I would submit that this is more an issue of trust than it is an issue of forcing client machines into compliance. Because of the industries persistent belief that anti-cheat is somehow an effective strategy, let alone a morally acceptable one, has meant that development of systems that develop player trust in others has totally atrophied.

This patterns of thinking "Well I'll just download a binary onto my clients machine and force it into compliance, then I can throw all of them into a big pot and they'll all mix just fine!" Is a kind of persistent insanity that is leading to your woes, more than it is the lack of a stiffer boot to land on the necks of client machines.

  "If we just control the platform"
  "If we just control the hardware"
  "If we just control the software"
  "If we just control everything".

  "And what of tools to moderate bad actors?"
  "Eh? Sure, here's a kick function."

Sure. But people want to run games on general purpose machines.

I’m not saying it’s impossible to cheat on consoles but it wasn’t a problem for us (lag switching aside; which was actually easy to detect).

Things like stadia help the platform more than consumers think; but people resoundedly rejected Stadia for a myriad of reasons.

I think everyone here paints a rosy picture of what content moderation is, and maybe we stretched our hand a bit thin regarding having enough humans involved (despite games taking 700-1400 people 4+ years to make in the first place)- but the rub is that people can’t have everything.

We can’t expect you not to try to tamper with the binaries and ruin games for others.

You can’t expect us not to try preventing it.

Because at the end of the day; people do submit reimbursement claims because of cheaters ruining their experience, and if there’s one thing that I can promise it’s that no amount of human review will ever be sufficient, we already put 70 or so humans on reviewing reports, and even then it was difficult to punish people, because if you ban someone they just buy another key from a Russian third market reseller for €3 (or if you make the game free god help you)

I'm not saying "You just need more humans to review and kick cheaters".

I'm saying that players often have the barest bones of ways, if they have anything at all, to say who they would and who they would not like to play with.

Players refunding over cheating are also refunding because, when they discover cheating, they can do absolutely nothing about it. If they're lucky, they might get to scream into the void and hope a moderator listens. Some brand new player on a $3 key just waltzed into the pool of players and everyone has to trust them as equally as everyone else. This is not how trust works.

But then how should one do it? I don't know! Precious little work has been done here. And why? Because it's been wasted on pretending that one can trust the clients machine if we just download enough malware to it.

I've had good experience in games with human moderation and recorded demos that you can play back to catch and report cheaters. After building some reputation and trust in the community, you'd be permitted to join a server with fewer random new users and practically no cheaters (and usually far more skilled players). No need for intrusive anti-cheat solutions (that IME just gave legit users trouble and still failed to stop cheaters).

Of course, I don't expect AAAs to offer an experience like this, because human moderation doesn't scale cheaply to 10s of millions of players.. race to the bottom <3

We did record demos and play them back, but cheaters are intelligent and will do things like change their ID after a game. They use IDs like “iIiiIiliiiiIii1” too, which means getting your report from someone who just takes a screenshot and doesn’t use the in-game report is just noise.

Cheaters also do things like buy CD codes/stolen accounts which are sold cheaply on various websites.

It also doesn’t help when there are promotional campaigns that let people play the game for free or very cheaply.

We even had a problem with people buying the game with stolen credit cards.

Regardless of that, human moderation efforts are a full time job, personally I’d be happy to release the server, but the server requires 40 cores and 256G of ram to boot, many people don’t have that, and that’s not including the kinds of nefarious things people did with the binaries of other games gameservers we gave out (like saving garbage back to our persistence, or trying to inject statistics to the leaderboards systems if there are any.)

It sounds easy from the outside; if you think it’s easy I really do have a job for you. Maybe I’m stupid.

But I was not told (for business reasons anyway) to hold on to the game server binaries.

We did it because making the game was easier/possible that way and the gameserver itself is nearly impossible to load for most people anyway.

I promise you that it is not cheap to host gameservers — if we could we would have pushed that burden onto players. (Speaking purely economically)

> We did record demos and play them back, but cheaters are intelligent and will do things like change their ID after a game. They use IDs like “iIiiIiliiiiIii1” too, which means getting your report from someone who just takes a screenshot and doesn’t use the in-game report is just noise.

So you didn't check the demo corresponding to the reporter's account and timestamp? Why not? Why don't you have IDs in logs?

My experience comes from 100% free games. Codes and accounts were irrelevant. If you can't earn some reputation and trust on a public server, you can't get invited to a private one. Simple as that. It doesn't matter if wannabe-cheaters can make a million accounts.

> Regardless of that, human moderation efforts are a full time job

For many clans and gaming communities, moderating their turf is a passion project and having the keys is a sought-after position of privilege. They love to spectate and look out for potential new "hires" while keeping the chat clean and kicking out any griefers and cheaters.

