theory on Open Source Anti-cheat as a mod (Not the current drama)

[Thorfinn]

Dunno. You could probably come up with some maximum values of blocks broken, but it needs to include things like XSkills in addition to everything in the base game. And, of course, all the stuff with RNG (like the 70% drop rate for seeds from immature crops) is a real problem. since it cannot be duplicated on server side. How could the server decide whether your quench roll was fudged on client-side? How can it verify that cracked vessel really did drop a copper scythe? And in the grand scheme of things, does it matter?

Ultimately, it's just a game. If you are still enjoying playing the game, who cares if someone else is cheating? If it really bothers you, find another server. Or do single-player, so you know for sure whether someone is cheating.

[Rainbow Fresh]

7 hours ago, Thorfinn said:

How could the server decide whether your quench roll was fudged on client-side? How can it verify that cracked vessel really did drop a copper scythe? And in the grand scheme of things, does it matter?

By all means that is how any multiplayer game *should* work. Server-side authority. The client displays and gives client inputs. The server is the game. RNG should be rolled on the server so the client cannot just say "Actually, my 0.1% to win the jackpot always fires".

7 hours ago, Thorfinn said:

If you are still enjoying playing the game, who cares if someone else is cheating? If it really bothers you, find another server. Or do single-player, so you know for sure whether someone is cheating.

And that is just a really silly statement. "If cheating doesn't bother you, fine. If it does, go somewhere else." If it was that simple cheating wouldn't be a problem. Sadly, there are plenty people out there who specifically enjoy games playing with others and if someone is in there who does bad stuff and makes the game unfun for those others, it is no longer fun.

[LadyWYT]

7 hours ago, Thorfinn said:

If you are still enjoying playing the game, who cares if someone else is cheating?

It depends on the game and level of cheating involved. For a game like VS, frequent server backups and whitelists stop most of it, I think, along with active admins paying attention to suspicious player behavior. In the event a server does have problems with rampant/constant cheating, moving to a different server would be option, but in VS it's a lot more inconvenient due to the time it takes to actually progress through the game(not to mention leaving behind friends, potentially).

In any case though, if cheating starts to become more widespread in the community, it starts serving as a deterrent to new players thinking about buying the game, and can cause current players to get frustrated enough to leave.

[Vratislav]

Actually, do you anybody have some knowledge on Vintage Story anarchy servers? How does look such unrestricted gameplay? Are there things like hacked clients rare, common or necessary for survival? Is there a strong community of players on anarchy servers already? This may show some other boundary for the topic...

[Zaph42nd]

46 minutes ago, Vratislav said:

Actually, do you anybody have some knowledge on Vintage Story anarchy servers? How does look such unrestricted gameplay? Are there things like hacked clients rare, common or necessary for survival? Is there a strong community of players on anarchy servers already? This may show some other boundary for the topic...

Good point, can't really think of any major anarchy servers really. Main thing is whether or not claims are enabled or disabled by server operators, I suspect hacked clients maybe exist mainly to work around the land-claims system but I'm not sure on that either.... Otherwise aside from metagame things, I'm unsure as to why a player would need a hacked client if the server operator(s) don't have limitations set for building/active claiming

[Diff]

23 minutes ago, Rainbow Fresh said:

RNG should be rolled on the server so the client cannot just say "Actually, my 0.1% to win the jackpot always fires".

Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions.

[Thorfinn]

1 hour ago, Rainbow Fresh said:

By all means that is how any multiplayer game *should* work. Server-side authority.

OK, but when/where do you draw the line? The advantage of a decentralized design is that it can accomplish more than one centralized machine being a server by "farming out" computing time to the clients. @Diff gave an example I had not thought of -- that a client says it mined out all the blocks in a given radius, and the server just accepts it. I did not know that was the case, but it certainly is ripe for abuse.

Servers can already get bogged down with just mapgen if you have a bunch of independent-minded players on a new world all sprinting in different directions. And the plan is to be able to support servers of 200+. Sure, a Ryzen 7 9800 is a couple years old, so probably not the hottest thing out there anymore, but if the plan is to support smaller, independent servers, you probably shouldn't be muscling out machines like that.

