Riot Games Approach to Anti-Cheat - <AUTHOR> https://engineering.riotgames.com/news/riots-approach-anti-cheat <comment><USER2> Back when I worked in games we would detect cheaters and then shadow ban. Quarantine them by only matching them into games with other cheaters.

You may still have to ban them from certain elements of your game, like player economies (auction house, etc). But the more legitimate their experience looks the better.

The idea is that instead of fully banning them and triggering the next iteration of the arms race, you trap and release them into a competitive arena for cheaters. It's actually fun for them to compete with each other at who can cheat the hardest and no one else gets hurt. We hooked them up with a community rep. They found bugs and generally improved our security. Everyone won.

There's no way to win with an adversarial approach to cheating IMO, not when you let the client run on their machine

<comment><USER3> Sure. Until you're playing Dark Souls for the first time, you get summoned to help someone with a boss, and then get invaded by someone with a 360 degree one-shot kill spell that breaks all your weapons and armor, gives you an egghead that you can't remove unless you know where to go, and gives you an item that marks you as a cheater so you now get constantly invaded by exclusively cheaters.

The item that marks you as a cheater might have been a drop in another invasion, I don't remember. The point remains, once the cheaters realize you have a separate cheaters' matchmaking system, they will weaponize that too.

<comment><USER4> > The item that marks you as a cheater might have been a drop in another > invasion, I don't remember.

I believe they can do it completely passively, so you're kinda screwed if it happens to you :( This is sadly the nature of trusting what clients send you: a hacked client can send whatever it wants and the "anti cheat" in Dark Souls sadly seems to simply just check if an item should be possible, meaning a cheater can trick the game into punishing non-cheaters. Luckily this hasn't been a problem for me on console, but it certainly does suck on PC :(

<comment><USER3> And of course, if it didn't punish non-cheaters, then cheaters could simply cheat the items in on one account, invade/summon another of their own accounts, (or passworded summon in the remaster) and then give the new account the items.

There's no winning against cheaters as long as you trust the client. (And it's possible to do it on consoles too, just more rare as the tools are readily available on PC.)

<comment><USER4> > There's no winning against cheaters as long as you trust the client.

Indeed.

> And it's possible to do it on consoles too

Sure, but the barrier to entry is higher, so its not done as often. I've never _noticed_ someone who was obviously cheating (which doesn't mean I've never encountered any, but if I have, they've never been so severe as to do the things mentioned here or for me to notice it)

</comment></comment></comment></comment></comment><comment><USER5> I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it was doing until my system crashed one day and the cause was some .sys file in PUBG.

It'll also randomly kick you from games for having various programs installed or running. Programs such as VMware. You have to disable all VMware services or PUBG will kick you randomly for using "unauthorized applications." God forbid you have any VMs running, that might amount to a ban (seriously).

Worse still is that when you take your complaints to their social media, or in anyway speak ill of it, you get hordes of fanboys saying that you shouldn't install anything other than games on your PC or you're a dirty cheater. "Oh you want to do things _other_ than gaming on your PC? You should buy another PC then."

Don't even get me started about trying to run games in a virtual machine w/ GPU passthrough. The communities will tear you a new one telling you to do things "normally" and by attempting to use anything other than the "normal" setup makes you a cheater. Just google anything like "steam vac kvm" or "battleye kvm" and you'll get hordes of people claiming they heard some guy say virtualization is the future of game cheating therefore VMs are cheating tools and should be banned.

Seriously, if I could get a refund for every game that uses BattlEye, I would try.

/rant

<comment><USER6> I've been out of gaming for some years but this reminds me of similar issues with PunkBuster. I'd spend hours pulling my hair out trying to figure out why I was being booted from games. The worst bit was, it didn't actually stop cheaters.

<comment><USER7> Oh god... I forgot punkbuster even existed, what an absolute pile of garbage. So many hours wasted on dealing with that shit and reading redundant and useless forum posts where everyone just copy pasted the same shit over and over.

</comment></comment></comment><comment><USER8> So I'm not seeing anything particularly novel here. In fact, I think most AAA titles do most if not all of these things today. It really just boils down to understanding your title's threat model and mitigating the threats.

I think the article missed an opportunity to talk about false positive rates, the workflow for users to get unbanned due to false positives (usually a very nasty process), performance, platform support (Windows, for example, has encrypted app packaging [1], anti-cheat monitoring [2], and protected processes [3] built in), and the privacy implications of uploading non-game- related Windows driver and process data.

[1] [https://docs.microsoft.com/en- us/windows/uwp/packaging/creat...](https://docs.microsoft.com/en- us/windows/uwp/packaging/create-app-package-with-makeappx-tool)

[2,3] [https://docs.microsoft.com/en- us/windows/uwp/packaging/app-c...](https://docs.microsoft.com/en- us/windows/uwp/packaging/app-capability-declarations)

<comment> m-p-3 > usually a very nasty process

especially with how opaque the whole flagging is.

I understand why they do it and a game environment is not a democracy or a court of law, but it's hard to defend yourself when you do not have access to the evidences.

<comment> half-kh-hacker Videogame cheat developer here (although, not for the game mentioned in the article) -- The mentality of game companies is if the 'evidence' of the anti- cheat flag is made accessible to users, cheat devs will use the same evidence to overcome the existing detections in place.

The oft-used 'arms race' analogy for this would be like sending blueprints of your newly-fabricated weapons to the adversary.

<comment><USER9> I've always been curious about this, do you get paid, and if so how?

<comment><USER10> People love cheating so much they pay for the tools to do so.

The fact is 99 out of 100 banned users were actually banned for good reason and are lying about not cheating. Half of those will also dmit to cheating but beg for forgiveness as if they aren't quite literally destroying the game and everyone's enjoyment of it. That less than 1 percent that is truly innocent is nearly impossible to service because of all the noise.

<comment><USER11> Cheating definitely sours a gaming community, as does falsely accusing people of cheating. I left the original (circa early 2000s) Counter Strike community after being routinely accused of cheating. I have never once cheated in a online multiplayer game. But, some people just couldn't grasp that I was really that (comparatively) good & quick of a shot. Also, I don't think they realized that certain materials could be shot through with a powerful enough weapon. I probably had a bit of a leg up on most people, too, as I had state of the art hardware for the time (I had dual P4 Xeons, 3GB RDRAM & the best at the time GeForce AGP card in 2002) and a single to low double digit ping for most servers being on a university OC-3 line.

<comment><USER12> Your comment reminded me of a frustrating evening on bzflag.

Long ago I was using a custom Linux box with a slow GPU, and on one map no matter how hard I tried (and no matter how many fellow players watched trying to help me get the timing right) I simply couldn't jump to the first level of a building.

I'd never experienced a hardware limitation quite like that.

<comment><USER10> Haha neat. That was probably caused by the physics engine running slower than needed. If you do a rough friction calculation based on the frame rate you will end up with more friction at 20 fps vs 40 or 60.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is a great technical breakdown of some modern high level approaches to common cheats. I think this the most transparent approach (even though the author admits leaving some detail out) to modern anti-cheat for massive multiplayer games. Good on riot for having an open dialogue about this. I don't think you'd ever see someone like Valve going a transparent route with something like this. (Not making a judgement on that decision, just an observation).

<comment><USER14> Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid.

I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial.

It suppose that it does make sense to not mention the implementation details of their anti-cheat, but I wish that they would be a little more transparent about how/when/what they snoop around and send to their servers. The current Mac game client for League Of Legends contains full debug symbols and it doesn't have Packman (the packer described in this article), which makes it quite easy to look through the symbols. Inside you can find all of the anti- cheat-related network packets, in specific:

PKT_C2S_EnumDrivers PKT_C2S_EnumProcesses PKT_C2S_EnumDrives PKT_C2S_EnumHandles PKT_C2S_EnumRecentFiles PKT_C2S_EnumModules PKT_C2S_ProcessorData PKT_C2S_SystemState PKT_C2S_ModuleLoadNotification PKT_S2C_SendModule PKT_C2S_ModuleResponse

Now, I personally expect anti-cheat to snoop around my system when I'm doing something shady like scanning its memory. However, if I was a normal user of the game, I would be a bit concerned to know that it might be sending my recently used file names, drive names, system driver names, currently running processes, processor information, system state, and even entire binary files that it automatically deems as "suspicious", to their servers.

<comment><USER15> Wouldn't that run afoul of GDPR?

<comment><USER16> Not necessarily. GDPR isn't a blanket ban on collecting/using this info without consent, it's a policy that consent is required for non-essential collection/usage. You could argue that anti-cheat is essential for an online multiplayer game like this.

I think it's sketchy to collect this much info, but I don't think it's explicitly illegal.

<comment><USER17> It's a bit more complicated than that. You have to do a few things. First you have to tell the customer that you are collecting their data. Then you have to tell them under what lawful basis you are collecting their data. The user then has various rights (depending on the lawful basis you choose) to object, etc. If you must collect and use the data in order to fulfil the contract (i.e., there is no other way to do it -- for example you need to get their address in order to ship them a package), then you can just do it (as long as you tell them that you are doing it). For most other lawful bases, you have to allow them to object, in which case you have to stop using the data.

I think the real question is whether or not the information in question is personally identifiable information. If it's not, then GDPR doesn't apply. I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information.

