This is so funny because rust has one of the worst cheating situations and majority of their players are windows users, and theres lots of games that have anticheat that allows linux and have notably less significant cheating problems like marvel rivals. in reality rust doesn’t take cheating very seriously because if they did they would have more server side software that detects illegitimate behaviour like tons of other games do successfully… even most popular Minecraft servers have better functioning anti cheat that is completely server side than rust has while getting kernel access to your pc. its pathetic and lazy development tbh and this entire post from them reads like such extreme cope…
It’s almost like client side anti cheat doesn’t work and if proper server side anti cheat is made it wouldn’t matter what platform the client is on.
I don’t pay multiplayer. That said, what if there is no anticheat? Would that level the playing field? Let everyone aimbot if they want to.
If your objection to client-side anti-cheat is that it “doesn’t work” what till you see what server-side anti-cheat fails to accomplish!
There’s no way with a pure server-side implementation to even try to work out whether the client is using an aimbot or wallhack. No solution is perfect, which is why the best solutions try to combine methods.
These people are delusional, don’t listen to them. Their cognitive dissonance drives them to jump through the biggest hoops to defend something that is simply flat-out wrong. You can’t beat most cheaters with a server side anti cheat only, unless you do what World of Tanks does and have everything server-sided which isn’t feasible for all games. Take CS2 or CS:GO for example. The game is riddled with cheaters, despite getting multiple VAC updates this year.
I don’t think it’s cognitive dissonance driving them, I think it’s hatred of rootkit anti-cheat that bleeds into other client-side anti-cheat.
People aren’t very good at separating different but related things, it seems.
Why would you even send the location of players behind walls? You can just do the visibility check on the server first. But hey that’s extra CPU cycles that they don’t want to be spending on helping you.
Visibility check of what?
This amounts to making players use thin clients and putting all visual and audio rendering on the server if you want it to work and not suck. Will you be happy to save £1000 on your PC at the cost of having games cost £150 a pop? Thought not. Or did you think the “extra CPU cycles” were just free?
@FishFace @x00z my small thought -> i think today no solution can prevent “cheaters” because you can’t differ “cheaters” from users anymore if they want to.
Here is why ->
One PC is running the game -> a second PC emulates Keyboard and mouse inputs using a CAM (Capture Card) / Sound (microphon / digital capture) and an on the Game trained AI.
So what does any “cheat protection” offer if they don’t protect against serious cheating ?
PS: “The only still working protection is lan play with control over hardware / software and players like done on real events”
Yes, there is no way to prevent all cheats. However, to prevent as many as possible, you need to use all available methods. It’s quite reasonable that kernel-level anti-cheat should not be available, as it it’s an overreach and a security risk. However, client-side anti-cheat is not that.
It’s a very hard thing to check for though especially with how complex the world can be in games today. Even if it was feasible you don’t know where a client will be in a few frames so you basically need to do a “what players can be seen from this general location” check. The higher movement speed the bigger of a volume is your possible viewpoint.
This is also ignoring all the things you need replicated even when you can’t see the player such as footsteps or them shooting or interacting with something.
You use both server and client side anti cheat.
Using only one will not work the way it should.
That, or cloud gaming needs to replace it.
“never trust the client” is pretty much a motto of infosec, idk what the hell game devs expect
It’s not a motto. It’s a given must design. (I have work context)
And this naïve understanding of infosec somehow makes people forget that this is not infosec, and there is more to anti-cheats than ignoring a client which says its travelling at warp speed.
See, the wild thing is that I used to run with some actual hackers in GMod… and… I learned from the exploits that they did, how you actually design at least a game mode script that can’t be fucked, can’t be poked proded or queried directly.
Of course, if the actual exploit is lower level than what I’m writing at, well then I’m still fucked…
I can remember at least one GMod originated, lower level exploit, caused by Garry leaving some direct, unsanitized interface to Steam itself directly exposed via lua… which caused Steam/Valve themselves to step in and rewrite a part of all of Steam, because Garry is s fucking moron, and more or less allowed a virus/malware to propogate through Steam itself, independent of Garry’s Mod…
Never did figure out if any of the goobers I knew had any direct ties to that or not.
But anyway, fucking yes, literally never trust the client with anything beyond their own GUI, and barely trust them with that, don’t just let them click on anything in their screen space to see if its an item they can put in their inventory, do an actual server side vector ray trace, from the item to the playet, make sure the thing they clicked on is actually near them, put that all into a buffer that locks up if they’re calling it at inhuman rates…
It was so easy to item dupe and stat boost and even hijack other players accounts in so many gamemodes I saw.
Fucking one of them had the user set and enter a login password to ‘access’ their various characters, pick one to spawn as.
Problem?
