Riot Games newest title “Valorant” installs kernel driver to run anti-cheat(old.reddit.com)
old.reddit.com
Riot Games newest title “Valorant” installs kernel driver to run anti-cheat
https://old.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_starts_upon_computer_boot/fn6yqbe/
141 comments
Why do consumers allow games to install these kind of kernel drivers? Are they aware they are giving away keys to the kindom wrt the OS/computing environment integrity just so game studios can take part in an unwinnable cat and mouse chase with cheaters? Also why does Microsoft or AV products allow this without giant "you are giving away root on your box" warning signs?
People don't know what a kernel driver is nor what root access is nor what it entails. I don't think the installer even mentions it, either. They just want to play the dang game. Remember when Vista launched with that UAC prompt and people just googled how to perma-disable it?
Also, cheating really is so bad that most people will accept it anyways.
Unfortunately we don't have a software nor user culture of, for example, having an isolated partition for our important files and an isolated partition for "I just want to play some games" -- You can imagine how streamlined and effortless and by-default this could be in an alternate universe where it was a top priority.
So people can really get hosed under catastrophic conditions like the anti-cheat becoming a remote backdoor for an attacker. I think this is really where people are let down by modern computing.
Also, cheating really is so bad that most people will accept it anyways.
Unfortunately we don't have a software nor user culture of, for example, having an isolated partition for our important files and an isolated partition for "I just want to play some games" -- You can imagine how streamlined and effortless and by-default this could be in an alternate universe where it was a top priority.
So people can really get hosed under catastrophic conditions like the anti-cheat becoming a remote backdoor for an attacker. I think this is really where people are let down by modern computing.
That isolated environment is called a game console.
We are in a weird situation with PC gaming. PCs have always been a hackers friendly platform. Both Counterstrike and DOTA started as mods. Skyrim is more of a platform than a game now. Of course, it also means cheating, but it wasn't a big deal back then. Cheaters were just shunned, or sometimes encouraged, depending on the context. No big money at stake, no big deal.
But now, we want a standardized platform for high stakes competitive play, so why not bring back consoles. They are more than powerful enough for this, and you can hook up a keyboard and mouse if you want.
We are in a weird situation with PC gaming. PCs have always been a hackers friendly platform. Both Counterstrike and DOTA started as mods. Skyrim is more of a platform than a game now. Of course, it also means cheating, but it wasn't a big deal back then. Cheaters were just shunned, or sometimes encouraged, depending on the context. No big money at stake, no big deal.
But now, we want a standardized platform for high stakes competitive play, so why not bring back consoles. They are more than powerful enough for this, and you can hook up a keyboard and mouse if you want.
people that play cs for real money target ~144 fps as the 99th percentile minimum. consoles aren't really designed for this use case.
Not sure why this has been downvoted, it’s strictly true. The console is not a reasonable platform for a competitive game which is cross-platform.
I think GP was suggesting that competitive titles should only be released on consoles, so that everyone would have a sandboxed environment with intrusive anticheat. my point is more that the hardware in current consoles isn't really suited for esports titles. consoles are mainly designed to run AAA games without dropping below 60 fps too often. this means selecting a relatively weak CPU so you can allocate more of the budget towards the GPU, which will usually be the bottleneck in this sort of game. you usually want the opposite tradeoff for esports; the graphics are not particularly fancy so you can get by with a middling GPU, but you care a lot more about fps, so you want a faster CPU. counterstrike in particular is almost completely bottlenecked by singlethread performance. even with a 9900k, a discrete gpu is barely above idle.
> consoles are mainly designed to run AAA games without dropping below 60 fps too often
This is not actually the case. It's part of what makes Doom's aiming for (and, with Doom eternal actually hitting) 60fps an exception. Most AAA games (including competitive games like COD) prioritize visuals over frame rate, and so they are typically aiming for 25-30 FPS.
Also, a number of graphical workloads are still bound by the CPU - such as occlusion culling.
This is not actually the case. It's part of what makes Doom's aiming for (and, with Doom eternal actually hitting) 60fps an exception. Most AAA games (including competitive games like COD) prioritize visuals over frame rate, and so they are typically aiming for 25-30 FPS.
Also, a number of graphical workloads are still bound by the CPU - such as occlusion culling.
[deleted]
> Also, cheating really is so bad that most people will accept it anyways.
I feel this is the part people miss. It's true that it's a cat and mouse game and these end up still being worked around, but cheating has crippled games before.
Search any popular game + "cheaters" and find thousands of posts complaining about these people.
Even if you explain this stuff to people, and admit it's still not foolproof, they will embrace it.
I think we see this mistake a lot in the tech bubble. People assume if only people knew their data was being used they'd be outraged, except if you give them a choice between that and paying for stuff they'll always take giving away their data.
People just don't care that much about the digital "realm". Their online presence, their "digital rights", to them it's all ethereal and a lot of the few who are even aware of this stuff assume the fight is lost anyways, further whittling down the number of people who care.
I feel this is the part people miss. It's true that it's a cat and mouse game and these end up still being worked around, but cheating has crippled games before.
Search any popular game + "cheaters" and find thousands of posts complaining about these people.
Even if you explain this stuff to people, and admit it's still not foolproof, they will embrace it.
I think we see this mistake a lot in the tech bubble. People assume if only people knew their data was being used they'd be outraged, except if you give them a choice between that and paying for stuff they'll always take giving away their data.
People just don't care that much about the digital "realm". Their online presence, their "digital rights", to them it's all ethereal and a lot of the few who are even aware of this stuff assume the fight is lost anyways, further whittling down the number of people who care.
I find that odd. I think that most people can't afford the prices asked to keep their data.
I mean, I feel like ad services are not making such unaffordable amounts of revenue per user. Facebook reports $112 of revenue per user in the US, and that number plummets to just $25 globally.
