Amongst the discussion of rootkits and anti-cheat, I would like to add that part of the reason it is necessary is caused by the game companies that took away the standard method of playing multiplayer -- players running their own servers.
It used to be pretty easy to just ban people from playing, now we're 100% reliant on their ability to do it. So we have anti-cheat which roots our computer, and still doesn't 100% solve the problem.
The reason it's necessary is because players want to be able to play with/against other players around the world. Matchmaking requires some form of anti-cheat. Running your own server as admin can't give you the degree of competitive global ranking that players enjoy today.
And cheating is an arms race. It's just hacking. You either preserve game integrity or you're going to have cheaters.
This has nothing to do with anti-cheat. I work on Rust and most servers are hosted by the community and there is a good modding+custom map scene. The game has an anti-cheat because it's a big target for cheaters.
Rust remains maybe the last true community game that's just solid all the way through where the studio is good to its players and doesn't patronize and betray them. I can have the sort of fun I would have had 20 years ago in Rust, and everything else feels like monocultural slop by comparison.
I wish more of my friends wanted to play it, and wish I had more time for it.
Naah, Rust from Steam just doesn't even launch on Linux for me (Mint aka Ubuntu aka Debian). Regardless of "Compatibility" choice of Proton. So there's no opportunity to even choose the server.
You need to run RustClient.exe instead of Rust.exe (default) to skip EAC setup. The only way to do this in the Steam UI is to add it as a non-Steam game.
Actually it kind of works out because cheaters want to play with people who aren't cheating. The few servers that run with anti-cheat disabled would have small communities that aren't attractive to cheaters.
This is the truth of it. If you can unlock all the on-disc DLC or create and use your own maps, mods, skins, etc. it risks the money companies want to take from you after you've already paid the $60-$80 for the incomplete game itself.
Anti-cheat is about protecting DLC profits as much as it is anything else.
It's a shame too because we got so much good content from random people who just loved the games and wanted to create neat things for them. It was one way that some people started their careers in the video game industry and it spawned a lot of other websites and communities around sharing, reviewing, and creating all that free content.
Not really. A huge number of players are on consoles that have little to no support for mods and games today have too many centralized online servers and companies who keep insisting on control over your local PC which means that game companies can decide what mods you can and cannot have on your system.
There was a time when the concept of "banned mods" only ever applied to a specific server out of countless other servers and locally you could do anything you wanted, even run your own server.
I agree with you in sentiment and am very nostalgic for the pre-monoculture days, but I also acknowledge that competitive games are a multi-billion dollar industry, and trying to moderate a game with millions of players in a distributed environment is just a non-starter.
You reject the premise that such control is necessary for your idea of fun.
But millions of players enjoy ranked matchmaking enough that without aggressive anti cheat you will wind up with cheaters.
I hate the root kits as well, but if you spend any time playing Valorant vs CS, you will see the difference. If I play CS consistently I'll get cheaters once or twice a week. In Valorant it's almost unheard of by comparison. It sucks, but that's just what's happening.
Do I wish I at least had the option in Valorant or whatever to host a server? Absolutely. Do I think they use the rootkits maliciously? No, generally not. Do I think studios are disincentivized to provide server hosting due to DLC or microtransactions? Definitely. But I also think there's often also a game integrity component. All of these things can be true simultaneously.
> The reason it's necessary is because players want to be able to play with/against other players around the world. Matchmaking requires some form of anti-cheat. Running your own server as admin can't give you the degree of competitive global ranking that players enjoy today.
Case in point, Counter Strike is a rare example of a popular game which supports both the "modern" matchmaking paradigm and the classic community server paradigm... and for better or worse the playerbase overwhelmingly prefers matchmaking.
> and the playerbase overwhelmingly prefers matchmaking
The server browser is buried under a couple layers of obtuse menus (and, at present, is completely broken on my SteamOS machine) while matchmaking is obvious and straightforward. You cannot come to any reasonable conclusions about player preference given the way the UI drives players towards matchmaking and away from servers. If they were presented on equal footing you might have a point.
Consider also TF2. It launched as a server-based game, and in the years after matchmaking was added Valve went through many UX iterations designed to drive traffic to it before it was more popular.
Counter Strike makes matchmaking far more prominent than community servers, so I don't think this is that good of an example. For a game like Team Fortress 2 where the options are presented more equally, It seems the players are closer to a 50/50 split. The reality is that most people follow the light patterns that get them in a game, which most modern multiplayer games make that matchmaking.
People are still playing Battlefield 4 (2013) on user-hosted servers. Right now.
The only way that "around the world" can be relevant is ping, and the best way to manage ping is by sorting a list of servers by ping.
Cheating is an arms race that no one needs to participate in. Moderation was a perfectly good workaround until major game studios decided to monopolize server hosting.
My point is that player-moderation scales, while corporate moderation does not. The fact that there are more players on corporate moderated servers only makes this reality more significant.
It's clearly one significant measure. What do you think is going to happen to tournament money if every other tournament has a cheater? How many esports fans want to go play League after watching Faker decimate another team if they have cheaters in their match every other day?
What it tells you most of all is popularity and incentive to cheat. Cast a big enough net and you'll inevitably find cheaters. The bigger the net, the more cheaters you'll collect.
> can't give you the degree of competitive global ranking that players enjoy today
I'm curious to know how player stats and global rankings truly affect game adoption (not that you can accurately measure what I'm asking for). It seems to me the more popular the game the less it matters because everyone becomes a small fish in a big pond. Rank one billion out of a gajillion. The games where it matters more would be the smaller games, which have less of a cheating problem to begin with.
I do agree however that you won't get the adoption without centralization, if only because centralization is exactly where all the money resides, via DLC and other nonsense. Therefore centralization is exactly where all the marketing money goes. And without marketing you don't usually get blockbuster games. So expecting the rootkits to go away is a lost cause, until client-side rendering goes away, at least.
That may be the answer to playing these rootkit titles on Linux: just stream it. I know it's somewhat lame, and I know it adds latency, but I seem to recall a recent demonstrate of a service where the latency is very minimal. Clearly I'm a bit out of touch with the state of the art, heh.
Yeah, this is pretty clear. The community for any competitive game if you are a member of the top 100 players is always amazing. These players play the most, they end of seeing each other over and over, and you build up a rapport with the other players and can start to play against specific peoples play-styles.
However, for the vast vast majority of the player-base who is top 50% in skill, the fat normal distribution nearly guarantees that most of the people they play against will never be seen again. And therefore there is no harm for them not to be toxic to them, so most people only ever experience toxicity in online competitive games.
Server browser games solve this because players end up with "home" servers where they come back to over and over, and over time build communities who do the same. This was taken away from the players when we moved to matchmaking, and many in the player-base have a bias against matchmaking because of it.
But this is in no way required, and merely a result of gaming companies to do any work on this front. It would be extremely easy for these games to add an arbitrary community tag to the matchmaker that would attempt to put people in games with players that they have not previously reported. The matchmaker might take a little bit more time, but since these players are in the fat normal distribution, their average matchmaking times will still be incredibly low.
WRT player stats and rankings: I'm inclined to disagree. Rankings in small team-based game communities tend to be pretty noisy. Matchmaking often ends up constrained by the number of online players searching for a game at the same time, so the teams may not be well balanced, and the outcome of the match can be decided by the presence of a single highly skilled player who happened to be searching for a match at the right moment. The resulting rankings aren't necessarily a good measure of player skill.
Larger games have the luxury of being able to place players into teams consisting entirely of other players of similar skill levels, against teams of similar composition. The results of those games are a better reflection of those players' skill.
> Rankings in small team-based game communities tend to be pretty noisy.
PP wasn't talking about ranking stability. PP was talking about the "Why should I give a shit about the leaderboard when ten million people play the game, and I'm someone with life obligations that aren't 'playing this game, exclusively', so I'm always in the middle of a sea of strangers because I can never git particularly gud?".
You might argue that the solution to that is to have separate rankings for folks in your friends' (or whatever) list, and I agree... but I'd get the same thing as filtered-to-friends-only leaderboards with leaderboards that are restricted to the population of players on the private servers on which I play. Plus, private servers give you the option to benefit from active admins who ban cheaters and other shitheels forever. [0]
[0] Or encourage them to cheat and be godawful, if that's the sort of server that they want to run. All-cheats-all-the-time and/or vent-your-spleen-24/7 servers are fun, too... just so long as folks are informed of what they're getting into by joining.
Are the stakes not still zero? Aren't like 99.9% of players not at all competitive in any meaningful sense basically by definition? Like if Counter-Strike has 1M active players, and you are in the 99.9%-ile, you are still only in the top 1,000. Do people watch the rank 1000 players? Are they making a career out of it? What fraction of the player-base thinks they are actually competitive vs. is just playing a game?
I actually think a big part of this anti-cheat push is just developers wanting their players to think something real is at stake. Yes we put a ton of effort into protecting your very important Elo score from hackers so you confidently sink hours into improving it.
If they would just let the cheaters win their way up the ranks, they could have their own little cheater lobbies and we wouldn’t have to deal with them.
Right, this is also my suspicion. It's all ultimately a way to psychologically manipulate people into buying more microtransactions. It's then important to always point out how silly and obvious the whole thing is. It's like if your local sports organization at the park insisted on drug testing everyone so they can try to convince you your beer league volleyball game is actually very serious and you should buy Air Jordans or fancy shorts to up your game. These people are a joke.
For some games like dota 2 cheats only make them marginally better at the game but much more frustrating to play against. The most common cheats are map hacks and instant action scripts both of which can be useless without the game knowledge for correct play. But both of these cheats make playing against them frustrating but they wouldn't rise to the top.
Again I think there’s a better way if we push through the concept of a fair game, and just focus on fun. It should be possible and accepted to block (and never match with going forward) players who are just… unfun. Annoying, poor sports, or cheaters. Heck, maybe player-curated and shared matching and blocking lists could become a thing.
Games are a social thing we do to have fun, there’s no obligation to spend your limited social free time hanging out with annoying people.
The problem is the reverse of what is being argued here. The stakes are high because of how much money these companies are making off of DLCs/in-app purchases. The game operator thus has an incentive to ensure that high value customers can't be banned by third parties. Instead of just being banned, the player is suspended 24 hours or something, and then they come back.
Came here to find this comment. It is NOT about matchmaking and/or "protecting the incomes" of competitive players AT ALL! It is solely about protecting these games' in-game shops and associated economies. The real comp scenes are all done on LAN anyway, with entirely different anti-cheat setups.
I think it’s streaming in particular. With actual competitive games, like, tournaments and whatnot, the players are well known and they are competing in actual tournaments, right? The play is broadcast and all the players have their professional game-player reputation at stake, so there’s a strong incentive to not cheat (it is a very cushy and high-skill job with almost no transferable skills, so like, better not get booted). It is just that streamers might bump into cheating and that’s annoying for their viewers I guess.
When people play in these “competitive” matchmaking queues, it is more like a pickup game. If somebody shows up to a pickup baseball game with a corked bat, they are just kind of a loser and it isn’t a big deal, right? There’s no actual reward for hitting “platinum rank” or whatever in most games, other than skins or something. Nothing real is on the line.
IMO: we really should just have let these people cheat their way out of the normal matchmaking population. Smurfing is a much bigger problem. I don’t actually care if the guy dominating the match with some 60:0 kill-death-ratio is cheating or a semi-pro beating up on casuals, haha.
More distributed and more manual. More administrative overhead. More localized culture we all get nostalgic for. Much more effort to play against peer competitors.
It's the same phenomenon you see in many sectors.
Access is democratized and the friction/barrier to play is dramatically lowered/free, and the localization is diluted or non existent and just a monoculture.
Does it though? Unless winning has real-world rewards, does it really matter that much if you are playing against someone who is cheating, if with cheating, they are evenly matched against you? Assuming the matchmaking works well, people who cheat would end up getting matched with either other people who cheat, or people who are good enough to compete against cheaters.
Not sure how to understand these questions. Have you ever played in a competitive game of any type, virtual or real?
A cheater isn't evenly matched against you. No one is good enough to compete against wallhacks/aimbots, never mind that it shouldn't matter. It ruins the experience, ruins games, ruins the spirit of competition and sport.
This argument is that the match-making software is incompetent. If what you say is true, and the match-maker could determine skill with any ability, then the cheaters would quickly find that the only people they match-make with is other cheaters. The non-cheaters don't care that the cheaters exist if they never play against them.
Most competitive games these days are free to play. A cheater gets banned, makes a new account, and gets placed on the competitive ladder level of a new player, and stomps their way up the ladder against unskilled players until they get banned, and repeat.
For players that cheat less egregiously and don't get banned, it's still obvious many times when someone has no skill but is using cheating as some form of assistance. It's not fun to play against a player who has a similar K/D ratio as you because they suck at aiming but can see through walls, or because they can instantly headshot people but have bad positional awareness or understanding of other game objectives like capture points etc.
It's like telling a high level chess player that playing against a child with poor chess knowledge but they're allowed to just ignore checks and flick your pieces off the board is similar to playing against an equally skilled non-cheating player just because they're capable of beating you only 50% of the time. A victory doesn't feel earned, a loss doesn't feel like an actionable learning experience.
The problem here appears to be the banning. If the cheaters are never banned then they will continue to only play with other cheaters, and everyone is happy. And in fact, to a normal player I doubt they care very much if the player is legit and smurfing or if they are not legit and cheating. That player ruins the game they are in.
The ranking system needs to be a better determinate of skill, especially early in a new accounts life, so that they can stop harming normal players games. This might mean changes to the rules of a game to allow this to be done better. The match-maker should take this into account, so that if a player does go up against a player that was far from the skill level that they end up at, it should protect that account from being placed with new players for a time so that they can forget about it.
For the example you choose for Chess, you might force players to do Chess Puzzles before they can queue for their first match. A normal player would then never see any cheaters.
Cheaters don't want to play against other cheaters. If they end up against only cheaters that's a kind of soft-ban or shadow-ban and once they figure out that's the case they'll do the same steps as if you had actually banned them. It also angers legitimate players to know that the top ladder tier is for cheaters only. If you're 200th in the world and legitimate, other players will say you only got that rank through cheating.
And the very best cheaters are still good at the games they cheat in, they just want to use cheats to be even better. One famous example in a game I play is Riolu in Trackmania. He was probably one of the top 10 players in the world. But he wanted to be #1. When he was accused of cheating it took a mountain of evidence for anyone to believe the accusations because he could set a world record live in-person. He just used cheats to be able to do it with fewer attempts.
Riolu is a uniquely terrible example. While he used Cheat Engine to slow down gameplay, he could have just as easily used TAS to record and replay his inputs since TrackMania is deterministic. This is still possible today. This will always be possible even with Kernel level anti-cheats.
I'll note here that the work that Nadeo has done on the matchmaking aspect is in line with what I'm thinking and should be expanded throughout the online gaming space. A division 10 COTD player will never see a cheater. If cheaters do show up, as they commonly do in Weekly Shorts leaderboards, the community ignores it. Their region leaderboards do a much better job than typical games of bringing the community together and they promote continuity. When top players smurf COTD on a new name, the community sniffs it out within the hour. TM doesn't need anti-cheat.
- If you were too good on some server, you'd get banned.
- If the admin doesn't know well cheating, he could tolerate something that was obvious cheating.
- Cheaters could just change server often.
It used to be easy to just ban peoples yes, and it was as easy to switch servers.
Plus on most competitive game today, you have custom lobbies, which do exactly what you want, and there is a reason why only a minority of players uses it.
Custom lobbies don't meet the same need. That's for playing with your friends, or at least, people you vet yourself. Community servers are a sub-community in of themselves: people tend to play on the same servers on a regular basis, allowing you to build rapport, community norms, and have substantially more direct moderation than company-run servers.
Yes, sometimes you run into power-tripping moderators. That comes with the territory of having moderators. But the upsides, of being embedded in a usefully-sized community, and having nearly constant human moderation, not to mention the whole "stop killing games" of it all, far outweigh the need to shop around a bit for a good server.
I think the ideal middle ground is something like Squad's server system: The developers offer a contract to server owners, establishing basic standards that must be met to be a recommended server. Rules forbidding the crazy bigotry that milsims tend to attract, minimum server specs to ensure smooth gameplay, an effective appeals process. If a server meets those requirements, and signs the agreement to keep meeting those standards, they get put on a "recommended" server list (which 90%+ of the playerbase exclusively use). Other servers go on the "custom" server list, which can be modded, or spun up for certain events, or whatever.
two or three months ago, I played a game that did exactly what you proposed, V-Rising, it have a server browser, I played a week with friend on a busy server.
Then the server was gone for two weeks. When it was back, mosts of the bases were gone due to inactivity.
That's the kind of things that were common too, maybe you forgot about it.
All the multiplayer games I play today are either community server based, or I exclusively interact with private lobbies.
My negative experiences with community servers represent a pretty short list. Sometimes servers die, but games die sometimes, too. That's obviously only an issue with persistent-state games, like Minecraft, but it's unfortunate when it happens. Can't say it was so frequent that it impacted my enjoyment of any games as a whole.
All true, but of course you're missing the player agency component that renders those issues moot. If any of the above happens, you can simply find another server.
Private games (now called "custom lobbies") were available back then too, they're not equivalent to a public server browser.
They are functionally equivalent for the player.
The problem with player hosted servers is that it was very hard to get a fair and balanced competitive match, where now it's extremely common with matchmaking on servers hosted by the game company.
Back then at least you could do something about it. Now if there's an obvious cheater you just kinda sit there and take your L, and ask people to make reports.
If you were playing on a server you owned or for which you had ban permissions, you could do something about it. Otherwise, you had to hope that an admin was online to ban the cheater. If no one was around to take action, your option was to... sit there, take your L, and ask people to make reports (to the admins). You had the option to hop around between servers until you found one that didn't have cheaters, but is that all that different from just quitting back to matchmaking and hoping you find a match without cheaters?
Edit to add: I'm not disputing that kernel-level anticheat is bad; I agree that it is. I don't think it helps to try and hearken back to a golden age of PC gaming that didn't really exist. Maybe it was easier for server admins to manage because player populations were smaller back then, but that's about all that would have made things "better."
This is drudging up some formative memories. In the counter-strike / TF2 communities you'd have servers that would grant vote kick rights with more playtime and some of those regulars would then apply for mod rights. It worked quite well.
It still doesn't solve the unfair votekick problem. People with more play time, doesn't have necessarly the abilities nor tools to judge if someone is cheating.
Take a look at the trackmania community, some cheaters are caught years later, because they played it smart.
Some cheating can't only be observed by looking at the statistics, or hard proof of cheating being ran.
It's a pub. It doesn't matter as long as it's not obvious aim bots and people are having fun. Besides when it's a 32 player instant respawn death match server you have like 200-300 regulars. That type of cheating was never an issue in those because the servers were always full during peak times and everyone kinda knows each other.
They are not functionally equivalent, unless there are games I'm not familiar with where custom lobbies are published in a list for strangers to join. Normally a custom lobby implies invite only.
Not everyone is interested in a "fair and balanced competitive match" where you're guaranteed to win no more and no less than 50% of the time. I actually find that intolerably boring.
> They are not functionally equivalent, unless there are games I'm not familiar with where custom lobbies are published in a list for strangers to join.
Lots of the mosts played competitive games have that, or third party websites/discords that have links to custom lobbies.
> I have to conclude you're unfamiliar with what multiplayer gaming was like when servers were the norm.
Did you even played a single game competitively ? The fact you keep pushing for server browser tell me that no, you need communities on something else.
You likely forgot the hassle that server browser were, and forgot that lots of games didn't had a server browser.
LFG communities were important and excluding this shows you were only playing casually, forgot all the problems servers browser had.
Do you even remember, that you could get malware by joining servers in a server list ?!?
No, I used to play multiplayer games for fun, which was the norm until that option was removed and replaced with derisive "casual" and "competitive" modes.
99% of people who played CS1.x/tf/Q3A/bf1942/cod/etc booted up the game, found a server in the browser with low ping to play on, and if they liked it they favorited it. They came back the next day, and the next, and started to recognized other players. That is the server browser experience.
If you were in the tiny minority of players trying to be "competitive" back then, you're right I don't know what it looked like for you. Sounds like it sucked, honestly, and maybe competitive matchmaking solved some of those problems, but in the bargain we lost a lot of what made those games fun for "casuals" as you smugly call us.
> ...you needed to sink in a lot of time to get the few quality time you wrote about.
Sounds like you've got a skill issue. That doesn't match my experience, like, at all.
But a really, really easy shortcut was to find servers that indicated that they were furry-friendly. This all but guaranteed that
1) The folks on there would be fairly even-keeled and reasonable, and folks who weren't would be rapidly banned forever.
2) The folks on there would generally be good at the game. [0]
3) If you're lucky -and the game is one that permits custom "sprays" (as HL1 and Source engine did)- you might get to see some high-quality-but-thumbnail-sized furry porn.
[0] Seriously, at least back when both server browsers and user-hosted game servers were commonplace, I found a 1:1 correlation between "Are they a furry?" and "Are they particularly good at the game?". It was wild.
> The problem with player hosted servers is that it was very hard to get a fair and balanced competitive match
Playing against overwhelming odds has its own kind of charm. I once spend days just sabotaging the top players on some gun game servers, only wining myself once or twice. Games against friends with various fun handicaps and flat out abuse of any knowledge you could gain from playing against the same people repeatedly - what good is a hidding spot when everyone knows you will be there 50% of the time.
"Fair and balanced" games against completely random people are just missing something for me.
This is something matchmaking games totally miss which keeps them from being truly competitive in the way sports or old games were: a competitive community. You need other players with known identities to compare yourself against on a consistent basis.
Of course, classic competitive institutions had problems as well (“he’s very competitive” is not necessarily a nice description of a person!), but they seemed more enjoyable that this matchmaking stuff.
I did indeed play in the era LanceH is talking about, and I agree with them! We had many thriving communities with no serious cheating problems because of community moderation.
Yes, there were poorly moderated servers, but you could simply leave and try a different community until you found one that clicked for you. When you require equal moderation everywhere, you throw the baby out with the bath water.
Initially, until you found the right community run ones? I don't see the issue. Today is worse, especially when there is no server browser but just a blackbox that drops you in a random match.
This ignore actual history: anti-cheats started on community run servers. Because the majority of admins are not dealing with cheaters it because they enjoy it, but rather out of necessity. I see everyone here appreciating good admins, not many people are going to be volunteering themselves.
Punkbuster for Team Fortress. BattleEye for Battlefield. EasyAntiCheat started for Counter-Strike. I even remember Starcraft Brood War ICCUP's anti-hack client. You can see this in modern community servers too. Face-IT and ESEA for CS2 have more anti-cheat, not less. FiveM, which modded GTA V for community servers, never worked for Linux even before they added anti-cheat to the full game, because they had their own anti-cheat, adhesive.
Admins for modern game servers are not going to be interested in turning off their anti-cheat. That just gives them more unpaid work for little gain.
This is the exception that proves the rule. When you host your own community server, you control how much anti-cheat is built into it, like GP said. That usually meant about none but manual admin bans, but it could also mean lots, like you said.
> It used to be pretty easy to just ban people from playing
I ran servers for a lot of games. It was often difficult to ban people from playing. First off, someone with ban permissions would have to actually be online at the time. So often nothing would happen at all, you'd just have to leave and find a different server. Second, one could get banned, often just change their IP or use a different CD key or whatever other identifier the game used, and hop back on with a new identity.
Meanwhile discoverability of similarly skilled matches were a challenge, along with actually playing with a group of friends against new people. Its not some perfect panacea, there are a lot of things people disliked about picking private servers to play on.
All of this is hard but solvable at least for some genres, with the help of the platform and game devs. A decade+ ago, I ran servers for several PvP sandbox games, we've been one of the major EU hubs. This was pretty complicated - tons of custom observability tooling, a community with 24/7 mods, investigations, mod transparency, etc. The IDs were partially solved by Steam, the rest was handled by player behavior tracking and reputation.
We also had skill-separated servers. Casual ones had votebans for teams and players that were too organized/skilled/abusive, with case by case mod approval. Anarchy servers had nearly zero rules and were absolutely cutthroat and toxic but fair, you always knew what you were signing up for. They even had mods temporarily banning players for whining.
Cheaters never lasted long in our servers, including returning ones. Running a dedicated server takes some dedication. Know the game and people you're doing this for.
The only actual problem with cheating is leaderboards.
When you have accurate matchmaking, you will be playing against other players of a similar skill level. If you we're playing in single-player mode, it wouldn't bother you that some of the players were better than others.
Whether the person you're playing against is as good as you because they have aim assist, while you have a 17g mouse and twitch reflexes shouldn't matter. You're both playing at equivalent skill levels.
The only reason it matters to anyone is that they want their skills to be recognized as better than someone else's. Take down the leaderboards, and bring back the fun.
Comments like this just make me upset to the point I can't cohere an appropriate argument. It's so out-of-touch with reality and completely ignores the core problem that I have to believe you're just fucking with us.
No, it is not fun to play against smurf accounts using hacks. They aren't doing it for the leaderboards, they actively downrank themselves to play against worse players!
And no, it's not fun to play against cheaters who are so bad at situational awareness their rank is still low, but who instantly headshot you in any tense 1v1 and ruin your experience.
And no, I actually do care that people are cheating in multiplayer games because it's not fair. Since when do we reward immoral fuckwits who can't or won't get better at the game?
Why don't we just start letting basketball players kick each other and baseball players tar their hands while we're at it. Who cares if the sanctity of the sport or competition is ruined - we're a community of apathetic hacks.
I play online FPS with friends for fun. I don't care about leaderboards, but I know people that do and don't want to take them away from them.
You can't have accurate matchmaking and allow cheating. People cheat for a variety of reasons, at lot of cheaters are just online bullies that enjoy tormenting other players. In a low ELO lobbies, you would have cheaters that have top tier aim activated only if they lose too much, making the experience very inconsistent.
Top tier ELO would revolve around on how the server handle peeker advantage and which cheater as the fastest cheating software. It's an interesting technical challenge, but not a fun game. As soon as a non cheating player is in view of a cheating player, the non cheating player dies. That doesn't make for a fun game mechanic.
>"Top tier ELO would revolve around on how the server handle peeker advantage and which cheater as the fastest cheating software. It's an interesting technical challenge, but not a fun game"
Fun fact, this does exist. There used to be old CS:GO servers that were explicitly hack v hack, would make it abundantly clear to any new visitors that stumbled upon the servers that you would NOT have any fun without a "client", and it was a bunch of people out-config'ing each other. It was actually kinda cool for those people, it would NEVER be fun for anyone else.
Try playing Rust without anti-cheat and you will immediately change your tune. It isn't fun playing a game where you can lose everything to a guy who can cause bullets to bend around objects.
Yea, that's one game that's more fun to watch than play I will admit, so mostly I'm a "pro rust watcher with over 300 hours watching rust" (this is a bit of an in-joke, sorry) who sees the annoyance and lack of fun people have when they get destroyed by cheaters. I did play one wipe, and spent 25 hours over 3 days in the game, so I chose to quit right there instead of doing that on a regular basis.
Oh for sure, and even now I occasionally watch videos as background noise during work - but it's just not a fun game for the vast majority of times I log in. I'm about 175 hours in now; and for the one time a month I play, I can't be assed joining anything besides a 3x anymore with a wipe at least 10 days away, it's just too much sunk cost and wasted time even getting a 2x1 down in official or vanilla servers.
It's fun when I get something down (and fully use a starter kit, if a server has it) and have neighbors to dick around with, or there's not enough traffic to actually enjoy landmarks and underground, or occasionally when I meet someone that's down to team up or just talk on mic while pacing around one of our bases. But when that doesn't happen, I'm just not having fun haha
Not just single player. Even in competitive multiplayer a lot of the complaints about "cheating" are actually complaints about matchmaking, and "cheating" is a giant red herring (griefing is a different matter, of course, that gets lumped into the umbrella term of "cheating"). But trying to explain this is typically like pissing against the wind, because people already believe in the existing status quo (no matter how irrational it is) and no one wants to change their beliefs unless it obviously and immediately short-term benefits them.