<comment><USER18> > I think you could make a pretty strong argument that it doesn't apply, as > long as you take pains to ensure that you can't identify the person from the > information.

That would entirely defeat the purpose of an anti-cheat system. You have to have some sort of personally identifiable information attached to the data being sent in to the server, otherwise how are you going to ban the cheaters? Even IP addresses are personal identifiers as far as the GDPR is concerned and even if they're not storing it long term, just sending the user data over the wire is enough to trigger the data collection portions of the GDPR.

<comment><USER19> Instead of using an IP address to identify cheaters the game could assign a unique random generated ID to players. Then they could ban that id without using IP. I think this scheme complies with the GDPR if you take care of not binding that ID with other user personal information.

<comment><USER20> If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.

<comment><USER19> You can apply a one way function to an IP to obtain an ID and then maintain a database of bad IDs. For example you could compute this ID by the SHA256(IP + secret salt). Since way one function don't allow you to recover the IP, the ID is not PII. If you detect an IP which has bad ID the connecting ban that IP from the game. I think this respect the GDPR, you don't maintain a list of IPs or any other PII.

<comment><USER18> The second you use this ID to tag data you're sending over to the servers, that ID could easily lose any claim to anonymity for the purpose of the GDPR because the anti-cheat system vacuums up a vast trove of information. All it takes is one email "Re: Claim for Your Local Psychiatrist Bob" or a document named "John Doe Jr - First Grade Book Report.docx" showing up in the titles of your open windows (that many anticheat systems send to a remote server) and boom, that ID and all of the data attached to it are now a radioactive liability.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Here's my project's approach to Anti-Cheat.

1, 2, 3) Everything on the server. Server's version always wins. Server is the authoritative source. Granted, I have a mathematical advantage in the game's particular movement mechanics which makes this easy to get away with. The other game mechanics are also designed with facilitating this in mind. Corollary: The client is almost nothing and trusted with nothing. It's pretty much a dumb terminal for displaying moving things, syncing their motion with the server.

4) Scripting -- if you can't beat 'em, join 'em! We're going to publish an API to allow for user scripting. We plan on releasing the client as Open Source, allowing people to modify and extend the client.

5) Cryptographically hard RNG and procedural generation. If you want to know what's in Star System 7, Galaxy Grid 123987236-87324958, you're going to have to go there yourself. We don't even know ourselves!

Regarding #4 -- This is going to be a design philosophy. Anything we can't enforce, we will allow and co-opt into the game!

<comment><USER22> Very unfortunately what you explain here only work for very specific type of gameplay. For instance almost nothing works when you need to secure first- person shooter simply because it's skill-based gameplay where it's also very easy to cheat for the bot.

<comment><USER23> Nvidia has geforce now [http://www.nvidia.com/object/cloud- gaming.html](http://www.nvidia.com/object/cloud-gaming.html) and people with good internet connection have been able to play FPS games. Granted, the latency and the FPS are worse than a local game, but surprisingly it is unnoticeable to many people.

<comment><USER22> Streaming wont help against cheating in FPS, aimbot just going to use machine learning to determine enemy location and conrrols are not problem.

</comment></comment></comment></comment><comment><USER24> The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network _during the game_ that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine code, or even random locations in the heap, all of which may or may not actually be verified on the other end.

You can use any number of obsfucation tricks to hide their purpose (if they even have one) and you could even randomly generate them. And since the server expects the response in the next client packet it would be literally impossible for a cheater to manually deconstruct them, and even be difficult for automatic analysis tools to have enough time to do anything meaningful with it.

You can reduce the security nightmare from the user's perspective by only allowing machine code that's on a tight whitelist. Allow it to read from anywhere, and only let it write to a dedicated little sandbox area with e.g. fixed addresses.

<comment><USER25> If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it. You may have some hope in network delivery of graphics only. If I am not running the game client code, and just streaming the game from one of your servers, you have a chance at keeping your client safe.

<comment><USER26> "If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it."

sure try to undo a block-chain and see what happens.

The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case closed.

<comment><USER25> I think you are missing my point. This concept in client computing security basically chains back to the halting problem. You can't /know/ what I am doing with my computer. You can build a very elaborate trap / obfuscation and it might be hard, really hard, to defeat it or circumvent it, but it is a certainty that I can. The block-chain has absolutely nothing to do with client code security because it has a network enforced mechanism. What the grandparent was suggesting was running some nugget of code in a little VM (or actually on my machine), computing a result, and then returning the result to the server to make a security decision. The problem is I control that machine performing that computation and your security decision as the server is based solely on the computation performed on my computer. A skilled reverse engineer will just hook your code in the right place, intercept that security check and have it return the right bytes back to your server, while still doing whatever client side cheats they wanted to do.

[https://en.wikipedia.org/wiki/Rice%27s_theorem](https://en.wikipedia.org/wiki/Rice%27s_theorem) <\--- this is all about program behavior and did the user actually run the code you sent them. Block chain is about "did I possess certain data" (such as a private key to sign a transaction) and not about "did I run certain code".

<comment><USER17> You are absolutely correct, but it occurs to me that CPU designers could actually implement a kind of RSA style memory fetch instruction. The CPU would generate a public/private key pair, where the private key is not accessible by any means. The client would send the public key to the server, which would in turn encrypt the memory location(s) that it wishes to inspect. There would then be an instruction on client's CPU which would accept that encrypted memory location and return the contents, without divulging location. The CPU could regenerate the public/private key values for each request. I can't imagine defeating that kind of scheme without hardware hacks. The more that I think about it, the more I wonder why no-one has done it before, because it seems useful. Probably there is something I'm missing...

<comment><USER27> How do you prevent the cheat doing a MITM attack and changing keys?

<comment><USER17> Yes, you are right. That's what I was missing :-)

<comment><USER25> The answer, and it has dark implications, to me, is Trusted Computing. Never let the user have full control. Do this key exchange on a base OS or some other VM the user can never touch (e.g. Knox / TrustZone). Still, we can exploit our way to this trusted OS and MiTM there, but it takes much more skill. With Trusted Computing the base OS can more simply install a "spy" to keep track of a games memory / code to ensure it is only ever loaded and executed from memory that is essentially made read only after the program is loaded but before it executes. The trusted OS verifies the program code, the OS, etc, and if it all checks out, let's the code run. Of course it goes back to the halting problem, but if the programs memory is unexecutable and modern exploit mitigation is applied the game is now in a considerably sturdier mouse trap :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> I wonder if Riot would consider building the scripting UI they show into some kind of training mode. It's a bit like the argument that no one would pirate if they content was easy to get for a reasonable price.

If players could train with the spell range circles, skill shot path projection, last hit helpers, etc in a sanctioned way, I wonder how much this would remove the desire to seek out the cheating programs.

Edit: I see they have a "training mode" already: [https://na.leagueoflegends.com/en/news/game- updates/features...](https://na.leagueoflegends.com/en/news/game- updates/features/practice-purpose)

<comment><USER29> > I wonder if Riot would consider building the scripting UI they show into > some kind of training mode.

The game would probably be more vulnerable then, because now you have "cheat" scripts designed to work with the game.

> If players could train with the spell range circles, skill shot path > projection, last hit helpers, etc in a sanctioned way, I wonder how much > this would remove the desire to seek out the cheating programs.

People who cheat aren't trying to practice; they're trying to win games. There already exists a "practice mode" which lowers cooldowns and shows tower ranges. And it doesn't make sense to practice with cheats because it won't help you play the game without cheats very much.

<comment><USER30> >The game would probably be more vulnerable then, because now you have "cheat" scripts designed to work with the game.

That's possible. For example, World of Warships is a game where you fire big ship-mounted guns and must learn to take shell travel time and target relative velocity into account to hit moving targets. There used to be a cheat which did those calculations for you and showed you a reticle you could aim at instead. IIRC this cheat relied on code that existed within the game already and was just not used.

<comment><USER31> So basically the same reasons real warships developed rangekeepers resulted in a game targeting computer? :)

</comment></comment></comment></comment><comment><USER32> Unfortunately, their latest anti-cheat measures broke the ability to play on Wine.

Guess no LoL for me anymore.

<comment><USER33> They broke GPU passthrough setups as well at first. There was some community backlash and they rolled that back, and I believe they also mentioned they intended to work with the wine people on a solution for that as well.

<comment><USER34> How did it break GPU passthrough?

Then again I heard recent versions of VAC detect running under a KVM hypervisor and kick you out of CS:GO servers.

<comment><USER5> That's unfortunate to hear that VAC looks for KVM. I was planning on moving my gaming partition to just a VM and using GPU passthrough. It's how I have my work PC setup, figured I'd replicate it at home.

<comment><USER34> Sorry to be the bearer of bad news.

I plan to reverse engineer VAC sometime to figure out how the detection works.

</comment></comment></comment></comment></comment><comment><USER35> Good timing, I am using my own AI (keras + tensorflow) stack to predict in- game hackers on ARK Survival Evolved with an AWS EC2 instance. Here's some background on the fully open-sourced stack: [https://github.com/jay- johnson/train-ai-with-django-swagger-...](https://github.com/jay- johnson/train-ai-with-django-swagger-jwt) with docs [http://antinex.readthedocs.io/](http://antinex.readthedocs.io/) I would love some players, but I'm still load testing how many players the game server can use + make real time predictions without impacting the game. Reach out if you want to try it out!

