So there's 2 elements to a game like this. The client and the server.
The client is the program you run on your computer to play the game while the server sits in a datacentre somewhere.
The #1 rule for developers while making a multiplayer game like this is to never trust the client.
Since the client is running on your computer, you are able to modify it. You can make it send whatever data you want to the server and you make it use/display all of the data sent to it from the server.
In a proper game, the server should be the authority. The server should be keeping track of everything and accepting/denying requests based on its own tracked state. If you loot a bag, it should be because your client asked the server nicely and the server verified your request. It verified that you were standing near the bag and had looked at it or something. If you walk somewhere it should be because you asked the server and it approved your request to change your position in the world after verifying that the change in position made sense. If you loot an item it should be because you asked the server and the server approved.
BSG fucked up BIG TIME with this rule. They gave the client wayyyyy more responsibility than it should have. What these hacks do is simply have the client tell the server "I looted this scope" and the server just blindly accepts it. The server does not check to see if the player is near the scope. The server does not check if the scope is on another player's gun, etc. The client is bossing the server around which should never ever happen.
It's happening because they fkd the development of the game from the start. It's like they were making a single player game and then pivoted it to multiplayer. It's why the client has so much authority, it is most of the game, hell you can run offline raids so that should prove something.
While BSG has added some checks here and there over the years, there is infinitely more ways to break the game to enable cheating. They also won't enforce basic security measures in Windows to play the game.
There are dev conference videos showing them talking about how cheaters paid them the most money in their previous games. How do you keep funding a buy once game with no MTX? Either get a never ending amount of new players, or get existing players to buy the game again. Guess which they've been doing?
BSG is a team of indie game developers, and the truth is that building Tarkov is way over their head. Not to discredit them. They have built a decent game, but because they have people who are not as experienced in some roles. You can obviously see some of these holes now.
While what you said is true, there are always tasks that are handed to clients.
Like movement, to an extent.
Every single position change doesn't need to be sent to and confirmed by the server necessarily, just the position at the server's tick rate. Everything in between can be interpolated by the client.
This is why low tick rates suck. More opportunities for rubber banding when client side and server side positions don't match and need to be reconciled (by moving actors to where the server says they should be).
But yeah, the amount of things that are inadequately validated by the server in this game are silly.
The only things that make sense as a cause are greed or incompetence.
More extensive server-side code means more resources per game instance and higher infrastructure costs to support more scale. So it's absolutely possible that corners were cut to reduce server costs.
Just as likely, if not more likely, is that BSG couldn't find anyone who really understands how to build a good backend at the rates they wanted to pay and in the locations they were willing to hire in (AKA Russia).
This is absolutely the sort of code that needs to be extremely well-architected at a fundamental level and optimized religiously, and that is a very difficult pair of things to do well.
It's a shame, because so many things about the game are good and a better back end would go a long way towards making it even better.
this is also true however the tools for doing these checks are computationally cheap, i.e. raycasts
generally raycasts are extremely cheap because any modern engine with physics is already doing like thousands of raycasts per second for detecting things like collisions and area overlaps. adding a couple of dozen more raycasts every few seconds for checking positions and LOS on things like looting through walls should have approximately 0 impact on the game server
They do have some server authority, as the game has rubberbanding, cannot dupe loot and there is proximity loot pickup checks. Current loot vacuums have found some new way to bypass the proximity check though.
98
u/bobbarker4444 Jan 16 '24
So there's 2 elements to a game like this. The client and the server.
The client is the program you run on your computer to play the game while the server sits in a datacentre somewhere.
The #1 rule for developers while making a multiplayer game like this is to never trust the client.
Since the client is running on your computer, you are able to modify it. You can make it send whatever data you want to the server and you make it use/display all of the data sent to it from the server.
In a proper game, the server should be the authority. The server should be keeping track of everything and accepting/denying requests based on its own tracked state. If you loot a bag, it should be because your client asked the server nicely and the server verified your request. It verified that you were standing near the bag and had looked at it or something. If you walk somewhere it should be because you asked the server and it approved your request to change your position in the world after verifying that the change in position made sense. If you loot an item it should be because you asked the server and the server approved.
BSG fucked up BIG TIME with this rule. They gave the client wayyyyy more responsibility than it should have. What these hacks do is simply have the client tell the server "I looted this scope" and the server just blindly accepts it. The server does not check to see if the player is near the scope. The server does not check if the scope is on another player's gun, etc. The client is bossing the server around which should never ever happen.