Hacker News Reader

Comment by wccrawford | Hacker News Reader

#1 rule: Never trust the client. You're sending the client data that it doesn't need (the invisible characters.) Instead of having it tattle when the client can see things it shouldn't, you should just not let it have that information in the first place.

Because there's still a way to cheat: Packet sniffing. Sure, they won't get as much info as they used to, but because it doesn't interact with the client at all, they can't get caught. Then they just write an overlay for the client so they can visually see the invisible characters, and poof... They're undetectable again.

View on HN

It's impossible. The server doesn't send a name packet unless requested. If they request it through individual packets, the requested IP is still recorded, and can be matched (we log all login-in events with an IP) to an account.

If I were to lead a game now, I'd definitely have things designed differently. You're right - a programming fix would've been desirable, but was unfortunately not a possibility at the time :(

The point is for the cheater to not ask for the name. Even simpler than an overlay, if you figure out how cheater detection works, is to filter the outgoing name request packet.

Edit, looking at your other post: Can't the packet editor that's marking people visible send a fake name to the client?

No, because the client is not telling the server the player's name. The server already knows, and sends that info to the client. You can definitely not ask for a name, but that would be a moot point, because it wouldn't be very useful at all.

If you want to know who is there, you have to request the name packet.

It still seems quite useful to know someone is there, and where they are. There's a big difference between "invisible enemy" and "stranger with a mask".

The consequence of breaking Rule #1 is that the cheat will be so straightforward that it can be distributed by wizards to muggles and 50% or more of your players will be using it.

The "fix" has helped with PR: now the muggles are afraid to use it, so they don't feel so bad. But guaranteed the wizards are still using it.

This shenglong guy has zero credibility with anyone who has ever cracked a game. Judging by his inability to understand the programming issues, its entirely possible that his claims of "spies" are equally delusional and that Guild Masters are now telling him "No! No new cheat here!"

Reply on news.ycombinator.com