Hacker News Reader

Comment by sgjohnson | Hacker News Reader

I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.

Same. I write cheats for CS2 for my own amusement and it's 100% detectable by replay analysis.

If I'm reacting to information that I shouldn't have at a rate much much greater than the general population, then I'm not psychic, I'm just cheating.

This is also true for aiming, spray control, etc. All current cs2 cheaters are producing a very large and detectable audit trail of very suspicious plays in game, even if they think they're being sneaky. The resolution of the data looks like keeping track of your location and where you're aiming about every 15ms.

Here's some recent research that's related: https://arxiv.org/html/2508.06348v1

I can hide from a kernel module, but I can't hide from my own data trail.

There's only really two paths:

* We do kernel anti-cheat in trusted execution environments, which is bad for all the reasons in the article. When I break through this, you'll get the full "having a cheater" experience in your game.

* We do AI/ML heuristic-based detection to the point where cheaters are forced to behave exactly like non-cheating teammates or risk detection, cheating maybe only 10-20% above their previously established skill patterns. When I break through this, you'll have a normal game and I'll be kind of bored and nobody will be having the "cheaters in my game" experience even though I'm actually cheating.

In either case, I'm still going to try and beat the system for fun. Because video games.

Valve has already discussed using ai? There's also some commercial alternatives. I haven't seen that it works well yet, so it doesn't seem easy to solve.

But it seems that will just push cheat devs to adjust their aimbot to become more human in behavior? For the average gamer the top 0.1% will look like cheaters anyway.

Heuristic detection is iffy IMO, because while this might look trivial now (=> before cheaters optimize for it) false positives could easily ruin the user experience after a few rounds of cat & mouse: Even if you manage to keep sensitivity high (detecting >90% of cheaters), if you have like single digit percentages of cheaters and false positives, a lot of your bans are innocent.

If you keep the heuristics "tolerant", on the other had, you end up perpetually chasing in a cat-and-mouse game, and a lot of cheaters go undetected inbetween detection upgrades.

I feel heuristic detection is a "metagame" that developers don't really want to engage in, because you basically can't really win and it's perpetual work/spending.

Even better way to think of false positives: If you judge 0.1% of players wrong, you just banned A LOT of innocent players.

Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.

On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.

I think this is the answer. You get a lot more false positives, but at least the players can do something about it and aren't at the mercy of devs who can stop support at any time and also are fighting a losing battle.

That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.

Why? I have a hard time imagining anyone would care more about the integrity of the game than the community. Private servers are an IP play, allowing companies to pull the plug completely when it is convenient for them.

Say you've got a game that's specifically designed for 5v5 play. In this game, things become imbalanced and overly chaotic when there's more than that many players, the main game mechanics start to fall apart.

So now let's say you only have private servers. A bunch of 10-seat servers, and each match takes ~30-40 minutes. How does this work in practice? You have servers with like 8 or 9 players sitting around waiting, hoping for someone to join. How long will they sit there waiting? We potentially have hundreds of these partially filled servers waiting for other players to join. Wouldn't it be nice if there was some system that would automatically send people towards your nearly full server? Some kind of...matchmaking system?

How do we ensure somewhat even levels of skill among those players? Some kind of system that tracked past performance against players of other skill levels and could help you find other players around your skill level? Some kind of service to help you find matches, like some kind of...matchmaking service?

Not all games need matchmaking services, I agree. A lot of games do benefit considerably from having matchmaking services.

You might not have noticed, but that's also where anti-cheats started. All 3rd party anti-cheats started on community servers because well you aren't getting them into official servers easily. And then game developers saw that and integrated it for the users. Quake 3 even had Punkbuster added at some point for example.

Plenty of modern community servers still do the same. Face-it servers for Counter-Strike 2 will have additional anticheat, not less. Modded Grand Theft Auto V servers, FiveM, built their own anticheat they call adhesive before RockStar ever added anticheat to the full game, and this prevents it from running on Linux to this day.

Yes. I'm an avid Dota 2 player. I used to play the remastered CoD MWs too, and had a Counter-Strike phase as well.

Cheaters using external tools in Dota are rare. Smurfs are a much bigger problem than scripters/maphackers.

In my experience, MW and CS aren't that bad. I see a cheater only about once in 20 games.

I also play online chess. No kernel level anticheat is going to help you there.

I would much rather the games have cheaters than give someone like Riot access to Ring 0.

Yes, but the problem is highly exaggerated and Counter Strike has multiple mechanisms for isolating or preventing cheaters, even outside of "traditional" anti-cheat tooling.

I play at moderately high elo in Counter Strike (Faceit Level 10, 25k Premier) in a lesser populated region and even Valve matchmaking is mostly fine. I have a multi-thousand dollar inventory, old Steam account and over 7,000 hours in Counter Strike, all of these things (likely) impact my trust factor.

Trust Factor doesn't detect cheaters, but it sure does expose me to way way less cheaters. It's pretty uncommon to see an obvious cheater in CS2, the number of closet cheaters likely increased. In CS:GO rage cheaters were more common, but they are (for the most part) detected a little bit better now.

Most of the worries that people focus on already apply to programs running in userspace.

Reply on news.ycombinator.com