</comment><comment><USER36> Message to EA: don't try to be clever. Make simple query based bans, after the fact. Sift through the event tables and make trivial questions like if A killed B with a weapon that is not possible to use on the map - then he cheated. Check for ridiculous (not just suspicious) activity.

The cheaters that ruin games aren't the ones that make players better such as discrete wallhacks. It's the trolls that are immortal and flying. They blatantly cheat just for the response to their trolling, and they empty a server in a matter of minutes. But just _because_ they are so very blatantly cheating, they should be quite simple to detect in logs too. If someone has 200 kills with an ammo box in a 5 minute round that's enough to say it's definitely a cheat. Yet these people do it over and over with NO obvious response to reports. Focus on THIS type of cheating (which is _trolling_ , not gaining an advantage). Only after that look at more subtle cheating.

</comment><comment><USER37> I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality.

As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where different Overwatch-style "classes" emerge all built from the same basic game elements.

<comment><USER38> Check out [http://www.pwnadventure.com/](http://www.pwnadventure.com/)

"Pwn Adventure 3: Pwnie Island is a limited-release, first-person, true open- world MMORPG set on a beautiful island where anything could happen. That's because this game is intentionally vulnerable to all kinds of silly hacks! Flying, endless cash, and more are all one client change or network proxy away. Are you ready for the mayhem?!"

"Pwn Adventure 3 was originally during Shmoocon 2015, from January 16-18, 2015. While the CTF is now over, we are still running the servers in a limited capacity so others can try it."

<comment><USER39> Recently (last week or so), there has been a hacker in PUBG who is using a flying car. I had never seen this cheat before, EXCEPT in "LiveOverflow" 's YouTube videos of pwnadventure!

[https://www.youtube.com/watch?v=pzM4o6qxssk](https://www.youtube.com/watch?v=pzM4o6qxssk)

In this series he managed to get his player to be able to fly.

I can't help but wonder if whoever that hacker is that developed the recent PUBG cheat, got his inspiration from pwnadventure and this series :)

<comment><USER40> I had a cheat back in Halo 2 for Vista that could make the Warthog fly. A flying car in a game is really not new

</comment></comment></comment></comment><comment><USER41> I am surprised people don't virtualize the game and do their analysis at a level that the OS and game can't detect. Ultimately, these games trust that the hardware they're running on behaves according to specification. That is clearly an unwise assumption. Cheaters may not be taking this path today, but it gets easier and easier as time goes on, and it sounds like they're not prepared at all. (Some other comments mention that current games look for virtualization software installed on the same OS install that the game is running on and fails the integrity check if found. I can't imagine that stops anyone actually determined to cheat. I imagine it annoys people that test their Docker images on the same machine they play the game on, though.)

Even if virtualization is detectable, you can also take the computer entirely out of the loop. The state of the art for aimbots seems to be reading game memory and applying synthetic mouse movements at the OS level. That is quite a blunt instrument to apply and I'm sure that no game has a major problem with this kind of aimbot. A more elegant aimbot would look at the video of the game, look for targets, and provide the necessary mouse movements over USB. At best, the only countermeasure is to make enemies harder to see or to learn some heuristic in mouse movement that differentiates the bot from a human... but injecting randomness is straightforward and nobody needs a 100% accurate aimbot anyway. The pros destroy you with 30% accuracy.

Finally, it's unclear if there is even any advantage to be gained by cheating. If you want a higher rank in a competitive game, you can just pay someone to play on your account. From what I've read on Reddit... many of the people offering these services are apparently professional players. No anti-debugger hook is going to detect that.

It should be interesting to see how this advances. While games that rely solely on mechanics or information hiding are clearly doomed in the long run, it's probably good news for the rest of the software industry. What is your cloud provider really doing? Is your own software compromised? The tools used to cheat in games will be quite valuable in answering these questions and protecting your users from people that actually have something tangible to gain from these actions.

</comment><comment><USER42> IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play?

For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

<comment><USER43> (As a former high level StarCraft / SC2 player / caster).

It's not chess. That's why.

There is a real physical aspect to the game. Training your fingers to hit certain combinations quickly to execute build orders, and mix in micro is key. Pro players use hot packs to warm up their hands, or glasses to aid their eyes.

The game developer takes a lot of care to ensure the UI / hotkeys / peripheral setups are optimized for pro players.

Using external tools to defeat this setup simply isn't fair and diminishes skill built into the hands and muscle memory of players. Even at a mid-level of skill, people learn simple combos. For example, a Protoss player hitting "4+e" because that's where they have hotkeyed all their Nexuses and e is the hotkey to build probes.

<comment><USER42> Many responses are saying the same thing, so I'm going to respond to you ...

> It's not chess.

I agree it's not chess, and chess often has a time component to it. The realtime nature of a game doesnt mean you should have to be able to "move" in realtime, IMO it would be superior if it tracked more closely to your ability to react, intellectually, in realtime. That is, real time thought more than realtime motion. Ergonomic aids would help people to convert their thoughts into real game plays without limiting them to their body's capabilities. But I also admit this is my opinion and it's clearly an arbitrarily decided dividing line between how much should a game be about myelinating certain move patterns (spread out troops, cast a spell, select production groups) and how much a game should be about quality of thought in realtime (I see he made units X, How am i going to respond? I have many minerals, should I spend them on tech or units?) ...

<comment><USER44> With enough mechanical aides, the game balance breaks.

For example, SC2 has a very cheap unit called the roach. When burrowed, it can't attack, but regenerates health incredibly quickly.

It's trivial to write a cheat that will, whenever one of your roaches starts taking damage, causes it to burrow, and whenever it stops taking damage, unburrow.

The unit is balanced around human control - no human can, with perfect accuracy, choreograph burrows and unburrows of individual roaches in a pack of ~60.

With such a cheat, roaches punch way above their weight, completely breaking the rock-paper-scissors balance of the game.

<comment><USER42> I do not deny that the game mechanics would vastly change. The strategy would shift away from "How can I micro these roaches" vs "How can i effectively attack burrowing/unburrowing roaches" to "How can i ensure I get roaches" vs "How can I frustrate/prevent my opponent from getting them in the first place"... As an aside, ANY change to a game is going to disrupt the equilibrium in some manner and I assume would require human intervention to re-establish a "fun" gameplay.

<comment><USER44> > How can i ensure I get roaches

Which is trivial for any skilled player, because they are an incredibly cheap, low-tech unit, and passive base defenses are currently very good at fending off very early aggression.

> As an aside, ANY change to a game is going to disrupt the equilibrium in > some manner

Yes, and sometimes, the equilibrium settles on an incredibly shallow, uninteresting game-space.

StarCraft is a game of a number of rock-paper-scissors cycles, all operating at the same time. Greedy expansion - versus rushing versus safe plays. Economy versus army versus tech. Roaches versus marauders versus zerglings.

Sometimes, due to patch changes, poor balancing, or because player skill improved, the game ends up stuck in a quagmire, where the risk/reward ratio for many of these options is completely out of whack. The game stagnates, and becomes incredibly unfun to play, and to watch.

Throwing a wrench into balance, by allowing auto-scripts, which have an incredibly uneven effect on the different units, mechanics, and races in the game is far more likely to push it into an unfun equilibrium, then a fun one.

<comment><USER42> Yes, but keep in mind this idea and thread is not about SC2 specifically. It used SC2 as an example of the class of games that I personally believe I would find improved by removing the mechanical aspect of the game allowing me to focus on the fun part -- Making decisions and giving instructions patterns more than "micro"

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> Great write-up. I'm my job we spend a lot of time dealing with hackers and cheats for our mobile and PC games.

We tend to see similar exploits across all our games (memory hacking, fake IAPs, etc) which lets us build an armoury of anti-cheat tools.

What I find most interesting is where hackers don't focus their attention. It took almost 4 years for them realise the encryption key for our assets was easily accessible using the 'strings' tool in Linux - once they found it we had a busy few days stopping modders from impacting legitimate players.

<comment><USER46> You're probably dealing with newbie reverse engineers, do you work for a triple A game publishing studio or an indie game shop? People who want to "mess" with games are usually doing it so that they can make a lot of money from it and therefore hunt big triple A games...the people I've seen do proper reverse engineer on triple A game to bypass ie. Blizzard's anticheat in World of Warcraft now all work for big "anti-virus" companies

</comment></comment><comment><USER47> Cheat, anti-cheat, antivirus, malware, and to a lesser extent debugger and profiler. All these tools are going after each other in the same territory: monitoring a certain system activity to report or intervene. To me, it looks that all these functions are traditionally in the realm of operating system. Are we going to have a new middle layer or a new OS architecture for catering things like this? I'm curious.

<comment><USER21> I'm working on this.

</comment></comment><comment><USER48> I wonder, given that nowadays access to vast amounts of computing power on demand is easy, if it would be effective to generate unique builds for each and every player. Just like they already do, but tailored for each downloader. Which would get tied to an account, and to a given fingerprint.

<comment><USER49> What problem would that solve?

