[TF2] Suggestions regarding the Bot Crisis

[TrickyTrix935]

Ever since the code leak of 2017 bots have been on the rise in TF2 and have only been getting worse with various workarounds to everything implemented against them, below I have listed a few possible things which could be used to stop or at least hinder the bots and their creators:

Matchmaking bans based on kick record in casual and competitive Currently the community is used to kicking any bots on sight, and has become accustomed to it. I propose using this to the games advantage and creating a matchmaking ban system. This could function like so, when a player is kicked [x] times within a [x] period, they receive a matchmaking ban from casual or competitive accordingly, this matchmaking ban is extended in duration based on how many times a player has received a matchmaking ban within a certain period from each other. To prevent accidental punishments, the kicks needed to trigger a matchmaking ban within a certain time period should be extremely high, and the matchmaking ban increase could reset after a certain amount of time has elapsed without the player receiving a matchmaking ban.

Disallow newly connected players from calling votes in casual and competitive Currently some of the bots are programmed to call votes on other players as they join the game, this is to trick others in the lobby into kicking someone else aside from the bot, as well as delay the voting process intended to be used on the bot itself. A simple solution to this would be to disallow newly connected players from calling votes for a certain amount of time, which could be implemented through a cvar if adjustment is needed for other modes and in community servers.

Restrict new steam accounts from casual and competitive play for a certain amount of time One of the main problems of the bot situation is derived from how easy it is for the creators to constantly create new steam accounts. If casual play was unavailable for new accounts for a certain amount of time it would make it more time consuming for bot creators to throw more bots or replacement bots into the game, combining this with the matchmaking bans suggestion would result in a much slower bot output.

While the community has become accustom to kicking bots on sight, the bots themselves still exist unhindered in large numbers within TF2s matchmaking system. While I'm unsure if these solutions would permanently stop these bots, it could potentially slow them down to a degree and reduce their effectiveness.

[voidplayer]

what are you talking about

I was agreeing with you

[JoriKos]

I was agreeing with you

You should probably word it a bit more carefully in the future, as you just quote replied to Jane's post which makes it seem like you're calling them someone who doesn't understand computers.

[voidplayer]

I was agreeing with you

You should probably word it a bit more carefully in the future, as you just quote replied to Jane's post which makes it seem like you're calling them someone who doesn't understand computers.

Yeah, sorry. Fixed it!

[motherofdragons96]

Quick question, because I have realized something that Valve should know about when there’s no bots during the 64 bit update. Remember the 64-bit update cleared out the bots earlier? I am curious; Do Valve released an update on Windows first, then on Linux? I was kind of curious to see if there’s no bots during the first Summer update of 2024.I was kind a hoping they did like last time during the 64 bit update.Sent from my iPhone

[GPGMGE]

Replying to #3477 (comment)

my personal solution would be to revert the game to the pre meet your match quickplay system. this would spread bots out among several community servers where they can be easily delt with by thier moderators, it would also breath new life into the community.

centralized matchmaking will always be vulnerable to this issue

I like this idea.

[JoriKos]

I like this idea.

Quickplay had an option to only queue for Valve servers, if they can select maps in Casual they can select only Valve servers. Quickplay isn't the ideal system people make it out to be, and it won't solve the bot issues in the slightest.

[motherofdragons96]

News! For those you didn't know, Valve is removing Mac support for Tf2. Hopfully this ends the bot crisis soon.

[JoriKos]

News! For those you didn't know, Valve is removing Mac support for Tf2. Hopfully this ends the bot crisis soon.

This is an unproductive and false comment. TF2 hasn't worked on Mac for almost 5 years, this is them simply updating the store pages (of not just TF2, but the other Orange Box games too see HL2:E2 and Portal). These are 32-bit apps (with the exception of TF2, but only recently, so it still doesn't have support).

[motherofdragons96]

This was posted just recently on X. I'm not kidding.

