How I Feel The VAC System Can Be Improved for TF2

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
Hello there. I've been playing TF2 for about 900 hours now and as such I have met my fair share of hackers. I'll be frank, they annoy me. I'm sure they annoy everyone. So one day I had a brainwave, and wrote it down, refined it, then posted it to the TF2 community who refined it a lot more, and gave feedback which changed a lot of ideas. So now here I am presenting this idea on how to improve the VAC System Version 2.1 to the community hoping it will get noticed. I posted this idea up here so that the community can refine and help point out problems in it I may have missed. Please give me constructive criticism in the comments, and I do hope that if this is indeed a good idea that Valve notices. This is also up on the Steam Community Discussions: http://steamcommunity.com/app/440/discussions/0/360670708795902096/?ctp=2
I appreciate this isn't related to TF2 Maps, but I'm trying to spread this to as many TF2 communities as possible, and frankly, TF2 Maps is a much nicer place than Steam. Be warned: a long article is ahead, and there's really no point in TL;DR for this.

The Problem

As we all know the Valve Anti-Cheat System is designed to ban these (hackers, cheaters, script-kiddies, whatever you want to call them) permanently. We also all know the most popular way to get these cheats is through LMAOBox. The VAC does a fairly good job of defeating these people but there will always be holes in it and the hackers take advantage of these. The problem is that the VAC is entirely computer run and its code determines who it catches. All LMAOBox (and other hacks) have to do is re-code and bam, uncatchable (mostly). VAC scripters then re-code as well, resulting in a VAC wave, but it’s an endless cycle. As for the people who have been banned, the system is very harsh and those who want to keep it up simply make new accounts.

My Suggestion

As well as being computer run, the VAC sytem should include more of a human touch. My suggestion is two-fold: volunteers and moderators. Private servers usually have their own administrators who patrol the servers and Valve servers get the VAC. What is needed is volunteer players to patrol all the servers and catch people out. I’m going to call these hypothetical people Junior Administrators. The vote system already exists and it enables kicking from a server but these volunteers should have power. Not the power to VAC ban people themselves, as in V1. Instead Junior Admins can flag a person who they believe as a hacker. This flag wouldn’t appear anywhere in normal gameplay, but other Junior Admins can see it and can keep an eye on that person. If they spot suspicious activity as well they can add another flag. If a certain amount of flags is reached, let’s go for 5, then the footage of their gameplay during the time they were flagged is sent to 3 random online moderators who can review it and determine if a ban is necessary. Every flag given by a Junior Admin is worth the same amount, and a Junior Admin cannot flag someone twice, they can flag someone again if their flag was cleared however. A moderator is not sent something if they’re offline, or the case may go nowhere. These moderators are experienced members of the community who Valve may want to hand pick. They would be chosen for various reasons, see recruitment section below. A decision is made based on the majority, i.e. 2 of them. This way if one is corrupt or makes a mistake, then an innocent person doesn’t get banned. I know the whole thing may seem an ambitious change but the sort of people I have in mind are people who are sick of the exploitation, who want to play the game. Also, this wouldn’t replace the current VAC System, just add to it. Plus, people should be given the chance to give reports to the Junior Admins. Unlike normal reports, these will go directly to a Junior Admin on the server. If there is no Junior Admin present, then it goes to an idle one. They can then take a look. Also, a moderator or private server admin does not have the powers of a Junior Admin and vice versa. Private server admins and moderators can be Junior Admins as well, but they have to go through the same recruitment system, see below, they don't get all the powers of the system just for occupying one role.
These Junior Admins will be undetectable because they would just be playing the game like normal, except they have authority. It’s not a job, they just do it when they’re playing.
What about people who make different accounts? Rather than banning the account itself something personal is needed to identify who they are. Thus if they make another account then the ban will still be present. This could be something like their e-mail, something where Valve is aware of its change.

Meet Your Match

Since V1 we entered the era of Meet Your Match, and everything changed. There’s a new casual, but personally I don’t see any need to change my idea to suit it, just perhaps Junior Admins can flag people after the round has ended. We also got competitive. Now I don’t play competitive, but I do see one need for change. In competitive griefing does affect the overall experience so it would be included as a reason to flag. It wouldn’t result in a ban, just a cooldown.