<comment><USER50> I think he's implying a cheater's injected DDL would be tailored for a specific build, so if they shared it with others, it would be ineffective. And not only that, but based on how the Cheater.DDL is targeting the build, they could identify the account that made the cheat.

</comment></comment></comment><comment><USER51> Does it hinder Linux gamers who are using Wine? A lot of such anti-cheats can't figure out when Wine is used and ban Linux users. Some also ban custom D3D implementations like DXVK even if they are really correctly implementing the API.

<comment> phoe-krk Yes - it hit the news that LoL will no longer work on Wine or virtual machines because of these anti-cheat measures.

<comment><USER33> Can't speak for Wine users, but VMs are working now. The workaround was found within days of the patch (they were just checking for the CPU feature "hypervisor"), and they actually ended up rolling back that check due to the community response.

</comment></comment></comment><comment><USER52> Some of this is pure evil.

> We block this very common technique by making sure that when the value is > changed by taking damage, the value is actually moved as well.

> To introduce more entropy, we also made sure that each value uses slightly > different encryption.

> At compile time, a randomly selected type of anti-debug check is inserted > into each of the locations where a check was requested in the code.

Ive always wondered where you store the key that decrypts code at run time. On phones and DVD players the key is stored on hardware but it does not seem like an exe has this luxury.

<comment><USER53> it doesn't matter where you store the key as long as it's not easy to figure out for the disassembly program

<comment><USER52> If its out in the open it sort of defeats the purpose doesn't it? If you know the key + encryption scheme you could decrypt all the .text in a single pass.

</comment></comment></comment><comment><USER54> One of the things I'm not seeing is what kind of statistical data they're collecting and storing for prevalence of discovered cheats/scripts/bots, on a per-ISP basis. Since they know and log the IP that every user connects to the game from, they can certainly profile it down to at least as granular as the individual /24\. For example if there's a college dorm full of students where somebody has shared a recent script/bot, the behavior could be correlated between time, place and IP.

Thereby allowing them to develop IP space reputation lists that contain the relative likelihood of bots/scripts being run (sort of like SMTP spam RBLs, but not an all-or-nothing, more of a weighted distributed reputation scale).

There is also a league of legends mobile android/iOS app. If you set it up to require location permission, they could begin to correlate the physical location of cheaters with their specific IP block. For example if somebody is at home on their wifi, their phone is connected to their home router, and their desktop PC with a cheat script are all going outbound to the internet through the same NAT, and coming from the same /32 (in ipv4) address.

I'm willing to bet that if plotted on a map you could develop hotspots. Of course they would also match the density of players in general. But perhaps certain trends could be identified.

</comment><comment><USER55> The best way to prevent cheating is by streaming games. Game streaming services are the future of multiplayer games. Edit: I mean cloud gaming like OnLive, not Twitch.

<comment><USER9> Aren't there massive video latency issues with this? People spend tons of money to get the absolute best frame rates and monitor response times, I can't imagine hardcore gamers wanting to have tens of ms additional latency in their gaming.

<comment><USER21> You can have real-time games whose mechanics are designed around latency. My game is one example. In fact, I would assert that for now, you have to design around latency in real-time multiplayer games. Until round-trip latency for your entire userbase is below 40ms, it will be an issue.

<comment><USER56> I'd say 30ms, not not 40. Because a single frame is 16.6ms, so 30ms round-trip would bring one-way down to below one frame of latency (potentially with a small amount of jitter).

<comment><USER21> It sounds surprisingly high, but a lot of the population won't notice 40ms round trip. Some of it will know. It also depends on the game's mechanics. Not all games are FPS. Not all games have action significant down to one frame. Some of my favorite real time games involve making decisions about once every 5 seconds which will result in a turning point in another 15 to 30 seconds which will get you killed or leave you victorious.

</comment></comment></comment></comment></comment><comment><USER57> What I wonder is how the encryption keys are stored. There are obvious ways to obfuscate keys, but at decryption time, the keys need to be exposed plainly in memory, don't they? So how do game makers like Riot prevent debuggers from discovering the keys and revealing them to everyone? Does every player have different keys?

<comment><USER58> A good solution will not only generate keys for each player, will even generate different keys for same player each time that player starts a new gaming session. Start game->generate keys for session->play game->throw keys away.

</comment></comment><comment><USER59> Even if they move a memory value when it's changed they still need to have a pointer somewhere to it's new location. If you can find that pointer you can still read/write at will. This is actually one of the things covered by Cheat Engine's tutorial.

</comment><comment><USER60> I wonder if there is any defense against adversaries that use computer vision and just digest the actual raw images and overlaying information, so there aren't any hooks into the software itself.

<comment><USER61> Overwatch changes the colors of its heatlh bars slightly every match so that aimbots can't lock on it

[https://www.reddit.com/r/Overwatch/comments/6imjce/todays_pa...](https://www.reddit.com/r/Overwatch/comments/6imjce/todays_patch_includes_defensive_measure_against/)

</comment></comment><comment><USER62> These are all just various degrees of obfuscation that will be defeated if it's worth the money.

In particular these approaches seem weak to hardware, firmware, and driver side-channels.

<comment><USER63> All anti-cheating techniques are fallible. It's impossible to build a perfect cheat detection/prevention, just like it's impossible to build something that will always detect all malware, etc. The client code is always going to be on the player's computer and has to execute on the player's computer. There's no way around that.

You can't guarantee effectiveness, but you can make it very hard to reverse engineer and circumvent, and you can constantly change techniques so that adversaries need to put in more work. It's an ever-evolving cat-and-mouse game.

</comment></comment><comment><USER64> One of the things coming out of this is that _legitimate_ coding within a game (for example teaching children how to code - a very important point for me at this point in life) is almost out the window

I love minecraft for their RPi version but beyond that, I don't know of any games that have that kids pull and can still be taught

it's something like "we used to turn on a PC and see a command line. now we have to jailbreak something"

<comment><USER65> you can still do so with most drm free singleplayer titles

<comment><USER64> can you suggest any please :-)

</comment></comment></comment><comment><USER66> Is this approach similar to ones used in VAC (valve) or easyanticheat, or battleye?

Some of the above are notorious for consuming client resources. Easy anticheat is known for banning players in unrelated games that they cheated on. (E.g. cheat on pubg, get banned in a different game that you didn't cheat if both games use easyanticheat)

This is a great writeup but I'd love to see how 3rd party anticheat programs work

</comment><comment><USER67> This talks about common techniques for protecting Windows binaries but what about their Mac client? Are similar techniques also applicable to Mac?

<comment><USER68> I don't know much about OS X except that they use the Mach-O executable format (unlike PE in the article), but I know that the ELF format as used on Linux and many other unixes is similar in that it also has a section where the code resides, so they can encrypt only that part. And inserting checks into the code is also portable of course.

It would have been interesting if they had talked about different platforms, but alas, it's quite a superficial article...

</comment></comment><comment><USER69> What great insight! As a developer I wonder how you implement such methods and still be sure the code runs at desired speeds. Benchmarks? I'd really love to see the workflow of implementing new behaviours. I mean... incremental decryption of distinct pieces of code during execution seems so tough to thoroughly test! Not to speak of debugging... I am genuinely stunned.

</comment><comment><USER70> I wish to see how they dealt with the overhead because of all the encryption, checks etc. performance-wise? I know LOL is quite an old game so they mastered these points. I am especially curious because lately I play PUBG and when PUBG does something about cheat it effectively kills performance.

</comment><comment><USER71> Free startup idea: sift science for anti-cheat for gaming industry

</comment><comment><USER72> slightly related: The LoL end user client that they wrote with CEF(!) is one of the worst game clients I've used.

Edit: It's CEF not Electron

<comment><USER73> It's crap, but at least it's better than the old one written in Adobe Air.

</comment></comment><comment><USER74> Ha obfuscation. The best way to get management off your ass to prevent hacking without actually preventing hacking.

</comment><comment><USER75> I got into developing by modding doom with a hex editor. Giving my SimCity virtually unlimited money. Cheating in a video game is fun and standard practice in my opinion.

<comment><USER76> Cheating in single-player games is absolutely fun and a good way to introduce oneself to reverse-engineering. The key difference, though, is that cheating in multiplayer games can directly (usually negatively) impact the experience of other people playing the game.

</comment></comment><comment><USER77> The next step is to rewrite it all in Brainfuck.

</comment><comment><USER78> I wonder if there's an optimization to be made about tolerating a minimum amount of cheating while being vociferous about the countermeasures? Along the same lines as "no such thing as bad publicity", having just enough cheating to piss off a few people and getting them to talk about it and the countermeasures seems like a great way to get free advertising and game engagement of players just curious to see who is cheating or the drama between cat and mouse.

<comment><USER79> You won't find any companies with competitive online games that turn a blind eye to cheating. If you consider a game with a cheater as being ruined for the other players, a very small number of cheaters can ruin games for a large portion of the players.

For a rough example of how the math works, let's say we have a game that is 5v5. If we have 100 players, 1 player cheating, and everyone plays once you end up with 9 players having their game ruined. That's 9% of players impacted by having 1% of the players cheating.

<comment><USER78> I'm not suggesting they tolerate it completely. Just that they make the game slightly "cheatable" then counteract it enough for there to be a known controversy.