I worked at a company once that didn't use any anti cheat. I once asked why, and they said the matchmaking system solved the problem for them. The matchmaking was good enough so cheaters only ever played with other cheaters, and it kept the numbers up.
Honest players never really complained, so I guess it worked for them.
At least in the world of chess (which has the OG matchmaking system, ELO), cheating is genuinely a problem.
The problem is that it doesn't matter how good you are. You will not beat a computer. Ever. Playing against someone who is using a computer is just completely meaningless. Without cheating control, cheaters would dominate the upper echelons of the ELO ladder, and good players would constantly be running into them.
> Without cheating control, cheaters would dominate the upper echelons of the ELO ladder, and good players would constantly be running into them.
...and, even worse, if they ever got to the very top of the ladder and started only playing against other cheaters, then they'd actually weaken their cheats so that they could drop down in ranking to play against (and stomp) non-cheaters again, and/or find creative ways to make new accounts.
Cheaters ruin games. The fact that the GP is so deluded as to claim that "The only actual problem with cheating is leaderboards." suggests that they've never actually played a competitive matchmade game on a computer before.
This is fine if you are low level, because the cheaters will be too good to play in the low level games.
If you are in the higher skill levels, you might end up playing too many cheaters who are impossible to beat. If the cheat lets you be better than the best human players, the best human player will end up just playing cheaters.
> If you are in the higher skill levels, you might end up playing too many cheaters who are impossible to beat.
It's almost kind of worse than this. If you are in higher skill levels, you end up getting matched with cheaters who lack the same fundamental understanding of the game that you do and make up for it with raw mechanical skill conferred by cheats.
So you get players who don't understand things like positioning, target priority, or team composition, which makes them un-fun to play with, while the aimbots and wallhacks make them un-fun to play against.
And as a skilled player, you are much better equipped to identify genuine cheaters in your games. Whereas in low skill levels cheaters may appear almost indistinguishable from players with real talent so long as they aren't flat out ragehacking with the aimbot or autotrigger.
There are still plenty of games that use community hosted servers for multiplayer. I play some of them (Rust, for example).
First, cheating is absolutely still an issue in Rust. Sure, server admins can kick them out... once they have been discovered, verified by an admin, and kicked. The damage is usually done by then, and that is the best case scenario... often, the admins aren't available at that moment, because they are normal people who are not online all the time.
Plus, this means you have to search and find a good server to play on. That isn't always easy, and limits your ability to find a good game.
Second, lots of games I love to play don't make sense in the 'server hosted by a community member' model.
I love playing sports games... Madden, FIFA (now called FC), NBA2k, etc. The best way to play those games is often 1on1 against someone who is close to your skill level. It isn't fun to play against people way worse or way better than you.
The only way to do this in a way that lets me get a good game whenever I want to play is to have some sort of matchmaking system, that keeps track of how good i am and finds players who are about the same skill level. There is no way this would work on user hosted servers, and even if it did, why would a user hosted server be better at solving this problem than a company hosted one? You need a TON of players to be able to do good skill based matchmaking 24 hours a day.
I have been playing multiplayer online games for over 30 years. I started playing when I had to call my friend on the phone, tell him to tell his family not to answer the next call because it was my modem calling, and then hope to god my sister didn't pick up the phone during our game and break the connection. We had to develop a code to signal if I was actually trying to call him to talk about an issue; if I called and hung up immediately it meant I was voice calling and the next call he should answer with the phone.
I have played every iteration of multiplayer gaming. I played Warcraft II when you had to pay $20 to subscribe to Kali to use their virtual IPX service. I played local Counterstrike games at the college dorms on the local network (which was not even a switched network!) I run Minecraft servers for my kids on my local network. I have written multiplayer games for both peer-to-peer and server based multiplayer.
No, you can't recreate the modern convenience and pleasure of company provided matchmaking by going back to community hosted servers.
Instead of anti-cheat on the client side, which 'kernel level' anti-cheat still gets beaten, why not look at a wholly server-side statistical analysis of player stats?
Make the anti-cheat follow one of the key tenets of cybersecurity: never trust user input.
Should work reasonably well for first-person shooters.
You're ranked based on the game's inner metrics, calculated on the server, rather than player-visible ones:
- time from observation to target contact with crosshairs (inc. standard deviation, standard error)
- % of time successfully striking specific hit boxes
and so on (depending on the game).
These rankings don't affect your public rankings but do affect who you're match-made with, or games that don't have private server options. Eventually you'll only be match-made with other cheaters, or players so good they give cheaters a genuine run for their money.
For games that do have private server options it could be configurable to:
- flag the player to admins as 'suspicious' for investigation
- Start ignoring hits that would've otherwise been successful for statistical outlier behaviours (where the statistical analysis indicates a significant disparity between observed and known-human-like reaction times and behaviours).
> caused by the game companies that took away the standard method of playing multiplayer -- players running their own servers
Let's be real, what % people among those who game are interested in running their own game server? I'm definitely one of them, and one of my earliest tech memories was setting up a CS 1.6 game server for a bunch of classmates (and being unable to play myself because the computer had nowhere near enough capacity for both the server and the actual game running at the same time); but it's a minuscule percentage.
This isn't a problem because any given server can support hundreds or thousands of weekly players, so only 0.1% of your playerbase needs to run a server.
We had this, it worked, for years. I'm baffled by all the posters saying it won't, because it did.
There are games I play were one of the players' machines becomes the server. In some it's transparent to them, you just join their world or lobby, in others it's explicit and you even have to input the host's IP to enter.
Standalone servers you need to run separately and care for are much more rare.
It's not the 2000s anymore - you don't have to run/rent "hardware" and worry about "connectivity" and whatnot. For most games that offer dedicated servers, there are services with easy to use panels with fancy colored buttons and everything.
I never ran a server back in the day but I still benefitted from community run servers where decisions about banning were done by volunteer admins. These days with centralized servers it has to be automated.
Back in the "small communities on their own servers" people also cheated. It was never entirely clear who cheated and who was just good and/or lucky with plenty of false positive bans also. Nothing about this was "easy" in any way. Which is why anti-cheat tools like PunkBuster have been around for 25 years.
Interesting thing I noticed trying to play old versions of Call of Duty a year or two ago -- the oldest ones which supported hosted servers, there are still players, but once they switched to matchmaking either no one is playing or its so tiny you never get connected.
The entire narrative of "cheating" is a giant misdirect. People don't actually care about cheating, they care about fun. If a player is making the game less fun, it does not matter how.
The real problem is that ~10 years ago major game studios decided to monopolize server hosting. This means that the responsibility of moderation is now in their hands. The only way this problem can ever be resolved is by giving the authority to moderate servers back to players. Until then, the responsibility to moderate will be unmet, no matter how fascist and authoritarian game studios become. Fascism cannot guarantee fun!
Even if custom game servers were a preferable experience, which I would argue against, it doesn't really do anything for this problem.
By the time you have to wait for someone to cheat just to ban a single user, the disruption is already done. Your 4v4 45min game is already disrupted and everyone has already wasted their time now that you have to kick someone.
It's kind of like thinking you can forgo anti-bot measures because your website's users can just report the bots: by the time it's your users' problem, you've ruined the experience for everyone except the bots.
I would much rather my 45 minute game be disrupted and the user booted permanently by moderators VS every game be disrupted for months while the developers try and work out which parts of my privacy they can invade to maybe hopefully boot the cheaters.
You didn't answer the GP's question. You talked about what you wanted.
The answer to their question is: the majority of people who play competitive matchmade games online have decided that they want anticheat, and disagree with you.
It's funny because this isn't even a hypothetical, you're actually just wrong!
The majority of people who play competitive matchmade games online didn't get consulted, the developers put anti-cheat in after the audience was already entrenched. The players didn't "decide" anything, Riot games decided it in like 2020 and the players have middling to negative feelings about it. You weren't talking about Riot Games? Well you said "majority of people who play competitive matchmade games online" and that's Riot Games, so yes you were.
> It's funny because this isn't even a hypothetical, you're actually just wrong!
Citation needed. Strong assertions like "you're just wrong" are automatically false if evidence isn't provided. Where's your evidence for this?
> The majority of people who play competitive matchmade games online didn't get consulted, the developers put anti-cheat in after the audience was already entrenched.
Completely irrelevant to anything we're talking about here. Although I'm not surprised, given that it's coming from someone with other utterly insane statements like "I would not be shocked if simple vote-kick outperforms every anti-cheat on the market." that suggest that you've never played competitive matchmade games or interacted with trolls on the internet, or completely failed to respond to hombre_fatal's question (whether due to bad faith or lack of reading comprehension is unclear) and just made some unrelated snide statement.
That they brought up League of Legends in 2020 makes me wonder if they were around when all we had were private servers or custom lobbies. That would explain their rose-tinted glasses.
In games like Warcraft 3 and Halo 2, the automated ranked matchmaking was well-regarded and a huge departure from waiting for a lobby to fill only for the admin to kick you because his friend wants to join or because you're playing the Age of Empires civ that he wants to play.
Auto randomization also baked in solutions to questions like how to stop people from farming rank.
The developers aren't pro players either, the cutting edge for anti-cheats still require that non-cheaters play with cheaters for months. I would not be shocked if simple vote-kick outperforms every anti-cheat on the market.
> By the time you have to wait for someone to cheat just to ban a single user, the disruption is already done. Your 4v4 45min game is already disrupted and everyone has already wasted their time now that you have to kick someone.
The difference is there is usually an existing level of trust between people playing on a private server. Usually your group would know ahead of time if someone is going to potentially be a problem.
Furthermore, even with public dedicated servers, there's a psychological aspect to it - it's no longer just a random matchmaking server; you're almost walking into someone's house. Many people feel a lot more pressure not to misbehave
Then there's the fact that you don't have to wait many days for your cheating report to hopefully be acted on. Our game got interrupted? Well, that sucks, but we can just ban that guy and go again and we likely won't have to worry that our very next game will also contain a cheater
Finally: these defences always have an implicit assumption with it: that the horribly pervasive anti-cheats actually... you know, work. They do, to a rather limited extent, but cheaters are still rampant, so what's the point?
If I already have a preformed 4v4, then I don't need anticheat.
The question is what to do about the rest of the time for everyone else. Shopping around private servers and dealing with individual server admin quirks is a regression from matchmaking UX that Starcraft had in the late 90s or that Halo 2 had in the early 2000s.
I'd love that. I bet that a lot of players would like having the choice, too. AND, data from a few months of a relatively popular game implementing this system should pretty much conclusively settle the question of whether competitive matchmade games should have anticheat.
The only multiplayer game I currently play is Beyond All Reason (a RTS game).
It's a free and open-source game, so creating a cheat client would be especially easy. But I've never encountered cheating.
I think there's a few reasons for this:
1) The playerbase is small and there is no auto-matchmaking, just a traditional list of servers. This results in the same group of people always playing together. People don't want to cheat when they're playing with acquaintances they see frequently.
2) Spectators are allowed in every game. The top-ranked games usually have several spectators.
You might think this would result in even more cheating, but in practice the spectators would prefer to watch a sneak attacks succeed, because it's funny. It's boring to be whispering the enemy secrets to you buddy on a private Discord, it's more fun to watch your buddy die in a surprising and funny way.
Also, the spectators can spot if a player does something that suspiciously well timed or lucky. The spectators see all, so they have the information needed to spot suspicious behavior.
3) Official servers create an official record of what happened in every game. The entire community has access to all the recordings. If someone thinks cheating is happening they can link to the official game recording on Reddit (or whatever) and everyone can see what happened.
4) An active moderator team reviews every report of cheating. There are official moderators that do the banning, but also volunteer moderators which can watch the recordings and create a trusted written account of what happened; this makes the official moderators have an easier job.
Hi, one of the BAR devs here. Glad to hear the tall praise for the project and even happier to hear you've been having a great time playing it!
One of the additional safeguards against cheating within BAR is the shared simulation that all machines connected to any given match have to perform. As the entire process is synced between all these machines, any mismatch is immediately picked up by other machines and the server hosting the match itself and results in an automatic booting of that player with the desynced game. If 15 machines can agree on an event happening in the simulation, and 1 can't, why should the 1 be trusted? This includes things like the economy reserves for a given player or the behaviour of their units, not just the physical simulation of the projectiles and their trajectories and hit registers.
Seems more likely that the cause is that RTS isn't a popular genre among gamers and Beyond All Reason is obscure[1] even among RTSes. There's no fame or money to make it worth investing in cheating.
[1] Among the general public, not RTS aficionados. Which is unfortunate; Total Annihilation and its spiritual descendants like BAR deserve more love.
Even as an RTS player I've never heard of it, but I have learned recently that I've missed out on an entire niche scene based off of TA. Been playing RTS's since 1994ish and only recently bought TA to go back and play through it. Never owned it back in the day.
I don't think they're saying cheating doesn't exist for the game, they're saying the popularity/incentive is too low to attract many cheaters compared to esports games.
I'm saying they have their fair share of cheating and they have managed to moderate it well without using any form of anti-cheat software.
Of course a small game is going to have fewer cheaters. They have fewer cheaters, but they also have fewer moderators; it's literally like 4 or 5 people doing it in their free time.
Hello, CM for BAR here, nice to see it mentioned :)
As Zephyr says state manipulation cheats are impossible since they would lead to desyncing any online battle.
Since every user technically has access to the whole game state there are user side cheats possible, like LoS hack, but these are easily detectible (as well as spectator cheating) and very active moderator team makes sure anyone using them is perm'ad so it's not worth for people to try them and it's been super rare so far.
Smurfing (using alt accounts with lower ELO to get weaker opponents/avoid moderation) is probably the most prevailent type of "cheating" but there is a lot of active and passive countermeasures implemented so most players will rarely experience issues with that.
As most of you know, these anti-cheat systems are functionally equivalent to rootkits. There is zero visibility into how these privileges are used for targeted attacks. Due to geographic location of the large game companies this has a geopolitical angle. Fingerprinting of devices and the networks they are in provides a lot of metadata that is most definitely fed into their intelligence apparatus.
I remember trying to install Valorant for the first time, and its ridiculously invasive anticheat kernel mod (or whatever it's called) gave me my first blue (or was it red??) screen I'd seen on Windows in years.
Immediately uninstalled it and haven't ever played Valorant to this day. Fuck that crap, if your community is so toxic that you need a rootkit to keep cheaters at bay, then maybe it's more of a community problem than a technological one. And yes, if this means that you have to block all of China in order to do so, then that is still a community problem. Put your rootkits on your Chinese servers, separate them out, and let the cheaters fight amongst themselves.
It might not be the sole reason (and most likely isn’t), but toxic communities breed these sort of behaviours, especially in games that are extremely hostile to casual players.
I'm curious, do they have to be? Would it be possible to boot the program + the anti cheat into it's own VM or something? So they know I am running on trusted hardware, but I know that the aren't reading my emails? Genuinely curious and don't know the answer to this.
The anticheat will try to detect the VM and it will give a warning, so that's not a solution. Ideally keep leisure time devices and work devices separate. Consoles are a good solution because you are never tempted to use your emails on those.
But also you need to think about who your adversary is. Other countries have access to all your icloud mail and photos all the time. Something like dropbox and onedrive is scanned and catalogued in the background.
Hardware supply chain is a difficult topic and each layer of abstraction has their own mini operating system in the firmware, and past has shown many of them have backdoors.
Yes, and more than that, the kernel-level-anticheats are unable to spot someone using a Cronus ( hardware aim assist among other stuff [0] ).
I'm never going to play again online on any FPS because that whole incoherent bubble of crap disgusts me.
The multiplayer games community is toxic, and players are focused on success whatever the cost is. And I don't even want to touch the question of match making with a 10-foot-pole.
Local, self-hosted or in small community is the best.
Unpopular opinion, but we would be better off with a single open trusted implementation of anti cheat (aka drm) which can attest whatever requirements are desired by the game is met. The only real problem is that it would likely be limited to approved kernel images and someone would need to own that validation and signing infrastructure, but you could imagine having multiple trusted entities have this role.
Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state.
Cheating is a meat space problem and there is no technical solution to it. Thats why in tournaments there are referees standing behind the players. Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
> Cheating is a meat space problem and there is no technical solution to it
Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it.
> Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.
This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.
> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state.
Incorrect. DMA (direct memory access) is and can be prevented [1] and detected [2].
You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments.
The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly.
But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures.
There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.
Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory
Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this
> Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this)
Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones.
> Something like TEE.fail can be used to read encryption keys for network traffic
So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often.
I don't consider it an arms race if you can prevent cheating to 10s of people in a million-player game. That's noise at best.
> Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones.
I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats
> So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often.
You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE. Reading memory speed doesn't really matter as long as you can find an encryption key for network traffic. Once you can intercept network traffic and decrypt its game over!
You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs
A few years ago, DMA cards cost upwards of $500. Now you can buy cards from china preloaded with pcieleech firmware for around $100. and there are thousands of customers. If you can afford the latest gen gaming gear and afford to spend money on cheats you can certainly fork over a couple hundred dollars for the latest undetected solution
> I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats
I can assure you that you will get banned from a game with a modern anti-cheat using that or you won't even be able to launch the game. Also 'flagged by most anti-cheats' means very little. Most good anti-cheats will delay bans or correlate multiple factors prior to a ban.
> You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE.
You don't have to decrypt it on the RAM wire bus. And the reasons TEE.fail is successful is because they screwed up the crypto as far as I can tell.
> Once you can intercept network traffic and decrypt its game over!
Not sure why you are so hung up on this. You still need to access the memory first. That's what they will detect and prevent. They obviously can't prevent or detect network sniffing if the key is known.
> You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs
I've made FPGA designs previously, including custom PCIE DMA cards back in ~2018. It would surprise me if you could find an FPGA capable of reliably sniffing DDDR5 6000+ MT/S without crashing the host system. FPGAs are not nearly as fast as CPUs. Maybe you could somehow hack a FPGA DDR memory interface. But finding one fast enough for DDR5 is probably impossible (or terribly expensive). Maybe https://www.amd.com/en/products/adaptive-socs-and-fpgas/vers... is theoretically possible. But you are looking at a 10k+ chip, if not 20k$+. Such a chip is not going to be easily embeddable and likely requires 10s if not 100s of amps of power delivery.
Why do you need to handle DDR5? You can use DDR3 to play the vast majority of competitive video games. It's not hard to find an FPGA that can handle DDR3 or DDR4.
You also don't need to sniff the entirety of the traffic. You just need to introduce aliasing. That is much harder to do for DDR5 but you don't need it to be reliable or stable for a long time, because you won't be sniffing for very long. And you don't need to do 6000+MT/s either.
As far as I know there are very few systems that support Windows 11 with DDR3.
I think his point was more that if you drop the link rate on ddr5 to sniff then the performance penalty will be very bad. DDR5 starts at 3000
> I can assure you that you will get banned from a game with a modern anti-cheat using that or you won't even be able to launch the game. Also 'flagged by most anti-cheats' means very little. Most good anti-cheats will delay bans or correlate multiple factors prior to a ban.
Most of what I said is a large oversimplification on the matter. Anticheats absolutely do make use of heuristic patterns to flag drivers that are correlated with known cheaters. Drivers are pretty well flagged now days by anticheats but Windows does virtually next to nothing to prevent people from abusing these RWEverything drivers
>Not sure why you are so hung up on this. You still need to access the memory first. That's what they will detect and prevent. They obviously can't prevent or detect network sniffing if the key is known.
The point is that you don't need a very complicated or long-lived exploit to yoink those keys if you know where to look.
The overarching idea here is that as long as you have physical access to hardware it is going to be very difficult to prevent these kinds of attacks without serious vertical integration and from who? Microsoft really don't seem to care much, CPU/Motherboard/RAM vendors are benefiting from an open market with shared standards and anti-cheat/games do not have enough purchasing power to push over consumers.
I can't comment much on FPGAs because I don't know a huge amount about them so il take your point. There are also countless side channel attacks and ways to leak data from your memory in completely unintended way eg; cache timing or faulty speculative execution
There are DDR4 interposers you can buy for 50$. The basic thing is that you don't need all of the ram all of the time, you just need to find an address which you can then rewrite to make two valid references to the same physical memory (see: badRAM/battering ram). Then you can use an IOMMU compliant DMA to access that memory.
Or you can use an FPGA to interpose the RAM and intercept the network traffic for a couple hundred bucks.
Indeed, you can buy a piece of fiberglass shaped correctly for 50$. That's not the hard part. Just the probe you are supposed to connect to such a PCB is > 1k USD per pin you need to sample. The oscilloscope / logic analyzer to sample it is likely 6-7 figures.
> Or you can use an FPGA to interpose the RAM and intercept the network traffic for a couple hundred bucks.
What FPGA solution do you have for a couple hundred bucks could interpose DDR4 RAM at any frequency? This number seems completely made up to me.
I do think a large portion of the huge price for this equipment is that it is very niche and only a few mfg's eg keysight/agilent make this kind of stuff.
Im sure if the DMA market goes way of the RAM bus sniffing its will be a year or two before mass produced products are on the market that can sniff the traffic without much reduction in signal quality and maximum data rate.
This is theoretically possible, but I don't think most cheaters would have the equipment or skill to do this. Cheating is only rampant in games where people can just buy and download cheats... if it requires a lot of skill and hardware, it won't be a big issue.
I'm not sure this is an unpopular opinion. I've seen it suggested multiple times, and IF done correctly (open/transparent) would solve most of the complaints with the ring-zero anti cheats. Still won't solve every cheat, especially hardware, social and perhaps good VMs. I would require the app/game to disclose what it requires to be true.
I'm ordering a new laptop to work on LLM stuff, and while I thought about jumping through the hoops to get Linux running with secure boot...
I had a realization, it's a cold day in hell when someone else is going to tell me what I can run on my computer. All the latest multiplayer games are now requiring secure boot on Win11 as well
I'm actually wary of all these anti-cheats, they're literally hyperinvasive maleware.
I don't need gaming that much.
And if I do I'll stream it with Gamepass or another cloud service.
What irritates me is when games that don't even benefit from anti-cheat require it. Helldivers 2, for example. My dudes, it's a co-op game. My teammates and I are all on the same side! Moreover, the vast majority of people are gonna play with their friends, not randoms. And if your friend is using a cheat and it bothers you, you just ask him to stop. There's no reason for a game like Helldivers 2 to require anti-cheat at all, let alone the rootkit variety. And yet...
Elden Ring: Nightreign is also a co-op PvE game that has anti-cheating in it. The most common way people cheat is by fudging then items equipped to their character that slightly alter their stats and abilities. Since the game is rouge-like and all of your character information and equipment you can assign before entering the game is handled locally then all it takes is editing your save file which the game and server have no way of (or makes no effort to) detect.
Also, after a brief period, all of the cheaters disappeared because just repeatedly winning a PvE game get boring.
The best games with anti-cheat have an option to launch without using it, but just restrict what game types you can play. Playing with friends should be allowed without anti-cheat.
Yep. I've seen quite a few free-to-play gacha games of the "Dress up your pretty princess in cool clothes and do cute activities in a relaxing, no-stress world." variety that have serious anticheat. There's no leaderboard, no multiplayer, it's totally singleplayer.
Why the serious anticheat? To try to prevent you from cheating your way to possession of all the cool clothes for your pretty princess.
It's also bad with games that have been sucked into the live service hell-vortex. I can't fire up a quick game of Madden against the CPU because EA has turned Madden into a multiplayer lootbox casino, so they chuck Linux-blocking anti-cheat on the whole damn thing, single-player and all.
The super invasive kernel-mode variants (that is, the sort that's in Valorant) flat out fail, and surely always will. It's my (perhaps mistaken) understanding that with some others (like Easy Anti Cheat), it's a choice made by the game dev as to whether running in Wine/Proton will be permitted or not.
I'm a pretty prolific gamer, but at the start of the year I finally kicked Windows to the curb.
It's been fine. Surprisingly few games I'm interested in to begin with have anticheat that doesn't work on Linux, and it's comforting to know games aren't allowed to just shove trash into kernel space at will.
I dropped my Game Pass sub immediately after they upped the sub price and unplugged my Xbox Series X. I have a Bazzite machine, but I've had issues with the NVidia drivers and not enough patience to deal with it. So i'm currently ONLY using my Steam Deck OLED for gaming. When i want to play big AAA games at my desk (SD in docked mode), i'll use GeForce Now and all of it has been a wonderful experience, even the online "competitive" FPS games like BF6. Much better than my experience on either Windows or Xbox. I'll never go back... and i'm impatiently waiting on my Steam Machine!
If you play older games, Linux ironically works better than windows now for stability. The only game I have seen any issues with (note I don't really play multiplayer much) is the Harry Potter game, but proton eventually fixed that.
Yep same; have had Linux on my laptop for a decade plus, but finally switched my desktop over a few years ago, and I have no regrets. The real magic is that I no longer feel the need to do any research before buying a game; it usually just works. Granted, I don't really play competitive multiplayer games, so YMMV (but even that might be about to change if the Steam Machine sells well enough).
Until Valve starts shipping native SteamOS games, they were and are right.
Games are developed on Windows, using Windows APIs and development tools, and then Valve does the job studios don't see any value in spending development resources on, even though some of them use engines that also target GNU/Linux.
Talking about Linux gaming with Proton is no different than if Windows users would start talking about Windows being their favourite Linux distribution due to WSL 2.0.
A lot of people give high praise to Yabridge, but I myself haven't tried using it for my existing VST library and just found alternative plugins that work with linux.
The sad thing is linux, like MacOS, is often vastly superior for audio routing and latency.
Personally I gave up all my audio productions tools that don't support Linux, but since music/audio work is just a hobby for me that's easier to do. I do miss my old DAWs (Ableton/Reason), and I miss a lot of VST plugins.
Not everyone can just re-base their setup on linux (for me Renoise & VCV Rack), but I can get plenty of joy out of a complete lack of Windows, license management crapware, invasive rootkit level DRM, etc.
Side benefit: it pushes me to get some more external hardware, but I have to do investigations on how some companies do firmware updates which often require MacOS/Windows or Chrome Browser (fucking webmidi looking at you Novation)
Fruity Loops 4 was my first DAW, and yeah it has been hard to ever leave computer based production behind since then.
The only hardware sequencing that has ever clicked for me is the Polyend Tracker, which is just a tracker so I hesitate to even call it hardware sequencing. I also dig Elektron's sequencing, but its an entirely different headspace I have to spend time in to get used to everytime I fire one up.
I'm lucky that most of my projects only use 4-12 channels of midi/audio, because I can't stand massive projects with 40+ channels of things going on like some friends I've worked with. Hard to imagine trying to do that in hardware alone.
It is a VERY weird device to say the least. I found myself not really enjoying it. The issue with hardware is when you want a final result mastering and splitting up tracks is like teeth extraction.
Vs using software where you can just export stems and hand it off to someone else.
However, with software you end up spending a lot of money on non tangable goods.
I can sell my Polyend. Selling a software license normally isn't possible.
Plus say you own a license to version 10.x. The day version 11.x comes out, the previous version might be worthless.
Vs vintage audio gear which might actually go up in value.
I was pretty surprised that the Polyend Tracker could spit out channel stems at least. I ended up selling mine when I needed some extra money to made ends meet, will buy one again eventually.
>However, with software you end up spending a lot of money on non tangable goods.
Yeah it sucks that this also keeps us locked into platforms for so much longer. I've been buying Reason updates for a decade, and own a bunch of Korgs VST releases of their hardware synths (Op-Six, Modwave, etc). If I can at least get the Korg stuff running on Linux one day that would be nice. It might be possible but I haven't tried.
>Plus say you own a license to version 10.x. The day version 11.x comes out, the previous version might be worthless.
Shout out to Renoise for being affordable and you get a whole versions worth of updates. Which after over a decade I still haven't had to pay again, but will gladly when the time comes. Plus I can even run it on a raspberry pi now.
Counter point: gaming is fun, and indy games are worth investing in. Voting with your wallet works better if you vote for behavior that's not user hostile, rather than only abstaining.
