1
\$\begingroup\$

I am developing a "city building" type of browser based flash/flex game. I was checking some of the implementation of existing one of the popular games in facebook using decompilers. I noticed they have implemented the loot algorithm the client side and sending the loot item to the server which I think is not cheat safe.

Knowing the fact that there are cheaters every where and it is easy to manipulate the messages and send the best loot always, is there any way we can counter this type of cheats?

I dont have a concrete solution designed for it yet but I am thinking to track the drops by maintaining the loot history.

So instead of mere updating the resources/inventory, I will implement a logic which will compare the loot with history to see if the player is receiving the rare drops excessively and flag the user or take a smart decision (which I don't have yet)

Or

Is it a good idea to implement the loot algorithm in the server side? Since this is "city building" kind of game, where it will not have extensive user actions like in typical RPG games which can trigger loot events.

\$\endgroup\$
4
  • 6
    \$\begingroup\$ We can't really tell you why other developers made the implementation decisions that they made in their games; we're not them. \$\endgroup\$
    – Trevor Powell
    Commented Feb 1, 2012 at 5:53
  • \$\begingroup\$ I meant, I wanted to know will they implement server-side checks. This surprised me that big developer has done it when I always keep reading "dont trust the client" \$\endgroup\$
    – Noob Game Developer
    Commented Feb 1, 2012 at 12:40
  • 2
    \$\begingroup\$ The business models for those games are a bit different than the usual. They don't lose much if a person who was never going to buy items cheats a bit. There is no direct item trading between them and their friends, so they aren't compromising game balance. If anything, seeing the advanced state of one friends stuff may cause another friend to actually pay money to reach that same level. \$\endgroup\$
    – Jesse Dorsey
    Commented Feb 1, 2012 at 15:38
  • \$\begingroup\$ @Noctrine : that last phrase is worth a 100+ ! \$\endgroup\$
    – Valmond
    Commented Feb 1, 2012 at 16:24

4 Answers 4

Reset to default
7
\$\begingroup\$

I am going to play the devil's advocate here: but you should really be doing this on the server - even with this method you still need to have logic on the server which is arguably more complicated.

One way to is calculate metrics based on what the user has done. For example (e.g. let's say we were writing Diablo 1):

  • In the last 10 minutes he has opened 2 chests and the maximum total gold worth from a chest at this level is 500g.
  • Let's add 10% for some leniency/error.
  • So he can't have gained more than 1100g.

Why did he gain 2000g worth of items? Clearly he is cheating. You could either decide on a suspend or a ban based on the percentage gain; or, you could find a curve that fits the users gold gain (before he cheated) and calculate how long it would have taken them to make that gold - and suspend the account until that time period lapses.

It becomes more involved though, some other questions your server needs to answer is:

  • How did he loot when his character isn't near something that is lootable, or hasn't been looted already?
  • Take into consideration any trading or alternate economic mechanism your game may have (e.g. loans, stock market, etc.)
  • Any net loss - e.g. selling a broken item.

It becomes really complicated and running the simulation on your server will most likely result in better performance under load.

\$\endgroup\$
2
  • \$\begingroup\$ Then I prefer to generate loot at server side and just check whether he picked the one he was suppose to. implementing the complex and smart algorithm is my worst case scenario implementation. Thanks for answer \$\endgroup\$
    – Noob Game Developer
    Commented Feb 1, 2012 at 12:34
  • 1
    \$\begingroup\$ And this is exactly why Diablo III will be online only. \$\endgroup\$
    – SpartanDonut
    Commented Feb 1, 2012 at 13:11
11
\$\begingroup\$

All multiplayer games that respect themselves takes all important decisions server side. All as in All. Never trust the client if there is something in an action that might give an advantage for the player.

World of Warcraft creates all loot, checks transactions etc server side but due to lag it lets the client control how the player moves (to check that out, just unplug the network when you are playing). They do of course check you don't move too fast for long times or teleport and so on.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ "dont trust the client" is what I was thinking every one do but I got surprise when I saw the game has client-side loot generation. \$\endgroup\$
    – Noob Game Developer
    Commented Feb 1, 2012 at 12:31
  • \$\begingroup\$ Noctrine actually has the explanation for that one: it is not a multiplayer game so cheating isn't so important. I know of no persistent multiplayer game (with players that is ;-) who have trusted the clients with important decisions and actually got away with it. I have heard a Lot of stories about those who tried and failed though (encrypting stuff, anti cheat schemes, pleading the community not to cheat and so on). \$\endgroup\$
    – Valmond
    Commented Feb 1, 2012 at 16:23
4
\$\begingroup\$

If there is a risk of cheating which gives a given client an advantage over other players, then that specific part of the gameplay should be implemented on the server.