Facebook is the privacy boogeyman these days, jokes about Zuckerberg are in no short supply.
Yet if you told people you can pay $9 a month and Facebook never needs your data ever again except host it for you, they'd say no. In fact they might be insulted you had the audacity to ask for such a thing. You could ask for $1 and they'd still say no.
It's just the same way they don't value their digital presence, they don't value digital goods and services.
They'll pay $6 every morning for the same cup of coffee worth 30 cents of ingredients and 5 minutes of work, but balk at the idea of an app asking for 99 cents for a lifetime of development work.
I'm not saying that from a place of bitterness to be clear, it's just what I've found to be the inconvenient reality of things.
Facebook is the privacy boogeyman these days, jokes about Zuckerberg are in no short supply.
Yet if you told people you can pay $9 a month and Facebook never needs your data ever again except host it for you, they'd say no. In fact they might be insulted you had the audacity to ask for such a thing. You could ask for $1 and they'd still say no.
It's just the same way they don't value their digital presence, they don't value digital goods and services.
They'll pay $6 every morning for the same cup of coffee worth 30 cents of ingredients and 5 minutes of work, but balk at the idea of an app asking for 99 cents for a lifetime of development work.
I'm not saying that from a place of bitterness to be clear, it's just what I've found to be the inconvenient reality of things.
>take part in an unwinnable cat and mouse chase with cheaters?
It may be unwinnable, but it is "mitigateable". It is much better to have your game ruined once a week by a cheater instead of 5 times a day. It can be a perfectly reasonable trade off if the game is important to you.
It may be unwinnable, but it is "mitigateable". It is much better to have your game ruined once a week by a cheater instead of 5 times a day. It can be a perfectly reasonable trade off if the game is important to you.
> Why do consumers allow games to install these kind of kernel drivers?
They want to play the game.
> Are they aware they are giving away keys to the kindom wrt the OS/computing environment integrity just so game studios can take part in an unwinnable cat and mouse chase with cheaters?
They are aware that even if cheaters will always exist, they accept that the anti-cheating measures will stop most people from cheating. As for giving away the keys to the kingdom, everyone already accepts that from Microsoft, a company they apparently trust. Why wouldn't they accept that from another company they trust?
> Also why does Microsoft or AV products allow this without giant "you are giving away root on your box" warning signs?
Because people didn't like that, they were mocked for it, and people became numb to the requests. So they still have warning signs, they are just toned down.
They want to play the game.
> Are they aware they are giving away keys to the kindom wrt the OS/computing environment integrity just so game studios can take part in an unwinnable cat and mouse chase with cheaters?
They are aware that even if cheaters will always exist, they accept that the anti-cheating measures will stop most people from cheating. As for giving away the keys to the kingdom, everyone already accepts that from Microsoft, a company they apparently trust. Why wouldn't they accept that from another company they trust?
> Also why does Microsoft or AV products allow this without giant "you are giving away root on your box" warning signs?
Because people didn't like that, they were mocked for it, and people became numb to the requests. So they still have warning signs, they are just toned down.
[deleted]
Because people want to play games and https://xkcd.com/1200/
This XKCD point is not wrong, but it's also a kind of whataboutism: Windows as used by most users is not very good at protecting user data since unsandboxed applications are typically all run as the same user with free access to all the account's files.
Most platforms are edging towards sandboxing applications, with OS X app store, UWP, and the various Linux snap/flatpak/appimage etc things. Web apps and iOS/Android have their own tings.
Most platforms are edging towards sandboxing applications, with OS X app store, UWP, and the various Linux snap/flatpak/appimage etc things. Web apps and iOS/Android have their own tings.
I don't get this xkcd. If you steal my computer while I'm logged in you can't log into my bank account of you don't know the password. Which bank has indefinitely long sessions? Mine's time out after like 10 mins of inactivity.
The only plausible attack scenario is if you steal my computer while I'm logged into my KeePassX. It has all my passwords visible. But that session times out as well.
The only plausible attack scenario is if you steal my computer while I'm logged into my KeePassX. It has all my passwords visible. But that session times out as well.
I mean, if you are logged into your email that's pretty much game over for most sites including possibly your bank.
Just request a password reset and change it to whatever you'd like.
Just request a password reset and change it to whatever you'd like.
There's two didn't attack models, "steals permanently" and "runs code on and returns to you" (which includes both "steals from your hotel room and puts back" or "installs malware on"). Yes, for the first one it's hard to get to the bank account and I agree the comic is inaccurate. For the second, it's very easy to install a keylogger or a cookie-logger or a malicious browser extension or whatever.
Riot installing a kernel module is more like the latter.
Riot installing a kernel module is more like the latter.
I assume most people use the browser built in password manager with no master password. If you can launch chrome, you're in.
title="Before you say anything, no, I know not to leave my computer sitting out logged in to all my accounts. I have it set up so after a few minutes of inactivity it automatically switches to my brother's."
[deleted]
I work in game anti-cheat, kernel drivers are a necessary evil. If I had a choice, I would stick to usermode or even server-side only. But you would be shocked how advanced some cheating software is, exploiting every aspect of the CPU. Now it is commonplace for a cheat to use a custom-made VM hypervisor or even a UEFI bootkit — crazy! Good luck stopping that from usermode.
On one hand, sure, there is no way to stop advanced client cheats from usermode.
On the other hand, it seems naive (from my own naive perspective) to assume your own drivers won't be reversed and defeated, given you already know your opposition is this advanced. So why still go down that path? Most of what I've read has been pretty down on anti-cheat, so I'm quite interested to get the other perspective from someone who personally finds it worthwhile to work on it.