Just to be clear, the anti-cheat systems that support Linux run at the user level and don't require secure boot. Those kernel-level and secure boot restrictions only apply to a handful of games, and they all explicitly block Linux users anyway.
For example, I've been playing Arc Raiders a lot recently in Linux, and the user-level EAC works just fine.
Lots of games don't need invasive anti-cheat. You can just play those. There are literally too many awesome games on the market to ever be without something great to play.
Many people have one or more Discord groups where someone will say "let's play Valorant tonight" and then everyone just installs it. Linux is fantastic for local gaming on a handheld or in the living room, not so much when your non-Linux friends pick the game.
All I really do on my Windows system is play games, and because of that I don't mind whatever draconian crap that's required to keep cheaters in check. It sucks, but not sure of a better solution.
I honestly don't understand why any game is even checking if secure boot is enabled.
If anything it's for the OS to care about that, not individual programs. Afaik, secure boot doesn't (on it's own) prevent the running of arbitrary software, so how is it actually preventing cheating?
I'm not really familiar with Secure Boot too much. Researching suggests that users can add their own keys so they are trusted by UEFI. Won't this resolve for linux users that must have secure boot on?
No, it's not a given that users can add their own keys - certainly in an anticheat scenario they probably couldn't, or at least if they did then key attestation would stop working.
PS5 completely supports mouse and keyboard at a hardware level. It's up to the game though if they support it. The new Doom games don't support it on console even though M&KB are obviously supported on Windows for example. Other games do like the Quake 1 & 2 remasters. I think even Monster Hunter Wilds does if you really want to.
I did that for years and I recommend it as well. Pure linux desktop + console for games is a nice combo and a good separation of functions.
Of course... at this point I am back to having a PC with a beastly GPU and I boot Windows for games and CAD. It is hard to resist high framerate 4k gaming once it becomes a possibility, so now I need to figure out the secure boot problem for the occasional game that requires it.
I don't personally have a problem with a system being locked down in general. I have a problem with my computer being locked down, or getting rootkits installed on it. So for me at least, playing those games on console is a good solution.
That's the seperation of concerns that drives me to a Switch alongside my computer. Though I'm by no means a "serious" gamer by most people's standards.
I still play on my ps2 ... because consoles are linked closely to the games of that generation I would guess that they are tech that are on relative terms least discarded
It's funny that game makers make a fuss about anti-cheat not working on Linux but then publish Switch versions of their games. That platform has almost zero security and is commonly emulated with cheats even in multiplayer these days.
If people cheat in the switch, they can blame Nintendo. If people cheat in PC, they can blame the anticheat. Without anticheat, they have to take the blame.
This. Even kernel level anti-c-spyware can't stop a cheap vision model hokked to a mouse, see youtube for examples from simple auto input up to full on elctromuscular stimulation.
Yes the channel “Basically homeless” has a few variations on this. Using electrodes to move your muscles to more practical a bot that moves your mouse pad for you to give you perfect aim. No anti cheat can detect that because there is nothing to detect.
Although who knows, they might be outright lying about that just to scare cheaters, but I tend to default to assuming what they're saying is more or less true.
They can’t detect me splitting my hdmi output, feeding one of them to a separate machine with a vision model to detect what needs to be detected and the same machine moving and clicking the mouse. People are already doing this.
How does it know what isn't visible? Can it handle glass? Frosted glass? Smoke? What if I can't see the player but I can see their shadow? What if I can't see them because they're behind me but I can hear their footsteps? What if I have 50ms ping and the player is invisible after turning a corner because the server hasn't realized I can see them yet?
To answer all those questions you either have to render the entire game on the server for every player (not possible) or make the checks conservative enough that cheaters still get a significant advantage.
I never understoof why google gave up so early on cloud gaming. Clearly it is the future, the infrastructure will need to develop but your userbase can grow by the day.
I live a bit remote on an island group, and even though I have a 500Mbit Fiber, my latency to the next GeforceNOW datacenter is 60-70ms (which is my latency to most continental datacenters, so not NVidias fault). That makes it unplayable for i.e. Battlefield 6 (I tried, believe me), but I have been playing Fortnite (which is less aim sensitive) for 100+ hours with that.
And under such system, how do you stop people from abusing latency-compensation to make their character appear out of thin air on the opponent’s perspective by fake-juking a corner to trick the netcode into not sending the initial trajectory of your peeks?
The Switch is a closed proprietary platform, so Nintendo can give some guarantees, and if the user does something at the Switch level, the responsibility of legal action will be on Nintendo, saving up headaches to the publisher.
At this point - you would think that cheaters could be detected on the server side by either training a model to flag abnormal behavior or do some type of statistics on the movement patterns over time - is a client-side anti-cheat really required?
Many forms of cheating revolve around modding the game locally so that certain textures can be seen through walls, so you always know where opponents are. So you aren't breaking any laws of physics, you are just able to make much better tactical decisions.
The obvious solution would be, just don't send data to the player's client about enemies that are behind walls. But this is a surprisingly hard thing to engineer in realtime games without breaking the player experience (see: https://technology.riotgames.com/news/demolishing-wallhacks-..., and then notice that even in the final video wallhacks are still possible, they're just more delayed).
> So you aren't breaking any laws of physics, you are just able to make much better tactical decisions.
With respect I'd like to disagree on this subtly. A lot of games have the client send their cursor position at relatively frequent updates/packages (i.e. sub-second). So the server knows pretty precisely in which direction and to which object a player is looking.
This in turn can be readily used upon when using wall-hacks, as most players, who use wall-hacks tend to almost faithfully follow objects behind walls with their cursor, which good moderators can usually spot within a few seconds, when reviewing such footage (source: I was involved in recognizing Wall-Hacks in Minecraft, where players would replace textures, to easily find and mine diamonds underground).
The biggest heuristic is that you suddenly get much more consistent. Valorant uses this to ramp up how intrusive its kernel anticheat becomes and often forcing you to turn on more intrusive features to continue playing the game
In Minecraft one of the common ways to catch people using x-ray hacks or transparent texture packs is to run statistics on the blocks mined. If the ratio of stone-to-diamond gets significantly out of whack it's a sure sign someone is cheating.
In blackjack card counting is (probabilistically) caught by tracking player winnings. If someone is beating the odds a bit too much it's a fairly good indicator they are counting cards. Of course in this case getting it wrong isn't so bad from the casinos perspective either since then they'll just kick out a player that was costing them money anyhow.
When the enigma cypher got cracked they had to be very careful about when to act on information gained. If they started beating the odds too much the Germans would cotton on to enigma being broken.
My point being that cheating will almost by definition improve your odds. There are definitely ways to catch that sort of thing happening without installing rootkits. You just might need to hire a couple mathematicians to figure it out.
That final video is recorded to look better than it is too: the delay is based on position, not time. In a real game you'd be moving slower and have the enemy's data on screen for longer.
That's because the 2025 definition of "anti-cheat" leans heavily towards preventing players from enjoying client-side content that's locked behind microtransactions (for example, EA's new Skate game).
What you’ll find is that a subset of players define a behaviour and now you have to prove that that behaviour is cheating. For most behaviours that could be cheating, it will overlap with skilled players.
Examples would be pre-aiming corners and >99th percentile reaction time.
It’s estimated that cod warzone has 45 million players - a 0.1% false positive rate at that player count is 45000 people. That’s a _lot_. It needs to be orders of magnitude less than that.
This is done, and generally doesn't work as well. Your model will catch people using yesterday's cheats, but the cat-and-mouse nature of cheating means that people will adapt. Funnily enough, cheaters are also training models to play games so that they can evade cheat detection. The kernel-level anticheats are designed to prevent the game from running if they detect you are running any software that interacts with the game. Much simpler for the developer, and circumventing it usually requires running your cheats on a second machine which a) limits what you can do and b) has a higher barrier to entry.
Is there really no way to make anti-cheat on Linux that can't be bypassed? I don't know much about this, but it seems very difficult to make an anti-cheat for a platform where you can make changes in the kernel.
I think the moment you accept data from the client as truth you've lost the battle already, everything else is just damage control. Loads of games have realized this and kept checking game rules on the serverside and reveal data on a need-to-know basis. This makes it nearly impossible for cheats to be made because anything you know you should know, and everythin you act is parsed by the backend according to rules already present
Some kinds of cheating can be mitigated that way, but it can't really stop cheats which just play the game more optimally than the user is able to, using the same inputs and outputs that a legit player would use. Aim assistance in shooters, automatic parries in fighting games, economy-breaking levels of automation in MMOs, and so on.
There's also practical limits to how much data you can filter out in complex 3D games, both due to performance constraints, and because culling information too perfectly can cause things to pop into existence too late under real-world network latency. The effectiveness of ESP cheats can be reduced, but not eliminated in practice.
You could probably detect those kinds of cheats heuristically on the server. There are limits to human ability. It’ll take more time to catch the cheaters, but I’m sure it’s possible.
This player is posting 30 auctions per second. Bot.
This player is turning at a rate of 500 radians per second to make perfect headshots. Bot.
this is already running in production for Counter-Strike since 2018 [0][1].
to be honest, it isn’t particularly good - all serious CS2 games operate on a third party provider with a kernel-level anti-cheat. also, the cs2 update banned people for spinning their mouse too fast [2].
Which they do already, because slamming all of the aimbot settings to max is a fast track to getting mass reported and escalated to human review, which will immediately see what's going on. Any cheater with an ounce of desire to preserve their account is going to try and maintain the pretense that they're just very skilled, not impossibly skilled.
I think anything that relies on reflex alone is flawed design. You can design around this, by for example in Dota2 it doesen't matter how fast you click an entity, because the turnrate of your character is limited, so a person clicking reasonably fast and a bot clicking in 0.01ms both arrive there at the same time. Precision also doesn't matter, because a player can click the icon of the enemy instead of trying to match the pixels on screen. MMO scripts that use information already given by the game just seem like the MMO should invest in UX instead of trying to ban people for using the tools the game already gives them.
>for example in Dota2 it doesen't matter how fast you click an entity, because the turnrate of your character is limited, so a person clicking reasonably fast and a bot clicking in 0.01ms both arrive there at the same time. Precision also doesn't matter, because a player can click the icon of the enemy instead of trying to match the pixels on screen.
Even with turnrate, reaction time is very relevant. Reaction time allows you to silence enemies midcast, or to pop a shield, or a BKB, or some other instant measure. Turnrate doesn't mean reaction time doesn't matter, it means the direction you are facing matters.
As for precision, yes it does matter, ask any Phoenix player who gets hexed mid-flight.
People cheat in Dota in these very terms, it's absurd to argue it doesn't matter.
Unless DOTA2 is running at a ~3 tick rate (Which it's not), even taking account processing delays and action batching, a bot will always have faster reaction times than an actual player. It will also never misclick.
This problem is magnified in a shooter game, which would be unplayable with that kind of batching, but where a cheater with an aimbot is actually impossible for a legitimate player to beat.
After you click, the character will begin to turn, which can take several hundred ms. A delta of couple ms compared to the time it takes to turn is completely negligible and even an inch better positioning of a character, or having a character with items or stats that makes them turn faster (because picks are asymmetric) will make several magnitudes more of an impact.
If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
> If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
This is interesting, because I feel like the fundamental gameplay of an fps is players exposing themselves to each other's field of view, and then trying to click the other's head first. Skill is a measure of map knowledge (so you can try to expose yourself to a possible field of view but not where the enemy is actually looking at that moment) and speed of clicking head.
How would you design FPSs to remove this "bad game design?"
> How would you design FPSs to remove this "bad game design?"
I think we just need to accept that bots will always be better at reaction based KPIs & abusing "knowing" too much game state, we should just remove those conditions.
1) Move most of the application logic to the server, the client should be a fairly dumb terminal that knows how to render and accept inputs, and only receives the state that it needs. No more spying issues.
2) Just give everybody auto aim & immediate/auto controlled firing, etc. No more aim bot issues.
3) Improve the quality of gameplay around the types of interactions which bots are bad at. Decision making, strategy, communication, execution, adaptation.
We can only minimize the amount of extra information given to the client, not eliminate it. And at high enough skill levels, even 1-2ms of extra information will always be actionable, even by humans (not just bots).
>If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
From the servers perspective you always kinda do that for fast movements as the client send rate usually isn't more than 60hz.
There is rampant cheating in online chess and poker as well, you know?
You can have an opinion about what constitutes a better game for humans: should it be about making better decisions, arriving at them faster or being fast and precise with your mouse but the reality is bots/assistance can make you unplayable in all of those domains.
However, this only solves the cheat problem to a minimal extent. There is a lot of important data that players should not be directly aware of, but which is important for the game. For example, it is important for calculating sounds to know where enemies are nearby, even though you cannot see them, which makes wall hacks possible, etc.
Sounds are core to shooters and very much within the expected abilities of the players to hear them. If anything, I'd incorporate this kind of indicator in the game itself, allowing for deaf people to "hear" footsteps as well
> I'd incorporate this kind of indicator in the game itself, allowing for deaf people to "hear" footsteps as well
That's just discount wallhacks. Fortnite has it and you're basically forced to use it even if you have no hearing issues, because it provides a massive advantage.
Eventually you have to send data to the client and they have to send you back what they did. Assuming you’re running a game server with 240hz updates, on a 120hz monitor with no buffering, on a low latency connection in the same location to your data center, the absolute bare minimum amount of latency you can plan for is about 15ms from server to on screen, and back again)
- 8 ms each way, 4ms for the server tick, and 5ms each way for networking. Now move 100 km from the server, or add in double buffering, and you’re closer to 50-60ms. That means at any given time you know there’s a deviance of between 0 and 50ms between your state and the clients - and a client can and will exploit that.
That only solves half of the cheating problem - illegal inputs from clients.
The other half is much harder to solve. For a simple example - my client knows that there is an enemy player around a corner. It knows exactly where that player is, because that player is walking, and making noise. A cheats could allow the cheater to see his opponent's player's model through the wall.
For a more blatant example, consider cheats in a first-person shooter that just snap your aim to the nearest enemy's head. This involves zero violation of the game's logic, and also makes the game completely unplayable for everyone in a lobby.
You already know where an enemy is if you hear them behind the wall, you don't need a cheat to tell you that there is noise coming from other side of the wall. The server also doesen't need to tell you they are behind it if they're sneaking. A game that allows zero home-in time sounds like a flaw in the game and something solvable on the serverside.
You can replace a playermodel with wider "sound coming from around here" if you want to make it even harder for a cheat to pinpoint a sound
> The server also doesen't need to tell you they are behind it if they're sneaking
This requires the server to calculate line of sight checks for every player, which is costly, requires loading the entire geometry into the server and would be horribly prone to latency. Then you're looking at potential performance problems on the client due to only knowing about a player the second its in view and having to stream the assets to the GPU, which if don't happen in time for the frame you'll experience as hitching.
> You already know where an enemy is if you hear them behind the wall
Yes but this requires using your brain rather than just seeing them straight up through a wall.
I don't think those performance concerns are really much of an issue with any sensible implementation. You'd do line of sight checks against simplified geometry first to handle the vast majority of cases, and you'd load character models/textures in advance (game/match startup) rather than only when they first appear on screen.
One non-trivial part seems to me that if you walk around a corner you don't want to wait 50ms (your ping) for the server to send enemy locations you can now see. Ideally every tick the server would be sending all enemies that you could potentially see before the next tick depending on what your movement packets that it hasn't yet received turn out to be. Wouldn't entirely eliminate advantage from cheating (e.g: a cheater walking around a corner could still see enemies up to a tick/~15ms in advance) but would hopefully make this form of cheating significantly less worthwhile.
Basic distance checking is doable, but any kind of "they're ducking behind a 2 feet wall in front of me" is going to be horrible to detect server side.
Both Valorant and cs have pretty simple geometry and low player count which helps a lot for a system like this. Can't really do for bigger outdoor games with buildings etc.
> You already know where an enemy is if you hear them behind the wall,
You know they are somewhere behind the wall, you don't know which exact angle they are behind the wall, because headphones and our ears don't work with that degree of accuracy.
The cheater can just swing the corner with his cursor already pre-positioned exactly on his target. Between peeker's advantage (inherent to any online game with latency) and human reaction time, there's not a lot you can do to fight that.
A trusted entity (probably Valve) could provide a locked down distro where kernel integrity is enforced through secure boot and TPM attestation, but that would mean giving up some control over your own system. There's no guarantee that anything client-side is impossible to bypass of course, but the goal would be to more or less match what Windows offers, which isn't perfect either.
There could simply be a developer option that disables these integrity checks but subsequently breaks online games that rely on them. Valve could also offer a module that allows signed user-space binaries access to kernel space, which would be an improvement over Windows offers in that anti-cheat wouldn't need to live in the kernel.
You don't even need a developer mode. I was looking into making my own image based distro/system which has its bootchain entirely verified and I intend to make any modifications via system extentions[1], which IIRC also get measured aswell (or was at least planned somewhere). To be fair, this is purely additive or overlaying, so no removing of files, at best changing. This all would be signed using Secure boot and after the fact using dm-verity.
Secure Boot in theory isn't even necessary, only TPM2. Secure boot only ensure that you are actually booting into a binary that you expect to boot in this case, so if your binary is actually different it would result in different PCR values in the TPM indicating something is wrong.
Sadly a lot of end user software (flatpak, ...) isn't packaged & signed in a way which would allow for full "only run software I allow by importing public keys" (read Linux IPE[2]), but what can you do, only your best I suppose...
You don't need a full distro, you can just run the game in a VM sandbox with trusted computing extensions alongside whatever distro you want. That breaks cheats that rely on network/memory inspection, you can still cheat using the raw pixel output to drive faked input, but I don't think the loop is closeable there.
That wouldn't be sufficient. You'd need a hardware component to verify the OS signature of the specific distro with a trusted (by the game company) asymmetric key, and that enforced driver signing.
Those things are all possible, but really the only entity that has the power to realistically do them is the OEM - Valve could do it for SteamOS, but only on it's own hardware.
Has anyone produced a proof of concept for such a system, for gaming or otherwise?
Given that a certain amount of windows gamers have been having issues making sure their PCs complied with the config requirements for the latest COD/Battlefield, it would seem an even higher bar for a consumer targeted bit of software that needs to do more to be running securely (or add a different mode to your distro install and reboot to it), alongside the wider variety of distros/configs. Distros advertising themselves for gaming or getting people to migrate from windows are also trying to keep barriers to entry low or to appear simple.
Sure. That also means it doesn't have to be kernel-level rootkits that fundamentally break the security model of my operating system and risk my bank account. Most people will be stopped by userland anticheat, right? It's inconvenient. So ... put it *there.*
And if someone does the kernel bypass thing, well, rely on server-side heuristics (which are imperfect, but also unknowable to the attacker) and you'll discourage enough of that with account bans.
Helpfully eSports players tend to have video captures of their gameplay, and most of these "undetectable" cheats are real obvious if you actually watch the footage. That catches most of the serious stuff at the upper level. It's why video verification has been a thing in the speedrunning scene for such a long time.
> Helpfully eSports players tend to have video captures of their gameplay, and most of these "undetectable" cheats are real obvious if you actually watch the footage. That catches most of the serious stuff at the upper level. It's why video verification has been a thing in the speedrunning scene for such a long time.
There's a subreddit called /r/vacsucks which is full of pro players blatantly cheating and getting away with it while the rest of the idiots think they're just good players.
Or, depending on your point of view, full of idiots flagging any player better than they are as cheating.
Aimbots can be "humanized" enough that any such determination becomes subjective.
Correct. E.g. you can aimbot by routing the video signal to a capture card on a separate computer and run image recognition software to generate mouse movements spoofed at the hardware level. The only way to reliably prevent cheating is with in-person tournaments played on hardware provided by the organizers.
As someone said about the lack of a Switch anti-cheat: it's a numbers game. If cheating is as easy as downloading a .exe for a few $$$, you're going to find cheaters everywhere. If it requires a complex, and/or fairly expensive setup, the number is going to be very low.
That's assuming there's no money in being a cheater.
The best way is to just make private servers, so people can play with their friends and not have to worry about random players. This also solves the issue of people using.... language thats not acceptable in games.
Reliable anticheat is serverside. Clientside anticheat sounds like a fool's errand to me. You need to control the client, so that means the user cannot be in control of their own computer, which is contrary to the idea of Linux.
It works on Windows by essentially rooting the machine. MS holds control of a bunch of stuff because they hold the signing keys. It’s fundamentally incompatible with open source.
Comparing VAC2 (released in 2005) to FACEIT in 2025 is pretty dumb. There are still absolutely cheaters running rampant on FACEIT and FPL.
The real solution is to limit information sent to the client, make it harder for cheaters to have reliable solutions to get access to critical game information. ARC Raiders has Theia anti tamper (very poor performance) but right now the number of cheaters is minimal because the select few who are smart enough to break the anti-tamper are keeping quiet.
See other examples; The Finals, Roblox (Byfron) and Overwatch
Because with Windows, MS can put a list of trusted rootkit anticheats in the kernel and that cannot be changed (without having the source or breaking signatures when hex editing etc).
If Linux did the same, anyone could recompile the kernel with their fake anticheat’s signature. The fake anticheat would then present itself as real to the game. One could go as far as to rewrite the relevant syscall to falsely indicate to the game that the legitimate version is running.
The OEM could control it in hardware and a secure part of the chipset could validate the OS integrity and sign the relevant key (which is what Apple does with SIP on a managed MacOS installation).
Yes and no. I agree the only thing that can be reliable is server side.
However that means that anything based on reaction times and such is impossible to protect against (under reasonable conditions). At the end of the day you can always have a robot sitting at your desk. But there is steps to that. You can have something that highlights enemies, etc., you can have something that controls keyboard and mouse (maybe inside a VM, so you don't need hardware) and so on. You can reverse engineer packet encryption in a debugger (in most situations) and have something on the network messing with stuff and so on.
So in that regard, yes you can prevent everything you can prevent on the server, but you cannot prevent every sort of cheating on the server.
Everything that has rounds basically can be prevented (other than again a bot playing).
Everything that is complex to automate is better, but might just make cheating more "worthwhile".
The other thing you can do on the server is "dumb cheat" detection. Eg. the odds of someone being consistently as good at a game and such. Statistics like that is widespread and doesn't need any change on the client.
I did a pretty deep dive into this recently, although haven't yet started any implementation work. As far as I can tell, the best strategy that preserves Linux's open-source and user-empowering ideals as much as possible:
- The game obviously needs to run as root, at least until large amounts of this stuff gets upstreamed into the kernel.
- We're going to be leaving the kernel and boot as untrusted, but injecting a hypervisor underneath the running kernel that is responsible for protecting most pages of game memory. This allows users to still run whatever kernel they want.
- The hypervisor sets up two sets of page tables, one that's only active when the game's thread is running and in userspace, one that hides protected pages and is active when the kernel or other threads are running. Note that game code itself needs to get decrypted into protected ram.
- The TPM of the system gets involved when we jump into the hypervisor to attest that the hypervisor is actually running, and the hypervisor then provides attestations to userspace that certain memory regions are protected from kernel or other thread access.
- Any syscalls will fail if they require the kernel to read or write pages that are protected. The game needs to allocate data that should be shared with the kernel into non-protected pages.
- When the game is closed, we can remove the hypervisor and Linux will be back to bare metal operation. This should be unobservable to the rest of the system.
This architecture preserves the ability of users to run arbitrary kernel modules, but does mean a hypothetical attacker can observe data that passes through the kernel (like draw calls/pixels). It's likely that a more complete implementation would also want some way for the hypervisor to attest to the accuracy of keyboard/mouse input and interface with iommu configuration like Windows KAC does.
There’s just no way to stop cheating client side despite what devs love to think. But server side anti cheat is much harder and requires more work; it’s much simpler to just install spyware / rootkits on the client and call it a day.
You can’t prevent wall hacks with only server side anti cheat. The client needs that data locally before the enemy is rendered on screen.
As mentioned in another comment, you can’t do this on the server without expensive checks for every single player that is always checking line of sight, because it’s not just your session running on a single server but multiple sessions.
And let’s say you did this, now you have a latency problem because most modern games to make them feel fluid has client side prediction with server reconciliation. This is what makes your modern games feel more responsive, if you put a constant server check there you have lost this.
No matter what people say online, it isn’t just move all of it to the server, there is data the client needs to know and can’t be spoonfed by the server.
I think it’s an organization accountability issue.
Why would a company pay for anti cheat infrastructure when they can outsource it to some company and blame them if there are cheaters or upset users? Windows is the status quo too, so it’s very easy to point to everyone else when justifying your choice to the execs.
It would be great if steam deck+box start costing studios quantifiable amounts of money that can be used to justify fixing this instead of outsourcing and hand waving.
I think the most stringent types of Windows anti-cheat rely on remote attestation of the operating system. It's theoretically possible to design a Linux-based OS that supports such a capability, but the sort of people who choose Linux are unlikely to accept a third party having the final say over their computer.
I, for one am disappointed that anyone has accepted it. Once it's widespread, service providers can demand it, as we're seeing with mobile banking apps and game anticheat.
I also strongly dislike requiring remote attestation for any kind of software I want to run. But what I also dislike is cheaters in my online games and I genuinely do not have a better suggestion on what to do.
Personally, I run Windows purely for gaming and don't let it near any important data. For the latter, I boot into Linux with separately encrypted disks.
>But what I also dislike is cheaters in my online games and I genuinely do not have a better suggestion on what to do.
You can't suggest "run online games as close-knit social groups, with social exclusion punishments for cheaters", which is how most online games used to be run. How old are you?
Game vendors used to be happy letting us host and run our own multiplayer games, until they realised they could get more money out of us -- "battle passes", microtransactions, ability to forcibly turn off multiplayer of older game when newer remake comes out -- and now they've made themselves a mandatory part of your online experience. You have to use their matchmaking and their servers. So now it's down to them to solve the problem of cheaters, enabled by their centralised matchmaking... and their only solution is remote attestation of your machine and yet more data collection?
I'm doing the same but I worry about windows compromise messing with the bootloader so then encrypted linux drive won't save me. Probably too paranoid though?
If you use secure boot and don't let your keys near Windows, you should be fine even if your Windows install is compromised. Unless you don't trust Microsoft themselves, in which case you'd need to re-enroll keys whenever switching operating systems, which is possible, but very tedious.
Linux is resistant to rootkits, which is what these things are, and allows you to remove them, yes.
The correct solution is to verify everything server side, or actually have humans watch replays and ban cheaters, but both of those would reduce profits, so will obviously never happen.
CSGO has actual humans watch replays to determine whether people were cheating, it's called overwatch. As can be seen, it doesn't actually stop cheating, at most it ensures that blatant ones are banned after the fact already happened.
CS2 Does not have overwatch anymore. VAC Live is completely AI and its a known fact that valve have a few buttons and sliders to play with to go through ban/boom cycles for cheaters to maximize impact
You'll never see cheats banned in real time - that provides an enormous amount of data to cheat developers to allow them to quickly learn to evade your detection. Bans after the fact in large batches are the only sustainable way to go.
IMO the real solution is back in community servers and votekicking.. It works on old games with no anticheat measures..
Maybe add some blatant detection for people teleporting and doing other absolutely impossible things serverside, but I don't understand why my team has to ruin their 'reputation' teamkilling a cheater so he doesn't ruin the game completely in most current games when the anticheat only catches free, old cheats. Just let people votekick and find someone else in the matchmaking queue who's willing to join halfway through.. Once votekicked enough times you can escalate to the AI (always indians) for automated (manual) review.
Also, you don't even have to ban cheaters. Just isolate them to play with each other. Some might find it fun and keep away from the normal players.
Edit: The 'issue' with community server manual review and votekick is you can be kicked for being cracked or garbage at the game legitimately, but TBH at this point you're ruining the fun of everyone else, so you should probably get in another server/match.. Also that premades can have majority, but that's easily solved by reducing their vote weight.
I mean not really, as someone that had been votekicked from many games. Servers with admins does solve this, but has it's drawbacks. But you also cannot have the matchmaking type of game that are popular today.
