| Author |
Thread Statistics | Show CCP posts - 0 post(s) |
Mara Rinn
Cosmic Industrial Complex
Cosmic Consortium
97
   |
Posted - 2011.09.29 04:54:00 -
[1] - Quote
Grey Stormshadow wrote:Would you be ready to run anti-botware to get botless eve? Would it work? Would it fail? Would it be the end of RMT or kill the economy? How do you think the game would change? Is there any alternative solution? What could go wrong? What would be awesome?
Software security 101:
Do not trust the client. This means that regardless of how careful you are with writing your software, do not expect it to work as you designed it when it runs on hardware that you do not have in your physical possession.
Software like Punkbuster only works as long as the potential offenders aren't smart enough to use a fake Punkbuster to send fake "client is clean" messages back to the server. Any encryption performed by software on the client means that by definition the encryption keys must be on the client, which means they can be copied and used to encrypt fake "client is clean" messages.
You cannot trust the client.
So certainly, all the innocent players will happily run your Punkbuster and put up with the errors that it introduces. In the meantime the bot users will install the fake Punkbuster which reports the "good" values, even though there are a dozen bots running on that computer.
If the problem of reliably detecting bots was really as easy as you believe it is, there would be no bots.
|
Mara Rinn
Cosmic Industrial Complex
Cosmic Consortium
97
|
Posted - 2011.09.29 04:57:00 -
[2] - Quote
luZk wrote:Can we at least agree it would be harder to bot than it is today right?
Sure. It would also be harder to play legitimately.
Any mechanism to "fight bots" that causes difficulty for legitimate players is not acceptable. If I'm trying to jump through a gate to escape pursuers, why should I be forced to respond to a CAPTCHA?
Then there's the issue of outsourcing CAPTCHA solving to Mechanical Turk or hordes of $1/week Chinese prisoners.
To which point, is there a game-ethics difference between running a bot versus having a dozen Chinese prisoners playing your character for you 23x7?
|
Mara Rinn
Cosmic Industrial Complex
Cosmic Consortium
98
|
Posted - 2011.09.29 12:58:00 -
[3] - Quote
TriadSte wrote:Only the people who use such things as RMT and bots would be against this.
Logical fallacy: "If you are not with us, you are against us!"
TriadSte wrote:The legit people would not mind any CCP software running to see out the bots.
Moral fallacy: "If you have nothing to hide, you have nothing to fear."
I do have things to hide from CCP, specifically my bank account details, my Tax File Number, pass phrases for various services I administer, various documents covered by secrecy agreements that CCP is not party to. I have secrets and having those secrets does not make me an evil person. While I might trust CCP to do the right thing by me, there is no guarantee that CCP won't get bought out by someone I don't trust (such as SOE), and there is no guarantee that their supervisor program won't get hacked.
TriadSte wrote:I mean all that's needed to catch bots is a software to track time between keypresses? If char 1-2-3 etc has the same time frame of warping to station for example, its a bot and they get auto banned.
The EVE client is "dumb". All those key presses are fed back to the server. A study on bots in Ragnarok Online found that messages sent from bots had very discrete periodicity while messages sent from human controlled clients had uniform periodicity between commands. That is to say, the timing analysis you are suggesting could easily be done server-side on EVE Online just as it was done for Ragnarok Online. There is no need for any software to be added to my computer to monitor my key presses.
In addition, there is no way for CCP to trust any software running on my computer. I could write my own software which pretends to be their supervisor program and simply feeds back to CCP whatever information they expect their supervisor program to send back if I was a "legitimate" player. |
Mara Rinn
Cosmic Industrial Complex
Cosmic Consortium
99
|
Posted - 2011.09.29 21:38:00 -
[4] - Quote
Mistress Motion wrote:TimeToNextKeyPress += 150 + rand(x);
I would imagine every bot maker is clever enough to randomize time between keystrokes, as it's really just that simple.
My argument was that there's no need to run software on the client to analyse the client's behaviour.
Thankyou for providing another argument demonstrating how hard it is to detect bots.
|
Mara Rinn
Cosmic Industrial Complex
Cosmic Consortium
99
|
Posted - 2011.09.29 21:52:00 -
[5] - Quote
Slade Trillgon wrote:GǪ I will say that I do not use my computer for anthing that I would not do or say in public GǪ
Slade Trillgon wrote:That is why I use a seperate computer for all of my 'sensitive stuff.'
Do you have sensitive stuff that you wouldn't show in public, or not? I think you're contradicting yourself here.
Bank account details, superannuation funds, silent numbers - there are plenty of things I wouldn't be letting any random stranger see. |
| |
|