Game Development

All these people explaining that server side anti cheat is "easier". Let me explain to you the real reason why games use client side anti cheat:

1. It used to be, gamers could self host servers. These servers, would almost always have an active moderator who would instantly ban any cheater. I've watched quite a few cheaters get instabanned on games like this.
2. But then, companies decided to deny gamers the control and ability to self host their own server which they could moderate. They decided to force everyone to play on one server — their server.
3. However, they quickly realized that they were unable, or unwilling to spend money on moderators to ensure a high quality experience.
4. Ergo — client side anti cheat. In addition to continuing their control over servers, now they also gain a degree of control over clients.

I've heard one rebuttal to this: Not all cheaters can be spotted by a human, sometimes they pretend to be a really good player.

To be blunt: I don't really care. I don't really understand why people care about that kind of cheater either. The point of kicking cheaters is to keep the game fun by not having everybody get crushed. But if the cheater is just like another good player, then they're just another good player to me.

I used to play this browser game, https://krunker.io/. It's a browser based FPS game, and due to being browser based it was really, really easy to write cheats. The devs gave up after like a month, and simply stopped updating the anti-cheat, opting for a different system instead — deputization. Players would become "krunker police", and while playing, if a cheater was reported, then they would anonymously, and silently watch, and then take action.

It worked pretty well, then krunker got bought by a mobile gaming company and the game lost a lot of members. But I think the original io browser game is still under full creative control by the devs though, it's just the discord, facebook, and mobile versions of the game that are enshittified.

Anyway, when I was playing a few months ago, I encountered a cheater in one of our lobbies. They were trolling, while advertising cheats. But there were like 5 good players in the lobby, it was a cracked lobby, and we stomped them. They couldn't even make it to top 4/8 people.

Imagine aimbotting, advertising those aimbots, and still getting stomped. We called them out on that, and they just left. And that moment was a shit ton of fun.

But anyway, in the comments, I see some of this same sentiment that companies parrot: That cheaters are inherently bad, and need to be stopped because cheating is bad. This frustrates me because cheaters are not the only entity which can make a game unfun, there are also other toxic elements which should be moderated, but are often not, because of the focus on cheaters.

Play with cheaters, or play without DRM/Kernel level anti-cheat, pick one

Like this snipped from one of the comments below.

But people do cheat with DRM/Kernel level anti-cheat? I can think of 3 ways to do it off the top of my head:

• Undetected virtual machine
• Physical device that uses DMA to modify memory
• Editing of device drivers that have DMA access

And I especially hate this particular dichotomy because, by assuming DRM/Kernel level anti-cheat is invincible, it creates a sort of "blindspot", where when someone does cheat, they may not get noticed because it's assumed they are unable to cheat in the game, which is not the case.

Server side anticheat needs to be tailer-made for every game; you need to have logic that understands how your game plays and what conditions mark a cheater.

With the kernel level client anticheat, you only need to verify one thing: that the user hasn't modified the game files. It's not 100% effective, but it's effective enough to keep script kiddies away.

Server side anti-cheat is vastly superior to client side anti-cheat in many ways. It completely negates most cheats in the first place. There are some problems with server side anti-cheat that prevent it from being a viable solution on its own:

1. The game needs to be programmed with Server Authentication in mind from the very beginning. Refactoring a game to move authentiation from client to server would take a lot of time. Client side anti-cheat is cheaper and easier to add later on to a game.

2. Not all cheats are detected. AimBot, XRay Vision, ESP, are the kinds of cheats that Server Authentication cannot reliably detect, because the server cannot possibly determine the difference between a really good player or a cheater in just a single game. Sometimes automated systems get it wrong.

3. Server Authentication feels bad for players with high ping and packet loss. IMO, this isnt a problem and players should play on low ping servers anyway, but programming the client to predict and do the math the server would do (and the server packets overwrite the client data when it receives the server data) makes the game feel more responsive. The issue is that this can lead to a rubberbanding effect when the result of the server is finally received by the client and they get teleported to a potentially different place or just die immediately because someone with lower ping got to them before the server packets did.

The proper solution is to use Server Authentication, Client Prediction, AND client side anti-cheat. This would eliminate nearly all cheating in the game. Of course, this removes a lot of functionality from the game client and players would see this as some form of invasive DRM.

Play with cheaters, or play without DRM/Kernel level anti-cheat, pick one. Because you unfortunately cannot have both.

Client side is cheaper. Vastly cheaper
Server side, it needs to essentially run the same game client for every single player to ensure that what the client is telling the server is actually possible, and to cull unnecessary detail.
Whereas transmitting everyone's position to everyone allows the client to do their own culling (or not, in the case of a hacked/cheat client).

Not at all, you should never trust the client as they can spoof. But you can't install malware or harvest data as effectively from the server, so shady companies generally don't try it that way.

Not so much difficult it's just not as effective. As the cheats are happening on the client side, they watch the client side.

The whole kernel level thing is so the anti cheat can run when windows starts while the cheat program runs when the user starts. This is a massively oversimplification though.