On the other hand, it seems naive (from my own naive perspective) to assume your own drivers won't be reversed and defeated, given you already know your opposition is this advanced. So why still go down that path? Most of what I've read has been pretty down on anti-cheat, so I'm quite interested to get the other perspective from someone who personally finds it worthwhile to work on it.
I actually agree with most of what you’re saying. Anti-cheats like BattlEye or EasyAntiCheat rely on advanced obfuscation like virtualization to protect their secrets. But people are now deobfuscating those, revealing exactly how the anti-cheat works, allowing cheaters to evade it.
I take a fundamentally different, “zero trust” approach and built my anti-cheat with the assumption that it has already been fully reverse-engineered and figured out. I think if your software relies on security by obscurity you’ve already lost.
I take a fundamentally different, “zero trust” approach and built my anti-cheat with the assumption that it has already been fully reverse-engineered and figured out. I think if your software relies on security by obscurity you’ve already lost.
> with the assumption that it has already been fully reverse-engineered and figured out
Then how do you prevent it from being circumvented?
Then how do you prevent it from being circumvented?
My curiosity is piqued. Is there somewhere I can learn more about your solution? Even if just a product page.
I guess so, I didn't want to use this as a promotional opportunity since I think it would make my comments insincere.
But if your interested, https://h6ntechnologies.com/.
But if your interested, https://h6ntechnologies.com/.
Yeah, I appreciate that. It just turns out my team's looking at integrating anti-cheat in the very near future so I happen to be in the market (and feeling lukewarm about EAC and BattlEye), and it's a topic of personal interest besides. So thanks!
No, what is actually crazy are modern game servers lacking even the most basic server side assertion logic(1) letting players FLY around the map, teleport, summon items, kill other players on the server at the press of a button, etc. Seen in all massive FPS games, for example Apex Legends, PUBG, Escape from Tarkov.
(1) often justified as necessity to reduce cost of running servers
(1) often justified as necessity to reduce cost of running servers
I agree with you. Good networking code is generally one of the best ways to reduce the visibility of cheating.
But take a look at CS:GO. That has some of the best designed networking code from a security perspective. Your keyboard and mouse input is sent to the server, and it figures out where you move or if you shot another player, not the client. And yet there is still widespread cheating on that game.
But take a look at CS:GO. That has some of the best designed networking code from a security perspective. Your keyboard and mouse input is sent to the server, and it figures out where you move or if you shot another player, not the client. And yet there is still widespread cheating on that game.
Given that, how do some of the worse CS:GO cheats work? I can understand wallhacks (at some point it does have to be up to the local graphics driver to calculate occlusion), but I thought CS:GO had a period of people being able to spawn in the enemies spawn, or snipe you at the spawn point. I'm not a CS:GO player so I#m sorry if I'm getting those accounts incorrect.
You're assuming that they do not detect such events, and react with a human review process at a time delay to the event itself.
I don't believe that Valve installs a kernel driver for CS:GO or its other titles. They turned anti-cheat into a pretty sophisticated deep learning solution called VACNET.
CSGO matchmaking is still rife with cheaters. Valve has put a ton of work into VAC, but if people want to cheat, it is still very possible. It prevents matchmaking from being taken seriously as a competitive ladder. Even when I’m just playing casually with friends, it’s stressful when I basically have a 1 in 10 chance of the opponent cheating, and I need to sus out whether they’re actually good or just cheating.
I pay for ESEA, an external service, which installs a kernel mode anticheat. ESEA also got sued for running a bitcoin miner on users computer several years ago. But it’s the only way to get any semblance of real, high level, competitive play.
This is the context for Riots anticheat. They need to provide a solid AC from the start to pull over players and provide a competitive matchmaking system that isn’t a total joke like Valve MM. It sucks, but I know who I’d trust more between Riot and ESEA. I just run my games in a separate partition and bitlocker my primary OS install.
I pay for ESEA, an external service, which installs a kernel mode anticheat. ESEA also got sued for running a bitcoin miner on users computer several years ago. But it’s the only way to get any semblance of real, high level, competitive play.
This is the context for Riots anticheat. They need to provide a solid AC from the start to pull over players and provide a competitive matchmaking system that isn’t a total joke like Valve MM. It sucks, but I know who I’d trust more between Riot and ESEA. I just run my games in a separate partition and bitlocker my primary OS install.
Dude you pay a company to install a kernel module in your PV that got sued for running a bitcoin miner on peoples systems. I have to say some people just deserve what is coming to them. Bad luck to you.
[deleted]
You don't play CSGO. If you play the free version it's practically impossible not to stumble upon a cheater every single match.
Another example, GTA online is practically unplayable on the PC whilst it's almost impossible to find cheaters on consoles.
Another example, GTA online is practically unplayable on the PC whilst it's almost impossible to find cheaters on consoles.
>kernel drivers are a necessary evil.
No they're not. Not for cheating in a video game. The reason why cheat makers have advanced to shady rootkit level exploits is because game publishers started doing it first. Stopping cheating in your games is not more important than the security of my computer period. I don't care. Find better ways to manage your game or i'll play something else. I have no interest in your anti-cheat spyware being on my computer.
No they're not. Not for cheating in a video game. The reason why cheat makers have advanced to shady rootkit level exploits is because game publishers started doing it first. Stopping cheating in your games is not more important than the security of my computer period. I don't care. Find better ways to manage your game or i'll play something else. I have no interest in your anti-cheat spyware being on my computer.
I would disagree with your reason cheats went kernel, speaking as someone wrote cheats for over 10 years before “switching sides”. It’s because cheat software always wants to hide from the anti-cheat, and kernel mode provides a perfect place to do that.
But if you don’t want to have anti-cheat software installed, that’s OK! I’m a big proponent of informed-consent, and if you don’t consent, nobody is forcing you to. You just won’t be able to enjoy online multiplayer.