Recruitment

To be a Junior Admin they need to have at least over 400 hours of TF2, regardless of class. They also need to be told of the rules, responsibilities and punishments that come with being one. They also need to do a questionnaire which offers situational questions e.g. ‘Would you flag someone if…’ as well as questions to demonstrate their knowledge of what hacking is and what it isn’t. They also need to prove they're a real player, this is done with a required number of matches played of any game mode, win or lose, or something as simple as captcha. If they have flags attatched to them, or have something that indicates they're a troll e.g. number of votekicks for griefing/trolling (which would have to be added), they'd be turned down.
To be a moderator you’ve got to be more active: at least 750 hours, regardless of class. A good account age and clean history. They’ve also gotta run some practices to see if they can do it properly, of course you get better with experience but still. Ideally they would be 18+ but I'm still working on a way you can guarantee that, suggestions are appreciated. They also have to prove they're a real player, see above, and that they're not a troll, see above.

Regulation

Now for the internal regulation. You can’t expect people to be eternally loyal and perfect, not taking advantage of their power. It isn’t possible for them to ban people on their own, but I would prefer if people weren’t randomly flagged all over the place, it could get annoying.
  1. Abuse. If a Junior Admin is found to be abusing the system i.e. flagging everyone in a server for no reason, they could have their powers removed. I would suggest removal for 2-3 months, then 4-6, then permanent.
  2. Spam. People who spam reports at Junior Admins (i.e. giving lots of reports in a short space of time) will be given a cooldown on it. If a report is given twice for the same person in a short space of time, the second one will be ignored. After a while, if no Junior Admin comes, they can send another.
  3. Missed Opportunity. If a person who is cheating leaves before they get justice then a Junior Admin should be able to access a separate list from the normal player list, of people who have left in the past ten minutes.
  4. Inactivity. Not in-game but when Junior Admins do not play the game for a very long time, say 8 months. When this happens they will be removed as Junior Admins, nothing more. They will be able to come back later. This would be the same for moderators, except they would take longer to be removed, say, a year, because it takes more to be a moderator than a junior admin. Also, if a moderator is given a case and doesn’t respond to it in, say, a week, it will be given to someone else.
  5. Privileges. I personally don’t want people becoming Junior Admins simply because they want special privileges. The Junior Admins will be allowed authority to flag and patrol servers but nothing more. They will not be immune to kicking due to inactivity nor to domination etc. or even the system itself. They will still have to pay at the store and work for items. Merely authority.
  6. Conflict. What happens when there is a conflict of interest? I already mentioned private servers have their own admins so if a private server’s admin is hacking or one is around when there is a cheater then I hope to promote working together. Private server’s admins have the power to ban from their server, Junior Admins have what I have listed. If a private server’s admin wishes to ban someone from a server because of hacking then the Junior Admin can flag the player as well. If the Private Admin wishes to ban because of other reasons e.g. exploiting or griefing, then the Junior Admin will not partake. Private server admins are treated like any other player in the system. Also, see above, private server admins do not have the power of Junior Admins and vice versa, unless they apply for the role as well.
  7. Cheating. Junior Admins are also not immune to the system, and can be banned in just the same way as any other person. None are exempt from justice in the system.
  8. Not-Hacking: It’s important that Junior Admins don’t flag people for the wrong reasons. I’m specifically talking about things people download that give them aimbot and such. What shouldn’t be a ban reason is if someone is griefing (except competitive) or exploiting e.g. leaving map boundaries.