It does not need to be a resource hog, though. If you are worried about server load, you could take a statistical approach: randomly verify eg. 5% of the loot operations on the server. If at any moment there is a mismatch, ban the client. As long as the client cannot predict which of its operations is being verified, it will need to play fair all the time.

\$\endgroup\$
6
  • 1
    \$\begingroup\$ Except that when you just check 5% of the data, 19 players out of 20 will be able to say give themselves 1.000.000$ once without getting caught ;-) \$\endgroup\$
    – Valmond
    Commented Feb 1, 2012 at 8:52
  • \$\begingroup\$ Not bad, cheaters are greedy anyway. \$\endgroup\$
    – Tili
    Commented Feb 1, 2012 at 9:47
  • \$\begingroup\$ yes, that's (a/b testing) was another idea. but I am not in favor of doing it any way. Thanks for the answer \$\endgroup\$
    – Noob Game Developer
    Commented Feb 1, 2012 at 12:36
  • 1
    \$\begingroup\$ @Valmond: but the question is, will they do it? Suppose you are given a d-20 die, and you get 1,000,000$ in all cases except if you roll a 13, in which case you get executed. 19 people out of 20 will end rich! Will you play that game? You just need to make the odds inacceptable for cheaters without much effort on your side. \$\endgroup\$
    – sam hocevar
    Commented Feb 1, 2012 at 12:53
  • \$\begingroup\$ @ Sam Hocevar : It was just an example to point out that your cheat-catch algorithm don't catch all types of cheating. Players must cheat Often to get caught. It is a good idea to catch players cheating often though :-) \$\endgroup\$
    – Valmond
    Commented Feb 2, 2012 at 10:26
0
\$\begingroup\$

The main reason it's implemented in client side is to take the load from the server and share it between clients. You might not notice how much load it is to check every thing server side for 10 or even 100 clients but think about 10,000 clients in average. In these cases even a milisecond faster code in server might save lots of cash!

Besides normal clients don't decompile games, so as long as there is no cheat program or other stuff like that, there will be too few cheaters and therefore companies can find them easily.

I've known some games which check thing server-side for example there is a game named runescape which almost does everything server-side. I remember once they were boasting about doing all pathfinding server side, and it resulted in much more smooth movement. before that one might set direction, move a little bit toward a direction and then move the other way due to delay in server response. I'm not sure but I think WoW use same system (for NPC and loots) as well.

\$\endgroup\$
8
  • \$\begingroup\$ do you know any one implemented server-side or its just me? or do you know any one implimenting aniti-cheats mechanism? (I have idea about desktop games but my question is about browser based games) \$\endgroup\$
    – Noob Game Developer
    Commented Feb 1, 2012 at 5:58
  • 1
    \$\begingroup\$ I know runescape. added details \$\endgroup\$
    – Ali1S232
    Commented Feb 1, 2012 at 8:10
  • 2
    \$\begingroup\$ It only takes one person to decompile the game, implement a modified version, a runtime patcher, or a protocol proxy, and then share it with the rest of the world. \$\endgroup\$
    – sam hocevar
    Commented Feb 1, 2012 at 8:49
  • 1
    \$\begingroup\$ @sam: if it's only one person doing this kind of work, you can easily create a patch for your game. finding modified versions and patching is the solution big companies usually pick. it's much cheaper than paying for servers with high loads! \$\endgroup\$
    – Ali1S232
    Commented Feb 1, 2012 at 11:07
  • 1
    \$\begingroup\$ I don't believe that to be true, for two reasons: 1) any remotely sane big company will implement critical gameplay on its server because cheaters can ruin a whole community, and 2) finding modified versions is absolutely impossible without implementing server-side checks anyway. \$\endgroup\$
    – sam hocevar
    Commented Feb 1, 2012 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .