One man’s quest to end cheating in virtual cycling
thehustle.co
thehustle.co
So predictable. "Please keep Mr. Feynman away from the locked safes."
It seems really hard to get this 100% fair, because so much relies on physical equipment. E.g. "Elite riders learned the serial codes of batches of smart trainers that overreported a rider’s power, and sought them out on the used market" isn't necessarily "cheating" – if you happen to have one of these trainers but don't know it reports the wrong data. And what's to prevent someone from just hacking these things (e.g. the firmware, or modify it so there's less friction when pedalling, endless possibilities)?
Seems basically impossible to detect all of this without physical access to the equipment. The stupid "cycles better than a doped up Lance Armstrong" ones get caught (what did you expect lol), but the more careful people won't.
I know someone who hacked their college system for applying for classes, it was a points-based system and he gave himself some ridiculous number of points, he got caught, ended up not getting in trouble
They also told him they had fixed the vulnerability. But they hadn’t, so the guy hacked the system again, and he gave himself a high number of points, just not a ridiculous number. He never got caught again
It is, for all the reasons you mentioned, and nobody is aiming for that. He just found and demonstrated a cheat (bug) that the platform itself should have no issue detecting - changing weight mid race
Zwift uploads race results to ZwiftPower and removes any cyclists that are outliers and it assumes are cheating. 8w/kg would be a big outlier. But it looks like the platform calculates w/kg based on the cyclists' ending weight. So if you change your weight to 25kg right after the race begins and back to 65kg before the end - while cycling at 200w, then Zwift's cheat detection system calculates your w/kg as ~3w/kg, which is completely reasonable and would not get caught. But cycling at 8w/kg is far far faster than 3w/kg
The article is overblown. He's not trying to end cheating altogether. He found a bug and demonstrated it
The article says he did more than demonstrate a bug:
"He became a founding member of FERA, the Fair E-Racing Alliance, where he works with 25 other volunteers to assess suspected cheats across ~60 online cycling teams. The list of ways to cheat on Zwift he amassed? It’s now up to 127."
As a casual Zwift enjoyer, I'm just vaguely familiar with the story, but now I ended up digging the initial (now deleted) article: https://web.archive.org/web/20220223133105/https://zweight24...
And some reddit post from him, explaining why the article was deleted and his disappointment in Zwift as a company: https://old.reddit.com/r/Zwift/comments/t0n5be/the_article_z...
If you're in a lower category and right near the w/kg limit you could be 70kg and racing against 100kg riders. If the cat limit was 3.2w/kg you could have 224w a maximum vs 320w for the heavier rider.
On the flats they'll destroy you, in the sprints they'll destroy you and on the descents they'll destroy.
On the climbs? They'll hang right with you because you both climb at 3.2w/kg.
If you get fitter you'll just be bumped up to a cat with higher limits but the same issue.
Unless you're an elite cat A rider, where there's no limits, you should treat the races as just a fitness activity.
The heaviest fit rider will always have a massive advantage regardless of the course. So why "race" at all?
Any rider with enough power to ride you off their wheel would be promoted until they couldn't do that any more.
They don't get a special exemption to ride in races with weaker riders simply because they're heavy like on Zwift.
It would the same issue in reverse if they simply grouped riders by absolute wattage without using weight as a component. The light riders would always win in the hilly races and hold their own on the flats. Also weird.
What Zwift needs is an Elo system based on results. Just like in real life.
Things are different downhill [2]
[1] https://www.cptips.com/climb.htm
[2] https://road.cc/content/feature/does-heavier-cyclist-descend...
For example I compete in high power three position. Your classification (unranked, marksman, sharpshooter, expert, master, high master) is based on whether you scored X% of points for three consecutive matches (or your first two matches for initial rank). I've shot Master scores in every single match bar one, including my first match. But in the second match, there was some confusing misfire on one string (like faulty ammo related? Still don't know to this day lol), which dropped something like 20 points, which is basically enough to kick you down. Which means for the subsequent three matches, I was effectively sandbagging in Expert, and scoring high expert, and getting some pocket change for it (like $20, a fraction of the ammo cost). But I've never pieced together three high master, and may never get there. Meanwhile, we've got a couple people in the area who are literal national champions, and they score so close to perfection every time it's untouchable for the rest of us. It's like they're competing in a much more difficult sport than we are, like smallbore (actually one of the guys went to the Olympics for air rifle so that makes sense lol, air rifle is way harder than high power, score-wise and competition-depth -wise). If one of them shows up to the match, it's a guarantee they win, even if they're massively sick during the match.
In a previous life I did fencing, and had years long struggles to barely make B (sorta the equivalent of Master in high power 3p I guess). In earlier years of that life, I would get crushed beyond belief by Ds, Cs, and Bs. Eventually I got to the point where I could occasionally beat Bs, and by stringing enough tournaments in there, I got it. But I'd still usually lose to a B. And, just like in 3p above, everything we did was a joke to the serious competitors with national rankings, because they could just walk all over us. The massive gap between random A, and A who is high on the points list and seriously might make the Olympic team isn't shown by the category ratings. On paper they're the same rank as the old high master guys, but there's no real comparison.
----
But ... despite all that, breaking into subcategories is a Thing in virtually all competitions, because it encouraged more people to participate. You're less demoralized if there's something hypothetically tangible to work for. It's everywhere - we break colleges into D1-D3 schools, high schools get even more partitioned. We break kids into tiny age brackets.
So you can compete in lower subcategories, but I think you're right in the back of your mind you need to remember you're doing it for fun or exercise (certainly not exercise in high power lol). That's why the people who get super worked up over scores or times or whatever at some middling amateur category look so out of place.
The problem is that the categories are designed in such a way that heavier riders are allowed to put out more power than lighter riders.
At the limits of what the category allows the lighter riders just can not win. If they do put out more power then they get disqualified and bumped up a category.
Moving up a category does not help you and in most races you are not allowed to race against lower cat riders because of power limits are enforced.
In open category races you'll be racing against Cat A riders and they're going win because they have more power than you.
So if you race in Zwift and you're not Cat A, you either have to be the heaviest in your race or accept that you won't get on a podium. Ever.
I think you're missing my point. I mean even if you move to a different classification method, you'll still end up with the same problem. Even if you move to some vague skill-based or prior-results-based classification instead of a power metric or weight class or whatever, any amateur subclassification is still going to have almost everyone get crushed by the people who are just sandbagging or blowing through the lower classification on their way up.
---
So what I mean is
Yes what you state is a problem. But I posit that even if you fix that problem, you'll still end up with basically the same underlying problem anyways.
(I race on a Zwift Racing League team, completed my 335th race yesterday, and have spent about 500 hours on the platform so far.)
The reality for Zwift is that less than 10% of their user base races and they don't really care about preventing cheating unless it's already in line with their product development plan. I don't think this is why they lost the eRacing WC sponsorship for next year (to oil-funded MyWhoosh), but I'm hoping it will encourage them to take this kind of thing more seriously. Highly doubtful, though, and anyone who trolls their forums already knows the animosity Zwift faces from many (most?) racers re: their refusal to fix stupid bugs.
It's very difficult to build a platform capable of fighting intentional fraud, especially when you have limited control of what your users are doing. It's completely hopeless if that fraud has limited impact on your business. Users with limited moderation/review tools trying to fight fraud are fighting a losing battle.
A while ago I noticed that all my Peloton PRs happened on the bike at my in-laws gym, not on my own bike. Clearly there is a calibration difference between the two that majorly advantages the in-gym one. And obviously every rider's bike is different so that person ahead of you on the leader board might be putting out less output than you are. But who cares?
I was repairing my Peloton the other day and getting inside made it really obvious how else you can manipulate it if you really cared to. And maybe some people do but again, who cares?
The two numbers that matter are; your weight and perhaps the comparison on output between yourself today and yourself some time ago. Anything where you attach significance to comparison between your number and someone else's, you are in trouble. Somehow the culture on Peloton is such that people don't get into that. Maybe because social interaction is blissfully limited to high fives and following someone's class history.
This system of competitive e sports on temperable equipment was sort of latent with disappointment from the start.