The Overwatch (CS:GO)

Now, in the previous thread, lots of people told me about how CS:GO has a very similar system: The Overwatch. Since then I did some research on The Overwatch, and I admit, my idea was similar, and this new idea is even more so. Still, I feel my idea my idea is a bit different and is more catered to TF2. For example The Overwatch deals with griefing as well, mine doesn’t, except in competitive. TF2 is more casual, griefing isn’t detrimental to your overall TF2 experience, except in competitive, where griefing would apply. Also, Overwatch’s moderators are chosen based on their competitive success and skill group. With my idea this isn’t necessary, you just have to have played a lot. Finally, in Overwatch, moderators can gain ‘Overwatch experience’ based on whether they are in the minority or majority on a decision, which means they can level up in it, giving them more influence and cases to oversee. This doesn’t exist in my idea, you’re equal to the other moderators. This prevents people losing influence if they make a mistake, and people getting too powerful.

Miscellaneous

While I’m here, I wanted to take the time to say a few other things. First I think VAC bans shouldn’t be instantly permanent. They should last a year and then those people should be given a second chance (What if they learned their lesson?). If they get caught again then it will be permanent. For anybody who thinks it’s lenient, it’s still permanent in the end. For anybody who thinks it’s harsh, it’s still better than before. Second, why can’t you do replays on official servers? It could be a way of submitting abuse or just because you want to, just a thought.

P.S. I will likely update this discussion based on community feedback so as I said: please give it. Also (I know this is asking a lot because this is, well, the internet (and you didn’t listen last time)) but could you please refrain from hate comments or arguments as I want to keep this thread positive and constructive.
P.P.S Although I have written this for TF2 I do suppose this idea (and Overwatch) may extend to other games outside of Valve. I haven't really thought about it but it is something to consider.

Thank you for your time.
 
Last edited:

Pocket

Half a Lambert is better than one.
aa
Nov 14, 2009
4,701
2,583
How many hacks are actually obvious to observers? My understanding is that the #1 hack is aimbotting, which is indistinguishable from a player who just has really good aim.
 

henke37

aa
Sep 23, 2011
2,075
515
Aimbots do not produce normal input. I am told that they have certain artifacts to their movement. For example, how many people can perfectly lock onto the head hitbox, for several seconds, while being airblasted? And then there is the issue of snapping. The aim teleporting to the target, fire, aim jumping back to exactly where it was before? And all in the span of less than four ticks? Totally bogus.

Then there is the typical aiming behavior of triggerbot users. Those scan instead of aim, letting the triggerbot detect when the crosshair happens to hit a target.
 

Vel0city

func_fish
aa
Dec 6, 2014
1,947
1,589
CS:GO has the Overwatch system, don't see why we can't have that. And VAC needs to be based on the hardware ID, not only Steam accounts. This way it's impossible to keep creating alt after alt after alt after alt since, well, your entire computer is flagged as "this was used to cheat, ban the bastard". Don't think you'll be buying new computer hardware over and over again just to cheat.
 

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
Personally I would say let anyone flag a suspected hacker but make the number of flags much higher and maybe make the junior admins flags count for more?

Maybe, but too many flags required can result in action taking longer to happen, I'll consider it. As for flags being worth more, I'm not sure what you mean.

Aimbots do not produce normal input. I am told that they have certain artifacts to their movement. For example, how many people can perfectly lock onto the head hitbox, for several seconds, while being airblasted? And then there is the issue of snapping. The aim teleporting to the target, fire, aim jumping back to exactly where it was before? And all in the span of less than four ticks? Totally bogus.

Then there is the typical aiming behavior of triggerbot users. Those scan instead of aim, letting the triggerbot detect when the crosshair happens to hit a target.

That's what I thought. People who've been playing TF2 for long enough can usually tell. Also, the rest of the server might be going on about how someone's a hacker, or likely they're spamming the chat with 'GET GOOD, GET LMAOBOX!'.

CS:GO has the Overwatch system, don't see why we can't have that. And VAC needs to be based on the hardware ID, not only Steam accounts. This way it's impossible to keep creating alt after alt after alt after alt since, well, your entire computer is flagged as "this was used to cheat, ban the bastard". Don't think you'll be buying new computer hardware over and over again just to cheat.

I have a whole section there on how my idea is different. TF2 is much more casual than CS:GO, so it wouldn't really fit, except maybe for competitive mode. Hardware ID's and interesting idea, but more than person may use the computer, and if only one of them's a cheater, then the innocent person is banned. I abandoned IP addresses for the same reason.
 

