Not a game dev either but my guess would be the main reason is server performance/compute cost.
Any checks that are done on the client run on the users' hardware instead of the publisher having to pay for more/better servers and electricity.

I think the disconnect with most other types of developers stems from the respective goal hierarchies. In most fields of computing, correctness isn't just a high-value goal - it's a non-negotiable prerequisite. With online multiplayer games, one of your chief concerns is latency and it can make sense to trade some cheating for a decrease in lag. Especially if you have other ways of reducing cheating that don't cost you any server processing power.

Also, aren't many of the client side anti-cheat solutions reused in several games? If you're mainly checking that the player is running exactly the same client that you published, I imagine the development cost for anti-cheat is lower.

TLDR: Money. It's always money.

Aimbots and esp is client side only.

Hello game, yes, I am indeed actually on the other side of the wall, now inside the enemy's base.

Doesn't CS do it by using volunteers, showing clips to players waiting for matches or something where they can vote if the player was using cheats? I could be remembering wrong though, my CS knowledge comes entirely from watching klicksphilip :P

And genuine hackers and cybersecurity professionals have got way better things to do than cheat in Rust.

The cheaters are all obnoxious 12-year-olds who couldn't land a single hit without the cheats, that's why all the compilation videos of cheaters falling foul to fake cheat software are so funny. They'll spend 10 minutes trying to go through a doorway without it ever occurring to them that something must be wrong.

"Do not tangle with the type of people who decide to put Linux on their PlayStations. Trust me, you are wasting your time."

• Extra Credits host guy, like a decade ago.

Garry leaving some direct, unsanitized interface to Steam itself directly exposed via lua... which caused Steam/Valve themselves to step in and rewrite a part of all of Steam, because Garry is s fucking moron, and more or less allowed a virus/malware to propogate through Steam itself, independent of Garry's Mod...

That sounds entirely on Steam. The game is the client in this context, and Steam as the server shouldn't be trusting anything from the client.

sir, this is a wendy's

That's the neat part: you don't. If their idea of anti cheat means taking over my machine to scan everything that runs on it, it's a lost battle. Either find a way to do it server side based on behavioral heuristics, or don't bother.

Finally someone who seems to have some sense of how things actually work and if course they get down voted...

Sure I get why people don't like kernel anti cheat but they should at least understand the difficulties from not having it.

Depends on the game but largely enemies don’t need to appear in the client until they’re becoming visible to the player

Because the client has to know where the enemies are while still hiding it from the player.

Why? :3 If a player shouldn't be able to see someone, just don't send their location.

There's been an increase in games that don't give the client full knowledge of enemies. That data doesn't actually need to be sent to the client if you can do checks on the server to know if they're visible. Yeah, it needs to be simplified from a full raytraced solution from the camera, but it can be good enough that it isn't much of a issue, depending on the game.

IIRC, some game (it may be Counter Strike, but idk) only gives your client player data for the "room" you're in, and adjacent ones, or something like that. You can still see through walls near you, but you can't see people on the other side of the map.

Yes, there's always going to be a point where there's nothing more you can do and you just have to hope for the best, and mitigate what you can on the client. Still, the naive "the client has to know where the enemies are" isn't accurate. A well designed anti-cheat solution will try to come up with a solution for this. Sometimes it isn't possible, but often there's some amount of information that doesn't need to be sent to players that can be hidden.

I love how in every anticheat discussion someone who actually knows something about how games work get downvoted into oblivion.

Maybe I'm wrong but the server could read where the players are and what are they don't and see if they can do that without using cheats. Then you keep the statistics of every player and flag every time there's something strange. If too much flags raise, check the user. I don't see the need to do it in real time. Some games will be bad... but nothing stops the server from rescoring the game after checking if a cheater is detected. The server can even send an alert to the other players of that game and let them decide how to fix the end result of the game.

I don't think it's cognitive dissonance driving them, I think it's hatred of rootkit anti-cheat that bleeds into other client-side anti-cheat.

People aren't very good at separating different but related things, it seems.

Visibility check of what?

• The player and their shadow and all visible effects on the game world -> congratulations, now the server needs a GPU per player.
• The player's geometry? -> shadows pop into existence when the player's arm appears around the corner, and the server is still way more expensive than it would be
• A volume around the player? -> Still allows a significant advantage, still requires significantly more horsepower, and the client still can't do spatial audio

This amounts to making players use thin clients and putting all visual and audio rendering on the server if you want it to work and not suck. Will you be happy to save £1000 on your PC at the cost of having games cost £150 a pop? Thought not. Or did you think the "extra CPU cycles" were just free?

It's a very hard thing to check for though especially with how complex the world can be in games today. Even if it was feasible you don't know where a client will be in a few frames so you basically need to do a "what players can be seen from this general location" check. The higher movement speed the bigger of a volume is your possible viewpoint.

This is also ignoring all the things you need replicated even when you can't see the player such as footsteps or them shooting or interacting with something.

Exactly. There are two methods that bypass kernel-level anticheat fairly easily, and there isn't really any way around them.

You can run the game in a virtual machine, with cheats running at the hypervisor level. This level is more privileged than the virtual machine's kernel, and can thus read or modify the active program without detection.

The other way is to load the hack into the bootloader, so the cheat loads before the kernel and, again, can thus be in a more privileged permissions state.

The only effective solution is to detect cheating server side, or change the game engine so cheats don't work (like loading all models with no line of sight behind the player, so wall hacks and modified game models don't matter.

They probably gave up on preventing cheat entirely, and are just trying to reduce the amount of cheaters by making cheating as annoying as possible.

I do actually believe them when they say that cheating on Linux can be made significantly easier and more comfortable than on Windows. I think it's a real fundamental issue for Linux, multiplayer games with toxic playerbases can be unplayable due to users being able to do what they want. They would have to make systems to allow for playing in smaller human-moderated servers, or rely purely server-side solutions

Yeah I should've specified vanilla pvp servers. It's always been a KoS hellhole. If anything, recent changes have made pvp less punishing.

When I say they're gamestack, I'm talking about their client and their backend services and their associated middleware.

Moving a game that is mostly client authoritative to server authoritative is a hell of a lot of work and requires serious rewrites to both the client and the server.

It also requires a lot more compute to handle the back end.

When you go from calculating everything on the front end and just sending the data back to the back end to sending actual controls to the back end and doing simulations, you need to rewrite a significant portion of everything.

It's way cheaper and way faster just to write it in the client, and require the kernel/secured OS to police risky actions to the application.

The last couple of projects I looked at were probably 50% more man hours to make it server authoritative out of the box. Trying to come back and do it after the fact, It's much, much higher.