Let's discuss: report / kick / ban system

[samolego]

RN I have an idea of each player having "sus value" which is decreasing automatically while playing (untill it hits 0, then it stays there). If player is detected for cheating, their "sus value" is increased accordingly to the detection - e.g. if detection throws almost no false positives, it is bumped much higher compared to detection which is known to throw FPs.

If sus value reaches certain level, player is logged, then kicked, and if value is really high, banned?

Example:
sus value:

• 0 - 100 = do nothing
• 100 - 200 = report
• 200 - 1000 = kick
• > 1000 = ban

How much should the value be decreased over time?

These are just ideas flowing through my head. If you have different opinions / suggestions, please post them below for further discussion.

[supsm]

It should probably slowly decrease over time. Maybe it would decrease slower for more sus players, or maybe the decrease in sus value should be reverted after they commit hacks again.. I also think there should be a way for server admins to monitor the sus value of each player.

[IMS212]

i would say only have it report silently to mods until it is 100% sure that the user is hacking, then perm ban where they would have to go through normal appeals. This might be a bit of a stretch but maybe somehow have some sort of recording in third person of what happened before the ban if that's even possible?

[samolego]

So you think a time-based records of hacks or sth. similar?

[supsm]

That would be useful. Maybe also a separate log just for hacking?

[samolego]

The /golf command now allows inspecting the suspicion value of the player(s). Cheat recording is still on todo list.

[beeeeep54]

You could make the player "rebound" back to where they were before they tried to use movement hacks.

[amnotbananaama]

It would be great if multiple detections for different types of cheats in a short period dramatically raise a player’s “sus value”.

Eg. If a player trips 4 flyhack detections in a 20 minute period, that could be the same false positive action repeated. But if a player trips an inventoryhack, a flyhack, a killaura, and a jesushack detection in a 20 minute period, that should be a serious red flag.

It’s extremely unlikely a player would have that many false positives across that many categories, in such a short period of time. And if they are false positives, we would want to know anyways to improve detection.

[beeeeep54]

I agree with amnotbananaama.

[supsm]

I agree as well.
There should probably also be a detection cooldown, as I wouldn't like to have my server console spammed when someone flies for just a few seconds (as an example). I've noticed that there are a lot of suspicion value increases while I was finding false positives.
I think the suspicion value should still increase, but maybe only by 20 per second or something like that. Also if a player is continuously using hacks, the suspicion value should not be in the server console. It might be better if there was something like supsm is probably using fly hack(s) for 10s, which would be cleaner than logging everything, but would still provide useful info to server admins.

[samolego]

Regarding

It would be great if multiple detections for different types of cheats in a short period dramatically raise a player’s “sus value”.

how often do you think the "list of cheats" should be popped?
To rephrase it, how much time should pass between clearing cheats from the list?

[El13B]

Probably should be a list that only depopulates one cheat at a time, say after 20min of being on the list the flag resets. Could also be a configurable value

[supsm]

I think 20 minutes is too long... maybe 2 or 5 minutes

Also why is this in issues and not discussions

[El13B]

really depends how much "sus value" you require. I think being able to change that value easily could be a very nice feature.

[samolego]

Humm, it might be really the best to put it in config ...

Also why is this in issues and not discussions

I don't think discussions existed when this was created :). I can migrate it though.

[samolego]

Please use #20 from now on.