… That gamemode was actually doing the id check via SteamID, duh.
The username/password thing was a fucking phishing scam, that game mode had a forum, everyone used the same user names, a bunch of people got their hotmails or whatever fucked, by the dev of that gamemode.
… Anyway… yeah, I learned all this infosec type shit first hand, in an earlier ‘FacePunch Studios’ production.
Fuck Garry, fuck FacePunch, these people are idiot clowns.
Roblox exists now, the GMod roleplay communities independently invented their own ways of monetizing their gamemodes via syncing to their sites and forums with payoal widgets, ya’ll missed the boat on that one, no one is going to play S&ndbox in anything close to GMod in its heyday numbers.
That sounds entirely on Steam. The game is the client in this context, and Steam as the server shouldn’t be trusting anything from the client.
This was like, over a decade back, I don’t remember it in accurate detail, and also, Garry deleted all the old Facepunch forums, which I do remember having a lot of discussion about this…
But, best I can recall, it was something like a buffer overflow/memory space exploit, because Garry exposed a core Steam function, that normally is only called by other Steam functions, in c++…
Well, Garry decided to give basically a lua api / reference method of accessing it directly, allowing doing arbitrary code injection into it, from anyone running a GMod server or networked client.
So I mean yeah, you can say Valve should not have trusted Garry with low level access to Source and Steam, that that’s their bad, they should have expected he would create a serious security exploit out of naivette/hubris, like the proverbial junior sql db admin who just does ‘DROP ALL’ on prod, as an ‘experiment’.
Uh yep, I would agree with that.
… I think this may have had something to do with Steam’s, fairly new at the time, achievements system roll out, but I’m not sure if that’s correct.
EDIT:
For those that don’t know, the vast, vast majority of what GMod is, is basically just opening up core Steam/Source calls done in C++, opening those up to Lua, by mapping them with reference methods, and then allowing Lua scripting via those methods.
Then on top of that, you draw like, the item spawning menu, tool menus, make a standardized template for making a new tool or weapon (SWEPs) or entities, or players or NPCs, etc.
So uh, yeah, if you’re not careful with that, if you don’t know what you’re doing at the lowest level, that can be very dangerous and easily lead to uh, unforseen consequences.
sir, this is a wendy’s
Fuck you, take my order, stupid hallucinating AI drive thru working off an 18 year old microphone!
Oh Wait!
You’re closing half your locations after trying to push realtime adjusting prices.
Nah I’m good, I’m gonna be posted up at the abandoned Wendy’s, screaming at it all day long.
Get those pigtails in a hairnet, and my fries in a bag, thanks very much.
They’re totally different scenarios. How is the server supposed to know if a player has (e.g.) walls disabled and knows where the enemies are?
Because the client has to know where the enemies are while still hiding it from the player.
People who have no idea how things work and go off on quotes they see online is why these discussions are useless.
There’s been an increase in games that don’t give the client full knowledge of enemies. That data doesn’t actually need to be sent to the client if you can do checks on the server to know if they’re visible. Yeah, it needs to be simplified from a full raytraced solution from the camera, but it can be good enough that it isn’t much of a issue, depending on the game.
IIRC, some game (it may be Counter Strike, but idk) only gives your client player data for the “room” you’re in, and adjacent ones, or something like that. You can still see through walls near you, but you can’t see people on the other side of the map.
Yes, there’s always going to be a point where there’s nothing more you can do and you just have to hope for the best, and mitigate what you can on the client. Still, the naive “the client has to know where the enemies are” isn’t accurate. A well designed anti-cheat solution will try to come up with a solution for this. Sometimes it isn’t possible, but often there’s some amount of information that doesn’t need to be sent to players that can be hidden.
That’s the neat part: you don’t. If their idea of anti cheat means taking over my machine to scan everything that runs on it, it’s a lost battle. Either find a way to do it server side based on behavioral heuristics, or don’t bother.
Oh, so the only options are rootkits and server-side. Weird, I didn’t know the calculator app was one of those.
Finally someone who seems to have some sense of how things actually work and if course they get down voted…
Sure I get why people don’t like kernel anti cheat but they should at least understand the difficulties from not having it.
Depends on the game but largely enemies don’t need to appear in the client until they’re becoming visible to the player
So the server has to compute whether a single pixel of the enemy’s body or shadow is visible to every client? How does the client play spatialised audio for enemy footsteps if it doesn’t know where they are - does the server calculate that as well?
I mean, if the client is thin, with everything computed server-side, this works, but that’s not what games are.
Easy to say but if you use Unreal Engine it’s very hard to do that. Unreal doesn’t have a built in way to not replicate something not seen and the inbuilt networking is built on any action a player makes is tied to the player. So if you want to hear that player walking or shooting that player will exist on the client.