[ethanholt1]

TF2 hasn't worked on Mac for almost 5 years

I've been playing TF2 on my Mojave computer for around three years (at least until they dropped Mac support entirely :[ .) I didn't have any issues and it ran quite nice for 2GB of VRAM.

[AnOpenSauceDev]

Valve removing support for TF2 on Mac will/has done almost nothing for the bot crisis. Realistically these bots are running in Windows/Linux Virtual Machines. This also doesn't inherently mean that Valve is working on an update for TF2.

[JoriKos]

Valve removing support for TF2 on Mac will/has done almost nothing for the bot crisis. Realistically these bots are running in Windows/Linux Virtual Machines. This also doesn't inherently mean that Valve is working on an update for TF2.

I have to mention, though, that the Mac version was used by cheat developers to make it easier to reverse engineer the game. Though this is not a response to FixTF2, it accidentally did actually help combat cheaters even if it's very very very very slightly.

[CookieCat45]

Valve removing support for TF2 on Mac will/has done almost nothing for the bot crisis. Realistically these bots are running in Windows/Linux Virtual Machines. This also doesn't inherently mean that Valve is working on an update for TF2.

I have to mention, though, that the Mac version was used by cheat developers to make it easier to reverse engineer the game. Though this is not a response to FixTF2, it accidentally did actually help combat cheaters even if it's very very very very slightly.

https://www.reddit.com/r/tf2/comments/yftoum/comment/iubakcn/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

This goes into more details about it. Reverse engineering without symbols is very hard.

[flip-dots]

Replying to https://github.com/ValveSoftware/Source-1-Games/issues/3477#issuecomment-2156347466

Band aid fixes

I'm not a game developer, but surely rendering and FPS requirements could be forced client side and then an off the shelf anti-tamper can be used to encrypt the game binary, making disabling of these checks difficult.

If bots are not rendering the game in the first place then things like increasing tick rates, entity limits, and network bandwidth in general will disproportionately decrease performance for bots while having a smaller impact on legitimate players, although graphical restrictions only make sense if the bot is forced to render the game in the first place.

These are just some band aid fixes I came up with in an afternoon, they aren't perfect, nor would all of them be effective, but the point of a band aid fix is to blunt the impact of the problem, not solve it, to solve it wouldn't be as hard as you would think, but would still take months of development, testing, and validation, which when the game is near unplayable as-is, is too long to wait.

[JoriKos]

I'm not a game developer, but surely rendering and FPS requirements could be forced client side and then an off the shelf anti-tamper can be used to encrypt the game binary, making disabling of these checks difficult.

People have already suggested disabling text mode, and those ideas have already been shutdown as ineffective. Not sure what "FPS requirement" would mean, though, as that just seems like a way to screw over people with bad PCs.

[flip-dots]

The solution to cheating in all video games*

Since band aid fixes don't seem to be very popular around here, this is what I suspect the best solution is.

The problem

The biggest problem with the prevalence of cheating in video games is not detection, systems like VAC are actually pretty good, but the problem is that a cheater or bot can simply create a new account and return to cheating.

The solution

Extend VAC to ban the hardware of the cheater, not just their account.

But How?

Every Intel and AMD CPU built in the last 5 years has an on-processor chip called a TPM which uniquely identifies the CPU of the computer and provides mechanisms to validate this. This could be used to allow VAC to ban specific CPUs.

What about spoofing?

How can the server know the TPM is not fake?

The TPM is cryptographically signed by the manufacturer, this allows for a game server to validate that the TPM is legitimate and not fake.

How can the server know the TPM identity provided to the server is that of the CPU playing the game?

It could be possible for an attacker to forward requests from the game server to validate its identity to some other TPM on some other system from the one the cheater is playing on.

The easy mitigation for this is to use the TPMs signing capability to make it sign data packets sent to the game server frequently, ideally all of them although depending on the bandwidth this may not be possible. The idea being that the more data that must be signed the less practical it is to forward requests to another CPU to sign them.

