I urge those unfamiliar with our QnA stream to watch the first one, starting at the 1:12:38 mark. It goes over some of what I'll talk about.
To elaborate on this, and hopefully not give "too much" away of current plans, while satisfying the original concerns here & elsewhere about Momentum's Anticheat approach will be difficult, but I will try my best.
First and foremost: Momentum is not going to have Client-sided anticheat. In other words, Momentum will have Server-sided anticheat, and will heavily rely on it along with a multitude of other (server-sided) systems to determine run and player validity. This unfortunate rumor has been making its rounds in other communities for quite some time. While the current run submission does not have proper anticheat hooked up yet, it's coming, and will be battle tested before 1.0.0. We're not naive, and the first rule of all anticheat is to not trust the client. We will not be trusting the client.
All runs are going to require an internet connection to submit. Keep in mind our branding is that we don't require a multiplayer server connection to play. This is still 100% true. The data we will be collecting can be queued up for sending (within reasonable bounds), as the gameplay is not a multiplayer server simulating the gameplay and networking it back to you. The benefit of not requiring the player to be on a multiplayer server, however, is that if they do happen to drop internet, Momentum doesn't crash and kick them out of playing it. We just don't submit the time. Likewise, we will never be able to support submitting "offline runs" or runs where you lost a significant chunk of connectivity to our server.
Talked about in the QnA stream linked above, the overall system will have primarily 3 "pillars", each with varied subsections.
- Validation / "Barrier to Entry"
- Verification
- Punishment
Two things from Validation that I can talk about (and did in that stream) were that we're going to require:
- Players to have an unlimited Steam account, which entails spending at least ~$5 of their own money on anything on Steam to be able to even submit runs to the leaderboards. Those that have a limited account will be properly notified of that in various UI (upon boot, playing an official map, etc). This is considered the harsh "barrier to entry" where the game runs in a limited state (can only download maps and runs, no XP/rank/progress due to no submission) until you overcome that. As a free to play game, we have to do something like this, otherwise it'd just be pure chaos.
- Players will need to obtain a specific cosmetic level (actual level yet to be determined) to have submitted runs show up on the leaderboards. We will still keep track of the runs, just they'll have a "pending" status until that level is met, allowing us to do more analysis if need be. This is considered a softer barrier to entry, but if you're serious about Momentum, you'll hit this no problem.
This would probably be your "prep" you're concerned about. You'll need to grind a bit on your account before it matters -- hopefully further entrenching you in just one account you care about and not alts. But there's always going to be black market systems prepping accounts that we can look out for, as best as we can, but still. For people serious about the game, Validation will be absolutely no problem.
As for Verification, this is where you can't really get the details, sorry. This is where we analyze all the (GDPR-compliant) details and information about players and determine whether or not they cheated a run. All of the info we collect will be relevant to the game. "Prep" work here is: just play the game normally and you'll have no problems. 🙂
As for Punishment, can't give too many details of what we have planned but I can divulge a thought process behind it: you really have to think, really hard, about "why would someone want to cheat in Momentum?" Like, really consider what they'd get out of it, and what we could do to minimize the outcome of cheating. Something to keep in mind: TAS will be allowed and have its own leaderboard, which will significantly help in this thought process if you decide to take it.
And I heard that the guy Mev making a living out of bypassing was not satisfied with Momentum's anti-cheat.
Yeah, he left the team while the version was still 0.7.X something. Doesn't surprise me, but the direction he was assured on was dedicated multiplayer servers were the only way to properly do anticheat, and never stuck around to find out what we have in store now. Unfortunate, but it is what it is. It's a gamble we're both making on it. We also have SlidyBat on the team, who is also making a great amount of money off of Valve from RCE-related activity, and he thinks the direction we're going with the anticheat can work. ¯\(ツ)/¯
Are you taking this seriously enough?
Absolutely. As seriously as a bunch of volunteers working to create a great platform can. Keep in mind we also don't have the budget to bug bounty out thousands of dollars for exploits, we're a free to play game (as we have to be) which means it's as easy as meeting the Validation requirements to be able to cause problems, and there can be hundreds of cheaters and cheat developers vs the limited effort of the Momentum dev team. Anticheat is always a depressing uphill cat-and-mouse-style battle, and we will do everything we can, but in the end of the day, it's just a game. We will fight as long as we can, which in most cases will be until the cheaters are demotivated enough to try anymore, or until the dev team moves on from the platform. Either way, it's a real concern that we're taking extremely seriously, because it's a core part of our platform.
While conversation around anticheat is good, discussing inner working of it and speculating how the game will function 7+ months from now is pretty moot. I will be locking the thread, if there's more concern around what I described in my previous message we can reopen and discuss, otherwise, it's just "wait and see".
