Hacker News new | past | comments | ask | show | jobs | submit login

This is fundamentally the wrong way to do anti-cheat. Anything you do on the client will fundamentally always be bypassable, and it tends to always have at least some negative side effects. Proper anti-cheat needs to happen on the server.



Doesn't work. Say, a shooter has support for surround/immersive audio - the client has to know where an approaching enemy is so that it can appropriately render footstep sounds or shadows. That in turn can be used by cheat aids to warn about someone sneaking up on you.


But such a cheat aid could also just be connected to your speaker jack.


I don't think the situation is so clear-cut to be able to make categorical statements like that: server-side cheat prevention is also bypassable, and depending on how it is implemented, also has the potential for negative side effects. No matter what approach the developer takes, they're going to be making a trade-off of efficacy, player convenience, and developer effort, and that trade-off is going to be influenced by a lot of different things, such that client-side cheat prevention (or, likely, a mix of client-side and server-side measures) will be the most reasonable option in at least some circumstances.


Only analyzing client command network frames and entities on the server isn't enough.


Why not? What more do you need? Trusting the client is always going to be fraut with failure.


It's not possible because the client's representation of the information from the server is an important part of the "gameplay". In typical network applications (that are not video games) the client's interpretation/representation of what the server is sending is entirely for the usability of the application. Maybe the client displays an array as text list, a series of cards, different tabs, etc. It's just about what makes sense to a particular client/user and what makes their life easier. It's not "unfair" for me to have an email client that highlights unread emails differently than you.

In a video game, different interpretations will give different people different, unfair, advantages. There is an "agreed upon" representation from the developer of the game that's supposed to be "fair" for everyone. Displaying audible ques as visual ques is a "cheat". Highlighting a piece of information or an object is a "cheat". Auto-interpreting information you're supposed to parse yourself is a "cheat". Not every cheat is God-Mode breaking-the-physics-of-the-game cheat. Plenty of cheats are just about having a slight edge over others.

For example, your game has a minimap. Part of the "gameplay" is that you scan the minimap every X seconds to check if something is approaching. It's a situational awareness skill that some will be better at than others. A flashing red map when something approaches would give you an edge. Or the server is sending spacial audio information about where a sound is coming from. It's an auditory skill that you develop and some will be better at it than others. An arrow on the screen pointing to where the audio is coming from would defeat that part of the game. Being able to see a moving shadow in the distance, or when to break/turn in a racing game, or an odds-calculator/card-counter in a cards game, a parry/counter attack indicator in a fighting game, etc are all "skills" that you are expected to develop to become "good" at this game. They are what make these games fun/rewarding for people. Having tools to help you with these tasks would be considered "cheats" in these games.

At the end of the day, there are "cheats" that no software can catch. Having a friend sit next to you who just watches the minimap, or who calculates stuff for you, or watch a different part of the screen for you are all "cheats" that no software can catch.

Obviously there is some stuff to be done to limit the "exploit-ability" of the information. Don't have the server send information that the client doesn't need like the location of all players all the time. Have the server reject invalid moves, like a player flying when there is no flying mechanics/ability for that player. But at the end of the day, the minimal amount of information needed to play the game can be exploited by someone if they find a different way to represent it to themselves that gives them an unfair advantage.


You can make it hard by forcing secure boot and doing remote attestation.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: