| HN Mirror

To clarify I don't really mean "no client trust", I just mean less. There's a lot of ways to skin a cat when it comes to multiplayer architecture. (I realize you probably know this, but it's always worth repeating. I'm routinely surprised by what people manage to come up with.)

For something like a 2D fighting game it seems like they've landed on determinism + rollback most of the time. That basically only trusts inputs from any given client and nothing else is trusted. Totally possible for the server to "verify" a client's claims by running the replay if needed, though obviously that can be rather expensive. Either way, that eliminates a huge avenue of cheating; as long as the developers did it right, you're basically just left with cheating by botting and using macros.

For something like an FPS game life is hard. The client has to react "as if" there is no latency even though there is. If an arena "twitch" shooter (does... anybody still make these?) ever had a situation where the cross-hair lined up but it didn't count, that would basically break the game. Still, there are many more things that are typically client-controlled, and there should be ways to not give the client as much control without adding too much latency. Any situation where the client and the server or peers can both track something and the server or peers can verify the correctness of the state of the client after the fact, it's probably possible to make some improvements. Basically, make an effort to ensure as little of the information received from any given client is inherently "trusted".

I won't lie, the approach of using heuristics in an otherwise client-trusted environment is definitely "fraught with peril" to some degree; bad heuristics can be pretty damaging. Blizzard ran into a problem where they were accidentally banning Wine users at one point, and it took them a really long time to actually admit the bans were incorrect, and as far as I know they never bothered reversing any of them. Don't get me wrong, they can say "Wine is not supported" and call it a day, but even ignoring that you'll always have some false positives, due to bugs or even weirder issues like clients with bad DRAM.

FPS games are definitely in for a world of hurt though. It's one thing to combat rudimentary aim bots that read internal game data and move the mouse with exact precision, totally different ball game when you have vision models controlling HID mice and keyboards. A Raspberry Pi Pico and a second computer with a capture card isn't a non-zero expense... but, a lot of people already have these things lying around. No amount of not trusting the client can do anything for you with this. You would definitely have to get deeper into behavioral analysis.