<comment><USER79> No one is intentionally making it possible to cheat in their games. Cheaters and cheat detection/prevention are in a constant arms race. You can't just allow a little cheating. The people that develop cheats will share them and those cheats become more widespread.

Your whole argument is also based on the idea that there is no such thing as bad publicity. This is incorrect. If your game gets a reputation for being full of cheaters then people will leave your game and probably not come back. If the first time you hear about a game, all you hear is that it is full of cheaters are you going to head out to the store to buy a copy?

</comment></comment></comment></comment><comment><USER80> I sorta miss the way cheat codes and exploits were seen back in the long ago days when I started gaming. They were fun little easter eggs and things to mess around with if you got stuck and couldn't progress past a certain point. Or just weird things to have fun with. Of course, pretty much everything was single-player, so it didn't impact anybody else if you wanted to turn on no- clip mode to get around some pain-in-the-ass jumping puzzle in Half-Life, or spawn a nuke-launching spaceman in Age of Empires. And the hours and hours spent button-mashing trying to get new and unusual finishing moves in Mortal Kombat...

</comment><comment><USER81> >We don't share the state of other players if it doesn't need to be shared, so we can avoid common cheats like "map hacks" (revealing all players on the map). >We let the server's game simulation make the authoritative game decisions and generally don't trust the information received from the client, which helps prevent common cheats like "god mode" and "disconnect hacks," barring any overlooked exploits. >Our network protocol has been obfuscated, and we change this obfuscation regularly so that making a network-level bot is much more difficult.

I hope they are proud of doing the obvious. That's like having a webpage and bragging about escaping strings that you insert into a SQL table...

<comment><USER82> The first point is actually something that game developers have failed to do in many cases. For example if they want client syncing to require transferring very little data, they may only send player inputs across the wire, meaning that each client needs to know everything, even if the final decision about game state is made by a server.

<comment><USER81> Yeah, the same many developers haven't escaped strings they inserted into SQL tables, leading to SQL injections. Does this mean if I don't do that I have a right to brag about it? If I wrote a post saying "look at me, I escape strings" the response here would be "cool story bro". This isn't any different.

</comment></comment></comment><comment><USER83> Great writeup, and nice that they mention telemetry only once and work more with obfuscation than the usual process scanning, document scanning, blacklisting and reporting all back to shady servers, etc.

It's scary that one can easily get nasty anticheat software installed, even when playing only single player(!) games.

<comment> squeaky-clean League of Legends is an online-only multiplayer game.

<comment><USER83> I know, that's why I wrote about single player games. Many games have both and the telemetry for anti cheating is not needed for single player.

</comment></comment></comment><comment><USER50> I feel like the industry would be better off being transparent about anti- cheat strategies and maybe even embracing open-source. Protecting "secret sauce" is basically admitting their anti-cheat are largely through obfuscation and can be defeated by knowing any details.

<comment><USER84> You obviously shouldn't rely entirely on security through obscurity, but obfuscation can absolutely be an important component of defense in depth.

Especially when your attackers own the hardware.

<comment><USER85> Or you could design the game mechanics so that client-side cheating offers little advantage... but that would probably require doing more than ripping off a popular mod of another game.

<comment> B-Con That's literally impossible. The entire _point_ of the game is to have client- side input and for that input to be generated by a human and not a computer. There's no way to move that to a server.

<comment><USER86> I'm pretty sure their comment only really existed to dismiss LoL as a "copy of a popular mod".

<comment><USER85> I'm merely saying that they could have avoided some of the issues if they designed a new game from scratch.

<comment> B-Con These problems are inherent to nature of being in the real-time PvP genre.

And AFAIK LoL was designed from scratch, it's Dota that actually based on the code of the WoW mod. Not that it matters today, that code is long gone.

<comment><USER85> I wasn't talking about the code.

Btw, you are thinking of Aeon of Strife (Starcraft mod). World of Warcraft hasn't even been released back then.

<comment><USER84> He's thinking of DotA, the Warcraft mod.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Use blockchain.

It is a very simplified comment, but behind that you can expand the topic to include many advantage a blockchain can provide during multiplayer games.

EDIT: yes it is a very unpopular topic, but deep down many of you who are developers, know that blockchain can solve many of these issues with cheater.dll

<comment><USER68> Reason for downvote: you seem to have no clue about blockchain or cheater.dll whatsoever.

<comment><USER26> Blockchain is all I work on and you seem to not understand my suggestion.

cheater.dll needs to be loaded in memory along with the game. Correct, right? If the original build of the game has already generated an encryption key that is stored on a server or a distributed ledger using your account, then tampering with the origonal build in memory will result in generating and invalod key thus changing the ledger or the stored key on the server, and not matching the ledger. If this happens then it invalidates your build and the distributed ledger would need to updated, but since that is not allowed in this instance all ledgers would reject your change and flag the block and the account. Making it easier to find who attempted a change. Sure this can be done on a server but because of the tamper proof inherited by a distributed ledger it would make it harder for this code to be shared. The cheater can still change the code but it would not be able to share it.

<comment><USER87> How would it invalidate the build? How would the server find out the build was tampered with? Why would my hacked game add anything to a blockchain? I've followed blockchain tech closely since '13 and your comment makes no sense.

<comment><USER26> apparently not close enough.</comment></comment></comment></comment></comment>


The Truth About J.D. Power's IQS - <AUTHOR> http://www.thetruthaboutcars.com/the-truth-about-jd-powers-iqs/ <comment><USER2> "J.D. needs to re-think their methodology and reporting."

I assume they've thought about it quite a bit and know how to get themselves paid.</comment>


iRead - facebook app to track your books on your facebook profile - <AUTHOR> http://www.facebook.com/apps/application.php?id=2406120893 <comment><USER2> Just curious how you got 1000 users already. What type of marketing did you do?</comment>


The Major Urban Revolution of Minor Transportation Means - <AUTHOR> https://www.strongtowns.org/journal/2018/9/13/the-major-urban-revolution-of-minor-transportation-means <comment><USER2> >We are only on the first steps of the urban revolution. It seems as if nothing has changed with the increased usage of said bikes but an uptick in associated accidents. But that was also the case when the car was introduced to the city. People demanded that every car be led by a man walking in front of it with a warning flag in hand. The car frightened both horses and pedestrians and claimed road rights. The public was furious, safety advocates wrote impassioned articles and demanded that cars be prevented from entering the city… sound familiar?

Good insight. Many people in my city decry bicycles and scooters (motorised or not) as a danger to pedestrians, but deaths and serious injury are almost always the result of a pedestrian being hit by a car. People complain that dockless rental scooters and bicycles block the sidewalk, but I have never experienced being blocked by one. On the other hand, I frequently have to navigate around cars parked on the sidewalk, blocking it completely. There is a cultural blindness to the problems caused by cars.

<comment><USER3> One of my biggest fears while cycling in the city is uber. Drivers frequently pull to the curb aggressively without signal, often blocking bike lanes. Unlike a taxi there are few markings to alert cyclists that the car will show this behavior. At best you might spot an airport rideshare pass in the back window, but these are often placed in the corner of the drivers side, making them hard to see from the edge of the road.

<comment> village-idiot One of the selling points of Uber in their marketing, at least in chicago, was that Uber drivers would drive like "regular" people and not like cabbies; because cabbies in Chicago drive like crazy people. In a very short period of time Uber drivers all drive _exactly_ like cabbies, which is obnoxious since there's more of them.

<comment><USER4> I live in Chi too and frequently lyft. They need to make it easier to report bad driving. That would solve the problem. I submit tickets when the driver drives like a madman but it's not clear what to do about it inside the app.

<comment><USER5> Given that Uber/Lyft track every inch of the car's journey, it seems entirely feasible for them to _automatically_ catch some types of bad driving (exceeding speed limits, illegal U-turns, frequent hard braking, etc). But currently they're not incentivized to.

<comment><USER6> I would rather prices went up and they did this. The point was that the data should make the experience better.

</comment></comment></comment></comment></comment></comment><comment><USER7> I sure hope that it won't take seventy years for cities to ditch the private car as the primary means of transport. The future belongs to a mixture of public transport, bicycles, electric scooters, and, once the technology matures, shared autonomous cars.

Imho the lever that needs to be pulled first is internalizing the costs of parking space. Free parking in cities must go. A parking spot should cost about as much as a small apartment. That's because it consumes about as much space as a small apartment if you put a couple of stories of housing above it. Abundant parking aggravates sprawl and makes all forms of transportation more expensive.

Tokyo is already ahead in this. There are basically no surface parking spots available in the inner city.

<comment><USER8> Unfortunately mandatory parking minimums are written into the zoning codes of most American cities, leading to the surfeit of parking in lots of places. Undoing this will take no small amount of work.

<comment><USER9> Another argument to rework the whole zoning thing....

<comment><USER10> Another software developer refusing to work in or understand an existing working system and instead asking for "the big rewrite", which assuredly will get finished on time, with all of the features of the existing system and none of the problems.

<comment><USER11> Heavy zoning has caused housing in many areas to be far more expensive than it needs to be.

The push for change is being driven by economists and activists, not software developers.

SB-827 in CA failed but it'll be interesting to see what comes next.

