rollcat

I normally recommend Tailscale, and that's a great starting point, for games that do not support any of the neat tricks natively. The problem: it's more difficult to build a community around that. You're introducing a point of friction, and a lot of newcomers will bounce. It's difficult enough to guide a non-technical friend, and Tailscale is top among the absolute easiest solutions.

SSAC is already widely deployed for many games. I'm not a professional backend gamedev (just an enthusiast), so I don't know all the approaches / tricks, but here's off the top of my head:

> [...] see how good they are vs. everyone else [...]

It's called Elo or MMR. You match players with a similar rating. An unfair advantage in one area (e.g. aimbot, map hack) turns into a significant disadvantage in all of the other areas (strategy, team play, mechanics, situational awareness, decision making). In SC2 you can regularly see mid-high masters or low GMs play against map hackers and just destroy them. Match making simply works as intended.

As a cheater - aside from being a different (not more difficult, but different) kind of a challenger, how do you gain material advantage from this? Streaming the game? If you attract a community that cherishes cheaters? Well.

This is of course on top of normal AC.

> [...] how do you know if someone is cheating or just really good?

In versus - it will surface, as noted above. You will plateau, just like any other player. If you're "really good", you will become an outlier and get attention.

In a game like Warframe (PvE, you can farm goods that you can sell for in-game currency), the main limiting factor is your time. A very good loadout will shorten an exterminate mission from 4 to 3 minutes, and you can build a decent loadout within ~2 months of starting to play the game. To further shorten it to 2min, you need good mechanics, or - as noted - to cheat. That's assuming you run solo - but since this is a co-op game, there's often someone on your team who will clear the mission for you in 2min anyway. Choosing to cheat is your own risk.

I'd consider AC a core part of game design.

> Most cheaters are not blatantly cheating so it is hard to know for sure. Even something like aimbotting is almost always adjustable in cheat software to have varying levels of accuracy.

It depends on how high you want to go - you don't know where the radar is, and it only needs to spot you once. The problem space isn't just aimbotting, it's highly multidimensional. An arms race like any other, except your "enemy" (the host) has significantly more information.

You must combine client-side with server-side AC either way. A CS exploit will circulate the same way a regular aimbot will.

The main appeal of a console (for both consumers and developers) is that's it's a "stupid" and "fixed" device. Your game either runs well on it or it doesn't, but you can always count on this remaining consistent prior to shipping it.

If Steam Machine gains enough foothold, it will be treated like a console. It won't run the latest title in 4K@120, but the title will still run great on default settings.

The main problem with Linux as a platform, is that it isn't. Linux is a kernel, with a platform built on top of it. And that's the real issue: Gnome and KDE are separate platforms; but so are Ubuntu and Fedora; but so are Flatpak and Snap; etc. Depending on your application, you will have to support several combinations.

For gaming, Steam OS fixes that. You can't target "Linux", but you can target Steam on Linux.

Yep, look at Mac Studio.

Honestly I'd love to see the trashcan come back, perhaps an entirely new design but still paying homage.

I haven't checked in detail, but I would suppose SteamOS isn't far off from running on general-purpose PCs. Else, I've heard a lot of good things about Bazzite.

Personal experience. First: I'm not a gamer. I'm honestly bad at aiming with the mouse. (Even in my personal favourites, SC1/2, much more intensive on raw mechanics than AoE or BAR.)

I've first played Zelda BotW/TotK (which is very light on precise aiming), and I found the gyro both precise and intuitive. The game is nowhere near as fast-paced as a modern shooter, and the weakpoints are large enough to consistently crit. I enjoy the bow.

Then I've Switched to Warframe - a looter-shooter. NO auto-aim. My first attempts to aim with the thumbstick were painful and felt pointless. The default sensitivity was very low, which I imagine was supposed to help aiming, but it made many parkour moves near-impossible (the game heavily relies on both). You could always press a button to place the camera behind your back, but that was two-step, non-incremental, and wouldn't help turning up/down.

So I've cranked thumbstick sensitivity to the max - turning the camera whichever way was now easy; then committed 100% to the gyro for aiming. Honestly, I'm much more precise than I've ever been with the mouse. I can consistently land headshots (super important with incarnons), use bows / thrown / charged weapons, etc. My hit ratio is between 50-70% for most weapons.

I'd now be hesitant to aim with a mouse. Thumbstick - out. But that's just personal experience.

> Anti-cheats should run server-side [...].

This. It should actually be easier to catch offenders - you're leaning on hundreds of years of applied statistics, rather than racing versus sneakier exploits.

> [...] or better yet, servers should be community-operated.

I'm conflicted about this one. I've wanted to host a game server at home since 2003, but couldn't get a public, static IP. The landscape hasn't changed much, perhaps even for the worse: a Quake 3 dedicated server could be run from a mid-range laptop while playing the game; Minecraft and Factorio (both great games with fantastic communities), by that measure, have unreasonable hardware requirements.

So, you pay a host.

OTOH there's many ways for a studio to build and operate an ethical live service. Check out Warframe: it's 100% F2P, the main source of revenue is cosmetics, and it's easy for people to gift stuff (whales spill their pockets reinforcing community goodwill, rather than gambling).

It's best when a game offers both, e.g. Brood War. StarCraft II isn't "simply" dying; lack of LAN play actively hinders on-site, professional tournaments. And we can do nothing about it.