It's quite easy to cheat in Zwift as you can put any weight on your profile (and the metric for measuring speed is generally W/kg). As well as different trainers have different power measurement accuracy, etc
But to some degree Zwift and other 3rd party Zwift race-tracking platform find the cheaters based on outliers and other factors and remove them from the list
All he did is figure out a way to cheat which should be simple to detect by the platform itself (changing weight mid-ride -> ie make yourself lighter uphill and heavier downhill) and demonstrated it. And he got banned for it
The way I see it, it's the same as someone demonstrating an LLM prompt injection or a cheat in a video game. A geek hacking a thing they like and showcasing it
To be fair, though, 1) this makes a lot of sense for team racing series, and 2) it's a really crappy experience to be at the bottom of a category and get dropped within 2 minutes of the start of every race.
I'm 100% convinced the vast majority of people either outright cheating or gaming the system are Cat C riders trying to avoid getting upleveled to B.
I’m sure many others are in similar situations.
https://www.strava.com/heatmap#9.83/114.11252/22.26615/hot/r...
I said I wouldn't survive.
The classic Peloton is basically a mechanical device with sensors attached - and none of those sensors are a power meter. The power estimates are widely reported to be inaccurate (they exaggerate output to varying degrees). On the other hand, the Kickr precisely modulates resistance and is able to accurately estimate power. I believe the newer Peloton Bike+ has a better system that produces accurate power readings as well.
Of course, as long as the competitors are bringing their own hardware, there will be ways to fake the data. I’m just pointing out it’s possible to measure power accurately and hardware that does it is widely available.
Personally, I find power readings to be useful because they help me understand the effort of cycling in different conditions. I can compare the readings I get in my garage to those from the climb up a steep mountain road, or into a gust of wind. Measuring my training based on my power output has helped me to go have experiences that I couldn’t have before.
That's because Peloton's hardware is ...to put it nicely... "somewhat economical". :P
Peloton's never been intended as a serious sports science tool though, so it really doesn't matter how inaccurate it is. Its experience is much closer to gym spinning classes than outdoor cycling.
A spinning bike is even cheaper in design, it'll just have a "make it harder or easier" screw to tighten a strap round a spinning drum. That's the level they're competing with.
Despite the name you're unlikely to see anyone in the professional peloton warming up for a Grand Tour on either a spinning bike or something from Peloton Inc's current range.
A high end smart trainer like the Tacx Neo family will use electromagnets to generate its resistance. 100 watts of resistance is 100 watts of electrical power to about 0.5%-1%. No calibration necessary because it's connected to a source of electrical power[1].
-
1. You can actually use a Neo without connecting it to the mains but it's less accurate and you don't get some of features like downhill simulation.
Meanwhile a good trainer has a power meter reading actual torque in real time and giving a power accuracy around +/-1% or better. There's really no comparison.
For example, my FTP is 342 watts as tested on my Stages SB20. It's slightly higher outdoors. A buddy got a Peloton and asked me what my FTP was because he knew I rode a lot and was surprised that his was soooo good because the Peloton returned him an FTP of 280. I was suspicious so I asked if I could give it a go. My FTP on the Peloton was 560 watts. I'd best doped up peak Lance Armstrong.
They are still expensive, so obviously they're not going to put anything decent in a Peloton.
People would post times for "events" they did like "bike from Boulder to longs peak, run up the trail to 13k feet, climb the diamond to the summit then run down then bike home."
Stranger was posting fake results then using sock puppet accounts to verify ("I met him with climbing gear at the end of the run, amazing effort!") He got caught because he posted a result on a rarely run trail that the employee had run, out and back, at the same time and not seen anyone.
Forum was tiny, free to join, no prize money or sponsorship etc. Some people are just crazy.
For Zwift, there are cash prizes for high end racing and even slots on pro teams on the line at times. Zwift also ran the UCI world championship for indoor cycling. So there's more pressure on some to cheat than you might expect.
('Startup News' was the title before it changed to 'Hacker News'.)
See eg http://www.paulgraham.com/growth.html and https://www.ycombinator.com/library/En-what-is-a-startup
If anything improved productivity and efficiency is going save the planet from the current status quo.
Better productivity comes about through competition in carefully regulated markets[1].
For example, Shoichiro Toyoda deciding to compete with incumbent car companies by using resources and energy more efficiently.
Calling those that want to compete to find a better way to do things "generally sick in the head" isn't really helpful.
-
1. Regulated farming for example doesn't use DDT any more even though it's cheap and good at killing pests. It's far too damaging and poisonousness tso we force farmers to find alternatives.