But if you don’t want to have anti-cheat software installed, that’s OK! I’m a big proponent of informed-consent, and if you don’t consent, nobody is forcing you to. You just won’t be able to enjoy online multiplayer.
> I’m a big proponent of implied-consent
There is no such thing as implied consent. There is either explicit consent, or there is an absence of consent.
There is no such thing as implied consent. There is either explicit consent, or there is an absence of consent.
I meant to say “informed-consent”. I’ve edited the post.
It’s too bad that the game industry has this all or nothing attitude. If you can’t make a video game without installing kernel drivers and spying on everything my computer is doing, then I guess I’m free to just not buy your games anymore. To me, thwarting CheatMan69 is less important than access to everything on my PC. I don’t think the majority of customers are informed about the risks of these anti-cheat systems, and suspect more would opt-out if they were.
I honestly wish OS companies would grow a pair and start classifying these systems as malware and removing them.
I honestly wish OS companies would grow a pair and start classifying these systems as malware and removing them.
I take it you're not a gamer. Pretty sure very few would opt-out even if they knew exactly what was happening as long as it prevented cheaters.
If OS companies did that then competitive online multiplayer would effectively be dead. That may be fine to you but it's a very selfish opinion considering it would completely destroy the hobby of hundreds of millions of gamers.
If OS companies did that then competitive online multiplayer would effectively be dead. That may be fine to you but it's a very selfish opinion considering it would completely destroy the hobby of hundreds of millions of gamers.
>You just won’t be able to enjoy online multiplayer
No, i'll be able to enjoy online multiplayer in one of the many, many games whose devs don't feel like they need to monitor and control my computer to provide a quality game.
No, i'll be able to enjoy online multiplayer in one of the many, many games whose devs don't feel like they need to monitor and control my computer to provide a quality game.
It's a naive viewpoint. Prime example: Counter strike. Even with VAC(valve anti cheat) measures, the game is full of cheaters. Those aren't super intrusive, and the game simply isn't fun for anybody who cares at all about competitive gameplay. So people move onto other platforms that support more intrusive anticheats. I'm not really sure what the solution is, but given your stance, that would just mean every FPS game will be rendered borderline unplayable because of all of the cheaters on it. And I mean, if that's your point--to just not play competitive FPS games, then I'm not really sure what we're even arguing here.
Right. The vast majority of players moved to the platforms with the most intrusive anti-cheat of all years ago: games consoles.
The market spoke. A few geeks with hangups about kernel drivers are irrelevant next to the masses of people who will happily buy entire dedicated gaming computers designed from the ground up to be physically tamperproof.
The market spoke. A few geeks with hangups about kernel drivers are irrelevant next to the masses of people who will happily buy entire dedicated gaming computers designed from the ground up to be physically tamperproof.
The PC contains my valuable data and is needed for important non-game uses. With the PC, reliability and security for those other tasks must not be compromised for a mere game.
Game consoles are toys. Even if the game screwed up the game console, it wouldn't be very intrusive.
Game consoles are toys. Even if the game screwed up the game console, it wouldn't be very intrusive.
I should have been more explicit, but by other platforms, I meant ESEA/Faceit that provide their own anti cheat systems that run independently of VAC. I'm not sure I'm really seeing many people go to ps4/xbox simply because of some cheaters on PC?
Well, most gamers went to consoles over time and there was certainly a thriving cheating scene there, that the console makers (at least Microsoft) were able to push back and destroy. Multi-player is pretty popular everywhere so it's probably a factor, though I'm not enough of a gamer to care. My skillz are so weak it feels like everyone is cheating all the time :)
Sure! That's a perfectly reasonable strategy, and one that I pursue as well. But competitive FPS games really do need to monitor and control your computer to stop ubiquitous aimbotting, so I don't begrudge those devs for doing it.
then don't play, what's the problem
cheating is very serious problem and there are no easy solutions
teams of skilled developers have been challenging it over decades and this is how it evolved
cheating is very serious problem and there are no easy solutions
teams of skilled developers have been challenging it over decades and this is how it evolved
The game I like to play, Destiny 2, suffers from a lot of cheaters. Players don't complain about too much anti-cheat: they complain about too little, and urge Bungie to adopt stricter controls. Many wouldn't even think twice about the game requiring a kernel extension. Majority would probably even celebrate the move if it was effective at eliminating cheaters.
So the flip-side of this feeling seems to be just as common.
So the flip-side of this feeling seems to be just as common.
You're free to play something else; don't complain when you're getting roasted by rampant cheaters though.
Even that is arguable. Competitive multiplayer games without competent anti-cheating measurements are unplayable in that the only winning move is not to play. Is there any value in being free to play what is unplayable? I suppose "something else" could include playing with yourself but then none of this even applies.
Yea thats great, punlishers wont care because the vast majority of people dying to get a beta of valorant wont give two shits about installing kernel drivers.
[deleted]
Just because it's not more important to you doesn't mean it's not more important to others. There are games that have contests with multi-million dollar prize pools, some people would find a good anti cheat very important.
> Find better ways to manage your game or i'll play something else.
Pretty sure game companies don't care about the small minority who cares or even understands the implications of this.
Pretty sure game companies don't care about the small minority who cares or even understands the implications of this.
[deleted]
Ever considered that maybe you should design your game so that modifying the client provides no advantage to players?
There is a universal way to do so, and it is to provide whatever feature the "cheat" programs are offering directly in the official client (either with first-party code or by providing an API that third parties can use).
There is a universal way to do so, and it is to provide whatever feature the "cheat" programs are offering directly in the official client (either with first-party code or by providing an API that third parties can use).
For technical reasons this is infeasible for most modern games, especially action games like FPSs.