Back in MW2 if you were the host you could kick players from your game using a cli tool that adjusted firewall rules.
For lobbied ones votekick is great as long as you remove majority vote from premades. So in a 5v5, a 3 man premade isn't able to kick any of the 2 randoms alone.
I remember the misuse of it but it was better than having your only option be teamkilling, which is now punished in all games via reputation systems.
The only thing I don't see this as a solution for are games like Planetside, with massive lobbies. I know they used to have automated detection and manual review by admins teleporting and flying around, usually invisible to sus players. Once we found a bug and got inside the map able to shoot through the ground and in like 15 minutes an admin came, asked us how we got in there and to get out nicely, before he gets us out forcefully :D
Yeah. It’s an erosion of rights that doesn’t solve the problem. You only need one cheater to make a game feel bad and DMA devices or pixel tracking can’t be stopped with these anti-cheats.
Server-authoritative games. Basically the client does stuff, gives the list of moves to the server along with a checksum/end result. Then the server runs the same commands on the same starting state and checks if it got the same result.
If a==b, then everything moves on as normal. If not, the client gets a synchronisation error and has to rewind back to the last known good state.
Completely unfeasible for anything real-time pretty much.
Having done modding for some older shooter games built on the server-authoritative model, it's still possible to create a "pingless" experience, but it requires more calculations and compromises on client/server trust to make it work. For shooters specifically, you want the client to provide instant feedback when the gun fires, and ideally when they hit an enemy. You can achieve this by telling the server "I was at position A and shot my gun at position B and hit enemy Bob." The server will validate all of this before informing the client who fired and the client for "Bob" that Bob was killed. The compromise here is that the server must trust that the client isn't sending forged data, or the server must do additional computations to validate it.
An elaborated version of this idea is called "rollback" where you let the local client predict and execute the game state at time t+1 and will "roll back" the state of the game if it received another game state than the one predicted. Extremely popular and state of the art for 2D fighting games (most of the time the prediction is correct and it greatly reduce the perceived lag) , but probably harder a bit harder to do with 3D games.
You can run a VM using trusted computing extensions for the game. If the VM encrypts traffic, that stops network level cheats. You can still fake inputs/outputs to the machine if you put the work in, but then you can also use a vision model and faked input with actual consoles, so that hole is never going to get patched.
You are looking completely wrong at this. There is no anti-cheat that cannot be bypassed. Period.
You can always run things in a VM, you can always replace your keyboard and mouse with a different device, you can always have your a camera instead of human eyes and have something that recognizes enemies.
Even cheat detection in the real physical world (sports, chess, etc.) is not a completely solved topic.
You can connect computers to other computers so other computers will always be able to control them.
The idea that any (currently realistic) cheat prevention is unbypassable is silly.
> The idea that any (currently realistic) cheat prevention is unbypassable is silly.
The idea that anti-cheats don't make sense because they don't catch 100% of the cheaters is what's silly, who believes that? Not even the people writing these anti-cheats believe catching 100% of them are possible, why are you under the assumption that others think that's possible?
If it removes 80% of the cheaters from the game, the experience goes from "Holy shit lets leave" to "Ok, bothersome, but fine", this is what they're reaching for, not some fantasy utopia that you seem to be under the impression is the target.
I don't think the comment you're responding to is trying to claim that. They're responding to the parent comment asking if there's any way to actually make a Linux anti-cheat method that isn't bypassable and pointing out that this framing isn't really useful because there's no way to make one on any platform that's actually impossible to bypass. Their point isn't about whether it's useful or not to have imperfect anti-cheat but that there's nothing fundamental about Linux that changes the fact that the anti-cheat is going to be imperfect anywhere.
> If people will leave, cheaters will play only with cheaters - problem solved.
Yeah, but it's a bit like the ultimately solution to climate warming; getting rid of all humans on the planet. Fine, it solves the problem, but who is staying to enjoy the solution?
Linux explicitely allows you to do things that makes cheating *really* easy.
There is also complete lack of secure boot and a way to validate that your kernel hasn't been compromised.
I mean seriously, making a cheat for a proton supported game that no anticheat has any hopes of detecting are in 100 lines of a kmod driver and 1 console command: insmod.
On windows you at least need to use scuffed tools like KDU to bypass signature verification requirements and every anticheat can detect you with a simple physical memory scan.
Based on what data do you draw that conclusion? The fact that cheaters can still exist isn't an indictment that it doesn't ever work. Have you ab tested a game with an without anti cheat?
I used to dual boot, but I that there are so many games on Linux, I just don't buy or play incompatible games. So EA lost a BF6 sale for being assholes.
Same situation here. If it were last year, I may have caved. But at this point I don't want to bother with dual booting and losing my Linux context as I do so.
Instead I'm playing ARC Raiders which works perfectly on Linux and I don't regret a thing.
The only game I miss when I moved to Linux was League of Legends. Everything else pretty much works. I get that it’s not worth it for them to deal with more potential cheating, but it’s a bummer.
The worst thing about League was that Riot added it retroactively after years of effort to patch Wine to work with League's weird quirky code. It was the only game that I always remember having a custom Wine build in Lutris even as far back as the early 2010s.
It also would be completely unnecessary if they fixed their servers.
I'm playing through wine (kegworks) on OSX but its no fairytale over here. TF2 over wine literally performs worse than native TF2 on my old dual core 2012 mbp. I'm having to use low resolution configs again. CS2 works OK but there are severe lagspikes that ultimately ruin the gunplay (a little more tolerable when it happens in tf2 but its there too). About the only game that works well in this setup for me is Mount and Blade: Warband. But I mean its a 2010 game... I can't even play bannerlord because of anticheat. Can't play chivalry 2 because anticheat. Can't play cities skylines 2. Most games that do work seem to struggle to get 40fps even on m max series macbooks. I'm not sure where the incompatibility is but its got to be in the software layer software given the specs on those max macbooks.
I just wish someone actually cared about this stuff at Apple. GPTK is not that useful. Rosetta 2 has some serious performance throttling going on somewhere in it (why is native macos cities skyline fps locked at 40fps...). Former mainstay native macos game devs from 10-15 years ago have zero interest publishing for the platform today, valve included.
Cheats aside, are there any competitive games that include Uber-like rating system? Meaning that you'd need to provide feedback whether you'd play with your opponents/teammates again after a game.
Overwatch (1) had something like that. Not sure if Overwatch (2) still has it, or how it functions now.
In higher ELO, people would target good players with "avoid player"^1, effectively soft-banning those people from match making because the pool was small enough. They would still get put in matches eventually but their queues would blow out a lot.
From memory it did not have an explicit "match me with this person" button, but you could thumbs up players in the post-match podium as well as endorse them which may have soft-factored into matching you with them again.
\1 I think it was called this. It was a general "bad attitude" marker, not a "bad team mate" or "bad opponent" marker.
Overwatch (1 and 2) had/have an avoid system, but it only avoids as teammate. Overwatch 1 use to at the very beginning have a system to avoid a player as a whole and they wouldn't be matched in your game at all, but that was remove really early on, as it is easily abusable against good player (I don't want them on the enemy team, they are too good so just get rid of them entirely) and there was a report system anyway for other kinda bad stuff.
Then there is just the endorsement system, which is just a level from 1-5 and you can endorse people you liked playing with. It doesn't really do much in matchmaking but you can't do certain things if you are below a certain level (I forgot what all it was but you can't make (public?) custom games if you are too low and I think text and voice chat could also get disabled if you are too low).
Overwatch 2 has a simplified endorsement system. It's just an optional thumbs up instead of endorsement for 1 of 3 reasons (roughly something like sportsmanship, good teammate, or good leader).
The avoid system is now more flexible. You have 3 pin slots for people you never really want to see on your team again, plus 12(?) regular avoid slots to avoid people for a week at a time like usual. In situations where too many avoid conflicts occur and the matchmaker struggles to create a match (e.g. high ELO), it will start to ignore people's avoid slots in order of (last regular avoid > first regular avoid > pin slots), i think.
Yes to some extent, I believe “The Finals” asked to rate how each match went in earlier seasons. But that stopped now that the game is more mature and feeling well balanced.
Cod MW2019 would occasionally ask, but once every X game IIRC.
While some anti cheat supports Linux they're mostly useless as you can much more easily bypass them on Linux compared to windows. I guess enabling them for competitive games is one way to increase Linux users.
One would hope that Microsoft will eventually revoke kernel access to these companies (see, Crowdstrike incident) eventually forcing game developers to support Linux for many popular online service games and actually stop being so lazy with anticheat. Somehow a smaller studio like Embark managed to make Arc Raiders compatible with Linux. I have 95 hours into the game and have not encountered 1 cheater. Yet a mega corp like EA can't possibly afford to support BF6 on Linux because of kernel anticheat. I put only 10 hours into bf6 and got killed by aimbots three times.
As someone who never plays online games with randos - mostly single player, or multiplayer with friends -
I cannot stress enough how much I do not give a shit about anti-cheat, and how thoroughly fed up I am with poorly conceived and ill executed malware being installed on my computer, holding games I own hostage in the name of stopping cheaters that I don’t care about it.
Main problem with highly competitive games is that you can run them inside a container and have full access to memory.
Most games will share all the data with every client which makes it trivial to display positions of every enemy on the map. It's just convenient for developers.
In games like Tarkov, once you spawn in, your client gets all the information that possible - positions of players, their names, equipment, contents of every single container on the map.
Tarkov is not the best example, because the netcode is terrible, and the architecure is a joke - you can loot everything on the map with a keystroke, and kill anyone with another, but other games are not better.
Even in Valorant, which makes an extra effort to only send data relevant to the player - ie. data about player that you are about to see - you can use that to see around the corners.
Do you have examples of where something isn't accurate? If something hasn't changed it doesn't need to be updated. As far as I'm aware the things that change are updated quickly, hence the list is relevant.
It will be interesting to see how this evolves. It used to be that game developers could safely ignore Linux. But with a growing number of Steam OS, Steam Deck, and Linux + Steam users gaming, it's going to get increasingly more painful in terms of revenue to be telling those users "our game only works on Windows" and just miss out on the revenue and deal with the angry users, forums full of users complaining the game doesn't work, etc.
It might only be a few percent of overall users. But a few percent of a billion $ is a couple of tens of millions. That's a steep price to pay for anti-cheat code.
Most game devs can continue to ignore linux and trust that proton will work it out.
It's only the highly competitive online games that have this issue. While they make up a lot of playtime, they're worked on by a tiny minority of developers.
They are still ignoring Linux, hence why Valve is using Proton, the validation they failed to convince studios to care, studios that happen to target systems like Android NDK, or use platform agnostic engines.
> They are still ignoring Linux, hence why Valve is using Proton...
Eh, maybe?
I'd put forth the notion that game devs might be caring how their game works on both Windows and Proton. That is, that they're still using the Microsoft-provided APIs to build their game, but care about how it runs on Linux just as much as how it runs on Windows.
Not really, otherwise you would be getting SteamOS native builds.
It is up to Valve to sort it up, they are the ones that care, otherwise they will need to pay Windows licenses, which is really what this is all about, while pretending to be some kind of white knights.
Fundamentally anti-cheat is made to ensure you're running the game in genuine Microsoft Windows. If you're using Wine, you're not. They could check for genuine Linux, except that isn't actually a real thing, so they can't. Maybe on SteamOS.
I don't understand why multiplayer games don't run more on the server. If the server runs the game, then sends to client only what it needs to display the game and play sounds, the client doesn't have more information than necessary and a whole class of cheats is eliminated. There is no need for a client to know where an enemy player is if the player won't be shown on screen (wall hacks).
I think World of Tanks runs this way, and I've never encountered much cheating on there.
Some do, but its much more expensive for game companies and adds latency to some elements. Its generally a much harder problem for first-person shooter games - an enemy might be hiding behind a wall but the game needs to know the position of that enemy anyway because the player might move around the corner and see that enemy before the server updates or their game client might need to play noise that enemy is making faintly even if they are far away.
Players of these games are sometimes running their games at high framerates like 240fps which is much higher than the tick rates of these games too.
Plus it doesn't solve all the possible cheats that are out there, as there are some like aim-hacks that don't need any server information to work.
The framing of this is, in my opinion, wrong. I'd like to be able to play unranked matches in spite of the anti-cheat system (which is probably a an anti-piracy enforcer) not working. I play games to have fun; yes, cheaters suck the fun out of matches, but so does anti-consumer "anti-cheat" software that impedes playing the actual game.
Anti-cheat is a necessity for an enjoyable game experience. If you are a casual who doesn’t care about game integrity, you probably aren’t the target audience.
I don’t want any cheaters in my games. I don’t care if a rootkit is required. Riot has a kernel level anti-cheat and it’s _really_ good. It’s so good in fact that it deters most cheaters from even trying. This is the dream for anyone who wants fair games.
I agree with you, but I think the best solution is just to let people run the game without anti-cheat, but they can only play with other people who also opt-out of anti cheat (or choose to allow themselves to be matched with people who opt-out).
Then people can choose to either accept they have to install a rootkit anti-cheat, or want to risk facing cheaters in return for not having to install the anti-cheat.
I wouldn't be able to enjoy life with the knowledge there's a rootkit installed on my machine, developed by the same people that make video games, and hate all levels of accountability, riddled with vulnerabilities that could grant an attacker the same ridiculous level of permissions.
> If you are a casual who doesn’t care about game integrity, you probably aren’t the target audience.
Friendly reminder. 90% of games are not competitive multiplayer and don't need any anti cheat to be enjoyable.
My main entertainment is video games and books (no TV) in equal proportions so I'm far from "casual". I play zero competitive multiplayer due to the "communities" being invariably toxic.
Last time I played something like that it was Starcraft 2 when it was new. Enjoyed being called a stupid noob when I won.
Yeah. I've found a nearly 1:1 correlation between "Does it try hard to be 'competitive' or an 'e-sport'?" and "Is a huge section of the playerbase just godawful toxic assholes?".
As the years ground on, I've learned to avoid games billing themselves as an "e-sport" or indicating that they are extremely focused on the "competitive" scene, unless there's something very compelling to offset the asshole players that will inevitably be pulled in.
Yea! There was a pretty popular /r/gamedev post talking about how like 95% of the linux bugs existed in windows also. Just that linux users are trained to report and provide quality logs/evidence.
It's a perfect litmus test as far as I'm concerned. If a company believes it's ok to put things like that on my machine, I don't want them anywhere near it, even if they were to "compromise" to work on Linux. Relying on a users machine to snitch on them is dumb at every level. Fix your hearts or die.
On my PC I can play basically every game ever made in all of human history, minus maybe 7 that use kernel level anti cheat, and a couple PS5 and PS4 exclusives.
Other than that I have emulation plus a steam library. I'll take that over a locked in console that can only play 2 generations of games any day!
Edit: I'm not sure why the person who replied to me asking about emulators was nuked, emulators are still legal everywhere as far as I know. Anyway tldr go check out emudeck's GitHub repo to see a good list of emulators for basically every platform.
I actually really liked Crysis for its open maps where you can approach a goal using different tactics. It had a lot of flaws and I hated the alien ship along with everything after as it was way too linear. Though I really want to play it again but alas, no more Windows for me.
Are they? Cheats for games like Fortnite, CS (Faceit), Rust, LoL have become very expensive (100 USD per month are not unheard of) or require you to purchase special hardware.
And I have yet to come across an anti cheat driver of the big publishers (EAC, Faceit, Javelin, Vanguard) being exploited and allow access to r/w kernel memory. It is more likely that the driver of some hardware is being exploited for, rather than anti cheat drivers.
Personally, I only remember the ac driver of Capcom ever being exploited. Compare this to the dozen hardware/av drivers which were exploitable, like the Intel LAN utility driver, ASUS IOMap64, MSI NTIOLIB or that one Razer driver. Oh, and CPU-Z and the Avast Hypervisor driver were exploitable too and allowed r/w on kernel memory. These drivers are way more likely to be weaponized than ac drivers.
I remember the anti-cheat of Valorant being exploited where basically the hackers could turn a bug in the game code into full kernel-level root access via the anti-cheat.
Video games are not engineered to withstand sophisticated hacking attacks which is fine mostly since the bad guys can only use their access to cheat - in this case they could fully compromise your system thanks to the kernel access of anti cheat
The thousands of RGB drivers from the various manufacturers that are just copy+paste jobs on RWEverything is actually disgusting and Microsoft letting that just happen is a serious problem. Ah yes you added AES to your IOCTL very secure!
I'd say the only reason that these drivers haven't been exploited is because of the insane bug bounties in place. There are also other big issues in games, see the whole hack with Apex Legends lmao
It's so disappointing that the halo master chief collection still doesn't support split screen. Nothing compared to the joy of playing halo with friends in the same room.
Well, that's just silly. Hook up a Raspberry Pi as your keyboard, mouse input and video output and all the anti-cheat fails. Same (largely) for VMs, same for many emulators.
And if nothing works you can always build a robot pushing mouse, buttons, etc.
Of course you can raise the bar, but if anything has been shown it's that cheating is not something that anyone has been able to prevent yet.
In many situations you can also interfere on the packet level. Of course maybe you need to extract some key, but in many situations that's not exactly hard. And then you can hook something into network.
They already do this. Including peripherals which appear as an actual mouse, but they are there only so that cheat software can take control of the input without modifying the game memory. There are cheats which run on a separate machine and access the game memory via a dedicated DMA card (which itself presents itself as an innocent piece of hardware). Note, this can still be detected either via detecting the DMA card itself, or eventually these shenanigans will be killed off by IOMMU.
Unfortunately, there are also plenty of offerings which do not touch the game memory or process at all, and work purely based on image recognition and these days they actually use AI that is trained on specific games. I have no idea how they plan to detect these. All the cheat needs is the video feed and the ability to provide input via mouse and keyboard, and as you say this is trivial to do in a way that is entirely undetectable.
The cheating isn’t just about input speed or accuracy though. It’s about seeing around corners or having knowledge about other things in the game that you can’t see on the screen.
Amongst the discussion of rootkits and anti-cheat, I would like to add that part of the reason it is necessary is caused by the game companies that took away the standard method of playing multiplayer -- players running their own servers.
It used to be pretty easy to just ban people from playing, now we're 100% reliant on their ability to do it. So we have anti-cheat which roots our computer, and still doesn't 100% solve the problem.
This isn't the reason.
The reason it's necessary is because players want to be able to play with/against other players around the world. Matchmaking requires some form of anti-cheat. Running your own server as admin can't give you the degree of competitive global ranking that players enjoy today.
And cheating is an arms race. It's just hacking. You either preserve game integrity or you're going to have cheaters.
We lost a lot of other things as well. Like modding and especially maps.
It doesn't matter how good the game developers are, someone out there is could make a better map.
The studios took control of everything, and their answer is to rootkit our computers, and to buy more DLC if we want another map.
Personally, I don't accept the premise that such studio control is necessary for me to have fun playing a game.
I especially miss custom maps.
This has nothing to do with anti-cheat. I work on Rust and most servers are hosted by the community and there is a good modding+custom map scene. The game has an anti-cheat because it's a big target for cheaters.
Do you work on community maps?
Rust remains maybe the last true community game that's just solid all the way through where the studio is good to its players and doesn't patronize and betray them. I can have the sort of fun I would have had 20 years ago in Rust, and everything else feels like monocultural slop by comparison.
I wish more of my friends wanted to play it, and wish I had more time for it.
No, I don't work on maps, I work for Facepunch. Thanks :)
Then I wish nothing but good fortune for you and the crew and hope the game continues forever!
Too bad rust isn’t playable on linux due to anticheat.
Rust is playable on Linux on servers that disable anticheat
Naah, Rust from Steam just doesn't even launch on Linux for me (Mint aka Ubuntu aka Debian). Regardless of "Compatibility" choice of Proton. So there's no opportunity to even choose the server.
You need to run RustClient.exe instead of Rust.exe (default) to skip EAC setup. The only way to do this in the Steam UI is to add it as a non-Steam game.
Implying that Linux gamers have to play with cheaters. It may as well not be playable at all.
Actually it kind of works out because cheaters want to play with people who aren't cheating. The few servers that run with anti-cheat disabled would have small communities that aren't attractive to cheaters.
play on good servers. play with good people.
This is the truth of it. If you can unlock all the on-disc DLC or create and use your own maps, mods, skins, etc. it risks the money companies want to take from you after you've already paid the $60-$80 for the incomplete game itself.
Anti-cheat is about protecting DLC profits as much as it is anything else.
It's a shame too because we got so much good content from random people who just loved the games and wanted to create neat things for them. It was one way that some people started their careers in the video game industry and it spawned a lot of other websites and communities around sharing, reviewing, and creating all that free content.
There are hundreds of popular games with mod support. See https://mod.io/g
If anything, we are in a golden age of mods!
Not really. A huge number of players are on consoles that have little to no support for mods and games today have too many centralized online servers and companies who keep insisting on control over your local PC which means that game companies can decide what mods you can and cannot have on your system.
There was a time when the concept of "banned mods" only ever applied to a specific server out of countless other servers and locally you could do anything you wanted, even run your own server.
I agree with you in sentiment and am very nostalgic for the pre-monoculture days, but I also acknowledge that competitive games are a multi-billion dollar industry, and trying to moderate a game with millions of players in a distributed environment is just a non-starter.
You reject the premise that such control is necessary for your idea of fun.
But millions of players enjoy ranked matchmaking enough that without aggressive anti cheat you will wind up with cheaters.
I hate the root kits as well, but if you spend any time playing Valorant vs CS, you will see the difference. If I play CS consistently I'll get cheaters once or twice a week. In Valorant it's almost unheard of by comparison. It sucks, but that's just what's happening.
Do I wish I at least had the option in Valorant or whatever to host a server? Absolutely. Do I think they use the rootkits maliciously? No, generally not. Do I think studios are disincentivized to provide server hosting due to DLC or microtransactions? Definitely. But I also think there's often also a game integrity component. All of these things can be true simultaneously.
Make a list of all game genres and modes that sprung out of player modification
> The reason it's necessary is because players want to be able to play with/against other players around the world. Matchmaking requires some form of anti-cheat. Running your own server as admin can't give you the degree of competitive global ranking that players enjoy today.
Case in point, Counter Strike is a rare example of a popular game which supports both the "modern" matchmaking paradigm and the classic community server paradigm... and for better or worse the playerbase overwhelmingly prefers matchmaking.
> and the playerbase overwhelmingly prefers matchmaking
The server browser is buried under a couple layers of obtuse menus (and, at present, is completely broken on my SteamOS machine) while matchmaking is obvious and straightforward. You cannot come to any reasonable conclusions about player preference given the way the UI drives players towards matchmaking and away from servers. If they were presented on equal footing you might have a point.
Consider also TF2. It launched as a server-based game, and in the years after matchmaking was added Valve went through many UX iterations designed to drive traffic to it before it was more popular.
Counter Strike makes matchmaking far more prominent than community servers, so I don't think this is that good of an example. For a game like Team Fortress 2 where the options are presented more equally, It seems the players are closer to a 50/50 split. The reality is that most people follow the light patterns that get them in a game, which most modern multiplayer games make that matchmaking.
People are still playing Battlefield 4 (2013) on user-hosted servers. Right now.
The only way that "around the world" can be relevant is ping, and the best way to manage ping is by sorting a list of servers by ping.
Cheating is an arms race that no one needs to participate in. Moderation was a perfectly good workaround until major game studios decided to monopolize server hosting.
What, 2000 players? 5000?
Moderating that game is multiple orders of magnitude off of major titles.
No Battlefield game is even in the top 100 of esports earnings.
My point is that player-moderation scales, while corporate moderation does not. The fact that there are more players on corporate moderated servers only makes this reality more significant.
Studios could release the server files when the game is EOL…
I wouldn't measure anticheat success by esports earning
It's clearly one significant measure. What do you think is going to happen to tournament money if every other tournament has a cheater? How many esports fans want to go play League after watching Faker decimate another team if they have cheaters in their match every other day?
What it tells you most of all is popularity and incentive to cheat. Cast a big enough net and you'll inevitably find cheaters. The bigger the net, the more cheaters you'll collect.
> can't give you the degree of competitive global ranking that players enjoy today
I'm curious to know how player stats and global rankings truly affect game adoption (not that you can accurately measure what I'm asking for). It seems to me the more popular the game the less it matters because everyone becomes a small fish in a big pond. Rank one billion out of a gajillion. The games where it matters more would be the smaller games, which have less of a cheating problem to begin with.
I do agree however that you won't get the adoption without centralization, if only because centralization is exactly where all the money resides, via DLC and other nonsense. Therefore centralization is exactly where all the marketing money goes. And without marketing you don't usually get blockbuster games. So expecting the rootkits to go away is a lost cause, until client-side rendering goes away, at least.
That may be the answer to playing these rootkit titles on Linux: just stream it. I know it's somewhat lame, and I know it adds latency, but I seem to recall a recent demonstrate of a service where the latency is very minimal. Clearly I'm a bit out of touch with the state of the art, heh.
Yeah, this is pretty clear. The community for any competitive game if you are a member of the top 100 players is always amazing. These players play the most, they end of seeing each other over and over, and you build up a rapport with the other players and can start to play against specific peoples play-styles.
However, for the vast vast majority of the player-base who is top 50% in skill, the fat normal distribution nearly guarantees that most of the people they play against will never be seen again. And therefore there is no harm for them not to be toxic to them, so most people only ever experience toxicity in online competitive games.
Server browser games solve this because players end up with "home" servers where they come back to over and over, and over time build communities who do the same. This was taken away from the players when we moved to matchmaking, and many in the player-base have a bias against matchmaking because of it.
But this is in no way required, and merely a result of gaming companies to do any work on this front. It would be extremely easy for these games to add an arbitrary community tag to the matchmaker that would attempt to put people in games with players that they have not previously reported. The matchmaker might take a little bit more time, but since these players are in the fat normal distribution, their average matchmaking times will still be incredibly low.
WRT player stats and rankings: I'm inclined to disagree. Rankings in small team-based game communities tend to be pretty noisy. Matchmaking often ends up constrained by the number of online players searching for a game at the same time, so the teams may not be well balanced, and the outcome of the match can be decided by the presence of a single highly skilled player who happened to be searching for a match at the right moment. The resulting rankings aren't necessarily a good measure of player skill.
Larger games have the luxury of being able to place players into teams consisting entirely of other players of similar skill levels, against teams of similar composition. The results of those games are a better reflection of those players' skill.
> Rankings in small team-based game communities tend to be pretty noisy.
PP wasn't talking about ranking stability. PP was talking about the "Why should I give a shit about the leaderboard when ten million people play the game, and I'm someone with life obligations that aren't 'playing this game, exclusively', so I'm always in the middle of a sea of strangers because I can never git particularly gud?".
You might argue that the solution to that is to have separate rankings for folks in your friends' (or whatever) list, and I agree... but I'd get the same thing as filtered-to-friends-only leaderboards with leaderboards that are restricted to the population of players on the private servers on which I play. Plus, private servers give you the option to benefit from active admins who ban cheaters and other shitheels forever. [0]
[0] Or encourage them to cheat and be godawful, if that's the sort of server that they want to run. All-cheats-all-the-time and/or vent-your-spleen-24/7 servers are fun, too... just so long as folks are informed of what they're getting into by joining.
The "players run their own servers" model has worked fine in TF2. If you played community-run servers, you never ran into the bot issue.
There are even ranked, private competitive leagues like TF2Center
How did it work in the early Steam (CS 1.4, 1.5, 1.6, CS:S) and GameSpy days?
I think a big part of it is the stakes were just lower. There wasn't money and careers in it the same way there is with egaming now.
Are the stakes not still zero? Aren't like 99.9% of players not at all competitive in any meaningful sense basically by definition? Like if Counter-Strike has 1M active players, and you are in the 99.9%-ile, you are still only in the top 1,000. Do people watch the rank 1000 players? Are they making a career out of it? What fraction of the player-base thinks they are actually competitive vs. is just playing a game?
I actually think a big part of this anti-cheat push is just developers wanting their players to think something real is at stake. Yes we put a ton of effort into protecting your very important Elo score from hackers so you confidently sink hours into improving it.
