Live data from Hacker News

Counter-Strike Global Offsets: reliable remote code execution

secret.club

91–94 of 94 posts

Re: Counter-Strike Global Offsets: reliable remote code execution

#91
post #88

Earlier quoted context omitted.

TLDR, but I think ancestor was talking about games being permitted to execute arbitrary code, as opposed to privileged users being able to inject code into a game process…

> TLDR, It's not like I can make you read my entire post, but I find it irritating that you went our of your way to let me know that you didn't actually read my post, but still felt compelled to respond anyways. > but I think ancestor was talking about games being permitted to execute arbitrary code, as opposed to privileged users being able to inject code into a game process… I never said anything about privileged u…

Try writing less next time.

Re: Counter-Strike Global Offsets: reliable remote code execution

#92

Earlier quoted context omitted.

"include footage from the cheater, not prerendered but as client state" Don't you need that deeper system integration to achieve that in a way it can't be negated by the cheat?

You can record (clientside and server side) the inputs from multiple players and play them back deterministically; if the suspected cheater's ones don't line up with how the game played out for the majority of the server then that's a pretty clear smoking gun. I think it is ok to be judicious with timeouts, kicks and even bans, so long as you provide a reasonable, accessible and well-scaled dispute mechanism.

> You can record (clientside and server side) the inputs from multiple players and play them back deterministically;

That requires a deterministic simulation, and also trusting the clients inputs. Cheats that just send damage/kill messages are stopped by a server just checking "is it possible for X to do Y". Stuff like this is often explainable by unfortunate lag spikes on the "cheaters" side (and most instances of someone rotating 90 degrees and headshotting you in one shot are really just bad networking combined with an edge case in prediction code).

Meanwhile modern cheats are emulating input devices and living as kernel extensions. A game that looks at client inputs is doomed to fail.

> well-scaled dispute mechanism.

The primary issue with dispute mechanisms is social engineering. If you have a cheat forum of 300 people banned, and one figures out what to say to be unbanned, they share the results with others and everyone gets unbanned. A stream of 300 tickets in a game like Fortnite, particularly if they're done in multiple languages and spread across a few days would be unnoticed.

It's a tough problem. I'm not claiming kernel level anticheat is a _good_ thing but it seems to be better than any of the other options available right now.

Re: Counter-Strike Global Offsets: reliable remote code execution

#93
post #71

Earlier quoted context omitted.

+1 on ISO 8601, but MM/DD/YYYY does have a certain logic to it. The month essentially tells you what time of year it is. "Want to go on vacation in July 10th?" carries less mental overhead than "..on the 10th of July", unless it's currently July (ie, you just say "..on the 10th"). Because "in July" is more meaningful than "on the 10th of any random month".

Is it? Either we're asking to pick a date (in which case it's just "in July" or "mid July" or "in a couple of months"), or you're asking about a specific date which works for you, in which case both components are equally important. I could make similarly silly arguments in favour of dd/mm/yy - if you're writing it down on a paper list and dates aren't yet final, it's easier to cross out the first item as you'll have…

Preface: Obviously this is all nitpicking, for fun; you should use whichever system you like.

> Is it?

Yes, I'll stand by this one. Imagine it's January 1st, and I ask you to "pack for a camping trip some day in July this year" vs "…on the 10th of some month this year." While technically the latter narrows it to fewer days, the former is much more actionable because there's a lot less variability.

In my mind, it's similar to putting the main point up front when you're writing an email, and then clarifying, instead of giving all the context and working up to the request. The latter feels logical, like you're telling a story, but the former is so much easier to follow, because you don't have to re-interpret the context when you get to the punch line.

Here's a quick example: "I can't wait until you can come try it out. Such a smooth ride, tons of acceleration, and great handling. You're going to love riding my new tricycle." From a literary standpoint, it's a nice subversion of expectations, which makes it more likely to stick in your mind. But from a functional perspective — that is, communicate the ideas in an efficient, reliable, boring way — this would be much more effective, "I can't wait until you can come try out my new tricycle. Such a smooth ride, tons of acceleration, and great handling. You're going to love riding it!"

Back to dates. If you asked me, "Are you free on July 10th?" I would assume you mean the current year. When you ask, "Are you free on July 10th, 2025?" I do same thing, then hear the year and have to forget that and start over.

The real thing to optimize for is useful information up front. Can I start drawing conclusions as soon as you start giving information, or do I need to wait until the end? The programming equivalent is something like short-circuiting conditionals. I personally know I won't be able to take vacation in July this year, so I don't need to pay attention to the date once I've heard the month; but if the date came first, then I'd have to remember it in case the month turned out to be June, September, etc.

It's not a lot of overhead, and the date usually comes all at once in a row so it's not a very big difference either way, but I do think there's an objective difference.

> The real reason we find a system preferable is just familiarity

I grew up with mm/dd/yyyy. It's the most familiar/comfortable and, due to practice, the easiest for me to parse. I still think yyyy-mm-dd is better, for the same reasons as above (and because it's an international standard, and I like standards).

Re: Counter-Strike Global Offsets: reliable remote code execution

#94
post #66

meanwhile they spend billions with VR nobody wants, controllers nobody wants, linux OS nobody uses, smart tv integration nobody cares about, etc cs:go at this point is a cheater's game. because valve's server ain't reliable at all, some people choose to play on third party servers, and not surprisingly a lot of players had the third party client mining bitcoin on their computer [0]. much blame the service, but it's o…

The Valve Index and Half-Life: Alyx were huge accomplishments that did more for VR as a medium than anything before (and probably after) it. Also Valve's efforts towards making Linux a gaming platform were immensely successful. Proton is amazing and most people that use it agree. Valve is not investing their resources in stuff you care about, but they are not objectively wasting their time. They are not just building…

it's a matter of cost of opportunity, and risk management. maybe those efforts were great for "VR as a medium" or for Linux enthusiasts, but not for cs community, which was basal for Steam success
Post reply on HN