In general, the way a networked FPS works is by using the server as an authoritative source for information, but doing extrapolation on the client-side. This means that enemies which are not visible to a player must still be known by the client, since the camera and enemy may move into a position where the enemy is visible more quickly than the server can respond. So the client must know the location and velocity of some opponents which are otherwise not visible to the player (because they might become visible).
But, let’s suppose we solve latency problems, and don’t use client-side prediction.
You would need some perfect visibility algorithm for determining which opponents should be transmitted to each client. Those visibility algorithms make a tradeoff between accuracy and computational expense. They are conservative, because it is always an error to fail to draw something which is visible, but it is never an error to draw something which is occluded.
But, let’s suppose we solve visibility perfectly, and only transmit to clients the locations of models which are actually visible, and only the parts of those models which have pixels on-screen.
Consider an opponent hiding behind a wall, but with a small part of the opponent poking out. The game is going to need to draw that part poking out, but if you look inside the game’s memory, you can find that those textures and vertices belong to a model used by an opponent.
Beyond that—we are transmitting a video stream to the client. Basically, we can solve cheating if everyone uses Stadia.
In general, the way a networked FPS works is by using the server as an authoritative source for information, but doing extrapolation on the client-side. This means that enemies which are not visible to a player must still be known by the client, since the camera and enemy may move into a position where the enemy is visible more quickly than the server can respond. So the client must know the location and velocity of some opponents which are otherwise not visible to the player (because they might become visible).
But, let’s suppose we solve latency problems, and don’t use client-side prediction.
You would need some perfect visibility algorithm for determining which opponents should be transmitted to each client. Those visibility algorithms make a tradeoff between accuracy and computational expense. They are conservative, because it is always an error to fail to draw something which is visible, but it is never an error to draw something which is occluded.
But, let’s suppose we solve visibility perfectly, and only transmit to clients the locations of models which are actually visible, and only the parts of those models which have pixels on-screen.
Consider an opponent hiding behind a wall, but with a small part of the opponent poking out. The game is going to need to draw that part poking out, but if you look inside the game’s memory, you can find that those textures and vertices belong to a model used by an opponent.
Beyond that—we are transmitting a video stream to the client. Basically, we can solve cheating if everyone uses Stadia.
You describe fancy advanced algorithms, meanwhile almost all mainstream FPS game servers happily accept client reporting arbitrary player position teleportation without the smallest of hitches. Not even the most basic server side validation.
I suspect that's because many games are targeted at consoles first, where the infrastructure prevents client modification or unauthenticated network connections, and see the PC platform as a second class citizen. They won't write tons of extra code to stop cheating when cheaters can't even log in to the game servers that matter for most of their players.
That is irrelevant to the argument I was making.
Anyway, the “fancy advanced algorithms” are not really fancy or advanced. They are de rigueur in FPS games.
Anyway, the “fancy advanced algorithms” are not really fancy or advanced. They are de rigueur in FPS games.
[deleted]
I think the GP suggested modifying the game design as seen by the players, not trying to implement the same games by doing (impossibly?) clever things under the hood.
> "There is a universal way to do so, and it is to provide whatever feature the "cheat" programs are offering directly in the official client."
Every game should have instantaneous snapping of the crosshairs to the target and firing without player intervention? Doesn't sound very fun.
Every game should have instantaneous snapping of the crosshairs to the target and firing without player intervention? Doesn't sound very fun.
Probably more fun that losing to someone just because he can move the mouse in response to a visual stimulus faster than you?
If the resulting game is too simplistic, slowing limitations can be added, such as limiting the maximum speed at which the crosshair can move, or making weapon fire deal little damage relative to health so the target can move out of range if near cover before they die.
If the resulting game is too simplistic, slowing limitations can be added, such as limiting the maximum speed at which the crosshair can move, or making weapon fire deal little damage relative to health so the target can move out of range if near cover before they die.
> "Probably more fun that losing to someone just because he can move the mouse in response to a visual stimulus faster than you?"
If people thought that way, nobody would ever play any real world sports. There's always somebody better out there. Yet here we are...
> "If the resulting game is too simplistic, slowing limitations can be added, such as limiting the maximum speed at which the crosshair can move, or making weapon fire deal little damage relative to health so the target can move out of range if near cover before they die."
Again, doesn't sound very fun.
If people thought that way, nobody would ever play any real world sports. There's always somebody better out there. Yet here we are...
> "If the resulting game is too simplistic, slowing limitations can be added, such as limiting the maximum speed at which the crosshair can move, or making weapon fire deal little damage relative to health so the target can move out of range if near cover before they die."
Again, doesn't sound very fun.
> Probably more fun that losing to someone just because he can move the mouse in response to a visual stimulus faster than you?
this is a very reductive view of fps gameplay. in all but the twitchiest arena-style games, anticipating the opponents position is much more important than being able to do a 45 degree flick faster than the other person.
this is a very reductive view of fps gameplay. in all but the twitchiest arena-style games, anticipating the opponents position is much more important than being able to do a 45 degree flick faster than the other person.
At this point you're just arguing for removing all mechanical skill from competitive games.
Impede the gameplay however you want, in pure mechanical aspects a program will always have the benefit of perfect accuracy and near-zero reaction time (as opposed to the >200ms average of a human)
Impede the gameplay however you want, in pure mechanical aspects a program will always have the benefit of perfect accuracy and near-zero reaction time (as opposed to the >200ms average of a human)
There’s a thriving market for turn-based games that do not depend on reflexes for competitiveness. I played one this weekend that was a top-down scroller shooter converted into turn-based.
It’s cheating to try and remove for yourself only that reflex-based competition from games that are built on it, and it’s draconian (and not fun) to suggest removing all reflex-based competition from all games.
It’s cheating to try and remove for yourself only that reflex-based competition from games that are built on it, and it’s draconian (and not fun) to suggest removing all reflex-based competition from all games.
That's a completely different game, then.
