Hacker News Reader

Comment by bob1029 | Hacker News Reader

I am not a fan of the signature-based techniques used by VAC, et. al.

I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) detection of debugging tools attached to totally unrelated processes on the same machine. Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. Ethical hacking and malicious hacking are indistinguishable from the perspective of this kind of machine-wide blind signature detection.

Statistical techniques can dramatically reduce false positives in cases like this. If someone at Valve had taken 10 seconds to review my stats during the detected interval, they should have been able to conclude I was not a threat to fair play.

View on HN

> Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what.

I think a no-brainer solution here, which I am surprised isn't used, is to just immediately kick the account when a well-known signature, such as CheatEngine, is detected. If the program isn't even attempting to get around VAC, there is no point in doing the whole "delayed ban" thing.

Or even banning at all. As you say, kick out of an abundance of caution. Any serious attempt at rule breaking is going to involve at least some basic obfuscation so if that's missing it's a strong indicator of a false positive.

That said, my snarky response is "I hope you learned your lesson about the need to restrict proprietary software to a container at all times".

>If someone at Valve had taken 10 seconds to review my stats

It seems super reasonable when it's a one-off thing for your own account. When you think about making it into policy and scaling it up to 1000s of interactions, it quickly becomes unreasonable.

>Statistical techniques can dramatically reduce false positives

For a period of time, anyways. Until the statistics get gamed by the cheaters (e.g. adjust accuracy of your auto-shoot from 100% to 85% or whatever).

Computation isn’t likely prohibitive when using the bedrock of predictive models, linear regression, especially w some optimization. Could also vary observation time so you only need a prediction once every ten minutes or whatever

The real issue is the cost of false positive detection of cheating is negligible since the vast majority of positives are probably true positives—it’s the cost of doing anti-cheat business (minimal)

But yes cheats would be modified to just below thresholds of detection

>Computation isn’t likely prohibitive when [...]

I think this might be in reply to my first comment about scaling? If so, I just want to clarify that I was thinking more along the lines of scaling the customer service/ban appeal side rather than infrastructure.

If, for example, every ban had a component of someone at Valve taking 10 seconds to review in-game stats at the time of the ban, and then making a determination of whether or not those stats seem reasonably non-cheater-ish (pretty hard policy question in itself), the process would slow to a crawl.

> adjust accuracy of your auto-shoot from 100% to 85% or whatever

Sure - looking at K/D, accuracy, etc., is an important factor in a statistical model.

Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player.

After a certain point, I don't think it matters if it is publicly known what your signals are. The amount of information becomes overwhelming in aggregate. You can impose the curse of dimensionality on the cheater.

>Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player.

I don't think these are the type of stats the parent was referring to when they said "If someone at Valve had taken 10 seconds to review my stats".

But sure, those are all examples of statistics to start logging, analyzing, and cross-referencing. (I would argue most of the statistics you listed are of little to no use in identifying false-positives (or good cheaters), but I understand the point you're making with those examples.)

It would maybe reduce the false positive rate by some amount at an increased monetary (and complexity) cost to themselves. I think it would be well past the point of diminishing returns though. Setting up all the infrastructure, policy, processes just to reduce false-positive rates by a few percent, maybe?

I think I'll stand by "that's unreasonable" and "cheaters will game the statistics".

You could just do a basic automated review of stats. If someone has a 50% win rate and a 20% accuracy, they're probably not cheating - what's even the point of cheating if you don't win more often than chance?

Cheating to help someone else/your other account.

I understand the sentiment but I can't bring myself to think valve is to blame or should be doing more. Getting a case of "Yes officer, I have an NO2 bottle in my trunk, but what it is plugged to is not actually the air intake for my car but something entirely unrelated, if you just take 2 hours to dig around and take it apart you'll also realize this"

Thats such a bad example. Ofc you can carry NO2 bottles plugged into something, if its not air intake of your car, and investigation should happen finding you not guilty.

… unless you plug it into your mouth

When you're accused of breaking the law, your accuser must prove you have broken the law. If they cannot, there are actions you can take to recoup your damages.

Valve can ban you for any or no reason with no means of recourse or refund.

Totally the same thing, yeah.

You're right that they're not the same thing. The government has a legal monopoly on the use of force. Valve sells games.

Actually, VAC handles Cheat Engine and the like very well. You won’t get banned for simply having them open, only for having them attached to the game, which I think is reasonable.

I used to use CheatEngine on single player games that I ran through Steam, and I don't recall Steam having a problem with that at the time. Not sure if it's changed, but it was pretty reasonable.

Never used it on Multiplayer games though.

VAC is only used in multiplayer games. (And even then, only in a limited number of games - https://steamdb.info/charts/?category=8)

signature detection can also make a false positive if running under Wine or in a VM (that's for example why you can't play League of Legends or Valorant with GeForce Now anymore since Riot revealed their new anti-cheat...)

> If someone at Valve had taken 10 second to …

Looking up some quick stats, Steam has 132 million monthly active users and 69 million people use Steam on a daily basis. Not all those games are using VAC, but just looking at CS2, it routinely has over a million players playing it.

Nobody is going to “take 10 second to review” anything with those numbers.

Reply on news.ycombinator.com