There's more…

This only covers a fraction of a TPMs capabilities, to be honest I don't entirely understand how the rest of the features work, but they include the ability to remotely attest that software has been unmodified and other neat things which would be very useful for someone developing an anti-cheat, and more or less every CPU since Intels 8th gen and AMDs 3000 series has one built right in.

It's free real estate.

If I were Valve I would strongly consider implementing this in TF2 as a case study to determine its effectiveness, and then consider expanding this to other games utilising VAC such as CS:GO. This technology is likely to become the future of security in computers, and anti-cheat is a perfect application for it.

*I'm not a game dev expert, I just like programming, cybersecurity, and solving problems, and TPMs look very promising for this application, but I might be wrong :P

[vinicentus]

I quite like the idea of verifying uniqueness and authenticity of hardware using TPM, and then banning that hardware. (Although I as well must admit I'm no expert in the field.)

I think this or then requiring users to strongly authenticate (with passport or similar level such as banking id) is the only way to make it hard and expensive enough for new accounts to be registered en masse when cheaters get banned due to their cheats being detected.

This blog post about Vanguard hints at it doing something similar with TPM and overall there are some good points in there. https://www.leagueoflegends.com/en-au/news/dev/dev-vanguard-x-lol/

Also the idea of signing challenges with the TPM is really interesting to me. You could maybe send more challenges to players suspected of cheating etc?

(I know I'm gonna get hate for sayin the V-word, and to be clear I'm not saying valve should implement a similar solution)

[JoriKos]

then requiring users to strongly authenticate (with passport or similar level such as banking id)

Don't ever suggest this stuff, it's a privacy nightmare.

[vinicentus]

then requiring users to strongly authenticate (with passport or similar level such as banking id)

Don't ever suggest this stuff, it's a privacy nightmare.

I agree that it's a privacy nightmare, but currently I see it as ONE OF the only ways of making it worthwhile to even ban bots in the long run. This would "make the treadmill much less steep" i.e. hopefully almost eliminate the work of detecting the same bots with new accounts).

But I think a good implementation of banning hardware could be much better.

Then of course the problem with humans cheating or humanlike players remains unsolved and that is a problem for detection.

[vinicentus]

It could be possible to verify that users are unique humans by strongly authenticating them and then throwing away/never getting access to the identifying information. Essentially just verifying that they have the ability to strongly authenticate. But you would still have to store a unique identifier, just not linked/easily linked to the user's real identity.

But this can be problematic for people that don't have that option.

I would not be surprised if there exist methods to do this. An example I can think of is using a hashing function. Or one could look into how patient data is anonymized in medical studies.

(Last comment for now I promise)

[AnOpenSauceDev]

TPM is a solution, but all it really means is that the bot devs just have to spend another ~$10AUD to get a fresh TPM module swapped out on their motherboard. Unfortunately these bot devs already do spend actual money so they can spam chat.

The reason why the FPS solution wont work is because: 1) A bot hoster's PC can easily run multiple instances of a game that is twice the age of the average Overwatch 2 player

2) Sudden dips in FPS are very likely to happen depending on what's going on (running an update, backgrounding a compile task and playing TF2 in the meanwhile)

3) A lot of players will be excluded due to them playing TF2 on much weaker hardware.

[JoriKos]

but currently I see it as ONE OF the only ways of making it worthwhile to even ban bots in the long run

I think I'd rather have bots

[wgetJane]

i'm quite curious to know how "minimum fps" is supposed to be enforced

[motherofdragons96]

I may have send this in the wrong hub, let me try that again.I may found another reason why we get so many bots. Maybe Casual do not have an anti-cheat at this moment.

[JoriKos]

Maybe Casual do not have an anti-cheat at this moment

It does, it's just not updated.

[UAVXP]

For some reason, Valve Matchmaking servers allow people with Game/VAC bans to join them. I think, Valve should begin with that issue first.

