http://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/

Trust is a critical part of a multiplayer game community - trust in the developer, trust in the system, and trust in the other players. Cheats are a negative sum game, where a minority benefits less than the majority is harmed.

There are a bunch of different ways to attack a trust-based system including writing a bunch of code (hacks), or through social engineering (for example convincing people that the system isn't as trustworthy as they thought it was).

For a game like Counter-Strike, there will be thousands of cheats created, several hundred of which will be actively in use at any given time. There will be around ten to twenty groups trying to make money selling cheats.

We don't usually talk about VAC (our counter-hacking hacks), because it creates more opportunities for cheaters to attack the system (through writing code or social engineering).

This time is going to be an exception.

There are a number of kernel-level paid cheats that relate to this Reddit thread. Cheat developers have a problem in getting cheaters to actually pay them for all the obvious reasons, so they start creating DRM and anti-cheat code for their cheats. These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat.

VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result.

Cheat versus trust is an ongoing cat-and-mouse game. New cheats are created all the time, detected, banned, and tweaked. This specific VAC test for this specific round of cheats was effective for 13 days, which is fairly typical. It is now no longer active as the cheat providers have worked around it by manipulating the DNS cache of their customers' client machines.

Kernel-level cheats are expensive to create, and they are expensive to detect. Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain.

There is also a social engineering side to cheating, which is to attack people's trust in the system. If "Valve is evil - look they are tracking all of the websites you visit" is an idea that gets traction, then that is to the benefit of cheaters and cheat creators. VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky. For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.

Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy.

Q&A

1) Do we send your browsing history to Valve? No.

2) Do we care what porn sites you visit? Oh, dear god, no. My brain just melted.

3) Is Valve using its market success to go evil? I don't think so, but you have to make the call if we are trustworthy. We try really hard to earn and keep your trust.

11 years ago*

Comment has been collapsed.

Deleted

This comment was deleted 5 years ago.

11 years ago
Permalink

Comment has been collapsed.

Did you even bother reading the topic?

11 years ago
Permalink

Comment has been collapsed.

no one did, too much text

11 years ago
Permalink

Comment has been collapsed.

Gaben is a real person? :O

11 years ago
Permalink

Comment has been collapsed.

11 years ago
Permalink

Comment has been collapsed.

VAC is a good thing (in principle - I can't comment on effectiveness) for preventing cheaters from ruining normal games, but the (understandable) lack of details on it combined with its one-strike-you're-out nature and lack of reasonable support leave modders, offline or consensual closed environment cheaters, and in general, the curious, creative people that make the best part of gaming communities, worried about where the boundaries are. I guess that's considered a small price given the popularity of competitive multiplayer, but I can't help feeling that more could be done to reduce the fear of VAC without losing effectiveness against its intended targets.

Anyway, it's nice to see a message like that, even though it's not likely to become a regular feature. :) I think Valve are a little bit evil for completely unrelated reasons, but trustworthy enough.

11 years ago
Permalink

Comment has been collapsed.

Oh Valve is definitely no different than other giant corporations. And ironically, in some ways, even less accountable due to their private holdings.

But yeah, the message was encouraging, I guess.

11 years ago
Permalink

Comment has been collapsed.

That's just random mumbo-jumbo, and it's not true

11 years ago
Permalink

Comment has been collapsed.

Maybe.... try ... not VAC protected servers?
Maybe.... try ... Gary's mod, or some other game that was made to be modded?

Also what you don't take into account, that any particular detail they share about their VAC is an another door left open for the groups who create hacks. The fact that there is no "this is what we do, this is how we do it" communication is an important part of covering their tracks. Also -I think obviously- anticheat softwares are always one step behind the cheats, and all they can do is react, adapt, and make it harder, more time consuming, and more expensive for the undetectable hacks to be made. And when they are made/upgraded create new ways, new layers, filters, and active protection that can detect it.

Also if there is anyone who feel like that anti-cheat softwares, and developers are "breaking rules", and invading your privacy, or destroying your fun in the game: Just go ahead, and try games with no/useless anti-cheat ""protection"". I can tell you, that having shiettons of hackers is just one thing, but the community becomes so paranoid, agressive, hostile and sour that it will be even more toxic than the actual cheaters. I've seen this in way too many shooters, and it's just sad to think about that whole gaming communitys wither, because there are some whiny, angry and frustrated loosers, who are unable to coop with negative things, and they rather destroy a whole game than to accept the fact that they are garbage as players, as human beings.

11 years ago
Permalink

Comment has been collapsed.

Some games don't have the option for non-VAC servers, it's not always clear when VAC is or isn't in action, and limiting modding to games designed to be modded is a waste of a lot of potential. Besides - while I don't know much about it - according to the store page, gmod uses VAC too.

I'm not a fan of these kinds of multiplayer games in the first place, which is why VAC's positive functionality is of little importance to me, but I understand its importance overall. What I'd propose is a simple option in games where you can say to VAC 'I am just cheating with myself/friends - do not allow me to play in a VAC environment, and please don't ban me' :) That in itself would reduce a few of the worries. However, there would be the potential for a lot of mistaken bans if such cheats/mods were uninstalled wrongly (whether the fault of the creator or not), and there's no easy solution for that - a 'verify I'm not cheating' button sounds nice to me, but would just end up helping actual malicious cheaters.

While I have issues with it even for its intended purpose, VAC itself is not so much the problem for me - rather it's that through the lack of information, I feel that in some ways it actually encourages the kind of negativity that you talk about, not necessarily in the protected game's community, but in the Steam community as a whole. A VAC ban message on someone's profile doesn't tell you what kind of cheat they used, so people are being equally shamed, and I also think the lifetime account ban with no appeals - while understandable given Steam's lack of support in general - is overkill. I've played some games where cheating was common, very little was done about it, yet the communities were awesome, and sometimes I've cheated too in such games (in a fun, non-competitive way) and fortunately that was pre-Steam and VAC, but I would be very disappointed if people judged me, or someone who made a silly mistake with using some kind of game enhancer like SweetFX, equally with the prats using aimbots for a public competitive advantage.

11 years ago
Permalink

Comment has been collapsed.

Why would someone cheat in games like counter strike? What benefits does it give? Anyone explain?

11 years ago
Permalink

Comment has been collapsed.

It makes them feel like they have skill.

11 years ago
Permalink

Comment has been collapsed.

But deep inside they know they lie to themselves...monsters.

11 years ago
Permalink

Comment has been collapsed.

Screwing with people that take a video game really seriously is fun for some people.

11 years ago
Permalink

Comment has been collapsed.

I have a friend who liked to destroy servers with his cheats. We tried once 1v1 with cheats and it was fun :)

11 years ago
Permalink

Comment has been collapsed.

Same reason why trolls exist: to live under bridges

11 years ago
Permalink

Comment has been collapsed.

They get to laugh at the cost of ruining the game for others.

We are a sad race.

11 years ago
Permalink

Comment has been collapsed.

Let's look at this logically:

1.) Valve needs customers to make money.
2.) Therefore trust needs to be established between Valve and their customers.
3.) Recording customer browser history violates this trust.
4.) Valve gain high amounts of porn while putting their entire business at risk.

So. much. profit.
Gaben will be swimming in virtual boobies.

11 years ago
Permalink

Comment has been collapsed.

From what I've read, it's not recording your history. It's reading for specific connections, and if the connection is unrelated, like you having twenty tabs of porn open, it does not record or send the information. However, if it is related, it terminates any connection to it from your VAC game, and still does not record the connection.

EDIT: I think if anyone is thinking logically, it's me and OP, you obviously didn't fully read the post where he/she mentioned it records nothing.

11 years ago
Permalink

Comment has been collapsed.

My mistake. It was aimed at those who assumed Valve were up to no good.

11 years ago
Permalink

Comment has been collapsed.

number 2 is flawed, you'd be surprised the shenanigans sheeple will put up with/forget in a week

11 years ago
Permalink

Comment has been collapsed.

+1

11 years ago
Permalink

Comment has been collapsed.

If you're going to pay money to someone, you need to be able to trust them right? Rather than getting specific, I was being more general.

11 years ago
Permalink

Comment has been collapsed.

Based on 2 and 3 I assume you are not using any Google related product/service, right? :)

11 years ago
Permalink

Comment has been collapsed.

So, classic overreaction? GG interwebz

11 years ago
Permalink

Comment has been collapsed.

In GabeN we trust

11 years ago
Permalink

Comment has been collapsed.

Actually if you read the comments to Gabes post he clearly states it looks for specific phone home dns calls and not calls to your sites. He even stated you can look at cheat sites but it is the phone home call to a server to check if the user paid for the cheat that is triggered by VAC.

11 years ago
Permalink

Comment has been collapsed.

Closed 11 years ago by pressstart420.