I’d be interested to know if that’s possible, purely on a technical level.

Detecting superphysiological maneuvers is probably a trivial way to do this, for certain gameplay scenarios. There's established limits on reaction time, for example, it's just a matter of differentiating between reaction and preemption which converge at the highest echelons.

Since it's trivial, I look forward to your proof-of-concept in the near future

they left themself an out with "probably"

You're walking a thin line tempting me with a good time like that.

There are limits on the reaction time, but you can own all humans by consistently hitting close to that limit and achieving useful things when you do. Adding a bit of delay to all bots would not make them useless.

Cheating is a lot more sophisticated than the simple aimbots you're thinking of. A lot of cheats focus on giving the player extra information. In the context of big money online tournaments this motivates some pretty extreme behavior, like folks running a PCI card set up to access memory directly and find the game state for player positions, then indicate that to the player somehow. This defeats even kernel level anti-cheat.

Well supposedly Riot’s server side interest management was supposed to solve this, perhaps by ray casting to the subjects’ bounding box. But I’m aware that wall hacks do get made for Valorant so it would appear that’s not the case. Which is understandable given the difficulty of juggling peeker’s advantage.

> A lot of cheats focus on giving the player extra information.

Why are clients being sent that extra data in the first place? The server should track players and only push the information each player should have to that player's client. No need to hand every player the locations of other players when they're across the map and behind several walls.

Even with no extra data at all, at a certain point they're going to run into the analog hole. Cheaters will be able to point a camera at their screen and have it connected to their mouse/keyboard (real or not) so they can send inputs with speeds beyond what a human is capable of. Maybe it's not feasible to stop every cheater on Earth and the whole concept is incurably broken. There's always the option of letting people host their own servers to play with friends and other people they trust to play the game fairly. It's a hell of a lot more fun to play with people you know anyway. Tournaments can be done in person on dedicated trusted hardware under direct observation.

> Why are clients being sent that extra data in the first place?

Performance reasons, usually. Easier to draw an enemy on the screen (and figure out occlusion, etc) than have the enemy pop in from nowhere due to lag. Also prevents lag (or netspeed in the UT days) hacking (used to be a thing, not anymore).

> Why are clients being sent that extra data in the first place?

Because FPS games don't run in lockstep. They run in server ticks, which the client interpolates or even extrapolates with prediction for smoothness. This means the server has to send player positions a bit earlier than they would be visible via strict occlusion culling.

If you tried to run FPS in lockstep it's atrocious. This is literally why John Carmack originally implemented client side prediction for QuakeWorld. Do you think he was just too stupid to do the obvious simple correct thing? Or maybe the problem is actually a bit more complicated?

Again, hnews is anchoring on aimbots when that's by far the least interesting way to cheat.

> Do you think he was just too stupid to do the obvious simple correct thing? Or maybe the problem is actually a bit more complicated?

No, but both hardware and software have changed dramatically since the 1990s. We even have cloud gaming services that run games remotely with very little being done on local hardware. They do currently over-promise when it comes to performance, but it's not unthinkable that we're at (or soon will be at) a point where games don't have to depend as much on the random PC at the player's end of the connection even though that's the way things have always been done.

Latency is still relatively high in LOTS of areas around the world. Not high enough to make online FPS games unplayable, but high enough to make sending packets in lockstep unplayable. Discriminating against those people wouldn't be fair (especially since they're not a particularly small minority).

It's even worse than that. Corner peeking is absolutely key in FPS games, and a laggy player can actually gain an advantage if there's pop in or rubber banding artifacts. It's like they teleport around the corner.

I always thought this was a super interesting problem, because you're balancing a bunch of stuff - emergent behavior, latency, and server load.

Latency is the obvious one - you have to be able to tell not only if a client can see another client, but whether they might be able to see each other in, say, 500ms. That's pretty hard and computationally intensive, at-least compared to just checking whether bounding boxes have line-of-sight.

Where things get interesting is when we come to emergent behavior tied to rendering. A good example is shadows - you can have no LOS to a player, and not be in a position where you could get LOS quickly, but be able to see their shadow. So your client needs to know where the other player is so the shadow can be rendered correctly. Sound is also hard, and forces you to balance server load and client trust. Lets say someone really far away takes a step that's audible within 10m. You can't hear that, but the server would have to check distance against every player to confirm that. If you have a directional sound system (where sounds from inside a room will originate from the doorway for those outside) it's even harder, as the server is having to calculate the shortest path not blocked by the enviroment. Even if you do all this, you're still screwed - since when you determine the dishonest player can hear something so you tell their client client to play a sound, you have to send them the coordinates of the origin, so you're telling them where the other player is anyways!

Right and how exactly that detects maphacks, wallhacks and a bunch of other non-input related ones ?

That wouldn't need to be detected based on the architecture in use.