Just refuse those accounts from joining your official servers at the very least. We would appreciate that move

[motherofdragons96]

I have a another suggestion regarding the Bot Crisis, I know if sound weird, but we should do a temporary ban on bot hosting on Casual, because this bot crisis is getting too offensive, and with Summer update is coming soon, and we want Casual mode to be cleared with bots during the Summer event. Just a reminder this is just a temporary ban, and we don’t know when this ban lifted, but with this, we could do a temporary ban on bot hosting in Casual mode during seasonal events as well, so we can enjoy Casual mode without bots.Good idea?

Sent from my iPhone

On Jun 16, 2024, at 4:05 AM, VXP @.***> wrote: For some reason, Valve Matchmaking servers allow people with Game/VAC bans to join them. I think, Valve should begin with that issue first. Just refuse those accounts from joining your official servers at the very least. We would appreciate that move

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: @.***>

[motherofdragons96]

I mean, I was wondering if Valve could put a ban on bot hosting for casual servers, and stop the bots from entering, so we could all play on casual during our seasonal events. Same goes to CS2.

[AnOpenSauceDev]

You can't just "ban bots", they essentially behave like a player as far as TF2 is concerned. Bot hosters want to make TF2 miserable for whatever reason, so they're going to try as hard as possible to update their bots once the update drops.

The only reason you see less bots post-update is because sometimes an update will cause the bot applications to not work, in which case the devs can fix this very quickly by writing an small patch.

[motherofdragons96]

You maybe found a point there.

[motherofdragons96]

Another suggestion if Valve could fix the bot problem, they could replace Sniper bots with Ai bots for bot hosters can use for casual, that way, we should be safe without aimbots.

[Wadmodder]

Rather, we should have Discord ban the bot hosters from their service and later Valve should ban them from using their Steam client.

[JoriKos]

Rather, we should have Discord ban the bot hosters from their service and later Valve should ban them from using their Steam client.

Discord won't care, nor will it solve anything, and I think you severely underestimate the problem. There's more to it than just banning the hosts.

[AnOpenSauceDev]

If discord banned the servers the bots were spamming, the bot hosters would just make more and instantly migrate the users, or just move to another service.

I doubt these bots are just running discord, so they cannot be used to track down a Steam user.

A lot of these points can be debunked instantly with a quick explanation. I don't think there's an understanding as to how cheats/cheat devs work, but just about anything client-side can be bypassed very easily.

[ninokep]

Why not add a captcha when joining casual? I have seen this suggestion a few times, and while it would be annoying, It would be easy, effective, and I'm sure 99%+ of the playerbase would prefer having to just do a captcha over over the current state of tf2.

[voidplayer]

Why not add a captcha when joining casual?

https://www.youtube.com/watch?v=SgkgsgaBBCA&t=646s

It would be easy, effective, and...

Can you guys stop suggesting things that an average engineer can come up with in like 2 seconds?

Nobody is being lazy or dumb at valve

Any solution that implies one of those things is just signaling that does not understand how a computer works

[voidplayer]

Another thing that could be improved is the "players in game" menu in the ingame overlay. Since the last big interface update it was reduced to its barebones

Right now it doesnt remember the position or size of the window, it doesnt allow you to filter players names or search, it doesnt update (you gotta close it and reopen it for it to refresh), the pfp is very small, sanitize names so they show the same everywhere

Maybe allow me to tag a profile or add notes

When you want to check the profile of somebody suspecting cheating is a very tedious process, some times i cant even find the player in the list for some reason

[ninokep]

Can you guys stop suggesting things that an average engineer can come up with in like 2 seconds?

"A minute is 60 seconds". I came up with that in 2 seconds, it doesn't make it wrong. I get that if you focus on this a lot this may seem like a repeating message, and since you watched a video about it, It seems like a bad idea. However, the idea of spending even more money might put bot hosters off, or at least result in less bots. It isn't a fix, but it would be a start.

Nobody is being lazy or dumb at valve

Yeah, they have other things to focus on, aka deadlocked.

Any solution that implies one of those things is just signaling that does not understand how a computer works

This sentence doesn't really make sense, unless it was the system that was signaling that It didn't understand how a computer works? Also, "how computers work" is a very wide topic. My line of work is not in game design, so It's fair to assume all my comments are meaningless gibberish. I just wanted to know about why or why not a captcha would work.