Those are garbage limitations that lower the skill ceiling of the game so low as to not be remotely enjoyable
Sure, but this is fundamentally incompatible with the kind of high-twitch action game many people enjoy.
What you’re describing is basically impossible except maybe if the entire game, including rendering, was done in the “cloud” and simply streamed to the player.
But people can and still make AI- or CV- cheat software that would still work in this situation. Any time there is any sort of user-input there is a way to exploit it for cheat purposes.
But people can and still make AI- or CV- cheat software that would still work in this situation. Any time there is any sort of user-input there is a way to exploit it for cheat purposes.
Maphacks, aimbots, and infinite resources cannot be options in competitive games, for obvious reasons. Of course, a game can be designed around these issues, hiding info not only from the player, but from the game client, but you still have to compete with the current games that take advantage of being able to offload logic to the clients. And in the end, the players simply don't care. The industry can't self-regulate regarding this. All competitive games will eventually end up taking complete control of the players' computers.
[deleted]
[deleted]
This is why I hope a strong sandboxing model like on iOS takes off on all platforms. Windows 10X is a step in that direction and I much appreciate it. Companies have abused people's trust way too long.
Seems doubtful it would help? The cheat developers will intentionally tell people who want to cheat how to bypass or disable any sandboxing protections to get their code installed.
It is impossible to win by playing by the rules if your opponent is not playing by the rules.
It is impossible to win by playing by the rules if your opponent is not playing by the rules.
The problem is it's not the (gaming) companies abusing trust but the users abusing trust.
An iOS model could help but not because it limits the legit app makers but because it limits what users can easily do, like a gaming console.
An iOS model could help but not because it limits the legit app makers but because it limits what users can easily do, like a gaming console.
It is an arms race. However far anti-cheat goes, the cheaters will attempt to push further.
Hi! Lucky 10000, although this thread's a little crowded: The revelation principle [0] in game theory is a fundamental result that applies here. In a revealed game, there would be no need for anti-cheating components. Instead, every player would honestly submit their desired actions to an adjudicating trusted server which evaluates everybody's desires and computes the actual outcomes. This is how games like Diplomacy [1] or Civilization [2] maintain their sense of robust fairness in the presence of cheating: A cheater cannot do anything more than be dishonest about their desires, and the revelation principle guarantees that dishonesty harms the cheater.
To address a nuance: You might here object that players in Diplomacy and Civilization have private state. Kind of? The agents that are playing the game do not have private state in the game, and they cannot submit actions which rely crucially on some special state of the game board which is only visible to them. They can, of course, do whatever they like outside the game, because actions taken outside the game cannot affect the effect of actions inside the game. This is the distinction between the game and the metagame [3], or the ludic and narrative perspectives [4].
So, then, when one plays a game like Hearthstone or League of Legends, one might hope that, because there is an adjudicating trusted server, and because submitted actions are limited to those possible within the game, one doesn't need to worry about cheating. The worst a cheater could do, again, is dishonestly choose the wrong action and get a suboptimal result which harms their position.
At this point, some folks might want to get irritated at the poor quality of some game servers. Sure, but there's something more important for games like Counter-Strike or Fortnite, which we cannot overlook: In free-for-all or battle-royale mode, all participants have the same goal. Thus, in the revealed game, all participants would submit identical agents. So, which agent should win? The one with the best randomly-generated starting position? That's no better than a lottery. Instead, we must realize that we are looking at these games as athletic contests.
And now the problem is obvious! You are asking athletes to compete at home and submit proxy scores. All of the spyware in the world won't fix this; the correct answer is to set up stadiums and officiate matches. Sure, it's expensive, but it's the better way to make a competitive spectacle out of measuring things like whose hands twitch faster or whose eyes track tiny dots more accurately. Speedrunners already figured this out, with more and more communities requiring hand-cams and complete splits, and with live runs at events being considered more attested than pre-recorded at-home runs.
Edit: "stadia" -> "stadiums" after reading neighbor comments. I mean that you need arenas, not that you need to purchase Google products. Like, the folks converting paintball and laser-tag rooms into VR rooms are onto something.
[0] https://en.wikipedia.org/wiki/Revelation_principle
[1] https://en.wikipedia.org/wiki/Diplomacy_(game)
[2] https://en.wikipedia.org/wiki/Civilization_(series)
[3] https://en.wikipedia.org/wiki/Metagaming
[4] https://en.wikipedia.org/wiki/Game_studies#%22Ludology%22_vs...
To address a nuance: You might here object that players in Diplomacy and Civilization have private state. Kind of? The agents that are playing the game do not have private state in the game, and they cannot submit actions which rely crucially on some special state of the game board which is only visible to them. They can, of course, do whatever they like outside the game, because actions taken outside the game cannot affect the effect of actions inside the game. This is the distinction between the game and the metagame [3], or the ludic and narrative perspectives [4].
So, then, when one plays a game like Hearthstone or League of Legends, one might hope that, because there is an adjudicating trusted server, and because submitted actions are limited to those possible within the game, one doesn't need to worry about cheating. The worst a cheater could do, again, is dishonestly choose the wrong action and get a suboptimal result which harms their position.
At this point, some folks might want to get irritated at the poor quality of some game servers. Sure, but there's something more important for games like Counter-Strike or Fortnite, which we cannot overlook: In free-for-all or battle-royale mode, all participants have the same goal. Thus, in the revealed game, all participants would submit identical agents. So, which agent should win? The one with the best randomly-generated starting position? That's no better than a lottery. Instead, we must realize that we are looking at these games as athletic contests.
And now the problem is obvious! You are asking athletes to compete at home and submit proxy scores. All of the spyware in the world won't fix this; the correct answer is to set up stadiums and officiate matches. Sure, it's expensive, but it's the better way to make a competitive spectacle out of measuring things like whose hands twitch faster or whose eyes track tiny dots more accurately. Speedrunners already figured this out, with more and more communities requiring hand-cams and complete splits, and with live runs at events being considered more attested than pre-recorded at-home runs.