Yrr

An Actual Deer
aa
Sep 20, 2015
1,317
2,759
TF2 is much more casual than CS:GO, so it wouldn't really fit, except maybe for competitive mode.
csgo's overwatch system only applies to its competitive mode
 

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
csgo's overwatch system only applies to its competitive mode

Well then all the more reason why TF2 should have a different one, because TF2's competitive scene is smaller than CS:GO's, much smaller than the casual scene, and it's only recently been added to the main game, rather than community competitions.
 

UKCS-Alias

Mann vs Machine... or... Mapper vs Meta?
aa
Sep 8, 2008
1,264
817
There are a few factors that should trigger an instant ban which dont even require a client side detection. And when they are done on for example matchmaking would exclude the extremes an achievement server has. As if its realistic to see a heavy spin 5x per second having a 0% miss rate acros the map, or a sniper that spins constantly making headshots? Even 20 headshots each minute is very suspicious. 100 headshots in 5 minutes would be a dead giveaway.

Some patterns area very easy to detect as they are simply not performable the normal way. Yes, they do take some performance cost on that. But because cheaters cant manipulate the checks or avoid it by checksum changing they will have problems avoiding it. Especialy since these borders of triggering the ban are vague (as if you would know when valve would change the value between 120 headshots in 5 minutes to 100 in 4, and then 110 in 4, then 98 in 3 etc etc). Yes, they can build around that and reduce the effectiveness. But many times those hacks are already the cases which arent obvious and dont devestate servers. To wait for VAC to handle those is far more acceptable.

Its blatant hackers that require the instant ban.
 

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
Hmm, very interesting point. I hadn't even considered this. And what you've said makes sense: some things just aren't possible in a normal game e.g. 0% miss rate at long distance/erratic movement if you have a gun with a wide spread like a minigun or syringe gun, among other things. Of course if you don't implement it right, then highly skilled players are at risk, but if you do do it right then it would make stuff quicker. But I feel it could seriously strain performance on servers if you have the normal VAC System running as well as constantly checking every player's actions to see if it crosses suspicious margins. Also, if a hacker is doing something as obvious as getting 100 headshots in 5 minutes, then the people in the system I've devised would easily notice as well.

It's an idea, but I'm not gonna include it in mine, thanks for your input anyways. :)
 

Necrσ

aa
Nov 16, 2015
198
488
Maybe, but too many flags required can result in action taking longer to happen, I'll consider it. As for flags being worth more, I'm not sure what you mean.

Say you needed 50 flags on a player for them to be reviewed (idk if this is too high or low) then if any player flags them it will add 1 flag to the hacker, however if an admin flags a hacker it would then add 5 flags or something
 

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
Say you needed 50 flags on a player for them to be reviewed (idk if this is too high or low) then if any player flags them it will add 1 flag to the hacker, however if an admin flags a hacker it would then add 5 flags or something

I think 50 flags is quite a lot, especially considering what I say next. I disagree with allowing just any player to be able to flag people, because then it would be too easy to abuse the system, e.g. new players who can't tell the difference between luck/skill and genuine cheating just flag anyone. It's only Junior Admins, who've proven to be trustworthy and competent, that will get to flag people, and each one is worth the same amount, as some people's flags being worth more may cause people to have too much power. Because of this, you wouldn't need as many flags, as (depending on how many Junior Admins there are) Junior Admins may not always be present. For moderators or private server admins I think I'll not let them have the ability to flag people. They can if they are Junior Admins, but not otherwise. Thanks for your opinion :).
 

Nebula Dragon

L1: Registered
Jan 31, 2016
29
12
02-08-2016 - Version 2.2

Updated article to reflect community feedback:
  • Changed Recruitment section to include more rules to prevent trolls/bots from becoming Junior Admins or moderators.
  • Changed the My Suggestion section to detail overlapping power, or rather, the lack of it, as well as further detailing the rules of flagging.
  • Edited The Overwatch comparison paragraph and Regulation paragraph to reflect changes.
Continued feedback appreciated. I'm still being professional about this, 'cos I feel I gotta point out changes.