Cheating is problem. Not only in tremulous, but in all games. We should gather information about what can be done and what cant be done on this situatsion. Maybe there is a solution.
There are 3 places to look. Server, connection and client.
I think connection problem is solved by now. Using encryption methods to transfer information is good enough. if speed is needed you can combine encryption methods, saw a way, that XTEA key whose transfererd trough RSA key pair. Works pretty good. Anyway, enough for connection, it can be secure.
Server is a bit harder. Problem is, server sends alot information what client dont need. Like where every opponent is, even if its another side of map or sometimes even how many bullets he has in his gun. Less information you send, less things to cheat. Still, you must send needed information and cheats can still use it. So next thing to ask is, can server detect cheater on gameplay, not on startup. Must useless way is statistical, because there will be allways lucky bastards, who really shot sometimes n times row to head. Good idea is "honeypot"(proposed here). If you know what clients needs, then you know what he dont need. At random times, spawn a normal opponent there for some moments, where normal player dont see it. Like behind you if there is no one. If someone is cheating, it reacts and you can do something about it. Point is not only detecting cheaters, but making cheats useless. But downside is, its hard to find effective "honeypots" and they wont give 100% accurate results. There is a hard way to implement algorithms, that detect on server side certain patters of cheats, but in long term, its useless. Is there anything more you can do on server side?
Last thing is client. You can't control what client has on his computer. It can be anything, but trough network connections looks pretty much authentic. MD5 sums of files wont work:you can replace them to correct values and most important, self compiled binarys have their own md5 sum. I have a idea, but i dont know how practical it is. There are 2 things you can trust. Server and connection. So you can send some programs/scripts from server to client and run them there. Can that program quickly detect, if client machine is running some cheat programs? If answer is yes, can we use it? I imagine program itself is open source, but every server has its own key pair to crypt that program and ofcorse, program is usable only 1 time only. Basicly, you secure now that program, not runing client application. Maybe im running to wall, maybe it helps.
Ty for listening:)
