Project Quarm - 1 Box Planes of Power

[tristantio]

Anti-cheat only catches the true boneheads, as it's a technical problem to reliably catch it.

From the project itself:

"ShowEQ or SEQ for short is a program designed to decode the EverQuest data stream and display that information on another computer running the Linux OS in real time. "

No amount of anti-cheat running on a Windows machine (or eqgame.dll host) is going to be able to tell a Linux machine on the same network is running ShowEQ if the network is properly setup - if ShowEQ was listening on a port as a server (I don't think it is) - MAYBE an anti-cheat could do extremely intrusive network port scanning to see if someone's network had this open - but again, a simple firewall rule would totally shut that down.

From what I understand, the anti-cheat's in the past (across various services) are pretty rudimentary (yet very privacy invading) - looking at running process names, scanning browser tab names, scanning file names (maybe the arms-race between anti-cheat and cheaters had a gap closed if they ever scanned for md5sums instead of names, since the bonehead+1 cheaters will at least rename the program).

It's like the p99 box rule - 1 box is the rule, and there are client side measures (sending your PC hostname to p99), server side measures (checking IP), and GM/manual measures (reporting) - yet all 3 are trivially circumvented if someone wants to box by running multiple machines on VPNs (virtual or otherwise) and never having the boxed characters in the same zones as each other.

I agree with Secrets - being overly focused on it is not really productive - infinitely so on the client side checks - that's why on the other thread, I suggest only analysis of behavior in an automated fashion, would catch this - it'd also be capable of catching boxers based on overlapping play time frames. If the server recorded all start/end activity periods for all characters, and noticed tight correlations like "these 3 characters are ALWAYS online at the same time windows for months straight - 3x ban" - vs the simpler checks of only catching IP exemptions that are stupid enough to do the same hostname+same IP at the same time.

Any measure to stop something like SEQ which is FOSS anyways is only temporary - billion dollar companies create DRM that gets circumvented by a 14 year old in their free time - no server to client encryption p99/Quarm/other p-servers push out there is anything more than a temporary blocker.