You can't make people just stop using a word. The best course of action is to reclaim it. Look at us, we're posting on Hacker News. With a sideloaded browser.

This exactly. Transferring ownership is a business transaction. Track that. If the new owner is trying to hide it, this is fraud, and should be dealt with in court.

> reputational damage

Whoa. You're a crime organization. The data may as well "leak" the same way it leaked out of your victim's "reputable" system.

Security is an arms race. Don't expect a leap; do your part to stay ahead.

Never pay the ransom.

The extortionist knows they cannot prove they destroyed the data, so they will eventually sell it anyway.

They will maybe hold off for a bit to prove their "reputation" or "legitimacy". Just don't pay.

Free firmware can have a security issue and root your device.

A working IOMMU will stop both free- and non-feee firmware from rooting your device.

These concepts are orthogonal.

Firmware is not OS.

Your machine is a distributed system. The firmware is what runs a specific node.

Yes they usually have DMA, shared busses, etc. That's an implementation detail.

This. I haven't seen or touched GRUB or BIOS in about a decade.

You can deploy /dev/null on any number of nodes, and expect exact consistency, high availability, and perfect partition tolerance with concurrent writes and reads bounded only by your hardware/kernel.

I understand this is supposed to be satire, but IMHO a well-executed joke should still be well-written and easy to follow. This "<statement> unless <condition>" is just terrible to read, and I can't even tell if FFI is necessary here, or a part of the joke. Funny not funny.

You can dismiss it as a triviality, but in CS it's always worth considering (what you assume to be) an "identity" value, and its edge cases. Does your DSP algorithm work with near-zero values as well as it does with "true" zero?

(hint: look up subnormal floats.)

AVFoundation is pretty cool. You can whip out a simple audio/video player in a couple dozen lines of code. It was one of my first macOS apps/prototypes.

> This simple feature bumps up the complexity of such a firewall by several orders of magnitude, which is why no similar runtime (like Deno) offers it.

My uneducated question, why not BPF? It's the actual original use case. Declare a filter rule (using any DSL you like), enforce it within the sandbox, move processing to the "real" firewall/kernel where applicable, etc.

Hard disagree.

Yes, it's easier to captivate attention by evoking primal instincts - avoid predator, find food, reproduce, etc. These stories stick around in your head, the memetic survivors. They are easier to feed off.

But "Happy" doesn't mean a perfect utopia. The entire "classic" Star Trek is set in a utopian future, yet with plenty of space for intrigue. Usually a commentary on a contemporary problem, with a "happy ending" that's supposed to show us the road to a better solution, rather than a bland "forever after".

Even "First Contact" (a zombie/survival horror) is spun around the theme of "this is the history/future that we're saving".

Bonus: <https://www.youtube.com/watch?v=Cq4QY0LGOiI>

> [...] they should have identified this, and either warn developers, or warn users.

Like I said, *this* is their warning.

> - Make those API calls a no-op if they come from an Electron app.

Long-term, this is a maintenance nightmare. These hacks can stick around for decades, because there's no backpressure on downstream to actually fix things. It's not about "team velocity", it's about keeping yourself sane.

> - Open a GitHub issue explaining those private APIs shouldn't be used.

> - Even better, open a PR fixing their use.

Apple has a history/culture of secrecy. Whenever they provide public source code, it's a dump thrown over the fence. There is most likely some team inside that actually cares, but they can't "just" open an issue. My guess is that this is their message.

> [...] is a rather shitty and user-hostile move, don't you think?

Yes, I agree, the general direction they've been taking has been increasingly user-hostile for a very long time; let alone the developer story.

But sometimes there's also a perfectly reasonable excuse, from both "technical" and "organizational" POV. That's just my take, a skunkworks effort to get Electron to fix their crap. I would do the same.

How else do you get the message across? Do not use the private APIs.

Electron is most likely using a whole ton more. Apple is sending a message. "Fix your crap or expect more."

I agree that we do need more decentralization, but for the decentralized infrastructure to scale, we need better building blocks. Internet is a much, much bigger place now. TOFU doesn't scale.

Wireguard (and certainly every VPN protocol worth your attention) runs on UDP. TCP-over-TCP is a disaster, no sane person does that.

And what's "lighter" than Wireguard? It's about as simple as it can get (certainly simpler than QUIC).

> [...] which means that OpenSSH could eventually pick it up too [...]

Remember OpenSSH = OpenBSD. They have an opinionated & conservative approach towards adopting certain technologies, especially if it involves a complex stack, like QUIC.

"It has to be simple to understand, otherwise someone will get confused into doing the wrong thing."

> Which is why I ended up writing my own mini-ansible which instead runs a remote command executor which can be used to run commands remotely without the session cost.

HMU on my email. I've been working on/with this since 2016, and I'd love to discuss: <https://github.com/rollcat/judo>

That is my main objection as well, but perhaps it's time to also revisit TOFU.

Remember when Github had to rotate its host keys? It was hitting the news far and wide, and likely broke pretty close to every single CI pipeline out there. There was little heads up because it's the friggin host key, you have to act now.

It's also pretty annoying when you have to deal with that in your own infra. Even if you have a pretty good network/service map, you'll probably have silent breakage somewhere.

I'm not saying CAs should be the future of SSH, but TOFU is certainly a problem at scale.