- Server-side actor occlusion.

- Server-side physics with client-side prediction that's been in use since 1996.

You can get rid of causal cheaters by having a secure boot all the way to the game. This would make it so people would have to use hardware cheats if they wanted to cheat.

This is factually incorrect. You dont need hardware cheats to defeat that requirement.

Then also add the requirement that the operating system is bug free and allows you to protect your process from being read from or written to.

Why jump through all those hoops? Just add a requirement for the game that prevents any form of cheating in the game.

Because that's not a realistic requirement.

and neither is a bug free OS!

From the perspective of a server-sided anticheat as client side exists as a barrier to entry so it must be intrusive to work. I know of non-cheat devs who have bypassed Vanguard accidentally while implementing low level windows stuff.

No, this isn't possible. There will always be purely client sided cheats that don't touch anything sent to the server. For example, seeing enemies through walls gives a huge advantage but isn't detectable. This can be mitigated only sending entities the client can see, but latency makes it so you can't fully stop this.

You can also attack latency which doesn't directly affect protocol. Rewind enemies slightly forwards or backwards in shooters so you land the shot when you aim slightly off. These cheats exist in CSGO.

However, an anticheat's job is to prevent other players from noticing you cheating rather than to prevent cheating. This key distinction does let you simply ignore a lot of purely client side cheats as insignificant.

You also can't do much about aimassists that slightly correct aiming. Machine learning can help here but falls apart quite fast when humans are covering up the machine's aiming patterns. Algorithmic inputs and random human inputs still result in random-ish human inputs.

Yeah, it's called plug your mouse and keyboard into a game console - on a more serious note, a realistic idea for serious gamers who care about the sovereignty of their P.C. buy a completely corporate anti-cheat CPU that runs a separate system and uses GPU pass-through so you don't need to build an entire new rig.

The main issue, and this pervades computing, is that people don't care enough about owning their computers and controlling the software that runs on them.

I remember that back in my console days, COD MW2 on Xbox 360 was full of glitchers and cheaters. I don't think the situation on PC vs console is all that much different.

Console security has significantly improved since the Xbox 360 days. All the "trustable computing" stuff is heavily utilized there, and this is like the third time these companies have taken a swing at "Unhackable" consoles. There still isn't a way to exert control over a Switch that doesn't have the old backdoor.

Only if that functionality came directly from OS, i.e. ability to run app in a container user can't mess with.

Then it is just OS being intrusive...

The OS is already "intrusive" by that definition. What you described has a different issue though; my own computer letting some software run in some container that I can't touch is insane. That's Black Mirror kind of spooky and I hope it never becomes a reality.

That's clearly been the plan for quite some time with all the "trusted computing" rubbish. Online shopping or banking or playing games (or streaming DRM'd content) won't be allowed on hardware you actually control by like 2035 at the very latest, IMHO.

There’s probably a few metrics you could come up with. I’d be thinking about ways to quantify awareness, then comparing average awareness vs. some distribution near the players’ skill level.

Awareness would be like: average travel distance between combat engagements, % of time fully occluded players receive gaze from a player, etc.

If Microsoft succeeds with their full plan for "trusted computing" (project Palladium), they'll be able to do anti-cheat at the operating system level.

The basic idea is the BIOS verifies the kernel (secure boot), and the kernel verifies all running software. The hardware TPM chip signs a message from the kernel attesting that this has all happened using the on-device crypto signature embedded by the hardware vendor (eg ATI). So the signature is tamper-proof, even by the computer user. And all that can validated over the internet via remote attestation.

The message would presumably include the hash of the game's binary files, and the signature & hash of all loaded kernel modules. So yeah, hardware level, "unhackable" anti-cheat on commodity hardware.

I can't tell whether to be terrified or impressed with the audacity of the plan.

https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...

While the whole signature verification thing sounds water-tight in theory there are lots of holes still being patched so I don't buy it this will 'change everything'. Making everything tamper-proof could even prevent some holes from being closed.

The only tamper proof part is the hardware TPM. Everything else uses a chain-of-trust model based on signatures. Most of the complex work will be in windows; and that code can be updated just fine so long as updated versions of the kernel are digitally signed.

I’m sure there will be security holes early on. But the people pushing this stuff seem to be playing a long, patient game. I think they’re going to get what they want.

> I can't tell whether to be terrified or impressed

I recommend the former, since this is another nail (maybe the final one?) in the coffin of "personal computers", hastening their replacement by hypertelescreens or whatever. (A computer you don't own, but merely access.)

Now announcing ButlerCheat™, installing a live human supervisor into every home in the latest anti-cheat technology. Included now with its own refrigerator where you can store your snacks and drinks for those long gaming sessions.

Blizzard had one, called Error 37.

For a game that runs on a general-purpose computing system?

That's about as feasible as making a perpetual motion machine.