5
\$\begingroup\$

Instead of maintaining a central server, many games allow players to build their own server, like Minecraft.

But if you give them the server-side program, how could you prevent them from cheating? I thought it's impossible, but Team Fortress 2 seems doing that. Usual TF2 servers are built by players. But Valve sells the items in TF2, so they must have a way to prevent server owner generating these items.

\$\endgroup\$
5
  • 5
    \$\begingroup\$ Have the server contact an authentication server whenever a player joins. \$\endgroup\$
    – House
    Mar 12, 2013 at 18:48
  • 5
    \$\begingroup\$ Cheating on TF2 servers is pretty easy for the admin. Only the valve servers prevent cheating by authenticating the game before allowing you to play. \$\endgroup\$
    – Benjamin Danger Johnson
    Mar 12, 2013 at 18:57
  • \$\begingroup\$ I still dont get it. For example, could I get some items on a dedicated server(with cheating), and use them on other servers? If so, how Valve sells these items to players? \$\endgroup\$
    – Lai Yu-Hsuan
    Mar 13, 2013 at 8:28
  • \$\begingroup\$ @Byte56 but once a dedicated server get authenticated, it can do anything it wants? \$\endgroup\$
    – Lai Yu-Hsuan
    Mar 13, 2013 at 8:31
  • 2
    \$\begingroup\$ It's probably going like this: You use an account for TF2, which is saved on the master server. Dedicated servers tell the master server 'player X has been playing on me for Y time', upon which the masterserver checks if that player is eligible for an item and if so, grants that item to the player and notifies the dedicated server. \$\endgroup\$
    – Exilyth
    Mar 13, 2013 at 21:45

3 Answers 3

Reset to default
6
\$\begingroup\$

I suppose you could have the server send a hash of it's executable to an authentication server, to ensure it hasn't been modified been modified, but that's about it.

I wouldn't worry too much about it, if you're going to let players have their own servers let them do whatever they want with the game, they purchased it. You can make it difficult to cheat, but you can't stop players from cheating. Your job is to make a fun game that people want to play. Focus on that first.

\$\endgroup\$
2
  • 3
    \$\begingroup\$ "Never screw the paying customers" - that's what many major game companies tend to forget these days. \$\endgroup\$
    – user1306322
    Mar 13, 2013 at 14:46
  • \$\begingroup\$ okay guy, I totally agree with your point. But in the case of TF2, people don't buy the game itself because it's free-to-play. The only way Valve can receive money is selling items. So I don't think they will screw the paying customers by prevent cheating. \$\endgroup\$
    – Lai Yu-Hsuan
    Mar 13, 2013 at 19:45
6
\$\begingroup\$

Can't be done.

Haven't you ever been in a 10mx10m TF2 server where you'd just wait for drops? Neither have I! ;)

You could implement some sanity-checks on your server, but then you'd have a central server.

Can you afford a central server for such checks?

\$\endgroup\$
1
  • \$\begingroup\$ Yes, but how is it possible? Can't a dedicated server just send a message to notify central server player X gets item Y? Or you mean they have to send a full-replay to central server? \$\endgroup\$
    – Lai Yu-Hsuan
    Mar 13, 2013 at 8:30
0
\$\begingroup\$

Unfortunately, there is no fool-proof method of preventing cheating in a set-up like this. I imagine Valve is able to enforce its game-economy through strict policing.

As such, there are ways to make fixing the damage--for example, you could limit what a server could give its players. If you had a some paid virtual item, a random server shouldn't be able to give the player the item; only the master server should be able to.

Another thing you can do is keep a log of what the servers tell the master server. This way, if you discover that a server has been sending "shady" commands (i.e. "Player X gained 1000000 XP"), you can instantly roll-back all commands that the server has sent to the master-server, instantly undoing everything that the server told the master server to do.

Sending the hash wouldn't work; if I were determined enough, I could always change the server code to send the appropriate hash.

You're never going to be able to trust the client. Once information gets on their computer, it's out there for good. The best thing you can do is develop accurate heuristics and deal harsh punishments.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .