Every now and again I read things on HN about the area that I work in that reminds me that HN despite being confident doesn't always know what it's talking about. If it's so easy, can you share a prototype of someone doing it? Surely, if you can solve the entire problem of anticheat in one HN post there must be some proof to back it up.
> Lag switching is only one kind of cheat that applies mainly to multiplayer FPS games, and as I said, it can be mitigated through statistical analysis
These methods are already in use with client side cheat detection. The thing about latency spikes is that there are many things that cause them. To use your example of checking when spikes appear near a kill in an FPs, presumably a kill is associated with a spike in traffic (multiple users shooting, extra movement, etc). So it's far more likely that you see spikes at the point of extra network traffic. Lag spikes wee also only one example.
> With server side heuristics, you are in a better position to understand how it works and document it so that others on your team understand it as well
You have control over all of these things with client side heuristics and cheat detection too don't forget.
> Running the game in a virtual machine? Banned. Running the client in WINE on Linux? Banned. Driver signature enforcement disabled? Flagged. User running AutoHotKey or WinDbg or Ghidra? Flagged. New Windows update that breaks some internal NT kernel ABI that my anti-cheat rootkit was relying on?
Firstly, the NT interface is probably the most stable of any software im aware of. I don't personally keep up with kernel breakages but my understanding of them is they're incredibly incredibly rare. They're also very well documented and published on a mostly expected cadence. If an anticheat isn't being kept up to date, it's ineffective, whether or not that's in relation to it's heuristics or its support for OS features. Secondly, there's a reason all of those things are suspicious. (And as an aside many games don't actually ban you for running them, they pop up and tell you to turn them off before killing the game . They _do_ ban if you bypass that check though).
> causing issues for legitimate players whose setup might deviate slightly from the norm.
Having ghidra or windgb running, or running via wine isn't "slightly" out of the norm, it's a statistical anomaly that would be flagged as "massive outlier" if heuristics were applied. Also, why is it ok for players whose software setup deviates from the norm, but not ok for players with outlying network setups?
> You can make it more difficult by issuing ban waves at fixed intervals, and slightly varying the thresholds by some small random amount each time.
So exactly the same methods in use right now?