[https://www.vox.com/cities-and- urbanism/2018/2/23/17011154/s...](https://www.vox.com/cities-and- urbanism/2018/2/23/17011154/sb827-california-housing-crisis)

</comment></comment></comment></comment></comment><comment><AUTHOR> I see these more and more every day in SF, even after the city banned the scooter shares.

I think the moment of the scooter companies dumping thousands of them on the street made a lot of people curious who otherwise wouldn't have been, and got a LOT of people to try them out. And once you try it... wow.

The mini scooter is pretty revolutionary IMO because it offers the convenience of the bike, but it's much easier to balance and feels safer than a bike, and of course the motor.

I think these things are greatly expanding the number of people who feel they have something to gain from the streets being shared more equitably, and in the end how we use our space is all about voting blocs.

I'm excited to see how this plays out over the next 10-20 years.

<comment><USER12> >"The mini scooter is pretty revolutionary IMO because it offers the convenience of the bike, but it's much easier to balance and feels safer than a bike, and of course the motor."

How do you reckon this?

In my experience, razor-style mini scooters are harder to control at speed, and their tiny wheels are prone to catching ruts and not very good at riding over uneven surfaces.

Compare this to bikes, which basically balance themselves once moving, and have large wheels that easily ride over bumps and ruts, and provide some additional cushioning inherent to spoked wheels.

<comment><AUTHOR> I base this on the experience of my wife and young kids trying them out. I love biking and do it all the time, but they don't. To me biking feels glued to the road. To them it feels like sitting on a wobbly rail. When they tried the scooters the first time it was like a revelation, "wow this is so easy!"

So, anecdotal, but I've heard this from others as well.

<comment><USER12> Sure, it's easier to just jump on and go, but there are huge limitations compared to bicycles. In addition to what I mentioned, you just can't go very fast nor very far. When the battery runs out, it's a really crap form of locomotion. At least when an e-bike runs out, you've still got a (somewhat heavy) bike :-)

<comment><USER10> sure but when the e-scooter runs out, you just leave it on the sidewalk and you still have your LEGS. With a bike you still have the bike.

And the GP is right, many people have real issues with bikes, they're harder to do right. Scooters are easier because of their limitations for many. I feel the safety (frequent crashes) is because people underestimate their safety and ease of use at speed. They're great when you're going at running speed or less for obvious reasons. People super mis-estimate how fast they can run tho, and if you get off one at the wrong speed you're taking a header. Bikes are easier to control in a run-away, but only if you know how to do it.

<comment><USER12> You won't just leave your own scooter behind on the sidewalk. Conversely, you could just as well leave a dockless rental bike behind.

Or you continue riding the bike, without e-assist.

<comment><USER13> The folding scooters(which do come in e-form) strike a good balance between transportation and transportable: You can take them on transit, and carry them inside. Folding and unfolding - on well designed examples, with a bit of practice - can be accomplished in seconds. Walking a bike really doesn't compare. I see non-folding e-scooters as a category restricted to "stunt users" (who need the extra structural integrity) and "rental companies" \- who, as we know, are going to encourage leaving them on the sidewalk.

Electric skateboards and roller skates can boast being even lighter, but most folks will gravitate away from them as a commute device since maintaining control is much more difficult.

<comment><USER12> I'm not opposed to scooters, they're quite fun. However, from a practicality point of view of everyday transport, shopping etc., a bike is simply superior.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> village-idiot The electric bike and scooter have been around for a while, but it seems that the price has finally dropped below a tipping point in the last year or so. They've gone from novelty device (e.g. Segway, home built e bikes) to something that I see dozens of times a day. Heck, a sizable percentage of the homeless people in my area have e bikes, that's how prevalent they are.

</comment><comment><USER14> A policy of wheels in roadways only and pedestrian primacy will keep cities alive. Force cars, bikes, skateboards and scooters to contend for space (dedicated non-motorized lanes helps) but preserve the pavement for foot traffic.

<comment><USER15> Agree with keeping the "walk" in sidewalk, excepting wheelchairs & similar mobility solutions for differently-abled folks, but with everything with wheels that can travel faster than a walking pace (say, 5 mph) having the opportunity to use a space that is normally devoid of pedestrians: the roadway.

<comment><USER16> The roadway is devoid of pedestrians, sure, but it's full of far more deadly predators.

A bike going 10mph is going to be able to stop faster, maneuver quicker, and do a lot less damage to a pedestrian if they hit them than a car going 55mph would to a biker going 10mph.

</comment></comment></comment><comment><USER17> It was interesting for me to discover how the motorized scooter rental companies maintain a charge on the device's batteries:

[https://www.theatlantic.com/technology/archive/2018/05/charg...](https://www.theatlantic.com/technology/archive/2018/05/charging- electric-scooters-is-a-cutthroat-business/560747/)

</comment><comment><USER18> While we can have hope in the tri state area or San Francisco, I don't see much traction any where else. In my city, the city government went hard on the scooters, and now they are exclusively being ridden on the sidewalk instead of the road, endangering pedestrians and the like. Unfortunately, the rest of the US is still stuck in 1990.

</comment><comment><USER19> There's an actual existing place where most people ride bikes and you can see tons of really lovely videos of it here:

[https://bicycledutch.wordpress.com/](https://bicycledutch.wordpress.com/)

</comment><comment><USER20> A nice thing about electrical kick scooter is that one can easily take them on a train. I started to see in Oslo how more and more people living in far away suburbs use them to get to/from train or underground stations.

</comment><comment><USER21> If bikes are going to be treated like real vehicles, then I think that safety regulations need to catch up. Something like: Require breaks and a free wheel on roads so that bikes can coast and stop suddenly without loosing control.

Ban clip on pedals from roads so that bikers can put their feet down at intersections instead of lurching forward and back unpredictably.

Require bikes to keep up with the speed of traffic (when not in bike lanes) just like cars are expected to.

I personally would also like to see electric assist/motors be mandatory so that bikers are less tempted to blow through intersections in order to avoid losing momentum, but I can see how the cost would be prohibitive.

<comment><USER10> people do the back and forth thing with clip ins to show off or because they are bored. I have clip ins and easily take my feet out at intersections. No issues.

<comment><USER21> Ah, I didn't realize that, thanks for the correction.

<comment><USER22> There's a name for this technique, if you're curious: [https://en.wikipedia.org/wiki/Track_stand](https://en.wikipedia.org/wiki/Track_stand)

</comment></comment></comment></comment><comment><USER23> Where can I find Chinese electric bikes in the US? I don't even know what brands to search for.</comment>


AIG considers suing government for bailing it out - <AUTHOR> http://www.washingtonpost.com/blogs/wonkblog/wp/2013/01/08/aig-considers-suing-government-for-bailing-it-out-world-implodes-in-on-itself/

<comment><USER2> I think that this headline a bit misleading. AIG is legally required to consider it because their former CEO is a huge shareholder and is demanding that they consider it. Since it has potential shareholder benefit they have to hear him out.

NPR's Marketplace covered this story tonight and provide a bit of context:

"[Henry Hu, a law professor at the University of Texas and a former SEC regulator] says AIG's board has an obligation to consider the lawsuit because of shareholder interests, "but they should also consider the costs of this in terms of their relationship with the regulators."

Don't forget, AIG is the company that just started running ads saying -- no joke -- "Thank you America."

A spokesman for the New York Fed said the allegations have no merit because bankruptcy was AIG's only alternative. That would have wiped out shareholders entirely.

[Phil Angelides, who chaired the Financial Crisis Inquiry Commission] thinks the board shouldn't consider this lawsuit for more than a minute.

...

AIG issued a written statement today saying it will follow the law and consider the suit. In earlier email to Marketplace, an AIG spokesman declined to comment. Though he did say Thank You."

Source: [http://www.marketplace.org/topics/business/aig-thanks- bailou...](http://www.marketplace.org/topics/business/aig-thanks-bailout-see- you-court)

<comment><USER3> If a large shareholder insisted they build a moon base, would they be required to consider that, too?

This is approximately as reasonable.

<comment><USER4> _If a large shareholder insisted that build a moon base, would they be required to consider that, too?_

If they owned 51% of shares? Well, er...

</comment></comment></comment><comment><USER5> Nobody made AIG accept the bailout. They could have walked away.

It's fortunate that even with the short attention spans of today, the word "AIG" is now synonymous with "fuck up".

They should have waited another year or two.

<comment><USER6> I think the problem is that there's very little overlap people that accepted the bailout and people who are running the company today.

We like to think of corporate entities as these monolithic self-governing decision-making entities, but most likely it's some top executive's knee-jerk reaction to not meeting the 2012 goals that his bonus depended on.

</comment></comment><comment><USER7> This was on the homepage less than 24 hours ago but from the New York Times: <http://news.ycombinator.com/item?id=5024900> — from what I can see they're basically saying the same thing. The whole situation is messed up, if they proceed I'm sure it'll rattle a few birdcages in Washington.

</comment><comment><USER8> It's a shame the government didn't break up these financial giants when they had the chance. Now they are powerful again and don't care what the government thinks, and they'll continue to lobby against new regulation, and repeat the same mistakes. Then the American citizens will have to bail them out again. And they know this.

