Thorfinn Posted yesterday at 05:40 AM Report Posted yesterday at 05:40 AM Dunno. You could probably come up with some maximum values of blocks broken, but it needs to include things like XSkills in addition to everything in the base game. And, of course, all the stuff with RNG (like the 70% drop rate for seeds from immature crops) is a real problem. since it cannot be duplicated on server side. How could the server decide whether your quench roll was fudged on client-side? How can it verify that cracked vessel really did drop a copper scythe? And in the grand scheme of things, does it matter? Ultimately, it's just a game. If you are still enjoying playing the game, who cares if someone else is cheating? If it really bothers you, find another server. Or do single-player, so you know for sure whether someone is cheating.
Rainbow Fresh Posted yesterday at 01:21 PM Report Posted yesterday at 01:21 PM 7 hours ago, Thorfinn said: How could the server decide whether your quench roll was fudged on client-side? How can it verify that cracked vessel really did drop a copper scythe? And in the grand scheme of things, does it matter? By all means that is how any multiplayer game *should* work. Server-side authority. The client displays and gives client inputs. The server is the game. RNG should be rolled on the server so the client cannot just say "Actually, my 0.1% to win the jackpot always fires". 7 hours ago, Thorfinn said: If you are still enjoying playing the game, who cares if someone else is cheating? If it really bothers you, find another server. Or do single-player, so you know for sure whether someone is cheating. And that is just a really silly statement. "If cheating doesn't bother you, fine. If it does, go somewhere else." If it was that simple cheating wouldn't be a problem. Sadly, there are plenty people out there who specifically enjoy games playing with others and if someone is in there who does bad stuff and makes the game unfun for those others, it is no longer fun.
LadyWYT Posted yesterday at 01:31 PM Report Posted yesterday at 01:31 PM 7 hours ago, Thorfinn said: If you are still enjoying playing the game, who cares if someone else is cheating? It depends on the game and level of cheating involved. For a game like VS, frequent server backups and whitelists stop most of it, I think, along with active admins paying attention to suspicious player behavior. In the event a server does have problems with rampant/constant cheating, moving to a different server would be option, but in VS it's a lot more inconvenient due to the time it takes to actually progress through the game(not to mention leaving behind friends, potentially). In any case though, if cheating starts to become more widespread in the community, it starts serving as a deterrent to new players thinking about buying the game, and can cause current players to get frustrated enough to leave.
Vratislav Posted yesterday at 02:08 PM Report Posted yesterday at 02:08 PM Actually, do you anybody have some knowledge on Vintage Story anarchy servers? How does look such unrestricted gameplay? Are there things like hacked clients rare, common or necessary for survival? Is there a strong community of players on anarchy servers already? This may show some other boundary for the topic...
Zaph42nd Posted yesterday at 03:00 PM Report Posted yesterday at 03:00 PM 46 minutes ago, Vratislav said: Actually, do you anybody have some knowledge on Vintage Story anarchy servers? How does look such unrestricted gameplay? Are there things like hacked clients rare, common or necessary for survival? Is there a strong community of players on anarchy servers already? This may show some other boundary for the topic... Good point, can't really think of any major anarchy servers really. Main thing is whether or not claims are enabled or disabled by server operators, I suspect hacked clients maybe exist mainly to work around the land-claims system but I'm not sure on that either.... Otherwise aside from metagame things, I'm unsure as to why a player would need a hacked client if the server operator(s) don't have limitations set for building/active claiming 1
Diff Posted 23 hours ago Report Posted 23 hours ago 23 minutes ago, Rainbow Fresh said: RNG should be rolled on the server so the client cannot just say "Actually, my 0.1% to win the jackpot always fires". Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions.
Thorfinn Posted 23 hours ago Report Posted 23 hours ago 1 hour ago, Rainbow Fresh said: By all means that is how any multiplayer game *should* work. Server-side authority. OK, but when/where do you draw the line? The advantage of a decentralized design is that it can accomplish more than one centralized machine being a server by "farming out" computing time to the clients. @Diff gave an example I had not thought of -- that a client says it mined out all the blocks in a given radius, and the server just accepts it. I did not know that was the case, but it certainly is ripe for abuse. Servers can already get bogged down with just mapgen if you have a bunch of independent-minded players on a new world all sprinting in different directions. And the plan is to be able to support servers of 200+. Sure, a Ryzen 7 9800 is a couple years old, so probably not the hottest thing out there anymore, but if the plan is to support smaller, independent servers, you probably shouldn't be muscling out machines like that. 2 hours ago, LadyWYT said: In any case though, if cheating starts to become more widespread in the community, it starts serving as a deterrent to new players thinking about buying the game, and can cause current players to get frustrated enough to leave. Very much this. Which is a good share of why I am so disappointed in the histrionics of late. Here we are, a game in early access, some cheat mod comes out that for whatever reason, the dev team can not or does not immediately step on with both feet, so someone takes it upon himself to address the incipient issue, albeit in a weird manner. Not the behavior of the cheat itself, but the idiosyncracies of the coder. I'm not (necessarily) saying Maltiez should get a ticker-tape parade, but what is happening seems extreme in the other direction, let alone what the more vocal seem to want.