Thanks for the video by the way, very helpful :).

[voidplayer]

at least result in less bots

You are putting troubles to legit players that fake players have no issue to overcome. The common misconception is that this also put some stress on fake players, either monetary, time, emotional or at least something!

It does not. It woudnt be a start either. You wouldnt even leave the room bots are in. You are running in treadmill

If you set the speed of the treadmill to very fast, you are, however, making a problem for legit players that cant run on a treadmill very fast for whatever reason

Troublemakers usually have no problem running very fast in a treadmil

The best you can do to fight them, is to make them not care about it

The louder you fight them, the brighter is the beacon that attracts the kind of people that like to overcome anticheats and mock them

Yeah, they have other things to focus on, aka deadlocked

Its not about focus, or being lazy. You cant even through infinite money to the problem. You can only dampen the problem a little, and they already do

Im pretty sure you guys dont actually play the game anymore to say those thing

The game is mostly playable most of the time right now

Theres been times when you couldnt play, last time #savetf2 came out or this time with #fixtf2 were moments in time where the game couldnt be played. It was really overflown. The bot wave tide was high

But its not the case anymore, It can be mostly played most of the time again. Both times the movement was successful. We even got some QoL improvements last time

Its not devoid of problems, but nothing that is popular will ever be

The current state of the game is very manageable with the right tools. If you understand how a computer works, its easy to see that it can get way worse way fast. The bots spinning is a god send. The cocky bots and cheaters mocking players is actually good thing. You can actually get players to identify and agree on the votekick

It baffles me the overconfidence when you throw your 2 second technical idea thinking you can outsmart engineers at valve

Im not talking about you @ninokep specifically. If we wait a couple of days, somebody else will suggest "why dont we just ban the ips" again, signaling again, how they dont understand the problem at all. Signaling how they think everybody around them is very dumb and lazy but they just had a great idea that will surely work

All while not researching or even reading whats its already being told and debunked to death. Not even reading this thread where they are responding to

[voidplayer]

More QoL ideas that other games have for ages

• have separate zones in the ui of the game player chat from voice chat messages like call for medic and server messages, so they dont overclog each other. hopefully with timestamps too
• save the text on the chatbox that is being typed when the server loads the next map
• having a ctrl + f work on the dev console so you can more easily find events there would be great too

These will help with the communication between players that is needed when bots try to overrun the server

[JoriKos]

Why not add a captcha when joining casual?

Instantly bypassed and just a nuisance to players

When you want to check the profile of somebody suspecting cheating is a very tedious process, some times i cant even find the player in the list for some reason

Enable mouse on scoreboard, easiest way of doing it.

More QoL ideas that other games have for ages

This is hijacking the issue to just ask for changes that can be distantly related to bots but don't have anything to do with bots. Endgame communications, "events" in the dev console that aren't really related to bots, and chat improvements have nothing to do with bots, really. Please make separate issues about this instead of putting it in a thread under a thin disguise of being anti-bot measures.

[voidplayer]

Enable mouse on scoreboard, easiest way of doing it.

You cant move while looking at the scoreboard, so not very useful to have it enable it

Do you actually use it while playing or you just know it is an option but never used it?

This is hijacking the issue to just ask for changes that can be distantly related to bots but don't have anything to do with bots. Endgame communications, "events" in the dev console that aren't really related to bots, and chat improvements have nothing to do with bots, really. Please make separate issues about this instead of putting it in a thread under a thin disguise of being anti-bot measures

This just your opinion

Communication is key to deal with everyday bots. The chaos that is the current chat box is the cause that bots manage to trick new players as makes very hard to track things

If you had ever played other games where you have to deal with bots and this chat improvements, you would know how they make a difference

The fact that bots can very easily trick players to vote the wrong player is the kind of problem that can actually be tackled

[JoriKos]

You cant move while looking at the scoreboard, so not very useful to have it enable it Do you actually use it while playing or you just know it is an option but never used it?