If they would just let the cheaters win their way up the ranks, they could have their own little cheater lobbies and we wouldn’t have to deal with them.
Right, this is also my suspicion. It's all ultimately a way to psychologically manipulate people into buying more microtransactions. It's then important to always point out how silly and obvious the whole thing is. It's like if your local sports organization at the park insisted on drug testing everyone so they can try to convince you your beer league volleyball game is actually very serious and you should buy Air Jordans or fancy shorts to up your game. These people are a joke.
For some games like dota 2 cheats only make them marginally better at the game but much more frustrating to play against. The most common cheats are map hacks and instant action scripts both of which can be useless without the game knowledge for correct play. But both of these cheats make playing against them frustrating but they wouldn't rise to the top.
Again I think there’s a better way if we push through the concept of a fair game, and just focus on fun. It should be possible and accepted to block (and never match with going forward) players who are just… unfun. Annoying, poor sports, or cheaters. Heck, maybe player-curated and shared matching and blocking lists could become a thing.
Games are a social thing we do to have fun, there’s no obligation to spend your limited social free time hanging out with annoying people.
The problem is the reverse of what is being argued here. The stakes are high because of how much money these companies are making off of DLCs/in-app purchases. The game operator thus has an incentive to ensure that high value customers can't be banned by third parties. Instead of just being banned, the player is suspended 24 hours or something, and then they come back.
Came here to find this comment. It is NOT about matchmaking and/or "protecting the incomes" of competitive players AT ALL! It is solely about protecting these games' in-game shops and associated economies. The real comp scenes are all done on LAN anyway, with entirely different anti-cheat setups.
I think it’s streaming in particular. With actual competitive games, like, tournaments and whatnot, the players are well known and they are competing in actual tournaments, right? The play is broadcast and all the players have their professional game-player reputation at stake, so there’s a strong incentive to not cheat (it is a very cushy and high-skill job with almost no transferable skills, so like, better not get booted). It is just that streamers might bump into cheating and that’s annoying for their viewers I guess.
When people play in these “competitive” matchmaking queues, it is more like a pickup game. If somebody shows up to a pickup baseball game with a corked bat, they are just kind of a loser and it isn’t a big deal, right? There’s no actual reward for hitting “platinum rank” or whatever in most games, other than skins or something. Nothing real is on the line.
IMO: we really should just have let these people cheat their way out of the normal matchmaking population. Smurfing is a much bigger problem. I don’t actually care if the guy dominating the match with some 60:0 kill-death-ratio is cheating or a semi-pro beating up on casuals, haha.
More distributed and more manual. More administrative overhead. More localized culture we all get nostalgic for. Much more effort to play against peer competitors.
It's the same phenomenon you see in many sectors.
Access is democratized and the friction/barrier to play is dramatically lowered/free, and the localization is diluted or non existent and just a monoculture.
PunkBuster and later VAC were commonplace. Anti-cheat middleware is not new by any stretch.
Not necessary, case in point skill-based-matchmaking got a lot of blow back when studios want to implement it.
Matchmaking isn't worth rooting my machine. Give me a dedicated server to host for folks, and we'll work out an equilibrium eventually.
> Matchmaking requires some form of anti-cheat.
Does it though? Unless winning has real-world rewards, does it really matter that much if you are playing against someone who is cheating, if with cheating, they are evenly matched against you? Assuming the matchmaking works well, people who cheat would end up getting matched with either other people who cheat, or people who are good enough to compete against cheaters.
Not sure how to understand these questions. Have you ever played in a competitive game of any type, virtual or real?
A cheater isn't evenly matched against you. No one is good enough to compete against wallhacks/aimbots, never mind that it shouldn't matter. It ruins the experience, ruins games, ruins the spirit of competition and sport.
This argument is that the match-making software is incompetent. If what you say is true, and the match-maker could determine skill with any ability, then the cheaters would quickly find that the only people they match-make with is other cheaters. The non-cheaters don't care that the cheaters exist if they never play against them.
Two reasons this doesn't work
Most competitive games these days are free to play. A cheater gets banned, makes a new account, and gets placed on the competitive ladder level of a new player, and stomps their way up the ladder against unskilled players until they get banned, and repeat.
For players that cheat less egregiously and don't get banned, it's still obvious many times when someone has no skill but is using cheating as some form of assistance. It's not fun to play against a player who has a similar K/D ratio as you because they suck at aiming but can see through walls, or because they can instantly headshot people but have bad positional awareness or understanding of other game objectives like capture points etc.
It's like telling a high level chess player that playing against a child with poor chess knowledge but they're allowed to just ignore checks and flick your pieces off the board is similar to playing against an equally skilled non-cheating player just because they're capable of beating you only 50% of the time. A victory doesn't feel earned, a loss doesn't feel like an actionable learning experience.
The problem here appears to be the banning. If the cheaters are never banned then they will continue to only play with other cheaters, and everyone is happy. And in fact, to a normal player I doubt they care very much if the player is legit and smurfing or if they are not legit and cheating. That player ruins the game they are in.
The ranking system needs to be a better determinate of skill, especially early in a new accounts life, so that they can stop harming normal players games. This might mean changes to the rules of a game to allow this to be done better. The match-maker should take this into account, so that if a player does go up against a player that was far from the skill level that they end up at, it should protect that account from being placed with new players for a time so that they can forget about it.
For the example you choose for Chess, you might force players to do Chess Puzzles before they can queue for their first match. A normal player would then never see any cheaters.
Cheaters don't want to play against other cheaters. If they end up against only cheaters that's a kind of soft-ban or shadow-ban and once they figure out that's the case they'll do the same steps as if you had actually banned them. It also angers legitimate players to know that the top ladder tier is for cheaters only. If you're 200th in the world and legitimate, other players will say you only got that rank through cheating.
And the very best cheaters are still good at the games they cheat in, they just want to use cheats to be even better. One famous example in a game I play is Riolu in Trackmania. He was probably one of the top 10 players in the world. But he wanted to be #1. When he was accused of cheating it took a mountain of evidence for anyone to believe the accusations because he could set a world record live in-person. He just used cheats to be able to do it with fewer attempts.
Riolu is a uniquely terrible example. While he used Cheat Engine to slow down gameplay, he could have just as easily used TAS to record and replay his inputs since TrackMania is deterministic. This is still possible today. This will always be possible even with Kernel level anti-cheats.
I'll note here that the work that Nadeo has done on the matchmaking aspect is in line with what I'm thinking and should be expanded throughout the online gaming space. A division 10 COTD player will never see a cheater. If cheaters do show up, as they commonly do in Weekly Shorts leaderboards, the community ignores it. Their region leaderboards do a much better job than typical games of bringing the community together and they promote continuity. When top players smurf COTD on a new name, the community sniffs it out within the hour. TM doesn't need anti-cheat.
UGC Highlander and the countless CS pug servers show otherwise, to some extent.
Did you played in this era ?
- If you were too good on some server, you'd get banned.
- If the admin doesn't know well cheating, he could tolerate something that was obvious cheating.
- Cheaters could just change server often.
It used to be easy to just ban peoples yes, and it was as easy to switch servers.
Plus on most competitive game today, you have custom lobbies, which do exactly what you want, and there is a reason why only a minority of players uses it.
Custom lobbies don't meet the same need. That's for playing with your friends, or at least, people you vet yourself. Community servers are a sub-community in of themselves: people tend to play on the same servers on a regular basis, allowing you to build rapport, community norms, and have substantially more direct moderation than company-run servers.
Yes, sometimes you run into power-tripping moderators. That comes with the territory of having moderators. But the upsides, of being embedded in a usefully-sized community, and having nearly constant human moderation, not to mention the whole "stop killing games" of it all, far outweigh the need to shop around a bit for a good server.
I think the ideal middle ground is something like Squad's server system: The developers offer a contract to server owners, establishing basic standards that must be met to be a recommended server. Rules forbidding the crazy bigotry that milsims tend to attract, minimum server specs to ensure smooth gameplay, an effective appeals process. If a server meets those requirements, and signs the agreement to keep meeting those standards, they get put on a "recommended" server list (which 90%+ of the playerbase exclusively use). Other servers go on the "custom" server list, which can be modded, or spun up for certain events, or whatever.
two or three months ago, I played a game that did exactly what you proposed, V-Rising, it have a server browser, I played a week with friend on a busy server. Then the server was gone for two weeks. When it was back, mosts of the bases were gone due to inactivity.
That's the kind of things that were common too, maybe you forgot about it.
All the multiplayer games I play today are either community server based, or I exclusively interact with private lobbies.
My negative experiences with community servers represent a pretty short list. Sometimes servers die, but games die sometimes, too. That's obviously only an issue with persistent-state games, like Minecraft, but it's unfortunate when it happens. Can't say it was so frequent that it impacted my enjoyment of any games as a whole.
All true, but of course you're missing the player agency component that renders those issues moot. If any of the above happens, you can simply find another server.
Private games (now called "custom lobbies") were available back then too, they're not equivalent to a public server browser.
They are functionally equivalent for the player. The problem with player hosted servers is that it was very hard to get a fair and balanced competitive match, where now it's extremely common with matchmaking on servers hosted by the game company.
Back then at least you could do something about it. Now if there's an obvious cheater you just kinda sit there and take your L, and ask people to make reports.
If you were playing on a server you owned or for which you had ban permissions, you could do something about it. Otherwise, you had to hope that an admin was online to ban the cheater. If no one was around to take action, your option was to... sit there, take your L, and ask people to make reports (to the admins). You had the option to hop around between servers until you found one that didn't have cheaters, but is that all that different from just quitting back to matchmaking and hoping you find a match without cheaters?
Edit to add: I'm not disputing that kernel-level anticheat is bad; I agree that it is. I don't think it helps to try and hearken back to a golden age of PC gaming that didn't really exist. Maybe it was easier for server admins to manage because player populations were smaller back then, but that's about all that would have made things "better."
You were not helpless if the admin wasn't on, votekick has existed for 25+ years.
Believe it or not us old folks who played during this time had ways to address these issues.
Votekick still exists in modern games, too.
Then it's weird you weren't aware of it when you posted your previous comment.
callvote insta_weapon 1
was my favorite in the Quake3A mod I played.
> Back then at least you could do something about it.
Back then, the most common option taken was leaving the server to find another one.
This is drudging up some formative memories. In the counter-strike / TF2 communities you'd have servers that would grant vote kick rights with more playtime and some of those regulars would then apply for mod rights. It worked quite well.
It still doesn't solve the unfair votekick problem. People with more play time, doesn't have necessarly the abilities nor tools to judge if someone is cheating. Take a look at the trackmania community, some cheaters are caught years later, because they played it smart. Some cheating can't only be observed by looking at the statistics, or hard proof of cheating being ran.
It's a pub. It doesn't matter as long as it's not obvious aim bots and people are having fun. Besides when it's a 32 player instant respawn death match server you have like 200-300 regulars. That type of cheating was never an issue in those because the servers were always full during peak times and everyone kinda knows each other.
Something you are explicitly punished for in modern matchmaking. Unless you want to be downranked or even temp banned you must suffer the cheater.
They are not functionally equivalent, unless there are games I'm not familiar with where custom lobbies are published in a list for strangers to join. Normally a custom lobby implies invite only.
Not everyone is interested in a "fair and balanced competitive match" where you're guaranteed to win no more and no less than 50% of the time. I actually find that intolerably boring.
> They are not functionally equivalent, unless there are games I'm not familiar with where custom lobbies are published in a list for strangers to join.
Lots of the mosts played competitive games have that, or third party websites/discords that have links to custom lobbies.
Being able to make friends off-platform and then play with them is obviously not what we're talking about.
I have to conclude you're unfamiliar with what multiplayer gaming was like when servers were the norm.
> I have to conclude you're unfamiliar with what multiplayer gaming was like when servers were the norm.
Did you even played a single game competitively ? The fact you keep pushing for server browser tell me that no, you need communities on something else. You likely forgot the hassle that server browser were, and forgot that lots of games didn't had a server browser.
LFG communities were important and excluding this shows you were only playing casually, forgot all the problems servers browser had.
Do you even remember, that you could get malware by joining servers in a server list ?!?
No, I used to play multiplayer games for fun, which was the norm until that option was removed and replaced with derisive "casual" and "competitive" modes.
99% of people who played CS1.x/tf/Q3A/bf1942/cod/etc booted up the game, found a server in the browser with low ping to play on, and if they liked it they favorited it. They came back the next day, and the next, and started to recognized other players. That is the server browser experience.
If you were in the tiny minority of players trying to be "competitive" back then, you're right I don't know what it looked like for you. Sounds like it sucked, honestly, and maybe competitive matchmaking solved some of those problems, but in the bargain we lost a lot of what made those games fun for "casuals" as you smugly call us.
Again, it looks like you forgot all the issues there was, and only remember the good aspect of it. You didnt find the server on the first try.
Your favorite server was not always online
Some people were too good on the server you like and it wasn't fun.
Countless other problems, and you needed to sink in a lot of time to get the few quality time you wrote about.
> ...you needed to sink in a lot of time to get the few quality time you wrote about.
Sounds like you've got a skill issue. That doesn't match my experience, like, at all.
But a really, really easy shortcut was to find servers that indicated that they were furry-friendly. This all but guaranteed that
1) The folks on there would be fairly even-keeled and reasonable, and folks who weren't would be rapidly banned forever.
2) The folks on there would generally be good at the game. [0]
3) If you're lucky -and the game is one that permits custom "sprays" (as HL1 and Source engine did)- you might get to see some high-quality-but-thumbnail-sized furry porn.
[0] Seriously, at least back when both server browsers and user-hosted game servers were commonplace, I found a 1:1 correlation between "Are they a furry?" and "Are they particularly good at the game?". It was wild.
> The problem with player hosted servers is that it was very hard to get a fair and balanced competitive match
Playing against overwhelming odds has its own kind of charm. I once spend days just sabotaging the top players on some gun game servers, only wining myself once or twice. Games against friends with various fun handicaps and flat out abuse of any knowledge you could gain from playing against the same people repeatedly - what good is a hidding spot when everyone knows you will be there 50% of the time.
"Fair and balanced" games against completely random people are just missing something for me.
This is something matchmaking games totally miss which keeps them from being truly competitive in the way sports or old games were: a competitive community. You need other players with known identities to compare yourself against on a consistent basis.
Of course, classic competitive institutions had problems as well (“he’s very competitive” is not necessarily a nice description of a person!), but they seemed more enjoyable that this matchmaking stuff.
I hated wasting a whole half hour server hopping until I found one that didn't suck
I did indeed play in the era LanceH is talking about, and I agree with them! We had many thriving communities with no serious cheating problems because of community moderation.
Yes, there were poorly moderated servers, but you could simply leave and try a different community until you found one that clicked for you. When you require equal moderation everywhere, you throw the baby out with the bath water.
How much time did you wasted server hopping ?
Initially, until you found the right community run ones? I don't see the issue. Today is worse, especially when there is no server browser but just a blackbox that drops you in a random match.
This ignore actual history: anti-cheats started on community run servers. Because the majority of admins are not dealing with cheaters it because they enjoy it, but rather out of necessity. I see everyone here appreciating good admins, not many people are going to be volunteering themselves.
Punkbuster for Team Fortress. BattleEye for Battlefield. EasyAntiCheat started for Counter-Strike. I even remember Starcraft Brood War ICCUP's anti-hack client. You can see this in modern community servers too. Face-IT and ESEA for CS2 have more anti-cheat, not less. FiveM, which modded GTA V for community servers, never worked for Linux even before they added anti-cheat to the full game, because they had their own anti-cheat, adhesive.
Admins for modern game servers are not going to be interested in turning off their anti-cheat. That just gives them more unpaid work for little gain.
This is the exception that proves the rule. When you host your own community server, you control how much anti-cheat is built into it, like GP said. That usually meant about none but manual admin bans, but it could also mean lots, like you said.
> It used to be pretty easy to just ban people from playing
I ran servers for a lot of games. It was often difficult to ban people from playing. First off, someone with ban permissions would have to actually be online at the time. So often nothing would happen at all, you'd just have to leave and find a different server. Second, one could get banned, often just change their IP or use a different CD key or whatever other identifier the game used, and hop back on with a new identity.
Meanwhile discoverability of similarly skilled matches were a challenge, along with actually playing with a group of friends against new people. Its not some perfect panacea, there are a lot of things people disliked about picking private servers to play on.
All of this is hard but solvable at least for some genres, with the help of the platform and game devs. A decade+ ago, I ran servers for several PvP sandbox games, we've been one of the major EU hubs. This was pretty complicated - tons of custom observability tooling, a community with 24/7 mods, investigations, mod transparency, etc. The IDs were partially solved by Steam, the rest was handled by player behavior tracking and reputation.
We also had skill-separated servers. Casual ones had votebans for teams and players that were too organized/skilled/abusive, with case by case mod approval. Anarchy servers had nearly zero rules and were absolutely cutthroat and toxic but fair, you always knew what you were signing up for. They even had mods temporarily banning players for whining.
Cheaters never lasted long in our servers, including returning ones. Running a dedicated server takes some dedication. Know the game and people you're doing this for.
The only actual problem with cheating is leaderboards.
When you have accurate matchmaking, you will be playing against other players of a similar skill level. If you we're playing in single-player mode, it wouldn't bother you that some of the players were better than others.
Whether the person you're playing against is as good as you because they have aim assist, while you have a 17g mouse and twitch reflexes shouldn't matter. You're both playing at equivalent skill levels.
The only reason it matters to anyone is that they want their skills to be recognized as better than someone else's. Take down the leaderboards, and bring back the fun.
I say, let the people cheat.
Comments like this just make me upset to the point I can't cohere an appropriate argument. It's so out-of-touch with reality and completely ignores the core problem that I have to believe you're just fucking with us.
No, it is not fun to play against smurf accounts using hacks. They aren't doing it for the leaderboards, they actively downrank themselves to play against worse players!
And no, it's not fun to play against cheaters who are so bad at situational awareness their rank is still low, but who instantly headshot you in any tense 1v1 and ruin your experience.
And no, I actually do care that people are cheating in multiplayer games because it's not fair. Since when do we reward immoral fuckwits who can't or won't get better at the game?
Why don't we just start letting basketball players kick each other and baseball players tar their hands while we're at it. Who cares if the sanctity of the sport or competition is ruined - we're a community of apathetic hacks.
I play online FPS with friends for fun. I don't care about leaderboards, but I know people that do and don't want to take them away from them.
You can't have accurate matchmaking and allow cheating. People cheat for a variety of reasons, at lot of cheaters are just online bullies that enjoy tormenting other players. In a low ELO lobbies, you would have cheaters that have top tier aim activated only if they lose too much, making the experience very inconsistent.
Top tier ELO would revolve around on how the server handle peeker advantage and which cheater as the fastest cheating software. It's an interesting technical challenge, but not a fun game. As soon as a non cheating player is in view of a cheating player, the non cheating player dies. That doesn't make for a fun game mechanic.
>"Top tier ELO would revolve around on how the server handle peeker advantage and which cheater as the fastest cheating software. It's an interesting technical challenge, but not a fun game"
Fun fact, this does exist. There used to be old CS:GO servers that were explicitly hack v hack, would make it abundantly clear to any new visitors that stumbled upon the servers that you would NOT have any fun without a "client", and it was a bunch of people out-config'ing each other. It was actually kinda cool for those people, it would NEVER be fun for anyone else.
Pretty sure HvH is still alive and well in CS2 and high rank Premier is still basically Valve-hosted HvH.
Try playing Rust without anti-cheat and you will immediately change your tune. It isn't fun playing a game where you can lose everything to a guy who can cause bullets to bend around objects.
>"Try playing Rust [...] and you will immediately change your tune."
In general, really.
Yea, that's one game that's more fun to watch than play I will admit, so mostly I'm a "pro rust watcher with over 300 hours watching rust" (this is a bit of an in-joke, sorry) who sees the annoyance and lack of fun people have when they get destroyed by cheaters. I did play one wipe, and spent 25 hours over 3 days in the game, so I chose to quit right there instead of doing that on a regular basis.
Oh for sure, and even now I occasionally watch videos as background noise during work - but it's just not a fun game for the vast majority of times I log in. I'm about 175 hours in now; and for the one time a month I play, I can't be assed joining anything besides a 3x anymore with a wipe at least 10 days away, it's just too much sunk cost and wasted time even getting a 2x1 down in official or vanilla servers.
It's fun when I get something down (and fully use a starter kit, if a server has it) and have neighbors to dick around with, or there's not enough traffic to actually enjoy landmarks and underground, or occasionally when I meet someone that's down to team up or just talk on mic while pacing around one of our bases. But when that doesn't happen, I'm just not having fun haha
I am a casual watcher of Willjum' Rust single and cooperative plays whenever it rarely pops into my YT feed.
It's almost a meme in Willjum's comments that people watch Willjum's channel but don't play Rust!
I am also a WJ watcher.
There was plenty of cheating when there were no global leaderboards. People will happily do things just to ruin other people's day.
Not just single player. Even in competitive multiplayer a lot of the complaints about "cheating" are actually complaints about matchmaking, and "cheating" is a giant red herring (griefing is a different matter, of course, that gets lumped into the umbrella term of "cheating"). But trying to explain this is typically like pissing against the wind, because people already believe in the existing status quo (no matter how irrational it is) and no one wants to change their beliefs unless it obviously and immediately short-term benefits them.
I worked at a company once that didn't use any anti cheat. I once asked why, and they said the matchmaking system solved the problem for them. The matchmaking was good enough so cheaters only ever played with other cheaters, and it kept the numbers up.
Honest players never really complained, so I guess it worked for them.
At least in the world of chess (which has the OG matchmaking system, ELO), cheating is genuinely a problem.
The problem is that it doesn't matter how good you are. You will not beat a computer. Ever. Playing against someone who is using a computer is just completely meaningless. Without cheating control, cheaters would dominate the upper echelons of the ELO ladder, and good players would constantly be running into them.
> Without cheating control, cheaters would dominate the upper echelons of the ELO ladder, and good players would constantly be running into them.
...and, even worse, if they ever got to the very top of the ladder and started only playing against other cheaters, then they'd actually weaken their cheats so that they could drop down in ranking to play against (and stomp) non-cheaters again, and/or find creative ways to make new accounts.
Cheaters ruin games. The fact that the GP is so deluded as to claim that "The only actual problem with cheating is leaderboards." suggests that they've never actually played a competitive matchmade game on a computer before.
This is fine if you are low level, because the cheaters will be too good to play in the low level games.
If you are in the higher skill levels, you might end up playing too many cheaters who are impossible to beat. If the cheat lets you be better than the best human players, the best human player will end up just playing cheaters.
> If you are in the higher skill levels, you might end up playing too many cheaters who are impossible to beat.
It's almost kind of worse than this. If you are in higher skill levels, you end up getting matched with cheaters who lack the same fundamental understanding of the game that you do and make up for it with raw mechanical skill conferred by cheats.
So you get players who don't understand things like positioning, target priority, or team composition, which makes them un-fun to play with, while the aimbots and wallhacks make them un-fun to play against.
And as a skilled player, you are much better equipped to identify genuine cheaters in your games. Whereas in low skill levels cheaters may appear almost indistinguishable from players with real talent so long as they aren't flat out ragehacking with the aimbot or autotrigger.
You're saying it's not a problem when cheaters to completely ruin the experience for top-10% players
There are still plenty of games that use community hosted servers for multiplayer. I play some of them (Rust, for example).
First, cheating is absolutely still an issue in Rust. Sure, server admins can kick them out... once they have been discovered, verified by an admin, and kicked. The damage is usually done by then, and that is the best case scenario... often, the admins aren't available at that moment, because they are normal people who are not online all the time.
Plus, this means you have to search and find a good server to play on. That isn't always easy, and limits your ability to find a good game.
Second, lots of games I love to play don't make sense in the 'server hosted by a community member' model.
I love playing sports games... Madden, FIFA (now called FC), NBA2k, etc. The best way to play those games is often 1on1 against someone who is close to your skill level. It isn't fun to play against people way worse or way better than you.
The only way to do this in a way that lets me get a good game whenever I want to play is to have some sort of matchmaking system, that keeps track of how good i am and finds players who are about the same skill level. There is no way this would work on user hosted servers, and even if it did, why would a user hosted server be better at solving this problem than a company hosted one? You need a TON of players to be able to do good skill based matchmaking 24 hours a day.
I have been playing multiplayer online games for over 30 years. I started playing when I had to call my friend on the phone, tell him to tell his family not to answer the next call because it was my modem calling, and then hope to god my sister didn't pick up the phone during our game and break the connection. We had to develop a code to signal if I was actually trying to call him to talk about an issue; if I called and hung up immediately it meant I was voice calling and the next call he should answer with the phone.
I have played every iteration of multiplayer gaming. I played Warcraft II when you had to pay $20 to subscribe to Kali to use their virtual IPX service. I played local Counterstrike games at the college dorms on the local network (which was not even a switched network!) I run Minecraft servers for my kids on my local network. I have written multiplayer games for both peer-to-peer and server based multiplayer.
No, you can't recreate the modern convenience and pleasure of company provided matchmaking by going back to community hosted servers.
Instead of anti-cheat on the client side, which 'kernel level' anti-cheat still gets beaten, why not look at a wholly server-side statistical analysis of player stats?
Make the anti-cheat follow one of the key tenets of cybersecurity: never trust user input.
Should work reasonably well for first-person shooters.
You're ranked based on the game's inner metrics, calculated on the server, rather than player-visible ones:
- time from observation to target contact with crosshairs (inc. standard deviation, standard error)
- % of time successfully striking specific hit boxes
and so on (depending on the game).
These rankings don't affect your public rankings but do affect who you're match-made with, or games that don't have private server options. Eventually you'll only be match-made with other cheaters, or players so good they give cheaters a genuine run for their money.
For games that do have private server options it could be configurable to:
- flag the player to admins as 'suspicious' for investigation
- Start ignoring hits that would've otherwise been successful for statistical outlier behaviours (where the statistical analysis indicates a significant disparity between observed and known-human-like reaction times and behaviours).
Even if cheats were used on the server, their
> caused by the game companies that took away the standard method of playing multiplayer -- players running their own servers
Let's be real, what % people among those who game are interested in running their own game server? I'm definitely one of them, and one of my earliest tech memories was setting up a CS 1.6 game server for a bunch of classmates (and being unable to play myself because the computer had nowhere near enough capacity for both the server and the actual game running at the same time); but it's a minuscule percentage.
This isn't a problem because any given server can support hundreds or thousands of weekly players, so only 0.1% of your playerbase needs to run a server.
We had this, it worked, for years. I'm baffled by all the posters saying it won't, because it did.
There are games I play were one of the players' machines becomes the server. In some it's transparent to them, you just join their world or lobby, in others it's explicit and you even have to input the host's IP to enter.
Standalone servers you need to run separately and care for are much more rare.
> Let's be real, what % people among those who game are interested in running their own game server?
Let's put it differently: What % of people among those who program are interested in maintaining open source software?
A very low %, and yet it's a thriving ecosystem.
To bring it back to gaming: How many people who game are interested in modding, or creating models/maps/etc? Again, a very low %, and yet...
Running/renting hardware and connectivity and administrating a service and development are slightly different.
It's not the 2000s anymore - you don't have to run/rent "hardware" and worry about "connectivity" and whatnot. For most games that offer dedicated servers, there are services with easy to use panels with fancy colored buttons and everything.
As another example: how about hosting a website?
I never ran a server back in the day but I still benefitted from community run servers where decisions about banning were done by volunteer admins. These days with centralized servers it has to be automated.
For a casual CS server the ratio could perfectly be 1:50 and that'd be fine. That's how it used to be with, i.e., CS:Source.
Then, there are companies that ran a bunch of them, which lowered the ratio even further.
IMO, it's more effective, cheaper and easier to mod smaller forums (be it web communities or game server communities) than to do for huge ones.
We used to run these servers on machines that today aren't even 20% of the M1 in my MacBook air.