Thorfinn Posted 23 hours ago Report Posted 23 hours ago (edited) 17 minutes ago, Diff said: Is it not all server-sided? I don't know. I was actually basing this simply off your description of "the client says it did X, so the server accepts it". Should be relatively easy to check. Change the drop rate on the client and see. Lower something relatively innocuous on the the client mods, like seed drops to 1%. Pretty sure mods like Zippy's cattail mod are server side, though. Edited 23 hours ago by Thorfinn
Diff Posted 22 hours ago Report Posted 22 hours ago (edited) 1 hour ago, Thorfinn said: I don't know. I was actually basing this simply off your description of "the client says it did X, so the server accepts it". The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about. Edited 22 hours ago by Diff 1
MKMoose Posted 21 hours ago Report Posted 21 hours ago (edited) 2 hours ago, Diff said: Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions. In the case of shattering during quenching, the relevant code in CollectibleBehaviorQuenchable.IsGettingCooled() at CollectibleBehaviorQuenchable.cs:178-202 has an immediate client-side return, so it's only processed on the server. 28 minutes ago, Diff said: The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about. Seems to me you're correct on that. Most of VS is server-authoritative, and any discrepancies on the client are typically overridden when the client receives updating packets. There are some cases where client-side data could be incorrect, e.g. when it is modified but not marked as dirty, but those don't tend to cause any major issues because any attempt at interacting with them will just be rejected by the server (or more specifically, for example where the client sees a ghost block, the server might be informed that the player is trying to interact with an air block which is obviously ineffective). Most if not all interactions are, as far as I can tell, sent to the server purely as interactions (with no data about the result thereof) and processed from there, so the server's trust that the interactions are legitimate may be what a significant portion of cheats would exploit. The client processes most things itself to reduce latency in normal gameplay, but updates from the server are authoritative should any discrepancies arise. That said, the above is just what I've learned or made an educated guess on when working on some PRs. I'm certainly not an expert on the technical details of the client-server relationship, and there are probably some ways to get around things - the devs wouldn't be fixing packet editing exploits if there weren't any. Edited 21 hours ago by MKMoose 1
Thorfinn Posted 21 hours ago Report Posted 21 hours ago (edited) OK. Kind of what I thought before I read (and, I guess, misinterpreted) your earlier reply. The examples given are extreme, so are simple cases. But wouldn't it still be cheating if the client reports a 150% mining rate? 120%? This would be particularly important on a PvP server, where an otherwise negligible advantage is all it takes. How any clock cycles do you want to burn verifying corner cases, when nearly 100% of the client reports are going to come back as legit anyway? [EDIT] @MKMoose, consider your reply to have a "Like". Edited 21 hours ago by Thorfinn 1
LadyWYT Posted 21 hours ago Report Posted 21 hours ago 23 minutes ago, Diff said: I don't have hands on an actual cheat mod to tear it apart Instead of trying to build anti-cheats or waiting until a cheat mod appears before figuring out how to counter it...how feasible would it be to gather up a good handful of the more technically adept users in the community, let them play "hacker" with a dummy server set up specifically for testing and see what kind of cheat clients they can make themselves? Then just take that data on the exploits they uncover and patch the weaknesses in the system. You'd have to make sure these users are in good standing, of course, and keep them on a tight leash to make sure shenanigans don't get out of hand, but it seems like it'd be a potentially decent way to stay ahead of some of the cheating curve, at least. Bonus points if the reward for uncovering the most weak points is a pair of sunglasses, a trenchcoat, and a Matrix screensaver.
Rainbow Fresh Posted 9 hours ago Report Posted 9 hours ago 14 hours ago, Thorfinn said: OK, but when/where do you draw the line? The advantage of a decentralized design is that it can accomplish more than one centralized machine being a server by "farming out" computing time to the clients. Diff gave an example I had not thought of -- that a client says it mined out all the blocks in a given radius, and the server just accepts it. I did not know that was the case, but it certainly is ripe for abuse. Servers can already get bogged down with just mapgen if you have a bunch of independent-minded players on a new world all sprinting in different directions. And the plan is to be able to support servers of 200+. Sure, a Ryzen 7 9800 is a couple years old, so probably not the hottest thing out there anymore, but if the plan is to support smaller, independent servers, you probably shouldn't be muscling out machines like that. That is, luckily, not my business. If you want a more secure experience with less angles of attack, everything that can be server-side authoritative is server-side authoritative. If you want a more performant experience, more things get outsourced to the client authority. If things are server authoritative people will complain about bad performance on anything but the beefiest servers. If it's client authoritative, people will complain about more cheaters and griefers as they will have a feast. Someone always loses so I am happy to not be responsible for making that decision. But considering how all this drama started in the first place and recently developments, clearly VS could use some more server authority on things.
Recommended Posts