I've used it for probably 8+ years now, since the scoreboard takes up most of your screen you don't wanna have it up during crucial moments regardless. If you can look up someone's profile through the Steam players list, then you can use the scoreboard (in a much faster process) to access it. It's different, but it works perfectly fine and it's something you can get used to.

This just your opinion

It is not, in no way are these suggestions anything but quality of life changes you can distantly relate to bots. I can list 10 things I'd like to see in TF2 and somehow relate them to the Bot Crisis, but they're not actually suggests that are of any use.

[voidplayer]

it's something you can get used to.

Well, i tried it a month and i couldnt get used to it. I check the scoreboard constantly while in the game

ymmv

In anycase, if its not by default, is something most players arent gonna notice and struggle with

It is not, in no way are these suggestions anything but quality of life changes you can distantly relate to bots. I can list 10 things I'd like to see in TF2 and somehow relate them to the Bot Crisis, but they're not actually suggests that are of any use.

Lets agree we disagree.. Ive been dealing with bots for a long time. You see them distantly related and i see "improve the tools we have and clarity of what you see in screen" the only way forward to effectively deal with bots

Again, this is the kind of things you wouldnt understand unless you experienced first hand, so i dont blame you for not understanding

[JoriKos]

Again, this is the kind of things you wouldnt understand unless you experienced first hand, so i dont blame you for not understanding

You act as if I haven't played the game since 2013, have 5000+ hours in it, and hang out in many TF2 spaces. This is just plain arrogance now, I've experienced all the bots from the 2019 spectator crashing bots to the current day ones. These kinds of suggestions are completely inconsequential.

There have been suggestions about improving the vote kicking process which are actually helpful, or about how to actually tackle bots, but suggestions like "let us keep what we type between servers" or "let us have a better look at the console" are not, because they aren't actually going to help against bots. But let's entertain these changes regardless:

save the text on the chatbox that is being typed when the server loads the next map

A large majority of the Casual servers become mostly or largely empty once the games end (this is a very common complaint with Casual). If you stay, there are another 150 seconds + setup time where people (who still need to wait the time it takes for their kicking cooldown to pass) can be told who is a bot and who isn't. You need to wait for everyone to connect during the 150 seconds anyway, so sending a message before they're all connected would be useless. Ergo, nothing to help fight bots.

have separate zones in the ui of the game player chat from voice chat messages like call for medic and server messages, so they dont overclog each other. hopefully with timestamps too

This just does not help at all. I don't see how this is going to help anything considering bots haven't spammed voice lines for a very long time now, and the ones they did spam were not visible in the chat. Ergo, nothing to help fight bots.

having a ctrl + f work on the dev console so you can more easily find events there would be great too

Bots don't log anything in the console, it's mostly filled with errors related to props, sounds, or captions. This is a good suggestion, but it does nothing to help fight bots.

[Wadmodder]

THAT"S IT!!!! Hire FBI, DHS and DOJ officials take the bot hosters' IP addresses so that they can track down their real-world location and arrest them.

[Wadmodder]

If this bot crisis is going to get worse, than its going to be permanent for TF2 and Valve fans to boycott The International 2024 Dota 2 tournament in Copenhagen, Denmark. And for the last time, F*** @kisak-valve, you and Valve turned GitHub into a wannabe member of the BSA, SIIA & ESA, and COVID-19 made your GitHub pages the WORST GitHub community ever to exist!!!!!!

[JoriKos]

I, for one, appreciate all kisak's hard work on this repo

[ethanholt1]

Don't make me tap the sign again, kids. Honestly, I feel like this should be closed. Every suggestion that can be suggested at this point probably has been suggested, and most of the posts in this thread are mindless bickering.

[voidplayer]

Another thing that could help is to make the voting info public, so you can see who is voting who

So can vote the same as people you trust, or distrust people if they vote along the bots

Regarding bickering:

• Complaining about bickering is making the problem worse. You are literally the bickering you are complaining about
• Just silence a few key people and go on with your life