Back in the "small communities on their own servers" people also cheated. It was never entirely clear who cheated and who was just good and/or lucky with plenty of false positive bans also. Nothing about this was "easy" in any way. Which is why anti-cheat tools like PunkBuster have been around for 25 years.
Interesting thing I noticed trying to play old versions of Call of Duty a year or two ago -- the oldest ones which supported hosted servers, there are still players, but once they switched to matchmaking either no one is playing or its so tiny you never get connected.
Community-run servers weren't a magic bullet, and they had a lot of other problems that modern matchmaking systems solve more effectively.
Not really true. For years you had both co-existing. Anti-cheat and people running their own servers where they could ban people.
Absolutely!
The entire narrative of "cheating" is a giant misdirect. People don't actually care about cheating, they care about fun. If a player is making the game less fun, it does not matter how.
The real problem is that ~10 years ago major game studios decided to monopolize server hosting. This means that the responsibility of moderation is now in their hands. The only way this problem can ever be resolved is by giving the authority to moderate servers back to players. Until then, the responsibility to moderate will be unmet, no matter how fascist and authoritarian game studios become. Fascism cannot guarantee fun!
> fascist
How are game studios "fascist"?
Even if custom game servers were a preferable experience, which I would argue against, it doesn't really do anything for this problem.
By the time you have to wait for someone to cheat just to ban a single user, the disruption is already done. Your 4v4 45min game is already disrupted and everyone has already wasted their time now that you have to kick someone.
It's kind of like thinking you can forgo anti-bot measures because your website's users can just report the bots: by the time it's your users' problem, you've ruined the experience for everyone except the bots.
I would much rather my 45 minute game be disrupted and the user booted permanently by moderators VS every game be disrupted for months while the developers try and work out which parts of my privacy they can invade to maybe hopefully boot the cheaters.
What about everyone else?
Re-read the comment but with generosity in your heart? I don't think you need it explained.
> What about everyone else?
You didn't answer the GP's question. You talked about what you wanted.
The answer to their question is: the majority of people who play competitive matchmade games online have decided that they want anticheat, and disagree with you.
It's funny because this isn't even a hypothetical, you're actually just wrong!
The majority of people who play competitive matchmade games online didn't get consulted, the developers put anti-cheat in after the audience was already entrenched. The players didn't "decide" anything, Riot games decided it in like 2020 and the players have middling to negative feelings about it. You weren't talking about Riot Games? Well you said "majority of people who play competitive matchmade games online" and that's Riot Games, so yes you were.
> It's funny because this isn't even a hypothetical, you're actually just wrong!
Citation needed. Strong assertions like "you're just wrong" are automatically false if evidence isn't provided. Where's your evidence for this?
> The majority of people who play competitive matchmade games online didn't get consulted, the developers put anti-cheat in after the audience was already entrenched.
Completely irrelevant to anything we're talking about here. Although I'm not surprised, given that it's coming from someone with other utterly insane statements like "I would not be shocked if simple vote-kick outperforms every anti-cheat on the market." that suggest that you've never played competitive matchmade games or interacted with trolls on the internet, or completely failed to respond to hombre_fatal's question (whether due to bad faith or lack of reading comprehension is unclear) and just made some unrelated snide statement.
That they brought up League of Legends in 2020 makes me wonder if they were around when all we had were private servers or custom lobbies. That would explain their rose-tinted glasses.
In games like Warcraft 3 and Halo 2, the automated ranked matchmaking was well-regarded and a huge departure from waiting for a lobby to fill only for the admin to kick you because his friend wants to join or because you're playing the Age of Empires civ that he wants to play.
Auto randomization also baked in solutions to questions like how to stop people from farming rank.
Problem is that requires moderators, that get paid, with money.
more likely volunteers when they're running their own servers
volunteers which aren't necessarly pro player and cant distinguish good players from smart cheaters.
The developers aren't pro players either, the cutting edge for anti-cheats still require that non-cheaters play with cheaters for months. I would not be shocked if simple vote-kick outperforms every anti-cheat on the market.
A simple vote-kick will kick, will kick so much players that doesn't cheat. It's already used to troll in games like CS.
Not really. In mostly player-run lobbies, one of the players would kick any found cheaters. It's not exacts science, but it's what people did.
> By the time you have to wait for someone to cheat just to ban a single user, the disruption is already done. Your 4v4 45min game is already disrupted and everyone has already wasted their time now that you have to kick someone.
The difference is there is usually an existing level of trust between people playing on a private server. Usually your group would know ahead of time if someone is going to potentially be a problem.
Furthermore, even with public dedicated servers, there's a psychological aspect to it - it's no longer just a random matchmaking server; you're almost walking into someone's house. Many people feel a lot more pressure not to misbehave
Then there's the fact that you don't have to wait many days for your cheating report to hopefully be acted on. Our game got interrupted? Well, that sucks, but we can just ban that guy and go again and we likely won't have to worry that our very next game will also contain a cheater
Finally: these defences always have an implicit assumption with it: that the horribly pervasive anti-cheats actually... you know, work. They do, to a rather limited extent, but cheaters are still rampant, so what's the point?
If I already have a preformed 4v4, then I don't need anticheat.
The question is what to do about the rest of the time for everyone else. Shopping around private servers and dealing with individual server admin quirks is a regression from matchmaking UX that Starcraft had in the late 90s or that Halo 2 had in the early 2000s.
Why not both?
If you wanna matchmake, great, go ahead.
If you want to run a private server, you can do that too.
I'd love that. I bet that a lot of players would like having the choice, too. AND, data from a few months of a relatively popular game implementing this system should pretty much conclusively settle the question of whether competitive matchmade games should have anticheat.
counterpoint: my 45 min 4v4 game gets terminally disrupted if I can't run the game on my device
Sure, but that's a trade-off everyone already enjoying the game might be fine with if it means a better experience. That's how bad cheating is.
> Sure, but that's a trade-off everyone already enjoying the game might be fine with if it means a better experience.
Does it mean a better experience though? This isn't like, a theoretical GP is talking about. We don't have to imagine if
> That's how bad cheating is.
Seems like the answer is no?
The only multiplayer game I currently play is Beyond All Reason (a RTS game).
It's a free and open-source game, so creating a cheat client would be especially easy. But I've never encountered cheating.
I think there's a few reasons for this:
1) The playerbase is small and there is no auto-matchmaking, just a traditional list of servers. This results in the same group of people always playing together. People don't want to cheat when they're playing with acquaintances they see frequently.
2) Spectators are allowed in every game. The top-ranked games usually have several spectators.
You might think this would result in even more cheating, but in practice the spectators would prefer to watch a sneak attacks succeed, because it's funny. It's boring to be whispering the enemy secrets to you buddy on a private Discord, it's more fun to watch your buddy die in a surprising and funny way.
Also, the spectators can spot if a player does something that suspiciously well timed or lucky. The spectators see all, so they have the information needed to spot suspicious behavior.
3) Official servers create an official record of what happened in every game. The entire community has access to all the recordings. If someone thinks cheating is happening they can link to the official game recording on Reddit (or whatever) and everyone can see what happened.
4) An active moderator team reviews every report of cheating. There are official moderators that do the banning, but also volunteer moderators which can watch the recordings and create a trusted written account of what happened; this makes the official moderators have an easier job.
Hi, one of the BAR devs here. Glad to hear the tall praise for the project and even happier to hear you've been having a great time playing it!
One of the additional safeguards against cheating within BAR is the shared simulation that all machines connected to any given match have to perform. As the entire process is synced between all these machines, any mismatch is immediately picked up by other machines and the server hosting the match itself and results in an automatic booting of that player with the desynced game. If 15 machines can agree on an event happening in the simulation, and 1 can't, why should the 1 be trusted? This includes things like the economy reserves for a given player or the behaviour of their units, not just the physical simulation of the projectiles and their trajectories and hit registers.
Seems more likely that the cause is that RTS isn't a popular genre among gamers and Beyond All Reason is obscure[1] even among RTSes. There's no fame or money to make it worth investing in cheating.
[1] Among the general public, not RTS aficionados. Which is unfortunate; Total Annihilation and its spiritual descendants like BAR deserve more love.
Even as an RTS player I've never heard of it, but I have learned recently that I've missed out on an entire niche scene based off of TA. Been playing RTS's since 1994ish and only recently bought TA to go back and play through it. Never owned it back in the day.
People have been banned for cheating, so cheats exist.
I don't think they're saying cheating doesn't exist for the game, they're saying the popularity/incentive is too low to attract many cheaters compared to esports games.
I'm saying they have their fair share of cheating and they have managed to moderate it well without using any form of anti-cheat software.
Of course a small game is going to have fewer cheaters. They have fewer cheaters, but they also have fewer moderators; it's literally like 4 or 5 people doing it in their free time.
Hello, CM for BAR here, nice to see it mentioned :)
As Zephyr says state manipulation cheats are impossible since they would lead to desyncing any online battle.
Since every user technically has access to the whole game state there are user side cheats possible, like LoS hack, but these are easily detectible (as well as spectator cheating) and very active moderator team makes sure anyone using them is perm'ad so it's not worth for people to try them and it's been super rare so far.
Smurfing (using alt accounts with lower ELO to get weaker opponents/avoid moderation) is probably the most prevailent type of "cheating" but there is a lot of active and passive countermeasures implemented so most players will rarely experience issues with that.
Thanks for this, BAR looks really great and open source is very important to me. Definitely gonna try this out!
Link for others: https://www.beyondallreason.info/download
Its unfair to compare other games to BAR. BAR is to good
As most of you know, these anti-cheat systems are functionally equivalent to rootkits. There is zero visibility into how these privileges are used for targeted attacks. Due to geographic location of the large game companies this has a geopolitical angle. Fingerprinting of devices and the networks they are in provides a lot of metadata that is most definitely fed into their intelligence apparatus.
I remember trying to install Valorant for the first time, and its ridiculously invasive anticheat kernel mod (or whatever it's called) gave me my first blue (or was it red??) screen I'd seen on Windows in years.
Immediately uninstalled it and haven't ever played Valorant to this day. Fuck that crap, if your community is so toxic that you need a rootkit to keep cheaters at bay, then maybe it's more of a community problem than a technological one. And yes, if this means that you have to block all of China in order to do so, then that is still a community problem. Put your rootkits on your Chinese servers, separate them out, and let the cheaters fight amongst themselves.
Is it any coincidence that such state is from the same company behind League of Legends?
> if your community is so toxic that
It's nothing to do with a toxic community.
It might not be the sole reason (and most likely isn’t), but toxic communities breed these sort of behaviours, especially in games that are extremely hostile to casual players.
I'm curious, do they have to be? Would it be possible to boot the program + the anti cheat into it's own VM or something? So they know I am running on trusted hardware, but I know that the aren't reading my emails? Genuinely curious and don't know the answer to this.
The anticheat will try to detect the VM and it will give a warning, so that's not a solution. Ideally keep leisure time devices and work devices separate. Consoles are a good solution because you are never tempted to use your emails on those.
But also you need to think about who your adversary is. Other countries have access to all your icloud mail and photos all the time. Something like dropbox and onedrive is scanned and catalogued in the background.
Hardware supply chain is a difficult topic and each layer of abstraction has their own mini operating system in the firmware, and past has shown many of them have backdoors.
Yes, and more than that, the kernel-level-anticheats are unable to spot someone using a Cronus ( hardware aim assist among other stuff [0] ).
I'm never going to play again online on any FPS because that whole incoherent bubble of crap disgusts me.
The multiplayer games community is toxic, and players are focused on success whatever the cost is. And I don't even want to touch the question of match making with a 10-foot-pole. Local, self-hosted or in small community is the best.
[0] https://cronus.shop/
>Local, self-hosted or in small community is the best.
It always makes me happy to fire up Quake via Darkplaces or even ioQuake3 and still see servers up and people playing.
Unpopular opinion, but we would be better off with a single open trusted implementation of anti cheat (aka drm) which can attest whatever requirements are desired by the game is met. The only real problem is that it would likely be limited to approved kernel images and someone would need to own that validation and signing infrastructure, but you could imagine having multiple trusted entities have this role.
Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state.
Cheating is a meat space problem and there is no technical solution to it. Thats why in tournaments there are referees standing behind the players. Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
> Cheating is a meat space problem and there is no technical solution to it
Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it.
> Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.
This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.
> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state.
Incorrect. DMA (direct memory access) is and can be prevented [1] and detected [2].
[1] https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-...
[2] https://community.osr.com/t/detecting-pcie-dma-based-cheatin...
You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments.
The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly.
But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures.
There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.
Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory
https://x.com/danielgenkin/status/1989003973429268974?s=12
Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this
> Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this)
Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones.
> Something like TEE.fail can be used to read encryption keys for network traffic
So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often.
I don't consider it an arms race if you can prevent cheating to 10s of people in a million-player game. That's noise at best.
> Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones.
I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats
> So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often.
You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE. Reading memory speed doesn't really matter as long as you can find an encryption key for network traffic. Once you can intercept network traffic and decrypt its game over!
You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs
A few years ago, DMA cards cost upwards of $500. Now you can buy cards from china preloaded with pcieleech firmware for around $100. and there are thousands of customers. If you can afford the latest gen gaming gear and afford to spend money on cheats you can certainly fork over a couple hundred dollars for the latest undetected solution
> I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats
I can assure you that you will get banned from a game with a modern anti-cheat using that or you won't even be able to launch the game. Also 'flagged by most anti-cheats' means very little. Most good anti-cheats will delay bans or correlate multiple factors prior to a ban.
> You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE.
You don't have to decrypt it on the RAM wire bus. And the reasons TEE.fail is successful is because they screwed up the crypto as far as I can tell.
> Once you can intercept network traffic and decrypt its game over!
Not sure why you are so hung up on this. You still need to access the memory first. That's what they will detect and prevent. They obviously can't prevent or detect network sniffing if the key is known.
> You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs
I've made FPGA designs previously, including custom PCIE DMA cards back in ~2018. It would surprise me if you could find an FPGA capable of reliably sniffing DDDR5 6000+ MT/S without crashing the host system. FPGAs are not nearly as fast as CPUs. Maybe you could somehow hack a FPGA DDR memory interface. But finding one fast enough for DDR5 is probably impossible (or terribly expensive). Maybe https://www.amd.com/en/products/adaptive-socs-and-fpgas/vers... is theoretically possible. But you are looking at a 10k+ chip, if not 20k$+. Such a chip is not going to be easily embeddable and likely requires 10s if not 100s of amps of power delivery.
Why do you need to handle DDR5? You can use DDR3 to play the vast majority of competitive video games. It's not hard to find an FPGA that can handle DDR3 or DDR4.
You also don't need to sniff the entirety of the traffic. You just need to introduce aliasing. That is much harder to do for DDR5 but you don't need it to be reliable or stable for a long time, because you won't be sniffing for very long. And you don't need to do 6000+MT/s either.
As far as I know there are very few systems that support Windows 11 with DDR3. I think his point was more that if you drop the link rate on ddr5 to sniff then the performance penalty will be very bad. DDR5 starts at 3000
Yeah, but DDR4 is very very common.
Also, you don't need a lot of performance for these games. Even 3000MT/s DDR5 is fine for competitive shooters especially in CPUs with big caches
> I can assure you that you will get banned from a game with a modern anti-cheat using that or you won't even be able to launch the game. Also 'flagged by most anti-cheats' means very little. Most good anti-cheats will delay bans or correlate multiple factors prior to a ban.
Most of what I said is a large oversimplification on the matter. Anticheats absolutely do make use of heuristic patterns to flag drivers that are correlated with known cheaters. Drivers are pretty well flagged now days by anticheats but Windows does virtually next to nothing to prevent people from abusing these RWEverything drivers
>Not sure why you are so hung up on this. You still need to access the memory first. That's what they will detect and prevent. They obviously can't prevent or detect network sniffing if the key is known.
The point is that you don't need a very complicated or long-lived exploit to yoink those keys if you know where to look.
The overarching idea here is that as long as you have physical access to hardware it is going to be very difficult to prevent these kinds of attacks without serious vertical integration and from who? Microsoft really don't seem to care much, CPU/Motherboard/RAM vendors are benefiting from an open market with shared standards and anti-cheat/games do not have enough purchasing power to push over consumers.
I can't comment much on FPGAs because I don't know a huge amount about them so il take your point. There are also countless side channel attacks and ways to leak data from your memory in completely unintended way eg; cache timing or faulty speculative execution
There are DDR4 interposers you can buy for 50$. The basic thing is that you don't need all of the ram all of the time, you just need to find an address which you can then rewrite to make two valid references to the same physical memory (see: badRAM/battering ram). Then you can use an IOMMU compliant DMA to access that memory.
Or you can use an FPGA to interpose the RAM and intercept the network traffic for a couple hundred bucks.
> There are DDR4 interposers you can buy for 50$.
Indeed, you can buy a piece of fiberglass shaped correctly for 50$. That's not the hard part. Just the probe you are supposed to connect to such a PCB is > 1k USD per pin you need to sample. The oscilloscope / logic analyzer to sample it is likely 6-7 figures.
> Or you can use an FPGA to interpose the RAM and intercept the network traffic for a couple hundred bucks.
What FPGA solution do you have for a couple hundred bucks could interpose DDR4 RAM at any frequency? This number seems completely made up to me.
I do think a large portion of the huge price for this equipment is that it is very niche and only a few mfg's eg keysight/agilent make this kind of stuff.
Im sure if the DMA market goes way of the RAM bus sniffing its will be a year or two before mass produced products are on the market that can sniff the traffic without much reduction in signal quality and maximum data rate.
This is theoretically possible, but I don't think most cheaters would have the equipment or skill to do this. Cheating is only rampant in games where people can just buy and download cheats... if it requires a lot of skill and hardware, it won't be a big issue.
It's not just theoretically possible, you can buy kits that do this already.
This way lies the death of general purpose computing.
I'm not sure this is an unpopular opinion. I've seen it suggested multiple times, and IF done correctly (open/transparent) would solve most of the complaints with the ring-zero anti cheats. Still won't solve every cheat, especially hardware, social and perhaps good VMs. I would require the app/game to disclose what it requires to be true.
Imagine wanting tivoization. Horrifying.
I'm ordering a new laptop to work on LLM stuff, and while I thought about jumping through the hoops to get Linux running with secure boot...
I had a realization, it's a cold day in hell when someone else is going to tell me what I can run on my computer. All the latest multiplayer games are now requiring secure boot on Win11 as well
I'm actually wary of all these anti-cheats, they're literally hyperinvasive maleware.
I don't need gaming that much.
And if I do I'll stream it with Gamepass or another cloud service.
What irritates me is when games that don't even benefit from anti-cheat require it. Helldivers 2, for example. My dudes, it's a co-op game. My teammates and I are all on the same side! Moreover, the vast majority of people are gonna play with their friends, not randoms. And if your friend is using a cheat and it bothers you, you just ask him to stop. There's no reason for a game like Helldivers 2 to require anti-cheat at all, let alone the rootkit variety. And yet...
Elden Ring: Nightreign is also a co-op PvE game that has anti-cheating in it. The most common way people cheat is by fudging then items equipped to their character that slightly alter their stats and abilities. Since the game is rouge-like and all of your character information and equipment you can assign before entering the game is handled locally then all it takes is editing your save file which the game and server have no way of (or makes no effort to) detect.
Also, after a brief period, all of the cheaters disappeared because just repeatedly winning a PvE game get boring.
The best games with anti-cheat have an option to launch without using it, but just restrict what game types you can play. Playing with friends should be allowed without anti-cheat.
Helldivers might have more to do with preventing people from easily farming super credits versus game integrity.
Yep. I've seen quite a few free-to-play gacha games of the "Dress up your pretty princess in cool clothes and do cute activities in a relaxing, no-stress world." variety that have serious anticheat. There's no leaderboard, no multiplayer, it's totally singleplayer.
Why the serious anticheat? To try to prevent you from cheating your way to possession of all the cool clothes for your pretty princess.
burying the lede here killer. the answer is "we want to get paid"
the cool clothes cost $$$ or are randomally found. 0.0000004% chance to get, or pay money for better odds.
or pay lots of money to just get it.
It's also bad with games that have been sucked into the live service hell-vortex. I can't fire up a quick game of Madden against the CPU because EA has turned Madden into a multiplayer lootbox casino, so they chuck Linux-blocking anti-cheat on the whole damn thing, single-player and all.
What? Helldivers 2 works just fine on linux for me. Is this just a windows thing?
Not all anticheat fails to work in Wine/Proton.
The super invasive kernel-mode variants (that is, the sort that's in Valorant) flat out fail, and surely always will. It's my (perhaps mistaken) understanding that with some others (like Easy Anti Cheat), it's a choice made by the game dev as to whether running in Wine/Proton will be permitted or not.
That's not exclusive to kernel-mode anti-cheats. Even VAC, which is not kernel-mode, doesn't work in Proton: https://github.com/ValveSoftware/Proton/issues/3225
> That's not exclusive to kernel-mode anti-cheats.
Sure, I didn't intend to suggest that it was. That's one of the reasons I mentioned EAC. Apologies for the confusion.
I'm a pretty prolific gamer, but at the start of the year I finally kicked Windows to the curb.
It's been fine. Surprisingly few games I'm interested in to begin with have anticheat that doesn't work on Linux, and it's comforting to know games aren't allowed to just shove trash into kernel space at will.
I dropped my Game Pass sub immediately after they upped the sub price and unplugged my Xbox Series X. I have a Bazzite machine, but I've had issues with the NVidia drivers and not enough patience to deal with it. So i'm currently ONLY using my Steam Deck OLED for gaming. When i want to play big AAA games at my desk (SD in docked mode), i'll use GeForce Now and all of it has been a wonderful experience, even the online "competitive" FPS games like BF6. Much better than my experience on either Windows or Xbox. I'll never go back... and i'm impatiently waiting on my Steam Machine!
If you play older games, Linux ironically works better than windows now for stability. The only game I have seen any issues with (note I don't really play multiplayer much) is the Harry Potter game, but proton eventually fixed that.
Yep same; have had Linux on my laptop for a decade plus, but finally switched my desktop over a few years ago, and I have no regrets. The real magic is that I no longer feel the need to do any research before buying a game; it usually just works. Granted, I don't really play competitive multiplayer games, so YMMV (but even that might be about to change if the Steam Machine sells well enough).
The thing is I still need Windows for music production.
Linux will never compete here.
They said this about gaming too... all it takes is Valve-esque sponsor
Until Valve starts shipping native SteamOS games, they were and are right.
Games are developed on Windows, using Windows APIs and development tools, and then Valve does the job studios don't see any value in spending development resources on, even though some of them use engines that also target GNU/Linux.
Talking about Linux gaming with Proton is no different than if Windows users would start talking about Windows being their favourite Linux distribution due to WSL 2.0.
It takes a stable ABI and a single target for apps. Don’t expect music production to ever show up for gnu/linux. Maybe Android
Bitwig is available for Linux, but I don't know what the limitations are.
A lot of VSTS aren't going to work even with tricks like WINE.
They often have complicated auth systems, etc.
I don't really want to learn a new DAW.
> They often have complicated auth systems, etc.
The paranoia audio devs have with piracy is insane. Ironically I think the worse your DRM is, the more your product should be pirated :)
It's often 20% DRM and 80% marketing.
Ohh cool, this plugin is "free". Looks like I have to register for an account and install a bunch of unrelated crap I really don't want.
The up selling never stops.
Then again. 30 years ago a lot of these trucks were straight up impossible without spending tens of thousands.
A lot of people give high praise to Yabridge, but I myself haven't tried using it for my existing VST library and just found alternative plugins that work with linux.
The sad thing is linux, like MacOS, is often vastly superior for audio routing and latency.
Personally I gave up all my audio productions tools that don't support Linux, but since music/audio work is just a hobby for me that's easier to do. I do miss my old DAWs (Ableton/Reason), and I miss a lot of VST plugins.
Not everyone can just re-base their setup on linux (for me Renoise & VCV Rack), but I can get plenty of joy out of a complete lack of Windows, license management crapware, invasive rootkit level DRM, etc.
Side benefit: it pushes me to get some more external hardware, but I have to do investigations on how some companies do firmware updates which often require MacOS/Windows or Chrome Browser (fucking webmidi looking at you Novation)
I've tried switching to hardware sequencers multiple times.
I just don't like it. I came of age making beats in Fruity Loops. I'll gladly drop another 200$ or 300$ just to make things easier.
I do have some dreams of making an open source sequencer that runs directly off a raspberry pi. Something like a fully open source MPC.
Some projects like this exist, but it's still more difficult than I'd like.
Maybe one day in the distant future Apple will make affordable laptops. A MacBook that takes a standard 2280 SSD would be amazing.
Never going to happen though. That's where the money is.
> I came of age making beats in Fruity Loops
Fruity Loops 4 was my first DAW, and yeah it has been hard to ever leave computer based production behind since then.
The only hardware sequencing that has ever clicked for me is the Polyend Tracker, which is just a tracker so I hesitate to even call it hardware sequencing. I also dig Elektron's sequencing, but its an entirely different headspace I have to spend time in to get used to everytime I fire one up.
I'm lucky that most of my projects only use 4-12 channels of midi/audio, because I can't stand massive projects with 40+ channels of things going on like some friends I've worked with. Hard to imagine trying to do that in hardware alone.
I actually have a Polyend Tracker.
It is a VERY weird device to say the least. I found myself not really enjoying it. The issue with hardware is when you want a final result mastering and splitting up tracks is like teeth extraction.
Vs using software where you can just export stems and hand it off to someone else.
However, with software you end up spending a lot of money on non tangable goods.
I can sell my Polyend. Selling a software license normally isn't possible.
Plus say you own a license to version 10.x. The day version 11.x comes out, the previous version might be worthless.
Vs vintage audio gear which might actually go up in value.
I was pretty surprised that the Polyend Tracker could spit out channel stems at least. I ended up selling mine when I needed some extra money to made ends meet, will buy one again eventually.
>However, with software you end up spending a lot of money on non tangable goods.
Yeah it sucks that this also keeps us locked into platforms for so much longer. I've been buying Reason updates for a decade, and own a bunch of Korgs VST releases of their hardware synths (Op-Six, Modwave, etc). If I can at least get the Korg stuff running on Linux one day that would be nice. It might be possible but I haven't tried.
>Plus say you own a license to version 10.x. The day version 11.x comes out, the previous version might be worthless.
Shout out to Renoise for being affordable and you get a whole versions worth of updates. Which after over a decade I still haven't had to pay again, but will gladly when the time comes. Plus I can even run it on a raspberry pi now.
> I don't need gaming that much.
Counter point: gaming is fun, and indy games are worth investing in. Voting with your wallet works better if you vote for behavior that's not user hostile, rather than only abstaining.
Just to be clear, the anti-cheat systems that support Linux run at the user level and don't require secure boot. Those kernel-level and secure boot restrictions only apply to a handful of games, and they all explicitly block Linux users anyway. For example, I've been playing Arc Raiders a lot recently in Linux, and the user-level EAC works just fine.
The user-level cheats are extremely bad. For example, Elden Ring uses EZ Anti-Cheat and it works on linux and that game is infested with PvP cheaters.
> ...Elden Ring uses EZ Anti-Cheat and it works on linux and that game is infested with PvP cheaters.
I would question how good Elden Ring's use of EAC actually is.
Given that -at launch-
* Players who were using a Japanese locale couldn't play the game unless they removed EAC
* Removing EAC substantially reduced the amount of incredibly noticeable hitching and stuttering
my hunch is that EAC was hastily slapped on very, very late in the process due to demands from some US-based PHB.
Lots of games don't need invasive anti-cheat. You can just play those. There are literally too many awesome games on the market to ever be without something great to play.
Many people have one or more Discord groups where someone will say "let's play Valorant tonight" and then everyone just installs it. Linux is fantastic for local gaming on a handheld or in the living room, not so much when your non-Linux friends pick the game.
All I really do on my Windows system is play games, and because of that I don't mind whatever draconian crap that's required to keep cheaters in check. It sucks, but not sure of a better solution.