2 hours ago, LadyWYT said:

In any case though, if cheating starts to become more widespread in the community, it starts serving as a deterrent to new players thinking about buying the game, and can cause current players to get frustrated enough to leave.

Very much this. Which is a good share of why I am so disappointed in the histrionics of late. Here we are, a game in early access, some cheat mod comes out that for whatever reason, the dev team can not or does not immediately step on with both feet, so someone takes it upon himself to address the incipient issue, albeit in a weird manner. Not the behavior of the cheat itself, but the idiosyncracies of the coder. I'm not (necessarily) saying Maltiez should get a ticker-tape parade, but what is happening seems extreme in the other direction, let alone what the more vocal seem to want.

[Thorfinn]

17 minutes ago, Diff said:

Is it not all server-sided?

I don't know. I was actually basing this simply off your description of "the client says it did X, so the server accepts it".

Should be relatively easy to check. Change the drop rate on the client and see. Lower something relatively innocuous on the the client mods, like seed drops to 1%. Pretty sure mods like Zippy's cattail mod are server side, though.

Edited Wednesday at 03:58 PM by Thorfinn

[Diff]

1 hour ago, Thorfinn said:

I don't know. I was actually basing this simply off your description of "the client says it did X, so the server accepts it".

The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about.

Edited Wednesday at 05:10 PM by Diff

[MKMoose]

2 hours ago, Diff said:

Wait, can we confirm this? Is it not all server-sided? I know the server is naive but I didn't think it farmed out actual RNG calculations out to the clients. Runs a little contrary to what I thought I knew about the server/client split, but I do go out of my way to avoid the networking portions.

In the case of shattering during quenching, the relevant code in CollectibleBehaviorQuenchable.IsGettingCooled() at CollectibleBehaviorQuenchable.cs:178-202 has an immediate client-side return, so it's only processed on the server.

 

28 minutes ago, Diff said:

The server does trust whatever the client says, but should only be certain things the client is capable of telling the server in the first place. I can punch you, the cheat is that the server probably shouldn't let me punch you 20 times in under a second. I can mine a block, the cheat is mining 500. I don't have hands on an actual cheat mod to tear it apart, but based on those strings "Nuker", "KillAura", "InstantShot", those all sound like abuses of normal, expected actions rather than wholesale rewriting reality at every player's whim. RNG is not the kind of thing I would really expect the client to be able to tell the server about.

Seems to me you're correct on that.

Most of VS is server-authoritative, and any discrepancies on the client are typically overridden when the client receives updating packets. There are some cases where client-side data could be incorrect, e.g. when it is modified but not marked as dirty, but those don't tend to cause any major issues because any attempt at interacting with them will just be rejected by the server (or more specifically, for example where the client sees a ghost block, the server might be informed that the player is trying to interact with an air block which is obviously ineffective).

Most if not all interactions are, as far as I can tell, sent to the server purely as interactions (with no data about the result thereof) and processed from there, so the server's trust that the interactions are legitimate may be what a significant portion of cheats would exploit. The client processes most things itself to reduce latency in normal gameplay, but updates from the server are authoritative should any discrepancies arise.

That said, the above is just what I've learned or made an educated guess on when working on some PRs. I'm certainly not an expert on the technical details of the client-server relationship, and there are probably some ways to get around things - the devs wouldn't be fixing packet editing exploits if there weren't any.

Edited Wednesday at 05:36 PM by MKMoose

[Thorfinn]

OK. Kind of what I thought before I read (and, I guess, misinterpreted) your earlier reply.

The examples given are extreme, so are simple cases. But wouldn't it still be cheating if the client reports a 150% mining rate? 120%? This would be particularly important on a PvP server, where an otherwise negligible advantage is all it takes. How any clock cycles do you want to burn verifying corner cases, when nearly 100% of the client reports are going to come back as legit anyway?

[EDIT]

@MKMoose, consider your reply to have a "Like".

