of playing against people cheating with Alpha Zero would you stop bothering to try and play Chess? I could tolerate it occasionally but if every single person I was playing against was just using Alpha Zero I'd stop trying to play Chess at all. It's no fun to lose every single time because the other person is always cheating.
Substitute any other pass-time for video games and I think most folks feel differently.
A pick-up game of basketball
A weekend mountain bike race
A corn-hole tournament at your local bar.
Someone cheating in any of these contexts would typically be upsetting. No one likes a cheater.
Video games are different because you can't call them out on it in real-time. You don't usually have any way to prove it. You also can't really escape it because there might be another cheater in the next lobby. In person, you have a lot more power or control over the situation (typically).
There are plenty of games you can play where cheating is allowed.
I think a majority of people who play competitive online games enjoy fair competition, and it really isn’t fun to play against cheaters.
I played NBA2k on PC for a few years, and unlike on consoles, cheaters were rampant. Half the games would be against players who were like 12 feet tall and could make every shot from anywhere on the court. It was zero fun, and I stopped playing.
I think “just let people cheat” is not a viable option.
It really depends on the level of cheats. Someone using wall hacks has a huge advantage, depending on the game, but it doesn't take that much more skill to outplay them. But when you get to a point where the cheats aren't just a tool anymore but do most of the work, the skills required to still win get so astronomically high that you will lose every time unless you are a top 0.1% player. Which isn't really fun anymore. And many cheats nowadays are exactly that: practically unbeatable. Not a challenge, not hard but doable with enough work, just unbeatable
Getting a win is the intermittent reward players get from these battle royale games against 20 or so other teams, when a hacker ruins that it's pretty annoying.
I think it depends on the kind of game. I played Team Fortress Classic back in the day and if someone was cheating it didn’t have a big impact. During the pandemic I got into FPSes again and played COD Warzone. In a game like that you have a multi minute build up to actually engaging another player, to go through all that then get beamed by someone with an aimbot is very frustrating.
This makes sense if you're playing games for fun with people you know, like on the old community servers, but nowadays games like CS are played competitively for money and clout, and usually with complete strangers. Fun isn't part of the equation anymore, or at least comes as a side-effect.
not only that.. we're not far from the point where it becomes undetectable because a camera fed AI instance on one computer is manipulating the inputs on gaming machine
I kinda feel the same way.. I imagine games not having community servers and focusing heavily on rank/seasons etc makes it feel a lot more serious? Idk I used to find community on dedicated servers, it was part of the game, with in game text/voice chat, now the community exists entirely outside of it in discords etc.
This sucks, but makes sense, nothing kills games community faster than cheating. And I don't think publishers spent time enought on combating it. I used to play Counter Strike since 1.5 era, and quit CS:GO entirely because there was a blatant cheater every match, even with the phone verification and AI trust factor (which Valve brags about it, but it doesn't work at all).
PUBG also had an era with lot of cheaters and lot of people dropped the game.
Like the article says, when Linux gets critical mass, with the Steam Deck's broader adoption for example (their market is still very limited) it will make more sense to support this.
I was into vidya about 15 years ago when I was in college.
Now that I've got all of the money to build a bitchin' system... I'm not into vidya.
The MBAs got to it and we now _must_ have a multiplayer game with anticheat because if we don't have anticheat how are we supposed to sell the tournaments surrounding the game to streaming audiences as a way to monetize an otherwise free-to-play* game?
We let people make this hobby into their whole lives and when you do that, it has to be monetized, and it begins to suck.
What online pastime we enjoyed 15 years ago hasn't been monetized all to shit? Making goofy YouTube videos? All about the big bucks now. Fuckin' blogging? Now there's Medium/Substack. Dicking around on a message board? Sorry, spez needs his billions. And if you're a gamer, don't forget to run some ads on your Twitch stream for easy money!
I really don’t understand all the people on this thread acting like gamers should just deal with cheaters. Anyone who plays online games knows how quickly it becomes not fun when there are obvious cheaters. It isn’t like 10% less fun, it is 100% less fun. Online games where you play against other people are fun because of competition, and cheating makes it so there is no competition.
There are a lot of games where cheating wouldn’t be an issue, but games like Apex legends aren’t those.
I said this in the other thread, but KLA isn't about preventing cheaters. It's about protecting the artificial scarcity of products for sale via microtransaction.
Progress has not followed a straight ascending line, but a spiral with rhythms of progress and retrogression, of evolution and dissolution.
— Johann Wolfgang von Goethe
I always struggled with Apex Legends on Linux. It didn't pre-load shaders, which led to a very jittery experience for the first round or two. Even after that you still get jitters here and there when it needs to load something new. It wasn't worth doing every time there was a new update.
Explain your reasoning here, because as i see it. It should be every game dev responsibility to ensure their game is not vulnerable no matter the platform you are using to play.
Not really my reasoning. The article has some quotes that basically the openness of linux means it is not difficult to compile your own distro that is purpose built for cheating. I have no personal exp with cheating systems or game dev. Assuming the quotes are true it would be beneficial to everyone(including themself)if valve took on the burden of making an anti cheat distro of linux for their gaming platform. Sure the game devs need to worry about security too.
It's true, anti-cheat on Linux is ridiculously harder than it is on Windows. You have many more hard to detect methods for a cheat program to interact with the game and fool-proof way to verify the environment.
How do cheaters circumvent bans? I would presume you have some unique copy key which is activated, and once it gets revoked should never ever allow you to connect to their game servers.
Company runs entire ecosystem, how apart from hacking their DBs you can ever get back?
If apex legends released a real dedicated server tomorrow, within a month there would be a large selection of well moderated community servers and cheaters would be mostly a non-issue.
EA doesn't care to actually moderate cheating, because that either takes ongoing money to pay people or a loss of control by releasing dedicated servers. They instead just want to pay 1 time to "automate" their "solution" to cheating... even though that pretty much never works long term.
That's the funny thing about it. People who are serious about cheating don't get caught and this Linux ban is all for naught.
The tech behind is quite fascinating actually. These days people use FPGA boards connected via PCIe to directly stream the memory contents to another PC. There is no cheating software on the gaming machine.
Disclaimer: I don't cheat, but these boards are the cheapest pcie fpga dev boards I could find.
The whole reason I stopped playing competitive online games was due to cheaters. The keyword is competitive. At least for me, I was always striving to get better and to move up the ranks. When you're consistently coming across teams that have one or more cheaters in them, the whole match becomes pointless. If that happens enough times, you lose the drive to participate anymore.
For non-competitive games, that drive generally isn't there, so it probably matters a lot less.
I don't think trust is a bad thing, but this feels forced and unpleasant.