I use Zwift normally, but only as a means to drive my smart trainer in structured workouts. Early in the pandemic, though, my cycling pals and I DID do some virtual racing and group riding, which was a nice enough distraction from cabin fever -- run Zwift on one iPad, and run a Zoom call with your pals on the other.
Anyway: actual world-tour pro Lawson Craddock is a friend of a friend, and he'd sometimes ride "with" us, though when racing he was obviously not in the same grouping as the rest of us.
In fact, he got dinged for power output, and provisionally DQ'd from Zwift racing, because his numbers were too high. Apparently, if you're ACTUALLY a pro and produce ACTUAL pro numbers, there's an additional verification procedure you have to go through. He posted the screenshot on Instagram; it said something like "Somethings wrong -- unless you're a pro!"
well, except that it made you more fit. Didn't it?
Cheating? In cycling?? Say it ain't so!
That had to be written ironically.
I did one with a fairly large starting group that broke apart on the first hill, and formed into smaller groups that worked together and in some cases merged back together on the flats, then split up again on the last hill.
If you squint a bit, it felt like an actual bike ride with other people outside. Which is pretty cool for something controlled by a phone on a stationary bike in your garage.
I mean the sheer violence of the accelerations after a slow corner, railing the corners at full speed in an exilarating way, being thrown in the gutters in crosswind fighting to stay on the wheel in front like your life depend on it, dropping other riders in a downhill section through faster speed in the corners, etc.
It is safer! People die from time to time on group pelton road rides.
Otherwise, racing virtually is much simpler than racing IRL, but it's also just different (there is essentially no freewheeling in Zwift, so even on a race that isn't very challenging you still usually end up in z2-3 on flat sections). I'm thankful there isn't sheer violence in online racing. :D
For me, this alone always made Zwift racing a really hard sell. Bike racing is already hard enough without having to grapple with doubts that the people ahead of you reported their weight correctly.
Some things are reasonably easy: don’t allow settings changes after a race starts. Why they don’t do this is beyond me.
That said, weight doping seems to be a big enough concern that esports organisers mandate athletes compete in a set arena and weigh in beforehand and use their calibrated trainers. I’m not sure how you solve that for people at home.
You don't. And it is valid for most "e-sports".
But I don't understand Zwift anyway. A big part of the joy of cycling is about being outside, feeling the wind, handling your bike. The actual physical exercise is important but it is not the whole thing. I understand pro racers using turbo trainers when the weather is so crappy so that they can do specific structured training necessary for their job. But amateurs??? If the weather is too crappy (which only really happen in freezing temps or storms), just do another sport or focus on another hobby while waiting for the weather to be better.
Note: I am saying that as a former elite racer.
This seems unnecessarily narrow-minded. There are lots of hobbies and pastimes out there that lots of other people don't enjoy or understand; why the need to gate-keep, to judge? Maybe consider Zwift racing as competing on a computer game (think Fifa, or Fortnite, or Counter Strike) with the added bonus of exercise thrown in.
It's also worth noting that the world of cycling is quite threatening when you're a relatively unfit amateur; even joining a local group ride can be scary, given the uncertainty of relative fitness and speeds. Attending a race is likely even more forboding, and it should be obvious that joining an anonymous online race would be magnitudes easier - logistically and psychologically.
You get dropped. So what? You just finish alone and happy no?
Besides there are many rides with no drop rule (sometimes until the last 10km or so) or with regular regrouping.
> Attending a race is likely even more forboding
Usually you would join the local club where people would prepare you for it and possibly introduce you to the etiquette. Usually you need a federation license for racing anyway, and you need to be member of an affiliated club for that. I doubt Zwift, or any other esport, has no etiquette anyway. I heard people are called noobs in fps and esports for stupid reasons.[1]
[1] like using default skin character in fortnite or things like that.
You feel shit. You feel useless. You feel a drag on the group. You give up on the idea of riding with an unknown group until you've gained more fitness riding on your own.
> Besides there are many rides with no drop rule (sometimes until the last 10km or so) or with regular regrouping.
There are many that aren't; and even if they are, believe me it sucks to be the one that's always having to be waited for.