Edited Wednesday at 05:23 PM by Thorfinn

[LadyWYT]

23 minutes ago, Diff said:

I don't have hands on an actual cheat mod to tear it apart

Instead of trying to build anti-cheats or waiting until a cheat mod appears before figuring out how to counter it...how feasible would it be to gather up a good handful of the more technically adept users in the community, let them play "hacker" with a dummy server set up specifically for testing and see what kind of cheat clients they can make themselves? Then just take that data on the exploits they uncover and patch the weaknesses in the system. You'd have to make sure these users are in good standing, of course, and keep them on a tight leash to make sure shenanigans don't get out of hand, but it seems like it'd be a potentially decent way to stay ahead of some of the cheating curve, at least.

Bonus points if the reward for uncovering the most weak points is a pair of sunglasses, a trenchcoat, and a Matrix screensaver. 

[Rainbow Fresh]

14 hours ago, Thorfinn said:

OK, but when/where do you draw the line? The advantage of a decentralized design is that it can accomplish more than one centralized machine being a server by "farming out" computing time to the clients. Diff gave an example I had not thought of -- that a client says it mined out all the blocks in a given radius, and the server just accepts it. I did not know that was the case, but it certainly is ripe for abuse.

Servers can already get bogged down with just mapgen if you have a bunch of independent-minded players on a new world all sprinting in different directions. And the plan is to be able to support servers of 200+. Sure, a Ryzen 7 9800 is a couple years old, so probably not the hottest thing out there anymore, but if the plan is to support smaller, independent servers, you probably shouldn't be muscling out machines like that.

That is, luckily, not my business. If you want a more secure experience with less angles of attack, everything that can be server-side authoritative is server-side authoritative. If you want a more performant experience, more things get outsourced to the client authority. If things are server authoritative people will complain about bad performance on anything but the beefiest servers. If it's client authoritative, people will complain about more cheaters and griefers as they will have a feast. Someone always loses so I am happy to not be responsible for making that decision.

But considering how all this drama started in the first place and recently developments, clearly VS could use some more server authority on things.

[Thorfinn]

Maybe. But that means everyone who plays single is going to get perf-dinged for stuff that can't affect him in the slightest. It also means latency when playing with friends.

Or maybe it's maintaining two types of servers -- trusted clients and non-trusted clients. But that was definitely not the intent here, as solo play is also run through a server.

I think cheaters are scum, even those who just save-scum, but so long as it's not griefing or PvP, or maybe a couple things I have not thought about, I don't really care. I play the game the way I like, and it doesn't really matter to me if someone has a hack that gives his tools infinite durability, or faster speed.

The most sane path, IMO, is heightened server security as a mod, maybe eventually an official mod. If you want to take the performance hit in exchange for making sure someone else isn't eating 800 satiety berries, hey, you be you.

[Zvengks]

On 9/9/2026 at 1:39 PM, LadyWYT said:

Instead of trying to build anti-cheats or waiting until a cheat mod appears before figuring out how to counter it...how feasible would it be to gather up a good handful of the more technically adept users in the community, let them play "hacker" with a dummy server set up specifically for testing and see what kind of cheat clients they can make themselves? Then just take that data on the exploits they uncover and patch the weaknesses in the system. You'd have to make sure these users are in good standing, of course, and keep them on a tight leash to make sure shenanigans don't get out of hand, but it seems like it'd be a potentially decent way to stay ahead of some of the cheating curve, at least.

Bonus points if the reward for uncovering the most weak points is a pair of sunglasses, a trenchcoat, and a Matrix screensaver. 

That's how cyber security often works. Bug bounties, and CTF. 

A Bug bounty is basically a company offering cash to find and report bugs in their software, and CTF (yes, capture the flag) is basically a cyber security training exercise that started at DEFCON, where one group sets up a deliberate, selectively insecure computer system with a hidden string of text (the flag), and the players have to hack the system and, well, capture the flag.

you could have 2 teams of people, one runs the server, one hacks it, and when things stall out, they trade, even if it means rolling back to the same starting point, to see if there are multiple ways to exploit.

 

anyway, I didn't quite expect adversarial training to come up in this thread, but I think I'm gonna stop following it. I started this thread to get people to consider the idea seriously, independent of, things, and figure out what it would take to do. see how much is feasible, and I think that's worked. so please, keep on going. maybe somebody will make it. 