I honestly don't understand why any game is even checking if secure boot is enabled.
If anything it's for the OS to care about that, not individual programs. Afaik, secure boot doesn't (on it's own) prevent the running of arbitrary software, so how is it actually preventing cheating?
It does mean that a signed OS image is running, so demonstrates that the kernel was unaltered at start-up.
It also demonstrates further levels of driver signing robustness.
I'm not really familiar with Secure Boot too much. Researching suggests that users can add their own keys so they are trusted by UEFI. Won't this resolve for linux users that must have secure boot on?
No, it's not a given that users can add their own keys - certainly in an anticheat scenario they probably couldn't, or at least if they did then key attestation would stop working.
It's usually a giant pia.
Some distros support it, some make it really difficult.
I like to distro hop. I'll often have to try two or three to get to a working system.
I've had no issues setting it up with Fedora and Ubuntu with kmods/Nvidia drivers. I just say I want it, and I have it. It's really easy now.
I was in a similar situation and ended up buying a PS5. It ended up being exactly what I wanted.
How's the mouse and keyboard story on PlayStation? The few shooters I play would greatly hinder me if I were stuck on a gamepad.
PS5 completely supports mouse and keyboard at a hardware level. It's up to the game though if they support it. The new Doom games don't support it on console even though M&KB are obviously supported on Windows for example. Other games do like the Quake 1 & 2 remasters. I think even Monster Hunter Wilds does if you really want to.
Not being possible for all games is a major detractor for me.
Just get a ps5. I went through the same adventure.
I did that for years and I recommend it as well. Pure linux desktop + console for games is a nice combo and a good separation of functions.
Of course... at this point I am back to having a PC with a beastly GPU and I boot Windows for games and CAD. It is hard to resist high framerate 4k gaming once it becomes a possibility, so now I need to figure out the secure boot problem for the occasional game that requires it.
A PS5 is an even more locked down system! There are vastly more games, many I already own, that work on Linux.
I don't personally have a problem with a system being locked down in general. I have a problem with my computer being locked down, or getting rootkits installed on it. So for me at least, playing those games on console is a good solution.
That's the seperation of concerns that drives me to a Switch alongside my computer. Though I'm by no means a "serious" gamer by most people's standards.
I'd much rather invest one powerful machine that cand do work and games instead of two that take up extra space and generate more e-waste.
I still play on my ps2 ... because consoles are linked closely to the games of that generation I would guess that they are tech that are on relative terms least discarded
It's funny that game makers make a fuss about anti-cheat not working on Linux but then publish Switch versions of their games. That platform has almost zero security and is commonly emulated with cheats even in multiplayer these days.
If people cheat in the switch, they can blame Nintendo. If people cheat in PC, they can blame the anticheat. Without anticheat, they have to take the blame.
I still blame the devs of the games.
> is commonly emulated with cheats even in multiplayer
There is no Switch emulator that can play online on official servers.
The only way you can cheat online is by hacking a real console, but the percentage of people who do it is quite small.
AIUI you can do it, but you risk the Switch you got the data from being banned.
This. Even kernel level anti-c-spyware can't stop a cheap vision model hokked to a mouse, see youtube for examples from simple auto input up to full on elctromuscular stimulation.
Yes the channel “Basically homeless” has a few variations on this. Using electrodes to move your muscles to more practical a bot that moves your mouse pad for you to give you perfect aim. No anti cheat can detect that because there is nothing to detect.
Based on the latest report from Dice/EA/BF6, seems indeed like they're detecting hardware-based cheating as well: https://store.steampowered.com/news/app/2807960/view/4972134...
Although who knows, they might be outright lying about that just to scare cheaters, but I tend to default to assuming what they're saying is more or less true.
Looking at the accessibility alternatives they suggest, they were probably detecting XIM users, not the much nastier PC stuff like DMA cards.
They can’t detect me splitting my hdmi output, feeding one of them to a separate machine with a vision model to detect what needs to be detected and the same machine moving and clicking the mouse. People are already doing this.
Could you please share examples of ML-based cheats that actually work?
This one is a good example; https://m.youtube.com/watch?v=T4rrcw_oRVs
Thanks, interesting! Looks like it works way better than I expected.
[dead]
Client side anti cheats is a lazy excuse why they don't want to spend on server side anti cheats anyway.
How do you stop a client-side wallhack with server side anti-cheat?
Don't send the client information about players they should not be able to see based on their current position.
How does it know what isn't visible? Can it handle glass? Frosted glass? Smoke? What if I can't see the player but I can see their shadow? What if I can't see them because they're behind me but I can hear their footsteps? What if I have 50ms ping and the player is invisible after turning a corner because the server hasn't realized I can see them yet?
To answer all those questions you either have to render the entire game on the server for every player (not possible) or make the checks conservative enough that cheaters still get a significant advantage.
GeforceNow begs to differ.
I know, not the same, but IMHO the future of anticheat. We just need faster fiber networks.
Yeah. Stadia worked well in ideal conditions, so for people lucky enough to live that life, the technology's there.
I never understoof why google gave up so early on cloud gaming. Clearly it is the future, the infrastructure will need to develop but your userbase can grow by the day.
I live a bit remote on an island group, and even though I have a 500Mbit Fiber, my latency to the next GeforceNOW datacenter is 60-70ms (which is my latency to most continental datacenters, so not NVidias fault). That makes it unplayable for i.e. Battlefield 6 (I tried, believe me), but I have been playing Fortnite (which is less aim sensitive) for 100+ hours with that.
And under such system, how do you stop people from abusing latency-compensation to make their character appear out of thin air on the opponent’s perspective by fake-juking a corner to trick the netcode into not sending the initial trajectory of your peeks?
Fortnite had this same issue when BR was first released. It was promptly fixed after cheaters started abusing it by adding more stringent checks.
Fortnite has a fairly invasive root kit level anti cheat too, don’t forget.
The invasive kernel root kit came months after they fixed the netcode abuses.
Then how would the client know where to render the positional audio of their footsteps for instance?
run your own servers, an admin watches them track people behind walls, player gets banned, move on. Oh, they took away player run servers...
Not scalable
Improve your server AI to catch weird behavior. Client side approach with this malware idea is simply unacceptable.
It's a numbers issue. How often do people encounter cheaters while playing Switch games online?
Try playing Pokémon Legends Z-A multiplayer.
Often because of cross play.
The Switch has good security as long as you can check the OS version robustly.
Any Switch game using an anti-cheat solution that can't trivially detect that it's being emulated is... not using a very good anti-cheat solution.
what multiplayer (esports) game that can run on switch ????
fornite???? its not gonna be main playerbase
From the top of my head: Rocket league, Splatoon.
I'm sure there are others, but those are the 2 I play
Splatoon is a Nintendo game.
Sure, but it's still an esport and any discussion of anti cheat ought to apply regardless of publisher methinks
mario karts
Super Smash Bros.
Madden and NBA2K
The thing is: the Switch has a clear ToS, and if the user breaks it they can get into trouble. OTOH, if you release your game in Linux... that's it
The games have ToS though right?
The Switch is a closed proprietary platform, so Nintendo can give some guarantees, and if the user does something at the Switch level, the responsibility of legal action will be on Nintendo, saving up headaches to the publisher.
Beaches of a Terms of Service agreement have no inherent legal penalties.
Some actions which breach ToS may be illegal, but that has nothing to do with them being outlined in a ToS.
Bad excuse, they could rely on Steam ToS for example.
Creating a steam account is cheap. Needing to buy a new switch is not.
At this point - you would think that cheaters could be detected on the server side by either training a model to flag abnormal behavior or do some type of statistics on the movement patterns over time - is a client-side anti-cheat really required?
Many forms of cheating revolve around modding the game locally so that certain textures can be seen through walls, so you always know where opponents are. So you aren't breaking any laws of physics, you are just able to make much better tactical decisions.
The obvious solution would be, just don't send data to the player's client about enemies that are behind walls. But this is a surprisingly hard thing to engineer in realtime games without breaking the player experience (see: https://technology.riotgames.com/news/demolishing-wallhacks-..., and then notice that even in the final video wallhacks are still possible, they're just more delayed).
> So you aren't breaking any laws of physics, you are just able to make much better tactical decisions.
With respect I'd like to disagree on this subtly. A lot of games have the client send their cursor position at relatively frequent updates/packages (i.e. sub-second). So the server knows pretty precisely in which direction and to which object a player is looking.
This in turn can be readily used upon when using wall-hacks, as most players, who use wall-hacks tend to almost faithfully follow objects behind walls with their cursor, which good moderators can usually spot within a few seconds, when reviewing such footage (source: I was involved in recognizing Wall-Hacks in Minecraft, where players would replace textures, to easily find and mine diamonds underground).
You very, very quickly learn not to look like you use wall-hacks.
The biggest heuristic is that you suddenly get much more consistent. Valorant uses this to ramp up how intrusive its kernel anticheat becomes and often forcing you to turn on more intrusive features to continue playing the game
In Minecraft one of the common ways to catch people using x-ray hacks or transparent texture packs is to run statistics on the blocks mined. If the ratio of stone-to-diamond gets significantly out of whack it's a sure sign someone is cheating.
In blackjack card counting is (probabilistically) caught by tracking player winnings. If someone is beating the odds a bit too much it's a fairly good indicator they are counting cards. Of course in this case getting it wrong isn't so bad from the casinos perspective either since then they'll just kick out a player that was costing them money anyhow.
When the enigma cypher got cracked they had to be very careful about when to act on information gained. If they started beating the odds too much the Germans would cotton on to enigma being broken.
My point being that cheating will almost by definition improve your odds. There are definitely ways to catch that sort of thing happening without installing rootkits. You just might need to hire a couple mathematicians to figure it out.
That final video is recorded to look better than it is too: the delay is based on position, not time. In a real game you'd be moving slower and have the enemy's data on screen for longer.
That's because the 2025 definition of "anti-cheat" leans heavily towards preventing players from enjoying client-side content that's locked behind microtransactions (for example, EA's new Skate game).
What you’ll find is that a subset of players define a behaviour and now you have to prove that that behaviour is cheating. For most behaviours that could be cheating, it will overlap with skilled players.
Examples would be pre-aiming corners and >99th percentile reaction time.
You need a false positive rate well below 1%.
It’s estimated that cod warzone has 45 million players - a 0.1% false positive rate at that player count is 45000 people. That’s a _lot_. It needs to be orders of magnitude less than that.
This is done, and generally doesn't work as well. Your model will catch people using yesterday's cheats, but the cat-and-mouse nature of cheating means that people will adapt. Funnily enough, cheaters are also training models to play games so that they can evade cheat detection. The kernel-level anticheats are designed to prevent the game from running if they detect you are running any software that interacts with the game. Much simpler for the developer, and circumventing it usually requires running your cheats on a second machine which a) limits what you can do and b) has a higher barrier to entry.
I don't believe there's a foolproof way to do this.
It's basically the usual cat-and-mouse game of an arms race.
oh but that would mean more computation on the server, cant have that!
Is there really no way to make anti-cheat on Linux that can't be bypassed? I don't know much about this, but it seems very difficult to make an anti-cheat for a platform where you can make changes in the kernel.
I think the moment you accept data from the client as truth you've lost the battle already, everything else is just damage control. Loads of games have realized this and kept checking game rules on the serverside and reveal data on a need-to-know basis. This makes it nearly impossible for cheats to be made because anything you know you should know, and everythin you act is parsed by the backend according to rules already present
Some kinds of cheating can be mitigated that way, but it can't really stop cheats which just play the game more optimally than the user is able to, using the same inputs and outputs that a legit player would use. Aim assistance in shooters, automatic parries in fighting games, economy-breaking levels of automation in MMOs, and so on.
There's also practical limits to how much data you can filter out in complex 3D games, both due to performance constraints, and because culling information too perfectly can cause things to pop into existence too late under real-world network latency. The effectiveness of ESP cheats can be reduced, but not eliminated in practice.
You could probably detect those kinds of cheats heuristically on the server. There are limits to human ability. It’ll take more time to catch the cheaters, but I’m sure it’s possible.
This player is posting 30 auctions per second. Bot.
This player is turning at a rate of 500 radians per second to make perfect headshots. Bot.
this is already running in production for Counter-Strike since 2018 [0][1].
to be honest, it isn’t particularly good - all serious CS2 games operate on a third party provider with a kernel-level anti-cheat. also, the cs2 update banned people for spinning their mouse too fast [2].
[0]: https://www.reddit.com/r/GlobalOffensive/comments/5u2xly/eli...
[1]: https://www.youtube.com/watch?v=kTiP0zKF9bc
[2]: https://www.youtube.com/watch?v=JwU_ejDNC0s
Aimbots will just add delay and variance then. Guess its a bit fairer but if they're better than shroud level then it's still not great.
Which they do already, because slamming all of the aimbot settings to max is a fast track to getting mass reported and escalated to human review, which will immediately see what's going on. Any cheater with an ounce of desire to preserve their account is going to try and maintain the pretense that they're just very skilled, not impossibly skilled.
The cheat could just be tuned to play at the level of the best humans.
I think anything that relies on reflex alone is flawed design. You can design around this, by for example in Dota2 it doesen't matter how fast you click an entity, because the turnrate of your character is limited, so a person clicking reasonably fast and a bot clicking in 0.01ms both arrive there at the same time. Precision also doesn't matter, because a player can click the icon of the enemy instead of trying to match the pixels on screen. MMO scripts that use information already given by the game just seem like the MMO should invest in UX instead of trying to ban people for using the tools the game already gives them.
>for example in Dota2 it doesen't matter how fast you click an entity, because the turnrate of your character is limited, so a person clicking reasonably fast and a bot clicking in 0.01ms both arrive there at the same time. Precision also doesn't matter, because a player can click the icon of the enemy instead of trying to match the pixels on screen.
Even with turnrate, reaction time is very relevant. Reaction time allows you to silence enemies midcast, or to pop a shield, or a BKB, or some other instant measure. Turnrate doesn't mean reaction time doesn't matter, it means the direction you are facing matters.
As for precision, yes it does matter, ask any Phoenix player who gets hexed mid-flight.
People cheat in Dota in these very terms, it's absurd to argue it doesn't matter.
Unless DOTA2 is running at a ~3 tick rate (Which it's not), even taking account processing delays and action batching, a bot will always have faster reaction times than an actual player. It will also never misclick.
This problem is magnified in a shooter game, which would be unplayable with that kind of batching, but where a cheater with an aimbot is actually impossible for a legitimate player to beat.
After you click, the character will begin to turn, which can take several hundred ms. A delta of couple ms compared to the time it takes to turn is completely negligible and even an inch better positioning of a character, or having a character with items or stats that makes them turn faster (because picks are asymmetric) will make several magnitudes more of an impact.
If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
> If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
This is interesting, because I feel like the fundamental gameplay of an fps is players exposing themselves to each other's field of view, and then trying to click the other's head first. Skill is a measure of map knowledge (so you can try to expose yourself to a possible field of view but not where the enemy is actually looking at that moment) and speed of clicking head.
How would you design FPSs to remove this "bad game design?"
> How would you design FPSs to remove this "bad game design?"
I think we just need to accept that bots will always be better at reaction based KPIs & abusing "knowing" too much game state, we should just remove those conditions.
1) Move most of the application logic to the server, the client should be a fairly dumb terminal that knows how to render and accept inputs, and only receives the state that it needs. No more spying issues.
2) Just give everybody auto aim & immediate/auto controlled firing, etc. No more aim bot issues.
3) Improve the quality of gameplay around the types of interactions which bots are bad at. Decision making, strategy, communication, execution, adaptation.
Sure, feel free to make an entirely different type of game that's not as vulnerable to cheating.
But some people just want to play competitive fps shooters. And currently obnoxious anticheat toolkits are the way to provide that, unfortunately.
> No more spying issues.
This isn't possible. And this explains why: https://www.youtube.com/watch?v=WFw4F2AyaP4
We can only minimize the amount of extra information given to the client, not eliminate it. And at high enough skill levels, even 1-2ms of extra information will always be actionable, even by humans (not just bots).
>just give everyone aimbots, no more aimbots issues
what if more people want to play an action shooter game, and not a slow strategy game?
>If your game allows your sights to just teleport on people's heads and take that as the winning condition then that just sounds like bad design, there's no reason to allow infinitely fast movement and omitting strategy even from a shooter
From the servers perspective you always kinda do that for fast movements as the client send rate usually isn't more than 60hz.
There is rampant cheating in online chess and poker as well, you know? You can have an opinion about what constitutes a better game for humans: should it be about making better decisions, arriving at them faster or being fast and precise with your mouse but the reality is bots/assistance can make you unplayable in all of those domains.
However, this only solves the cheat problem to a minimal extent. There is a lot of important data that players should not be directly aware of, but which is important for the game. For example, it is important for calculating sounds to know where enemies are nearby, even though you cannot see them, which makes wall hacks possible, etc.
Sounds are core to shooters and very much within the expected abilities of the players to hear them. If anything, I'd incorporate this kind of indicator in the game itself, allowing for deaf people to "hear" footsteps as well
> I'd incorporate this kind of indicator in the game itself, allowing for deaf people to "hear" footsteps as well
That's just discount wallhacks. Fortnite has it and you're basically forced to use it even if you have no hearing issues, because it provides a massive advantage.
This is not how it works, most games that take cheating seriously already have a gameserver where most of the gameplay logic happen.
Doing everything server side does prevent cheating.
Eventually you have to send data to the client and they have to send you back what they did. Assuming you’re running a game server with 240hz updates, on a 120hz monitor with no buffering, on a low latency connection in the same location to your data center, the absolute bare minimum amount of latency you can plan for is about 15ms from server to on screen, and back again) - 8 ms each way, 4ms for the server tick, and 5ms each way for networking. Now move 100 km from the server, or add in double buffering, and you’re closer to 50-60ms. That means at any given time you know there’s a deviance of between 0 and 50ms between your state and the clients - and a client can and will exploit that.
> Doing everything server side does prevent cheating.
No. Server side only protects against some types of cheats, such as telling the server that your bullet in an FPS is actually a grenade.
It cannot prevent snapping your aim to a target on screen.
I missed a *not
Obvious when rereading. Sorry :)
That only solves half of the cheating problem - illegal inputs from clients.
The other half is much harder to solve. For a simple example - my client knows that there is an enemy player around a corner. It knows exactly where that player is, because that player is walking, and making noise. A cheats could allow the cheater to see his opponent's player's model through the wall.
For a more blatant example, consider cheats in a first-person shooter that just snap your aim to the nearest enemy's head. This involves zero violation of the game's logic, and also makes the game completely unplayable for everyone in a lobby.
You already know where an enemy is if you hear them behind the wall, you don't need a cheat to tell you that there is noise coming from other side of the wall. The server also doesen't need to tell you they are behind it if they're sneaking. A game that allows zero home-in time sounds like a flaw in the game and something solvable on the serverside.
You can replace a playermodel with wider "sound coming from around here" if you want to make it even harder for a cheat to pinpoint a sound
> The server also doesen't need to tell you they are behind it if they're sneaking
This requires the server to calculate line of sight checks for every player, which is costly, requires loading the entire geometry into the server and would be horribly prone to latency. Then you're looking at potential performance problems on the client due to only knowing about a player the second its in view and having to stream the assets to the GPU, which if don't happen in time for the frame you'll experience as hitching.
> You already know where an enemy is if you hear them behind the wall
Yes but this requires using your brain rather than just seeing them straight up through a wall.
I don't think those performance concerns are really much of an issue with any sensible implementation. You'd do line of sight checks against simplified geometry first to handle the vast majority of cases, and you'd load character models/textures in advance (game/match startup) rather than only when they first appear on screen.
One non-trivial part seems to me that if you walk around a corner you don't want to wait 50ms (your ping) for the server to send enemy locations you can now see. Ideally every tick the server would be sending all enemies that you could potentially see before the next tick depending on what your movement packets that it hasn't yet received turn out to be. Wouldn't entirely eliminate advantage from cheating (e.g: a cheater walking around a corner could still see enemies up to a tick/~15ms in advance) but would hopefully make this form of cheating significantly less worthwhile.
You have to do line of sight checks based on the players entire FOV, which requires the server to know this in realtime with little latency.
This is unworkable for fast paced games.
This is unworkable for even slow paced games.
Cs2 and Valorant does this, but start sending positions around corners before they're visible.
Basic distance checking is doable, but any kind of "they're ducking behind a 2 feet wall in front of me" is going to be horrible to detect server side.
Both Valorant and cs have pretty simple geometry and low player count which helps a lot for a system like this. Can't really do for bigger outdoor games with buildings etc.
CS2 does not do Vischeck culling anymore. It was ditched with the move to source 2. All players are globally visible to everyone
I feel like you've only played 1 genre of video game or something.
> You already know where an enemy is if you hear them behind the wall,
You know they are somewhere behind the wall, you don't know which exact angle they are behind the wall, because headphones and our ears don't work with that degree of accuracy.
The cheater can just swing the corner with his cursor already pre-positioned exactly on his target. Between peeker's advantage (inherent to any online game with latency) and human reaction time, there's not a lot you can do to fight that.
A trusted entity (probably Valve) could provide a locked down distro where kernel integrity is enforced through secure boot and TPM attestation, but that would mean giving up some control over your own system. There's no guarantee that anything client-side is impossible to bypass of course, but the goal would be to more or less match what Windows offers, which isn't perfect either.
> giving up some control over your own system
There could simply be a developer option that disables these integrity checks but subsequently breaks online games that rely on them. Valve could also offer a module that allows signed user-space binaries access to kernel space, which would be an improvement over Windows offers in that anti-cheat wouldn't need to live in the kernel.
I think that's a fine trade off.
You don't even need a developer mode. I was looking into making my own image based distro/system which has its bootchain entirely verified and I intend to make any modifications via system extentions[1], which IIRC also get measured aswell (or was at least planned somewhere). To be fair, this is purely additive or overlaying, so no removing of files, at best changing. This all would be signed using Secure boot and after the fact using dm-verity.
Secure Boot in theory isn't even necessary, only TPM2. Secure boot only ensure that you are actually booting into a binary that you expect to boot in this case, so if your binary is actually different it would result in different PCR values in the TPM indicating something is wrong.
Sadly a lot of end user software (flatpak, ...) isn't packaged & signed in a way which would allow for full "only run software I allow by importing public keys" (read Linux IPE[2]), but what can you do, only your best I suppose...
[1]: https://www.freedesktop.org/software/systemd/man/systemd-sys...
[2]: https://docs.kernel.org/admin-guide/LSM/ipe.html
You don't need a full distro, you can just run the game in a VM sandbox with trusted computing extensions alongside whatever distro you want. That breaks cheats that rely on network/memory inspection, you can still cheat using the raw pixel output to drive faked input, but I don't think the loop is closeable there.
That wouldn't be sufficient. You'd need a hardware component to verify the OS signature of the specific distro with a trusted (by the game company) asymmetric key, and that enforced driver signing.
Those things are all possible, but really the only entity that has the power to realistically do them is the OEM - Valve could do it for SteamOS, but only on it's own hardware.
Has anyone produced a proof of concept for such a system, for gaming or otherwise?
Given that a certain amount of windows gamers have been having issues making sure their PCs complied with the config requirements for the latest COD/Battlefield, it would seem an even higher bar for a consumer targeted bit of software that needs to do more to be running securely (or add a different mode to your distro install and reboot to it), alongside the wider variety of distros/configs. Distros advertising themselves for gaming or getting people to migrate from windows are also trying to keep barriers to entry low or to appear simple.
Running in a VM is not secure by itself. You need something similar to what Android is building via protected VMs.
Indeed running a VM is an exploiter's dream, unless the VM is essentially run by a hardware hypervisor (akin to Android's system).
This is what a console is.
Could reboot into secure mode for these types of games.
There is no way to make anticheat that can't be bypassed, regardless of OS. All of the anticheat games today have cheaters.
It doesn’t have to be 100%. The point is to make it inconvenient. The majority of people will not do it if it is inconvenient.
Thats the point to many things in life that you just make it more difficult and most people won’t be bothered to attempt to circumvent whatever it is.
There will still be circumventers but it is will be less than if you just said fuck it.
Sure. That also means it doesn't have to be kernel-level rootkits that fundamentally break the security model of my operating system and risk my bank account. Most people will be stopped by userland anticheat, right? It's inconvenient. So ... put it *there.*
And if someone does the kernel bypass thing, well, rely on server-side heuristics (which are imperfect, but also unknowable to the attacker) and you'll discourage enough of that with account bans.
Helpfully eSports players tend to have video captures of their gameplay, and most of these "undetectable" cheats are real obvious if you actually watch the footage. That catches most of the serious stuff at the upper level. It's why video verification has been a thing in the speedrunning scene for such a long time.
The problem with userland stuff is that it’s trivial to download and doubleclick an EXE (that acts as a fake anticheat or whatever).
Anyone can do that, but not anyone can simply “patch the kernel” and such.
> Anyone can do that, but not anyone can simply “patch the kernel” and such.
Sure they can - download this pre-patched ISO and boot it in QEMU. Now you have a modified kernel, _and_ you’re not running dodgy spyware on your PC.
> Helpfully eSports players tend to have video captures of their gameplay, and most of these "undetectable" cheats are real obvious if you actually watch the footage. That catches most of the serious stuff at the upper level. It's why video verification has been a thing in the speedrunning scene for such a long time.
There's a subreddit called /r/vacsucks which is full of pro players blatantly cheating and getting away with it while the rest of the idiots think they're just good players.
Or, depending on your point of view, full of idiots flagging any player better than they are as cheating.
Aimbots can be "humanized" enough that any such determination becomes subjective.
Sure, and my point is that making it inconvenient for other people to cheat is a way too low bar for us to accept rootkits on our systems.
Correct. E.g. you can aimbot by routing the video signal to a capture card on a separate computer and run image recognition software to generate mouse movements spoofed at the hardware level. The only way to reliably prevent cheating is with in-person tournaments played on hardware provided by the organizers.
As someone said about the lack of a Switch anti-cheat: it's a numbers game. If cheating is as easy as downloading a .exe for a few $$$, you're going to find cheaters everywhere. If it requires a complex, and/or fairly expensive setup, the number is going to be very low.
That's assuming there's no money in being a cheater.
The best way is to just make private servers, so people can play with their friends and not have to worry about random players. This also solves the issue of people using.... language thats not acceptable in games.
Reliable anticheat is serverside. Clientside anticheat sounds like a fool's errand to me. You need to control the client, so that means the user cannot be in control of their own computer, which is contrary to the idea of Linux.
It works on Windows by essentially rooting the machine. MS holds control of a bunch of stuff because they hold the signing keys. It’s fundamentally incompatible with open source.
And it still doesn't prevent cheating.
No, but it seems to vastly reduce it. Compare VAC2 to FACEIT on CS2 for example.
Comparing VAC2 (released in 2005) to FACEIT in 2025 is pretty dumb. There are still absolutely cheaters running rampant on FACEIT and FPL.
The real solution is to limit information sent to the client, make it harder for cheaters to have reliable solutions to get access to critical game information. ARC Raiders has Theia anti tamper (very poor performance) but right now the number of cheaters is minimal because the select few who are smart enough to break the anti-tamper are keeping quiet. See other examples; The Finals, Roblox (Byfron) and Overwatch
https://codedefender.io/sigbreaker/
> It’s fundamentally incompatible with open source
Yeah, I mean why would they open source their anti-cheats, would defeat the purpose, wouldn't it?
Not sure why you bring up OSS here, it isn't relevant in the least, plenty of non-OSS runs on Linux even though Linux and more is OSS.
Because with Windows, MS can put a list of trusted rootkit anticheats in the kernel and that cannot be changed (without having the source or breaking signatures when hex editing etc).
If Linux did the same, anyone could recompile the kernel with their fake anticheat’s signature. The fake anticheat would then present itself as real to the game. One could go as far as to rewrite the relevant syscall to falsely indicate to the game that the legitimate version is running.
The OEM could control it in hardware and a secure part of the chipset could validate the OS integrity and sign the relevant key (which is what Apple does with SIP on a managed MacOS installation).