<comment><USER9> What role do industry representatives have in writing a huge bill like Dodd- Frank, and the implementation of it after it passes? It was my assumption that industry has a big role in crafting the laws that regulate them.

<comment><USER10> This is unlikely to change as long as one side is willfully determined to remain ignorant of finance. If you want to write effective regulation, you'll need to understand the industry. Until then, the insiders will continue to run the show.

<comment><USER11> To balance that out, I would state that neither the regulator, nor the _regulatee_ , really understands finance enough to make arbitrarily accurate predictions of consequences to their actions. They are betting that they understand how the whole market, the rest of the market, or the regulators (regulatees only need consider this) will act in response to information they may or may not possess based on analysis they may or may not be able to justify.

</comment></comment></comment></comment><comment><USER12> Doesn't the government own 92% of the company? How can the company make any decision they don't approve of? Did they buy 92% and have no voting power?

<comment><USER13> The government now own no shares in AIG, it was paid back in full and with interest. In fact, the US made $18 billion profit from AIG: [http://abcnews.go.com/Business/government- makes-177-billion-...](http://abcnews.go.com/Business/government- makes-177-billion-profit-aig-bailout/story?id=17074275#.UOzbeInjnaI)

<comment><USER14> The accusation is that the government used AIG to bail out the rest of Wall Street, forcing AIG to settle trades with big name Wall Street companies for a loss. And on top of that, the gov't charged 14% interest on the money it lent.

Yes, they could have "not accepted" that deal. But there are two sides to this.

<comment><USER15> Trades that AIG took at fair terms. Sorry, but if an insurer insures something, it better damn well pay what it promised.

</comment></comment></comment></comment><comment><USER16> I thought there was such a thing as sovereign immunity. How does this reconcile?

<comment><USER17> Wikipedia has some info:

[http://en.wikipedia.org/wiki/Sovereign_immunity_in_the_Unite...](http://en.wikipedia.org/wiki/Sovereign_immunity_in_the_United_States)

Maybe a lawyer will stroll by and give you a real answer.

</comment></comment><comment><USER18> i hope there is a special ring of hell for these guys.

</comment><comment><USER19> Patient survives, sues doctor. Happens all the time.

<comment><USER20> America, fuck yeah!

</comment></comment><comment><USER21> These guys need to hire a normal person to sit in their CEO office and say "What the actual __*?!" to stuff like this, because they clearly do not understand how normal people see the world.

SECOND REACTION: hmm, so they're only 'considering' it because they have to. Fair enough I guess, crazy shareholders must be a nightmare.

</comment><comment><USER22> I hope AIG sues the government, and the scandal and political firestorm that results means that similar bailouts become politically impossible for the next 50 years.

</comment><comment><USER23> Reminds me of the costly executive conference retreat they took after the bailout:

Less than a week after the federal government committed $85 billion to bail out AIG, executives of the giant AIG insurance company headed for a week-long retreat at a luxury resort and spa, the St. Regis Resort in Monarch Beach, California, Congressional investigators revealed today.

"Rooms at this resort can cost over $1,000 a night," Congressman Henry Waxman (D-CA) said this morning as his committee continued its investigation of Wall Street and its CEOs.

AIG documents obtained by Waxman's investigators show the company paid more than $440,000 for the retreat, including nearly $200,000 for rooms, $150,000 for meals and $23,000 in spa charges

[http://abcnews.go.com/Blotter/story?id=5973452&page=1#.U...](http://abcnews.go.com/Blotter/story?id=5973452&page=1#.UOzYUDV2qM4)

<comment><USER24> As the other commenter said, it would actually be pretty dumb to cancel a conference that's already bought and paid for, unless it's for pure CYA PR reasons. I used to work in the meetings and events industry and I can confidently say that the organizers of the AIG conference at the St Regis probably never imagined that it would turn into a PR debacle, because that kind of event is absolutely ordinary. They would not have considered it extravagant at all.

Consider this: you're having a conference for multimillionaire corporate executives and top performers. People who usually work in different locations are coming in to meet together and perhaps bring their spouses for some hobnobbing, strategy talks, and teambuilding exercises. Where do you think they're going to stay? The Motel 6? When you're paying someone a high six figure salary plus bonuses, is it really a scandal to pay $300 for a hotel room?

And by the way, if the rooms "can cost $1000 per night" and you rent out two hundred rooms for your event, if you ended up paying more than $300 per room, you should fire your meeting planner.

<comment><USER25> Top Performers? These are the executives who didn't just grounded their company, but the whole financial system into a hole.</comment></comment></comment>


Exploratory computing with Python - <AUTHOR> http://mbakker7.github.io/exploratory_computing_with_python/ <comment><USER2> I love the title and spirit of this book and completely agree with this sentiment:

> _Lots of books are written on scientific computing, but very few deal with > the much more common exploratory computing (a term coined by Fernando > Perez), which represents daily tasks of many scientists and engineers that > try to solve problems but are not computer scientists. This set of Notebooks > is written for scientists and engineers who want to use Python programming > for exploratory computing, scripting, data analysis, and visualization. > Python makes many of these programming tasks quick and easy and, probably > most importantly, fun._

It's been awhile since I've worked as an applications developer, but I love spending 30min a day just trying things out, even if the code is trivial. The other day I mirrored NASA's astronauts page and started writing some code to parse its "yearbook" of astronauts because I thought it'd be interesting to analyze their professional paths, e.g. civilian vs. military, engineering degree versus...well, actually almost all of them have some kind of engineering degree. Today I spent most of the early morning and noon writing R scripts to visualize the USGS earthquake data...I initially wanted to look at the surge of recent earthquakes in Oklahoma (the causes of which have more or less been isolated to increased fracking activity), but spent a lot of time looking at other anomalies...mostly, other spikes of earthquake activity that I had forgotten about. Admittedly, about 80% of my time has been struggling with R, but even that has led to some nice side roads...I finally opened up Hadley Wickham's book ggplot2, which I had avoided in favor of "cookbook" type references...but reading his book has been a joy...learning about the theory and "grammar" of visualization has helped me a lot in terms of how to think in general as a programmer...nevermind learning how to use ggplot2 effectively.

I think the fundamentals of computer science are absolutely necessary to teach...I just wonder why so many of the exercises have to be about moving a pixelated robot around or rewriting hypothetical tic-tac-toe scenarios when there's so many accessible, real-world things to explore computationally.

Edit: though as a criticism, unless the book is meant to have an epic sweep of content...I don't think it needs to cover object-oriented programming. Don't get me wrong, OOP is a great mindset in the right software engineering situation...but nothing kills the momentum of exploring with code than, "Time to design some classes and interfaces!" I have folders of dead code written in efforts to model legislative activity as OOP hierarchy...maybe it helped increase the sophistication in which I approach data problems...but these days, I get so much more done writing functional...or at least _working_ code, and putting off design considerations until much later in a project.</comment>


VW slumps to first quarterly loss in at least 15 years - <AUTHOR> http://www.reuters.com/article/2015/10/28/us-volkswagen-results-idUSKCN0SM0QB20151028 <comment><USER3> I don't buy the implication that this didn't go up extremely high in VW. I'm sure they'll find some low level drone(s) to take the fall like normal, but generally speaking if they were engineering and building cars which they KNEW couldn't pass emmissions it had to have been a concerted effort to cheat the system inter-departmentally, which means coordination, which means senior management involvement.

<comment><USER4> The CEO has already been fired, but for something this big it won't just be the low-level types that get fired.

<comment><USER5> >The CEO has already been fired

...with a 67M severance package

[https://www.washingtonpost.com/news/on- leadership/wp/2015/09...](https://www.washingtonpost.com/news/on- leadership/wp/2015/09/24/outgoing-volkswagen-ceos-exit-package-could- top-67-million/)

<comment><USER6> He wasn't fired, so he shouldn't be getting a "severance package". He resigned. He shouldn't be getting anything for the tens of billions of dollars in damage caused to the company. I wish CEOs stopped being _rewarded_ for screwing up.

What's worse is that VW is still pushing the narrative that only two engineers are at fault here, and it refuses to blame the CEO, even though it keeps finding millions and millions of other cars affected by this.

<comment><USER7> _I wish CEOs stopped being rewarded for screwing up._

CEOs typically aren't rewarded for screwing up, they get rewarded for _signing_ up. Any severance package is most likely negotiated before they they take the job so as to get them to show up in the first place.

Now why it's that way is a different discussion. Want me as CEO of GroupOn or Yahoo? Damned straight you're giving me a severance package whether I screw up or not, otherwise I'm taking a less risky job. But CEO of VW? WTH does the company need to offer a severance package for that gig?

<comment><USER8> > Want me as CEO of GroupOn or Yahoo? Damned straight you're giving me a > severance package whether I screw up or not, otherwise I'm taking a less > risky job.

Why? Tons of employees take on this risk when joining a startup, and they don't get a huge severance package. Risk should be aligned with reward - <USER2> you succeed you should be very well compensated for a risky gig, but if you fail you shouldn't also be very well compensated. The only reason these large CEO severance packages exist is because other CEOs sign these deals, and who doesn't want to be on the "heads I win tails you lose" side of a deal.