Edit: "stadia" -> "stadiums" after reading neighbor comments. I mean that you need arenas, not that you need to purchase Google products. Like, the folks converting paintball and laser-tag rooms into VR rooms are onto something.
[0] https://en.wikipedia.org/wiki/Revelation_principle
[1] https://en.wikipedia.org/wiki/Diplomacy_(game)
[2] https://en.wikipedia.org/wiki/Civilization_(series)
[3] https://en.wikipedia.org/wiki/Metagaming
[4] https://en.wikipedia.org/wiki/Game_studies#%22Ludology%22_vs...
If this driver is so minimal that it is nothing more but an interface to userspace, opening the source would benefit everybody.
It really means nothing when a company audits itself.
It really means nothing when a company audits itself.
If they open-sourced it, cheaters could fork it and completely neuter the anti-cheat functionality.
Security through obscurity isn't good security. The cheat writers won't be stopped just because they don't have the source. And with open source, the vulnerabilities it has can be found and fixed by everyone.
It's all about obscurity when dealing with this type of malware. They are advanced rootkits used by malicious users tampering with distributed systems that must trust the client to a high degree or they simply will not work. As soon as obscurity is used by either side it inevitably becomes the tool both sides are forced to use.
Aren't they going to do that even if it's not open source? (I mean, patch the binary)
You can detect binary patching. You can’t really detect patching if they have control over the whole source.
That doesn’t sound right.
Can you describe a method of detecting binary patching that wouldn’t also detect a changed fork being compiled?
Can you describe a method of detecting binary patching that wouldn’t also detect a changed fork being compiled?
They specifically said they were externally audited, in this case.
As long as they tell you, great.
Cheating really ruins online games for many of us.
Cheating really ruins online games for many of us.
They flat out mention that they have an anti-cheat, but not that it's a kernel driver (most likely because the vast majority of users don't know what it is). They said you need to reboot. So, to me, I assumed it was a kernel driver of some sort.
EDIT: Official comments from Riot: https://www.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_...
They mention they've had multiple external audits of the driver code.
EDIT: Official comments from Riot: https://www.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_...
They mention they've had multiple external audits of the driver code.
I agree, as a competitive fps player, I welcome this. Cheating was so bad in CSGO that people made a whole business running custom servers and private anti-cheat. They took the advanced steps that Valve wouldn't.
I agree that they should definitely inform you of the extent of the anti-cheat system. I have never been able to take online gaming seriously due to how easy it is to cheat and how many people there are in the world that simply don't care about ruining others experience.
Until it is impossible to cheat it will always be a casual experience only. Maybe this is what it takes to actually prevent cheaters, but I doubt it. It's an arms race and they will always find a way around it.
Until it is impossible to cheat it will always be a casual experience only. Maybe this is what it takes to actually prevent cheaters, but I doubt it. It's an arms race and they will always find a way around it.
It's better to try vs do nothing. The solutions to all arms races is not just do nothing.
I'm not suggesting not trying. I'm just saying this won't be the final nail in the coffin for cheating.
There will never be a final nail. It's a game of cat and mouse.
It's a nail.
How long before cheaters can buy a specialized robot/deep learning machine that has a high speed camera and servos that they can point at their computer screen where it can watch the screen and work the keyboard and mouse for them? (Or, better yet, the robot plugs into USB providing it's own keyboard/mouse/controller input and video output is recorded via a simple VGA or HDMI...)
I think these physical types of cheating systems already exist for smartphones. Last time I mentioned it, some people hinted at systems you can setup for phones - https://news.ycombinator.com/item?id=21991775.
Perhaps we're just waiting on the right software for this type of revolution to occur in PC gaming. I can't think of what's lacking right now though - all the pieces seem to be in place.
I think these physical types of cheating systems already exist for smartphones. Last time I mentioned it, some people hinted at systems you can setup for phones - https://news.ycombinator.com/item?id=21991775.
Perhaps we're just waiting on the right software for this type of revolution to occur in PC gaming. I can't think of what's lacking right now though - all the pieces seem to be in place.
Would be trivial for less graphically cluttered games. Your external cheat could run a copy of a game engine constantly matching player position/orientation and comparing rendering of empty map to video feed from low latency capture card. Simple visual diff is all it takes to identify even 1 pixel of enemy peeking from around the corner. You could inject visual overlay on top of external video signal and auto trigger mouse click when crosshair points at potential differences. No fancy AI/deep learning required.
The blocking factor for that scenario is that the hardware to do that kind of cheating isn't cheap enough that the majority of cheaters can afford it. Get it below maybe $100 or so and then it would become a real problem.
It would be cheaper to hire a gig worker to play the game for you, which is how we ended up with RMT farming as an industry in the first place. Why develop a robot when a human will do, more cheaply and with less fuss?
It’s impossible to stop someone who can build robotic hands, but it’s still worth stopping cheap/easy software and hardware cheats.
I saw one of the threads on reddit about this yesterday with the usual litany of privacy/security complaints and had a random idea - make it optional. Put people that decide to remove it in an alternate queue with server-side anti-cheat mechanisms only, maybe disable competitive/ranked game types for them.
They would use cheats to tell the server that they aren't cheating, to get placed into the "not cheating" queue.
This is unfortunately why I switch to console exclusively for gaming. I personally prefer a powerful PC especially with keyboard and mouse, but it’s just so much harder to cheat on a console nowadays, and I don’t want to install this stuff.