Yes and no. I agree the only thing that can be reliable is server side.
However that means that anything based on reaction times and such is impossible to protect against (under reasonable conditions). At the end of the day you can always have a robot sitting at your desk. But there is steps to that. You can have something that highlights enemies, etc., you can have something that controls keyboard and mouse (maybe inside a VM, so you don't need hardware) and so on. You can reverse engineer packet encryption in a debugger (in most situations) and have something on the network messing with stuff and so on.
So in that regard, yes you can prevent everything you can prevent on the server, but you cannot prevent every sort of cheating on the server.
Everything that has rounds basically can be prevented (other than again a bot playing).
Everything that is complex to automate is better, but might just make cheating more "worthwhile".
The other thing you can do on the server is "dumb cheat" detection. Eg. the odds of someone being consistently as good at a game and such. Statistics like that is widespread and doesn't need any change on the client.
I did a pretty deep dive into this recently, although haven't yet started any implementation work. As far as I can tell, the best strategy that preserves Linux's open-source and user-empowering ideals as much as possible:
- The game obviously needs to run as root, at least until large amounts of this stuff gets upstreamed into the kernel.
- We're going to be leaving the kernel and boot as untrusted, but injecting a hypervisor underneath the running kernel that is responsible for protecting most pages of game memory. This allows users to still run whatever kernel they want.
- The hypervisor sets up two sets of page tables, one that's only active when the game's thread is running and in userspace, one that hides protected pages and is active when the kernel or other threads are running. Note that game code itself needs to get decrypted into protected ram.
- The TPM of the system gets involved when we jump into the hypervisor to attest that the hypervisor is actually running, and the hypervisor then provides attestations to userspace that certain memory regions are protected from kernel or other thread access.
- Any syscalls will fail if they require the kernel to read or write pages that are protected. The game needs to allocate data that should be shared with the kernel into non-protected pages.
- When the game is closed, we can remove the hypervisor and Linux will be back to bare metal operation. This should be unobservable to the rest of the system.
This architecture preserves the ability of users to run arbitrary kernel modules, but does mean a hypothetical attacker can observe data that passes through the kernel (like draw calls/pixels). It's likely that a more complete implementation would also want some way for the hypervisor to attest to the accuracy of keyboard/mouse input and interface with iommu configuration like Windows KAC does.
There’s just no way to stop cheating client side despite what devs love to think. But server side anti cheat is much harder and requires more work; it’s much simpler to just install spyware / rootkits on the client and call it a day.
You can’t prevent wall hacks with only server side anti cheat. The client needs that data locally before the enemy is rendered on screen.
As mentioned in another comment, you can’t do this on the server without expensive checks for every single player that is always checking line of sight, because it’s not just your session running on a single server but multiple sessions.
And let’s say you did this, now you have a latency problem because most modern games to make them feel fluid has client side prediction with server reconciliation. This is what makes your modern games feel more responsive, if you put a constant server check there you have lost this.
No matter what people say online, it isn’t just move all of it to the server, there is data the client needs to know and can’t be spoonfed by the server.
I think it’s an organization accountability issue.
Why would a company pay for anti cheat infrastructure when they can outsource it to some company and blame them if there are cheaters or upset users? Windows is the status quo too, so it’s very easy to point to everyone else when justifying your choice to the execs.
It would be great if steam deck+box start costing studios quantifiable amounts of money that can be used to justify fixing this instead of outsourcing and hand waving.
I think the most stringent types of Windows anti-cheat rely on remote attestation of the operating system. It's theoretically possible to design a Linux-based OS that supports such a capability, but the sort of people who choose Linux are unlikely to accept a third party having the final say over their computer.
I, for one am disappointed that anyone has accepted it. Once it's widespread, service providers can demand it, as we're seeing with mobile banking apps and game anticheat.
I also strongly dislike requiring remote attestation for any kind of software I want to run. But what I also dislike is cheaters in my online games and I genuinely do not have a better suggestion on what to do.
Personally, I run Windows purely for gaming and don't let it near any important data. For the latter, I boot into Linux with separately encrypted disks.
>But what I also dislike is cheaters in my online games and I genuinely do not have a better suggestion on what to do.
You can't suggest "run online games as close-knit social groups, with social exclusion punishments for cheaters", which is how most online games used to be run. How old are you?
Game vendors used to be happy letting us host and run our own multiplayer games, until they realised they could get more money out of us -- "battle passes", microtransactions, ability to forcibly turn off multiplayer of older game when newer remake comes out -- and now they've made themselves a mandatory part of your online experience. You have to use their matchmaking and their servers. So now it's down to them to solve the problem of cheaters, enabled by their centralised matchmaking... and their only solution is remote attestation of your machine and yet more data collection?
I'm doing the same but I worry about windows compromise messing with the bootloader so then encrypted linux drive won't save me. Probably too paranoid though?
If you use secure boot and don't let your keys near Windows, you should be fine even if your Windows install is compromised. Unless you don't trust Microsoft themselves, in which case you'd need to re-enroll keys whenever switching operating systems, which is possible, but very tedious.
Linux is resistant to rootkits, which is what these things are, and allows you to remove them, yes.
The correct solution is to verify everything server side, or actually have humans watch replays and ban cheaters, but both of those would reduce profits, so will obviously never happen.
CSGO has actual humans watch replays to determine whether people were cheating, it's called overwatch. As can be seen, it doesn't actually stop cheating, at most it ensures that blatant ones are banned after the fact already happened.
CS2 Does not have overwatch anymore. VAC Live is completely AI and its a known fact that valve have a few buttons and sliders to play with to go through ban/boom cycles for cheaters to maximize impact
You'll never see cheats banned in real time - that provides an enormous amount of data to cheat developers to allow them to quickly learn to evade your detection. Bans after the fact in large batches are the only sustainable way to go.
You see cheaters banned in real time in Valorant, and the match is canceled, at least you used to.
IMO the real solution is back in community servers and votekicking.. It works on old games with no anticheat measures..
Maybe add some blatant detection for people teleporting and doing other absolutely impossible things serverside, but I don't understand why my team has to ruin their 'reputation' teamkilling a cheater so he doesn't ruin the game completely in most current games when the anticheat only catches free, old cheats. Just let people votekick and find someone else in the matchmaking queue who's willing to join halfway through.. Once votekicked enough times you can escalate to the AI (always indians) for automated (manual) review.
Also, you don't even have to ban cheaters. Just isolate them to play with each other. Some might find it fun and keep away from the normal players.
Edit: The 'issue' with community server manual review and votekick is you can be kicked for being cracked or garbage at the game legitimately, but TBH at this point you're ruining the fun of everyone else, so you should probably get in another server/match.. Also that premades can have majority, but that's easily solved by reducing their vote weight.
I mean not really, as someone that had been votekicked from many games. Servers with admins does solve this, but has it's drawbacks. But you also cannot have the matchmaking type of game that are popular today.
Back in MW2 if you were the host you could kick players from your game using a cli tool that adjusted firewall rules.
For lobbied ones votekick is great as long as you remove majority vote from premades. So in a 5v5, a 3 man premade isn't able to kick any of the 2 randoms alone.
I remember the misuse of it but it was better than having your only option be teamkilling, which is now punished in all games via reputation systems.
The only thing I don't see this as a solution for are games like Planetside, with massive lobbies. I know they used to have automated detection and manual review by admins teleporting and flying around, usually invisible to sus players. Once we found a bug and got inside the map able to shoot through the ground and in like 15 minutes an admin came, asked us how we got in there and to get out nicely, before he gets us out forcefully :D
Yeah. It’s an erosion of rights that doesn’t solve the problem. You only need one cheater to make a game feel bad and DMA devices or pixel tracking can’t be stopped with these anti-cheats.
Server-authoritative games. Basically the client does stuff, gives the list of moves to the server along with a checksum/end result. Then the server runs the same commands on the same starting state and checks if it got the same result.
If a==b, then everything moves on as normal. If not, the client gets a synchronisation error and has to rewind back to the last known good state.
Completely unfeasible for anything real-time pretty much.
Having done modding for some older shooter games built on the server-authoritative model, it's still possible to create a "pingless" experience, but it requires more calculations and compromises on client/server trust to make it work. For shooters specifically, you want the client to provide instant feedback when the gun fires, and ideally when they hit an enemy. You can achieve this by telling the server "I was at position A and shot my gun at position B and hit enemy Bob." The server will validate all of this before informing the client who fired and the client for "Bob" that Bob was killed. The compromise here is that the server must trust that the client isn't sending forged data, or the server must do additional computations to validate it.
An elaborated version of this idea is called "rollback" where you let the local client predict and execute the game state at time t+1 and will "roll back" the state of the game if it received another game state than the one predicted. Extremely popular and state of the art for 2D fighting games (most of the time the prediction is correct and it greatly reduce the perceived lag) , but probably harder a bit harder to do with 3D games.
You can run a VM using trusted computing extensions for the game. If the VM encrypts traffic, that stops network level cheats. You can still fake inputs/outputs to the machine if you put the work in, but then you can also use a vision model and faked input with actual consoles, so that hole is never going to get patched.
You are looking completely wrong at this. There is no anti-cheat that cannot be bypassed. Period.
You can always run things in a VM, you can always replace your keyboard and mouse with a different device, you can always have your a camera instead of human eyes and have something that recognizes enemies.
Even cheat detection in the real physical world (sports, chess, etc.) is not a completely solved topic.
You can connect computers to other computers so other computers will always be able to control them.
The idea that any (currently realistic) cheat prevention is unbypassable is silly.
> The idea that any (currently realistic) cheat prevention is unbypassable is silly.
The idea that anti-cheats don't make sense because they don't catch 100% of the cheaters is what's silly, who believes that? Not even the people writing these anti-cheats believe catching 100% of them are possible, why are you under the assumption that others think that's possible?
If it removes 80% of the cheaters from the game, the experience goes from "Holy shit lets leave" to "Ok, bothersome, but fine", this is what they're reaching for, not some fantasy utopia that you seem to be under the impression is the target.
I don't think the comment you're responding to is trying to claim that. They're responding to the parent comment asking if there's any way to actually make a Linux anti-cheat method that isn't bypassable and pointing out that this framing isn't really useful because there's no way to make one on any platform that's actually impossible to bypass. Their point isn't about whether it's useful or not to have imperfect anti-cheat but that there's nothing fundamental about Linux that changes the fact that the anti-cheat is going to be imperfect anywhere.
> the experience goes from "Holy shit lets leave" to "Ok, bothersome, but fine",
This is making those rootkit anitcheat mechanism work. If people will leave, cheaters will play only with cheaters - problem solved.
> If people will leave, cheaters will play only with cheaters - problem solved.
Yeah, but it's a bit like the ultimately solution to climate warming; getting rid of all humans on the planet. Fine, it solves the problem, but who is staying to enjoy the solution?
Linux explicitely allows you to do things that makes cheating *really* easy.
There is also complete lack of secure boot and a way to validate that your kernel hasn't been compromised.
I mean seriously, making a cheat for a proton supported game that no anticheat has any hopes of detecting are in 100 lines of a kmod driver and 1 console command: insmod.
On windows you at least need to use scuffed tools like KDU to bypass signature verification requirements and every anticheat can detect you with a simple physical memory scan.
Linux supports secure boot just fine, it's just happy (correctly, IMO) to give the keys to the user and not the developer.
Unfortunately right now SteamOS does not support secure boot or measured boot.
yah my bad: vendor defined secure boot*
> There is also complete lack of secure boot
That's not true, though?
well lack of secure boot is bad wording, lack of vendor defined secure boot.
I mean kernel level anti-cheat doesn't really work on Windows either, its just security theater.
Based on what data do you draw that conclusion? The fact that cheaters can still exist isn't an indictment that it doesn't ever work. Have you ab tested a game with an without anti cheat?
I used to dual boot, but I that there are so many games on Linux, I just don't buy or play incompatible games. So EA lost a BF6 sale for being assholes.
Same situation here. If it were last year, I may have caved. But at this point I don't want to bother with dual booting and losing my Linux context as I do so.
Instead I'm playing ARC Raiders which works perfectly on Linux and I don't regret a thing.
The only game I miss when I moved to Linux was League of Legends. Everything else pretty much works. I get that it’s not worth it for them to deal with more potential cheating, but it’s a bummer.
The worst thing about League was that Riot added it retroactively after years of effort to patch Wine to work with League's weird quirky code. It was the only game that I always remember having a custom Wine build in Lutris even as far back as the early 2010s.
It also would be completely unnecessary if they fixed their servers.
I'm playing through wine (kegworks) on OSX but its no fairytale over here. TF2 over wine literally performs worse than native TF2 on my old dual core 2012 mbp. I'm having to use low resolution configs again. CS2 works OK but there are severe lagspikes that ultimately ruin the gunplay (a little more tolerable when it happens in tf2 but its there too). About the only game that works well in this setup for me is Mount and Blade: Warband. But I mean its a 2010 game... I can't even play bannerlord because of anticheat. Can't play chivalry 2 because anticheat. Can't play cities skylines 2. Most games that do work seem to struggle to get 40fps even on m max series macbooks. I'm not sure where the incompatibility is but its got to be in the software layer software given the specs on those max macbooks.
I just wish someone actually cared about this stuff at Apple. GPTK is not that useful. Rosetta 2 has some serious performance throttling going on somewhere in it (why is native macos cities skyline fps locked at 40fps...). Former mainstay native macos game devs from 10-15 years ago have zero interest publishing for the platform today, valve included.
[dead]
Thank you, I prefer my Linux without rootkits.
Same here, I don't need any game so badly that I compromise my security unnecessarily. I'll just play something else.
Cheats aside, are there any competitive games that include Uber-like rating system? Meaning that you'd need to provide feedback whether you'd play with your opponents/teammates again after a game.
Overwatch (1) had something like that. Not sure if Overwatch (2) still has it, or how it functions now.
In higher ELO, people would target good players with "avoid player"^1, effectively soft-banning those people from match making because the pool was small enough. They would still get put in matches eventually but their queues would blow out a lot.
From memory it did not have an explicit "match me with this person" button, but you could thumbs up players in the post-match podium as well as endorse them which may have soft-factored into matching you with them again.
\1 I think it was called this. It was a general "bad attitude" marker, not a "bad team mate" or "bad opponent" marker.
Overwatch (1 and 2) had/have an avoid system, but it only avoids as teammate. Overwatch 1 use to at the very beginning have a system to avoid a player as a whole and they wouldn't be matched in your game at all, but that was remove really early on, as it is easily abusable against good player (I don't want them on the enemy team, they are too good so just get rid of them entirely) and there was a report system anyway for other kinda bad stuff.
Then there is just the endorsement system, which is just a level from 1-5 and you can endorse people you liked playing with. It doesn't really do much in matchmaking but you can't do certain things if you are below a certain level (I forgot what all it was but you can't make (public?) custom games if you are too low and I think text and voice chat could also get disabled if you are too low).
Overwatch 2 has a simplified endorsement system. It's just an optional thumbs up instead of endorsement for 1 of 3 reasons (roughly something like sportsmanship, good teammate, or good leader).
The avoid system is now more flexible. You have 3 pin slots for people you never really want to see on your team again, plus 12(?) regular avoid slots to avoid people for a week at a time like usual. In situations where too many avoid conflicts occur and the matchmaker struggles to create a match (e.g. high ELO), it will start to ignore people's avoid slots in order of (last regular avoid > first regular avoid > pin slots), i think.
Overwatch did have a "prefer this player" option, but not for very long
Dota 2 comes to mind, they have the commend system. If I remember correctly they added something like this to CS: GO too.
Pretty sure the commendation system in CS is just for looks, as it can be easily gamed.
Yes to some extent, I believe “The Finals” asked to rate how each match went in earlier seasons. But that stopped now that the game is more mature and feeling well balanced.
Cod MW2019 would occasionally ask, but once every X game IIRC.
The idea of someone rating me, or rating someone else makes me anxious.
I'm not sure it would be better than just reporting people with undesired behavior.
> The idea of someone rating me, or rating someone else makes me anxious.
But not enough to avoid, as you’re here.
I think it’s more anonymized like “did you enjoy the game with this team (1-5)”
Not quite like that but plenty of games used to have vote kick mechanisms.
Smite used to do that, but long time since I played it.
While some anti cheat supports Linux they're mostly useless as you can much more easily bypass them on Linux compared to windows. I guess enabling them for competitive games is one way to increase Linux users.
One would hope that Microsoft will eventually revoke kernel access to these companies (see, Crowdstrike incident) eventually forcing game developers to support Linux for many popular online service games and actually stop being so lazy with anticheat. Somehow a smaller studio like Embark managed to make Arc Raiders compatible with Linux. I have 95 hours into the game and have not encountered 1 cheater. Yet a mega corp like EA can't possibly afford to support BF6 on Linux because of kernel anticheat. I put only 10 hours into bf6 and got killed by aimbots three times.
As someone who never plays online games with randos - mostly single player, or multiplayer with friends -
I cannot stress enough how much I do not give a shit about anti-cheat, and how thoroughly fed up I am with poorly conceived and ill executed malware being installed on my computer, holding games I own hostage in the name of stopping cheaters that I don’t care about it.
Anti-cheat should be opt-in.
Main problem with highly competitive games is that you can run them inside a container and have full access to memory.
Most games will share all the data with every client which makes it trivial to display positions of every enemy on the map. It's just convenient for developers.
In games like Tarkov, once you spawn in, your client gets all the information that possible - positions of players, their names, equipment, contents of every single container on the map.
Tarkov is not the best example, because the netcode is terrible, and the architecure is a joke - you can loot everything on the map with a keystroke, and kill anyone with another, but other games are not better.
Even in Valorant, which makes an extra effort to only send data relevant to the player - ie. data about player that you are about to see - you can use that to see around the corners.
Hm, most of these seem updated 3-4 years ago, is this list relevant any more?
Do you have examples of where something isn't accurate? If something hasn't changed it doesn't need to be updated. As far as I'm aware the things that change are updated quickly, hence the list is relevant.
No, I just assumed things would change a lot.
It will be interesting to see how this evolves. It used to be that game developers could safely ignore Linux. But with a growing number of Steam OS, Steam Deck, and Linux + Steam users gaming, it's going to get increasingly more painful in terms of revenue to be telling those users "our game only works on Windows" and just miss out on the revenue and deal with the angry users, forums full of users complaining the game doesn't work, etc.
It might only be a few percent of overall users. But a few percent of a billion $ is a couple of tens of millions. That's a steep price to pay for anti-cheat code.
Most game devs can continue to ignore linux and trust that proton will work it out.
It's only the highly competitive online games that have this issue. While they make up a lot of playtime, they're worked on by a tiny minority of developers.
They are still ignoring Linux, hence why Valve is using Proton, the validation they failed to convince studios to care, studios that happen to target systems like Android NDK, or use platform agnostic engines.
> They are still ignoring Linux, hence why Valve is using Proton...
Eh, maybe?
I'd put forth the notion that game devs might be caring how their game works on both Windows and Proton. That is, that they're still using the Microsoft-provided APIs to build their game, but care about how it runs on Linux just as much as how it runs on Windows.
Not really, otherwise you would be getting SteamOS native builds.
It is up to Valve to sort it up, they are the ones that care, otherwise they will need to pay Windows licenses, which is really what this is all about, while pretending to be some kind of white knights.
Fundamentally anti-cheat is made to ensure you're running the game in genuine Microsoft Windows. If you're using Wine, you're not. They could check for genuine Linux, except that isn't actually a real thing, so they can't. Maybe on SteamOS.
I don't understand why multiplayer games don't run more on the server. If the server runs the game, then sends to client only what it needs to display the game and play sounds, the client doesn't have more information than necessary and a whole class of cheats is eliminated. There is no need for a client to know where an enemy player is if the player won't be shown on screen (wall hacks). I think World of Tanks runs this way, and I've never encountered much cheating on there.
Some do, but its much more expensive for game companies and adds latency to some elements. Its generally a much harder problem for first-person shooter games - an enemy might be hiding behind a wall but the game needs to know the position of that enemy anyway because the player might move around the corner and see that enemy before the server updates or their game client might need to play noise that enemy is making faintly even if they are far away.
Players of these games are sometimes running their games at high framerates like 240fps which is much higher than the tick rates of these games too.
Plus it doesn't solve all the possible cheats that are out there, as there are some like aim-hacks that don't need any server information to work.
The framing of this is, in my opinion, wrong. I'd like to be able to play unranked matches in spite of the anti-cheat system (which is probably a an anti-piracy enforcer) not working. I play games to have fun; yes, cheaters suck the fun out of matches, but so does anti-consumer "anti-cheat" software that impedes playing the actual game.
Anti-cheat is a necessity for an enjoyable game experience. If you are a casual who doesn’t care about game integrity, you probably aren’t the target audience.
I don’t want any cheaters in my games. I don’t care if a rootkit is required. Riot has a kernel level anti-cheat and it’s _really_ good. It’s so good in fact that it deters most cheaters from even trying. This is the dream for anyone who wants fair games.
I agree with you, but I think the best solution is just to let people run the game without anti-cheat, but they can only play with other people who also opt-out of anti cheat (or choose to allow themselves to be matched with people who opt-out).
Then people can choose to either accept they have to install a rootkit anti-cheat, or want to risk facing cheaters in return for not having to install the anti-cheat.
I wouldn't be able to enjoy life with the knowledge there's a rootkit installed on my machine, developed by the same people that make video games, and hate all levels of accountability, riddled with vulnerabilities that could grant an attacker the same ridiculous level of permissions.
> If you are a casual who doesn’t care about game integrity, you probably aren’t the target audience.
Friendly reminder. 90% of games are not competitive multiplayer and don't need any anti cheat to be enjoyable.
My main entertainment is video games and books (no TV) in equal proportions so I'm far from "casual". I play zero competitive multiplayer due to the "communities" being invariably toxic.
Last time I played something like that it was Starcraft 2 when it was new. Enjoyed being called a stupid noob when I won.
Yeah. I've found a nearly 1:1 correlation between "Does it try hard to be 'competitive' or an 'e-sport'?" and "Is a huge section of the playerbase just godawful toxic assholes?".
As the years ground on, I've learned to avoid games billing themselves as an "e-sport" or indicating that they are extremely focused on the "competitive" scene, unless there's something very compelling to offset the asshole players that will inevitably be pulled in.
So all in all Linux gamers are nicer because the “games” requiring anti cheat are not available?
They also send better bug reports if you launch Linux in early access, there was this indie dev saying that a couple years ago.
Yea! There was a pretty popular /r/gamedev post talking about how like 95% of the linux bugs existed in windows also. Just that linux users are trained to report and provide quality logs/evidence.
> 95% of the linux bugs existed in windows also
Of course they do! Not all bugs are hardware related and most game logic bugs should be written cross platform from the start!
It's a perfect litmus test as far as I'm concerned. If a company believes it's ok to put things like that on my machine, I don't want them anywhere near it, even if they were to "compromise" to work on Linux. Relying on a users machine to snitch on them is dumb at every level. Fix your hearts or die.
Between Windows being so unbearably bloated and no way to make anti-cheat really work on Linux, it looks like the consoles win!
Or you could miss out on like... 5 games. Competitive games on a controller would be a much larger trade off than dual booting to me.
On Xbox at least Keyboard / Mouse support is decent. I played Fortnite and Minecraft this way for a while.
Personal preference, but I'd far rather have a separate device dedicated to gaming than my kernel hacked by anti cheat.
https://www.purexbox.com/guides/all-xbox-games-with-mouse-an...
The only games on that list that doesn't run on Linux I can spot are Call of Duty and Fortnite.
The problem is that consoles also tend to have much worse support for modding.
On my PC I can play basically every game ever made in all of human history, minus maybe 7 that use kernel level anti cheat, and a couple PS5 and PS4 exclusives.
Other than that I have emulation plus a steam library. I'll take that over a locked in console that can only play 2 generations of games any day!
Edit: I'm not sure why the person who replied to me asking about emulators was nuked, emulators are still legal everywhere as far as I know. Anyway tldr go check out emudeck's GitHub repo to see a good list of emulators for basically every platform.
> I'm not sure why the person who replied to me asking about emulators was nuked...
Wow. They're so nuked, I can't even vouch for them. "Good" to know that's possible on HN, I guess.
No modding and higher prices of games on consoles though.
This is a big, missing piece for sure. I suppose for competitive games though, it's okay to not be able to mod, and for everything else, we have PC's.
It'd be nice to have the publisher of the games...
But can it run Crysis? No. Not on Linux :-(
I actually really liked Crysis for its open maps where you can approach a goal using different tactics. It had a lot of flaws and I hated the alien ship along with everything after as it was way too linear. Though I really want to play it again but alas, no more Windows for me.
Actually, ProtonDB indicates Crysis runs just fine on Linux.
https://www.protondb.com/app/17300
I have never gotten it to run on Linux, even with tweaks. However I gave up years ago so maybe I should give it a go and see if anything changed.
nah thanks. i remember my vista install getting destroyed by securom
kernel anti-cheat are notoriously inefficient and are weaponized by hackers.
Are they? Cheats for games like Fortnite, CS (Faceit), Rust, LoL have become very expensive (100 USD per month are not unheard of) or require you to purchase special hardware.
And I have yet to come across an anti cheat driver of the big publishers (EAC, Faceit, Javelin, Vanguard) being exploited and allow access to r/w kernel memory. It is more likely that the driver of some hardware is being exploited for, rather than anti cheat drivers.
Personally, I only remember the ac driver of Capcom ever being exploited. Compare this to the dozen hardware/av drivers which were exploitable, like the Intel LAN utility driver, ASUS IOMap64, MSI NTIOLIB or that one Razer driver. Oh, and CPU-Z and the Avast Hypervisor driver were exploitable too and allowed r/w on kernel memory. These drivers are way more likely to be weaponized than ac drivers.
I remember the anti-cheat of Valorant being exploited where basically the hackers could turn a bug in the game code into full kernel-level root access via the anti-cheat.
Video games are not engineered to withstand sophisticated hacking attacks which is fine mostly since the bad guys can only use their access to cheat - in this case they could fully compromise your system thanks to the kernel access of anti cheat
The thousands of RGB drivers from the various manufacturers that are just copy+paste jobs on RWEverything is actually disgusting and Microsoft letting that just happen is a serious problem. Ah yes you added AES to your IOCTL very secure! I'd say the only reason that these drivers haven't been exploited is because of the insane bug bounties in place. There are also other big issues in games, see the whole hack with Apex Legends lmao
In still doesn't prevent a wide array of cheating.
It is more a anti-(non-steamOS)-linux than anything else.
It's so disappointing that the halo master chief collection still doesn't support split screen. Nothing compared to the joy of playing halo with friends in the same room.
Well, that's just silly. Hook up a Raspberry Pi as your keyboard, mouse input and video output and all the anti-cheat fails. Same (largely) for VMs, same for many emulators.
And if nothing works you can always build a robot pushing mouse, buttons, etc.
Of course you can raise the bar, but if anything has been shown it's that cheating is not something that anyone has been able to prevent yet.
In many situations you can also interfere on the packet level. Of course maybe you need to extract some key, but in many situations that's not exactly hard. And then you can hook something into network.
They already do this. Including peripherals which appear as an actual mouse, but they are there only so that cheat software can take control of the input without modifying the game memory. There are cheats which run on a separate machine and access the game memory via a dedicated DMA card (which itself presents itself as an innocent piece of hardware). Note, this can still be detected either via detecting the DMA card itself, or eventually these shenanigans will be killed off by IOMMU.
Unfortunately, there are also plenty of offerings which do not touch the game memory or process at all, and work purely based on image recognition and these days they actually use AI that is trained on specific games. I have no idea how they plan to detect these. All the cheat needs is the video feed and the ability to provide input via mouse and keyboard, and as you say this is trivial to do in a way that is entirely undetectable.
The cheating isn’t just about input speed or accuracy though. It’s about seeing around corners or having knowledge about other things in the game that you can’t see on the screen.
[dead]
[dead]
I cant believe some people still insist calling it GNU/Linux.