> personally I’d be happy to release the server, but the server requires 40 cores and 256G of ram to boot

> the gameserver itself is nearly impossible to load for most people anyway.

I think you lack some imagination. Letting gamers operate their own servers doesn't mean they have to host their own servers. Just like discord "servers" aren't actually hosted by their "owners".

> It sounds easy from the outside; if you think it’s easy I really do have a job for you.

Sorry, not interested in AAA games.

> Maybe I’m stupid.

You're probably not stupid but it's all too common to see people not being able to think outside the box.

I understand you really believe everything you’re saying; unfortunately I can’t help but read it as painfully naive.

Logs are great, but people are not great at reporting cheaters. Some resort to recording their screen or cheaters bypass the “report” button by acting in a way that prevents that button from popping up.

We must have lost thousands of man hours on people falsely hitting the report button when someone was being better than them. Everything in it’s time.

Community moderation is a very comforting idea, but the reality is actually not conducive to a good online experience except for a very small minority; the kinds of problems that crop up are obviously exclusion but also go into the area of power abusing operators.

I know you’re going to say “go to another server” but honestly, that’s naive. Oper abuse is even more deeply unpleasant than cheating. It is enough to put you off a game entirely.

So the gatekeeping, politics aspect are obviously not good but what is also true is that there is a large contingent of people who desire good matchmaking, good matchmaking depends heavily on:

A) regionality

B) a large population to pull from

C) consistency of the platform and administration.

If you get into a “random” game and someone cheats, that’s no different than if you joined a “random” game and the admin of the server did something within their power.

Having a small population for a game like apex legends means that the outcome is nearly always the same.

Having low regionality of hosted servers means people in South America have extremely bad experiences; as severs there are expensive and finding a population to fund it amongst themselves is difficult.

Also, obviously, a 40 core 256G windows PC costs in the region of €300/mo (not including the windows server license). Given people are already very cost conscious when it comes to games; getting people to shell out the price of a game each every month to run a server seems unlikely.

> I understand you really believe everything you’re saying; unfortunately I can’t help but read it as painfully naive.

I'm sharing my experience. I can say that I had very good experience with community moderation for many many years across numerous different games.

By the sound of it, you haven't even tried it, you're just explaining why you don't believe it works?

And the end result then is that you have no moderation. Cheaters can still cheat, griefers can still grief, and hosting your game for a better experience is impossible. Yeah, that's the kind of thing that puts me off a game entirely.

Except we have tried it.

https://www.massgate.org/

> Of course, I don't expect AAAs to offer an experience like this, because human moderation doesn't scale cheaply to 10s of millions of players.. race to the bottom <3

I think it does scale, but it requires users being able to host their own servers for your game. It doesn't scale in a way that maximizes control for the IP holder, however.

Was there an attempt at detecting cheaters by modeling human reaction times and otherwise inputs, and thus detecting non-human like inputs?

Yes.

Here's a good perspective on the situation by someone who was cheating: https://www.reddit.com/r/thedivision/comments/4k17n8/confess...

Thanks for the post. It was very interesting, however, I honestly do not see it addressing my question. Most of the problems he mentions are due to client-side trust issues.

However, there is nothing there that should be hard to pick up by modelling normal behavior, and then being able to flag the anomalies. Most things he manipulated were known server side. Going the route of installing rootkits seems like fools errand to me, of which I can understand a possible non-nefarious intention behind... but it starts stinking to high water unless the other more obvious approaches are not seriously exhausted.

Develop mathematical models for likelihoods of cheating based on user input, and non-conforming game states. Create a heuristic that takes into account time spent and the possible cost of losing progress. Move possible cheaters into isolated environments where they go up against each-other. Or subtly punish by reducing drop rates.

In the post you linked to, he mentioned things like. 125-500% move speed. 200-2500% DMG increases, by manipulating client side states. However, surely, this is trivial to detect server side?

The hardest things I can imagine detecting are probably stochastic cheats like randomly improving your aim and reaction time, but these arguably less severe, to a point where if it becomes super-human, it again becomes detectable. And, these are also the kind of cheats that typically can be done through user input, and thus very easy to make undetectable to any root-kit like anti cheat.

For lest than the cost of one AAA game, you can buy the hardware required to do this processing completely outside of any rootkit. If cheating is your thing, and based on the post in question, the cheater could make back this investment in 15 minutes... arguably.

----

But, to sort reply to your answer to my question. I'm curious, do you have some more details other than "yes"? The post you linked, to me, read as "nope, The Division does not do that this at all. And if they did, very few things this person did would have been possible".

So you distribute rootkits to make money. Sounds unethical.