Hacker News Reader

Comment by charcircuit | Hacker News Reader

There are some cheats like wallhacks, trigger bot, fake lag, backtrack, etc that aren't really possible to catch with just server side checks.

View on HN

I am not sure what you mean there. Wallhacks is the ability to see through walls. The server could simply not give out the information about what behind a wall and the wallhack exploit would stop working. It would also very likely introduce pop-in and latency issue as soon the client peeks behind the wall and now need updated information from the server.

Fake lag is in a similar situation. The server could simply hold the true state of all positioning and ignore what the clients think is their position. This might work fine in a very low latency situation, but as latency increase it would make playing the game feel sluggish. It would also make aiming difficult, since the key press for fire would have to travel to the server in order for it to occur, and by then the location of players could have shifted.

Trigger bots however is mostly impossible to stop server side. Any action that is identical to human actions can only really be detected through statistics and heuristics.

>It would also very likely introduce pop-in and latency issue as soon the client peeks behind the wall and now need updated information from the server.

Which is why games that do that will still send you data about player who you are almost able to see. This will be their exact position and look direction along with what they are holding. Even limited wallhacks can give a competitive advantage.

I think you misunderstand fake lag. With fake lag you get fake packet loss / latency which causes your character to stutter making it harder to aim at you. The server isn't getting a regular stream of updates of your position.

If the movement, location and actions occurs at the server, the effect of fake lag would just harm the player doing it. It would not make the character stutter for everyone else, as from the server perspective the player would just be standing still.

Yes, the player will look like they are teleporting around, but they will still be able to kill you. No, it doesn't harm the player doing it because client side they are still moving around.

There is a misunderstanding here over how server side vs client side movement work. I will illustrate this with an example:

With Client side movement, Player A sends in even intervals their location to the server. Let say they move right for 3 unit of time, the location get updated from 0:0, 0:1, 0:2. The server then relay the information to Player B.

With Server side movement, Player A tells the server they want to move to the right. The server create a path over time, 0:0, 0:1, 0:2, ... and continuously sends this to player B.

Let now add a fake lag with client side movement. In the first case the we see Player A send locations like 0:0, 0:1, -, -, -, 0:5. The server sends this to player B. If Player B fired a gun at 0:2 at the third interval they might miss because player A is not there. The server might extrapolate an virtual path between 0:1 and 0:5, but that depend on game logic.

Lets now add a fake lag with server side movement. Player A tells the server that they want to move right. After 2 units they add a 3 unit lag, and finally sends tells the server a stop command. The server would construct the following path: 0:0 (start moving player A), 0:1, 0:2, 0:3, 0:4, 0:5 (halt moving Player A). If Player B fired a gun at 0:2 at the third interval, the server see that player A is at that location and will mark a hit.

This is why server side movement isn't vulnerable to fake lag. The server has the full game state and thus know at any point where all player are and what they are doing, and if the client lag then it simply mean that their input gets delayed. Server side movement is however vulnerable to real lag, as between any action there might be a delay and thus events might not occur at the server when players want it to occur. Server side movement is also slightly more vulnerable to ddos attacks if players can identify the IP address of other players.

Even with that implementation of server side movement it will still mess up by fake lag adding jitter.

Player A may send 0:0, 0:1, -, -, -, 0:2 0:3 0:4 0:5

The location for 0:2 that B would have been wrong via your approach. If player A's actual location at 0:2 isn't about the same B will miss his shot.

With server side movement, player A do not send coordinates. The server does the movement of players.

Imagine you are talking over the phone to someone who is driving, given them directions. That is server side movements. If you suddenly stop talking, the car doesn't just stop, nor does the traffic. All you have accomplished is that the driver is no longer getting any further instructions from you.

I wasn't talking about coordinates. Just commands attached to timestamps. If Player B shoots player B at t=5 and then Player A says they stopped moving at t=2, then Player B's shot will miss since they didn't know Player A had already stopped 3 seconds ago.

Depends on how it is implemented. If the server-side version is the truth, only the player doing it suffers. For example, player lags for a second. In that second, the server extrapolates their new position based on last velocity, heading, input, etc. Someone kills them at that extrapolated position. When the client resyncs they suddenly die.

Reply on news.ycombinator.com