[Juwan Alexander]

2 hours ago, Zvengks said:

That's how cyber security often works. Bug bounties, and CTF. 

Thank God we have people in this community who actually know that they're talking about. I'm tired of people who have probably never taken Intro to C having an opinion and thinking that it should matter when it comes to anything regarding tech aside from how much it costs to purchase devices/software.

Quote

anyway, I didn't quite expect adversarial training to come up in this thread, but I think I'm gonna stop following it. I started this thread to get people to consider the idea seriously, independent of, things, and figure out what it would take to do. see how much is feasible, and I think that's worked. so please, keep on going. maybe somebody will make it. 

There is a mod on the database right now that is basically a more robust form of anticheat than maltiez's implementation. The only difference is transparency and public advertisement of the intent behind the mod, but I haven't taken the time to check if I can review his code just by opening the zip files and reading the text. If that is the case, then I have some terrible news for the people excited about it. If that is not the case, then I have even more terrible news about the people who still believe that maltiez's actions/conduct are to be condemned.

Either way, the game is growing and even though that is a wonderful thing for the devs in a financial sense, it is most definitely going to turn into Minecraft 2.0 because that will give trolls more incentive to actually purchase cheat clients and ruin the gameplay experience for the rest of us that play multiplayer on a public server. I grew up watching Team Avolition make reddit neckbeards cry over block game, but once the cheating starts en masse you can't put a lid on that can of worms as easily as the average person might believe. It was still hilarious, though. It could also potentially be incredibly hilarious to see happen in this game because you actually earn every block you place and ingot you bring into existence LMAO.

That is why I will never play with anyone who I have never met face-to-face. I trust this community as far as I can throw Dave Blunts over my shoulder and into the morgue when he passes from the complications of his morbid obesity.

[Diff]

2 hours ago, Juwan Alexander said:

Thank God we have people in this community who actually know that they're talking about. I'm tired of people who have probably never taken Intro to C having an opinion

No shade because a literal "Intro to C" class isn't actually required to know anything but thought it was funny you said this considering

On 9/7/2026 at 2:24 AM, Zvengks said:

I am not a programmer, and cannot implement any of this myself. My experience programming consists of game maker some 15-20 years ago as a kid, and playing Shenzhen I/O

 

[Juwan Alexander]

5 hours ago, Diff said:

No shade because a literal "Intro to C" class isn't actually required to know anything but thought it was funny you said this considering

Quote

I am not a programmer, and cannot implement any of this myself. My experience programming consists of game maker some 15-20 years ago as a kid, and playing Shenzhen I/O

I was mostly joking, but you'd be surprised at how many people dropped and switched majors when pointers were introduced. The next course's (CPSC 1020) project was to literally build a ray tracer from scratch and so many people whined about it that they actually changed the curriculum just to avoid losing more students right before I took it (I was actually looking forward to it). OOP was literally a breeze with Java/C++. The program only became difficult once they started to throw some massive curveballs in the form of Discrete Mathematics (300 level, not intro) and professors who had literally written languages that didn't exist so we couldn't cheat by looking up tutorials or finding it on stack exchange. Intelligent foreigners who never really learned English well enough to explain these concepts were a common complaint as well. Basically, we were on our own. Code monkey business was any 100 to 200 level course that you were actually wasting money learning in a university because YouTube exists. 300 and above is when the difficulty actually spiked. Lots of my peers never made it that far.

However, the backlash for maltiez's actions has more to do with a startling lack of tech literacy that shouldn't be possible in the big 26 when I've been learning how to keep my system safe the hard way as a 90's kid before we even coined the term 'cybersecurity.' If Mutahar has not covered this drama, then it is not worthy of anything more than mild concern for people who use the 1-click install function one too many times without reading the warning label.

With that being said, OP might not be a programmer, but you don't need to be a skilled code monkey to have a good understanding of the many subfields that comprise Computer Science as a whole. Installing linux and an adblocker is all you need to do to protect yourself from just about everything, but the ones complaining most about this nothingburger of the century probably don't even understand what BIOS means nor what it is even used for.