Console games have a low-tech cheating mechanism known as a Lag Switch, basically a switch that will disconnect the cheater for ~3 seconds. Here's one around the 1:35 mark and he tests it at around 4:00
https://youtu.be/iXUmhGruPRo
You don't even need to cheat on consoles, most games come built in with it, I think they call it aim assist. Or you can just use a keyboard and mouse and suddenly your better than all the controller users.
Aim assist doesn't let you violate the in-game mechanic rules to generate impossible events over the wire to other players. Most PC games are vulnerable to this. Most console games aren't. Its quite refreshing that the worst cheating I've seen in 5 years has been artificially-induced network lag.
There's also a thread on /r/pcgaming about the anti-cheat causing performance issues in other games, even though Riot says it only runs when Valorant is running.
Did anyone in this HN comment section actually read the discussion on Reddit? According to the devs you can delete the executable if you're really that worried.
They also talk about in more detail here:
https://na.leagueoflegends.com/en-us/news/dev/dev-null-anti-...
They also talk about in more detail here:
https://na.leagueoflegends.com/en-us/news/dev/dev-null-anti-...
This is straight up funny, and I think well written, with good detail for the target demographic.
This is why I have a PC dedicated only to gaming and other machines dedicated only for casual web browsing. There's too much maintenance for a PC if it's multi-use.
Doesn't Player Unknown's Battlegrounds (aka pubg) do the same, but as a Chinese company?
I stopped playing when they started forcing you to install something so intrusive.
I stopped playing when they started forcing you to install something so intrusive.
Riot is owned by Tencent, a Chinese company.
A minority stake. Disney has one too. Doesn't mean Mickey Mouse is backdooring overwatch.
> Tencent paid $400 million for a 93 percent stake in Riot Games.[2][9] Tencent bought the remaining 7 percent in December 16, 2015; the price was not disclosed.[2][10]
https://en.wikipedia.org/wiki/Riot_Games
https://en.wikipedia.org/wiki/Riot_Games
This is incorrect. Tencent owns 100% of Riot.
PUBG is owned by Tencent too.
Citation needed that PUBG Corp or Bluehole is 100% owned by Tencent.
Okay. I guess not everyone played PUBG like I did from the start and paid attention to these things. Just look at the Bluehole wikipedia page https://en.wikipedia.org/wiki/Bluehole_%28company%29 . Here's an excerpt for you showing they have a strong if not completely controlling ownership.
>In August 2017, Chinese holding company Tencent announced that it had, following a rejected acquisition bid, invested an undisclosed amount of money into Bluehole.[4] Bluehole initially denied that any investment had been made,[5] but later stated that they were in talks with Tencent in multiple partnerships, including the acquisition of an equity stake in Bluehole by Tencent.[6] Subsequently, Tencent acquired 1.5% of Bluehole for a total of ₩70 billion.[7] Tencent reaffirmed their intents to fully acquire Bluehole in November 2017.[8][9] Korean magazine The Korea Times suggested that an initial public offering, through which Bluehole would become a public company, was "out of question" due to Chang Byung-gyu's position as chairman of both Bluehole and the Fourth Industrial Revolution committee.[10] At the time, 38 Communications, a company that tracks unlisted Korean stocks, valued the company at ₩5.2 trillion.[11][12] Tencent plans to invest further ₩500 billion to acquire further 10% ownership, raising their total stake to 11.5%[13] Through the acquisition, Tencent is set to become Bluehole's second-largest single shareholder, following Chang Byung-gyu, Bluehole's founder and chairman, who owns 20.6% of the company.[14]
>In August 2017, Chinese holding company Tencent announced that it had, following a rejected acquisition bid, invested an undisclosed amount of money into Bluehole.[4] Bluehole initially denied that any investment had been made,[5] but later stated that they were in talks with Tencent in multiple partnerships, including the acquisition of an equity stake in Bluehole by Tencent.[6] Subsequently, Tencent acquired 1.5% of Bluehole for a total of ₩70 billion.[7] Tencent reaffirmed their intents to fully acquire Bluehole in November 2017.[8][9] Korean magazine The Korea Times suggested that an initial public offering, through which Bluehole would become a public company, was "out of question" due to Chang Byung-gyu's position as chairman of both Bluehole and the Fourth Industrial Revolution committee.[10] At the time, 38 Communications, a company that tracks unlisted Korean stocks, valued the company at ₩5.2 trillion.[11][12] Tencent plans to invest further ₩500 billion to acquire further 10% ownership, raising their total stake to 11.5%[13] Through the acquisition, Tencent is set to become Bluehole's second-largest single shareholder, following Chang Byung-gyu, Bluehole's founder and chairman, who owns 20.6% of the company.[14]
I did play PUBG from the start and paid attention to these things. Which is why I knew what I was talking about when I asked the question.
Thanks for confirming I was right, btw.
Thanks for confirming I was right, btw.
I could be wrong, but I believe the developers of PUBG are Korean, not Chinese. Whether they are ultimately owned by a Chinese company, I do not know.
You are wrong, PUBG is owned by Tencent, a Chinese company.
Technically I'm not wrong. I said the developers of PUBG were Korean, and it looks like I'm correct.
> PlayerUnknown's Battlegrounds (PUBG) is an online multiplayer battle royale game developed and published by PUBG Corporation, a subsidiary of South Korean video game company Bluehole.
https://en.wikipedia.org/wiki/PlayerUnknown's_Battlegrounds
I said I didn't know if it was ultimately owned by China. Apparently, it looks like Bluehole is in part owned by Tencent.
> PlayerUnknown's Battlegrounds (PUBG) is an online multiplayer battle royale game developed and published by PUBG Corporation, a subsidiary of South Korean video game company Bluehole.
https://en.wikipedia.org/wiki/PlayerUnknown's_Battlegrounds
I said I didn't know if it was ultimately owned by China. Apparently, it looks like Bluehole is in part owned by Tencent.
https://news.ycombinator.com/item?id=22230168