--
Take some well-meaning feedback from an anonymous person on the internet: you are seriously lacking empathy on this subject.
Clubs or bike stores will often have A/B/C road rides for different ability levels. Usually only the A ride is a drop ride, while the B and C rides have designated regroup points.
Attitudes like this are what stop many new riders from joining cycling clubs, myself included.
I am struggling to figure out the difference.
That depends a lot on where you live, a road bike and snow is not a good combination. For me it is a joy for about 4 months a year, where 2 of the months is when my allergy is at it worst. So the rest of the year is training inside on a trainer
* Easier to do a session
* Weather is too bad (either today or the entire winter)
* Want to maintain some fitness through winter
* More convenient on that day (just finished work)
I don’t use Zwift for racing but then I live on the outskirts of a fairly remote city so it’s easy to get outside. I think I’d feel differently if I lived in Central London.
Then the usual happened, ran out of VC money. Zwift are knee deep in the viscous cycle of raise money, hire lots of people with that money because you are obliged to spend the money you raised, fail to out-earn your newly inflated costs, try raising more money.
Of course they need a story to tell investors, a story why this time it will all be different, and one time, after "running!" and before "our own hardware!", it was "racing", abandoning all careful avoidance of the cheating problem in a 125M hail Mary: "we'll introduce racing! TV licences and sponsoring will make all our troubles faint memories". (at the time there were independent racing clubs doing events on the platform thatvtolerated them at best, which must have helped selling this story a lot)
Running is still a non-starter four years after introduction (fully unlocked on a free tier, and most of the very few runners you see I the platform are probably triathletes who just use the virtual cycling platform for the treadmill as well because they already have an account) and the hardware division was closed before the first product (current offerings are badge-engineered third party). Racing is certainly not quite as successful as hoped and suffering from exactly the same chatting problems that made them carefully avoid racing at first, but compared to those other "funding round stories", it's looking not quite as bad. They are still hopelessly overspending, but it seems that by the time of "racing will solve all our problem", they were at least aware of the viscous cycle problem and burnt off most of the excess money that didn't go to compensate ongoing losses as ad spending, instead of hiring even more.
As the article points out they have trouble keeping cheaters out of bike races in the real world, they're going to have issues when everyone is at home in charge of their own equipment. I don't know why its seems like it a bike sport thing, maybe its the "bring your own equipment" aspect of it.
There is always someone better than you, usually with a rare genetic gift, and/or an obsessive desolate life that is not worthy of any admiration.
Just compare yourself to how you were yesterday. If it is a moral quest, then monotonic progress in wisdom is the objective. If it requires physical or mental agility, then adjust your PBs by age.
If you compete and you cheat, you are a double loser - physically and morally.
Competition with others is futile.
Competition with yourself is productive.
I love pith. The world needs more pith.
I had a paid Zwift subscription for a while but the game aspects of are boring and pointless. So now when I do indoor smart trainer workouts, I just use my bike computer to control it and watch a movie to keep myself entertained.
Are you sure you are on the right forum? :P For me it sounds like ~hacker news~ fun. Dig down into a deep hole and explore it. Find out all the technical ways to exploit something, try to find whys to fix it and blog about it.
I can understand why you might not enjoy it, but do you really not see the appeal for other people in it?
It is human behavior. Cheating is engrained in everyone's life. Mostly everyone try to cheat at life all the time. That coffee in the morning? Your cheating your way into life trying to be and feel more awake than you should. The nutritionnal supplements? cheating. The sleeping pills, antidepressant some people take. Cheating. The hormone therapy of aging mens. Cheating. The aesthetic chirurgy. Cheating. Mentionning stuff you were in fact barely involved in in your previous job in an interview. Cheating. Going past the speed limits while driving. Cheating. I could go on for hours with examples.
In fact just considering using a turbo trainer at home and connecting to zwift can be considered cheating.
Indeed, there are cases in every single sport out there (especially if practiced professionally), but cycling is probably the one with the biggest exposure on the topic (I would say the other big one is/was athletics).
The main reason it has the biggest exposure is because it is one of the sport that fights the most against it. The amount of testing and openness to this subject is just on another level to other sports compared to say soccer, rugby or tennis where there is so much money on the table that every possible scandal is shut down.
Is this true? Could not find any source for it.
Can someone elaborate?