<comment><USER7> _Why?_

I said why: I'll take the equally-well-paying and less risky job over at FoobarCorp, which is turning a profit and shows no signs of doing otherwise for the foreseeable future, where I might be employed for a good long while and leave without a black mark on my resume. If I'm going to have the albatross around my neck of not turning around an already screwed company, you're paying me whether I turn it around or not.

Don't shoot the messenger, I don't like it any more than you do. I'm just laying out what the current incentive system is. Should Fiorina just scraped by on her $4 million/year (or whatever it was) salary, and made big stacks from her options when she turned HP around? Sure, just like the rest of us. But that, unfortunately, isn't the way it works. Instead the rest of us get to sit around saying, "hell, I would have been happy to fuck up HP for _half_ that amount", because we're not members of the "get paid whether you do a decent job or not" club.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> General Motors - which knew about their broken ignition switches for over a decade - got away with a 900$m fine. That defect killed at least 124 people.

<comment><USER10> And they got bailed out by the US taxpayers.

I am just astonished at the outrage over some skirting of an arbitrary number in an emissions standard, in contrast to the comparative yawn over the things other automakers have done that they knew would actually kill people.

<comment><USER11> Diesel emissions kill tens of thousands of people each year.

It's probably hundreds of thousands across Europe. VW's scam has added to those deaths. VW killed far more than 150 people.

<comment><USER12> you're way off

[http://www.latimes.com/business/la-fi-vw-pollution- footprint...](http://www.latimes.com/business/la-fi-vw-pollution- footprint-20151007-htmlstory.html)

[http://www.sciencealert.com/scientists-estimate-the-death- to...](http://www.sciencealert.com/scientists-estimate-the-death-toll-of-the- volkswagen-emissions-cheating-scandal)

while pollution will affects almost everyone on earth, the cumulative effect is not that much and pollution is not a major cause for deaths to begin with

[http://apps.who.int/gho/data/node.wrapper.ENVHEALTH3?lang=en...](http://apps.who.int/gho/data/node.wrapper.ENVHEALTH3?lang=en&menu=hide)

<comment><USER11> From your link:

> At present, outdoor air pollution kills in excess of 3 million people every > year, and automobile exhaust is a significant part of the problem.

Are you talking about this bit?

> the harmful nitrogen oxides emitted by Volkswagen's affected diesel vehicles > – which the US Environmental Agency claims were 40 times higher than the > legal level – could be responsible for as many as 106 deaths in the US > between 2009 and 2015.

That's _the US_ , where diesel is not as common as Europe.

Your link says that:

> From a global perspective, the actual death toll could be much higher.

<comment><USER12> 600 000 premature deaths and of the diseases caused by air pollution in the WHO European Region in 2010

[http://www.euro.who.int/en/media-centre/sections/press- relea...](http://www.euro.who.int/en/media-centre/sections/press- releases/2015/04/air-pollution-costs-european-economies-us$-1.6-trillion-a- year-in-diseases-and-deaths,-new-who-study-says)

Some percebtage by car, of which some percentage by diesel cars, of which some are wv, of which some have defeat devices.

Edit: sorry totally misread parent post

<comment><USER11> > hundreds thousands death caused by the pollition increase from the defeating > device

I didn't claim that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Well, that's what happens when your software lies.

At least EFF had a small win here [https://supporters.eff.org/civicrm/mailing/view?reset=1&id=1...](https://supporters.eff.org/civicrm/mailing/view?reset=1&id=1234) despite losing the fight against idiotic CISA.

</comment><comment><USER14> They feed roughly 600.000 people worldwide (without suppliers) and have been around for more than 70 years. Just saying.

</comment><comment><USER15> The article mentions €6.7bn set aside, but their trimestrial loss is $3.48bn only. IANA-financial-analyst, but they're still profitable after scandal. Here are a few points of comparison:

\- Revenue 2013: €197 billion (over 1 year)

\- Profit 2013: €6.4 billion (over 1 year)

So the scandal cost them 1 year of profits, 3% of their revenue.

</comment><comment><USER16> I'm surprised that in the US their sales didn't take nosedive, I take that to indicate their customer base has a very enthusiastic and fundamental core... Which is good for them. If this does not shake their confidence, then nothing will, and if this is the case worldwide, VW will survive this scandal largely unscathed, relative to the size of this scandal. For a while it seemed like their viability was very much in question, now it seems beside some large write downs and some lean years, they will survive.

<comment><USER17> VW is a giant company and they're sitting on a giant pile of cash. Anyone that thinks this was going to kill VW is not very bright.

This will affect their status perhaps as the world's #1 automaker, but they'll be around for a long time.

<comment><USER18> And they're partially owned by the government of the largest nation that doesn't run a deficit™, so even if they'd be at risk of default, no politician is willing to fire 600'000 thousand people.

</comment></comment></comment><comment><USER19> Ford did the same thing in 1997. Companies seem to recover.

<comment><USER20> Honda as well: [http://www2.epa.gov/sites/production/files/2014-06/documents...](http://www2.epa.gov/sites/production/files/2014-06/documents/defeat.pdf)

</comment></comment><comment><USER21> I wonder if we are going to discover similar emissions skirting in over manufacturer's vehicles soon.

<comment><USER22> Already done. It's funny how the press is only talking about VW but meanwhile there are first tests showing that many other manufacturers do/did the same.

[http://www.theguardian.com/environment/2015/oct/09/mercedes-...](http://www.theguardian.com/environment/2015/oct/09/mercedes- honda-mazda-mitsubishi-diesel-emissions-row)

<comment><USER23> That wasn't "the same". In those cases, they optimized for the kind of environment the tests have (which regulators encourage as that test is supposed to be representative). They didn't have the computer detect whether a specific run was a test, as VW did.

</comment></comment></comment><comment><USER24> VW cars exceed legal emissions 40 times. There is a reason for no preventing to use this cars?

<comment><USER25> I don't think the government can say "you were lied to about your car, stop using it" also VW can't force people to get the recall, why would you want to get a recall that worsens the performance of you car.

<comment><USER26> Couldn't they force the hardware/software modifications when people go in for yearly inspections?

<comment><USER10> Not all states have inspections.</comment></comment></comment></comment>


Consumption Addiction - <AUTHOR> http://phuu.net/2012/03/28/consumption-addiction.html <comment><USER2> Ah, the good old Wikipedia Effect. I think we could phrase it more precisely like this: when following anything anecdote-like, your mind becomes unaware of the causal process of following connections, and perhaps even unaware of the time spent doing so (although that might be more of an effect of Flow[1]).

If anything, this article is too shallow: I have actually gone past the consumption level and into a further abyss, at times. What I mean is, it's possible to crave an even deeper high, and to receive one.

The "trick", if self-destructive behavior can be called that, is that your brain has many different centers, like a language center and an audio center -- some of which are mostly idling while you're consuming information. You can use those zones to consume other information. So, like, I will sometimes play FreeCell (or solve other logic puzzles) while watching a lecture sped up by 33% to eliminate the time wasted by the "ums". The only limitation is eyestrain from staring at a screen too long and that feeling you get after about half an hour of delicious "too-much-ness".

Not all of the mechanisms of addiction transfer. So, here is one of the central mechanisms of addiction, the mechanism of escalation: an addict consumes Z in order to feel better in some sense -- a rush or an altered mental state -- but as time goes on, they build up a tolerance. They stop consuming Z to feel better. They start consuming Z to feel _normal_ instead. That particular situation doesn't happen nearly so much with information, unless you count being nonplussed when you hear someone say something that you've already thought about.

The central problem of addiction is also only incompletely transferred over. I am not consuming information _in order to lose control_ , which is what seems to shift e.g. alcohol-abuse into alcohol addiction. I was for a while addicted to the game Morrowind because I would actually jump into it in order to waste a day -- that was my goal, to lose control of myself. We need to make this distinction early: there is _information abuse_ \-- getting so saturated with information that you don't actually do anything with it -- and then there is _information addiction_ , where the information itself wouldn't be interesting to you, if you weren't going to get lost in it.

[1] What I mean is that _creation_ is not an antidote to losing-track-of-time, and therefore that's not really central to the problem. It is easy to create so much that one forgets to be productive: I will often lose track of the time when I am helping people with mathematics and physics; or even just now, as I am writing this on Hacker News. I could have been programming something useful to my larger goals instead.

<comment><USER3> Thanks very much for the great comment.

I agree, I didn't go as far as I could have — but then the article is intended as more of a warning than an in depth discussion of a struggle. Having said that, I definitely saw in myself the symptoms of escalation.

My hope is that anyone in a similar situation recognises in it themselves and makes a change, preventing anything worse, whatever that might be, from occurring.

</comment></comment><comment><USER4> Excessive information consumption has become an awful lot like watching TV. Both disengage that part of the brain that actually has to work a little bit to come up with new thoughts. Creativity is HARD. I find that it's especially true when I'm skimming the mainstream tech/startup sites and reading over five different posts titled "10 ways to..." or "10 things you need to know about ..." and then not remembering 2 minutes later what the heck I had read.

I used to fall asleep by watching cartoons to disengage my brain and I found that it hurt my memory and awareness the next day. I found myself beginning to do that with information consumption as well and had to do a gut check... I was getting the cartoon effect by reading tons of meaningless posts until I passed out. So are you reading because you're actually seeking particular information or are you hibernating your brain while you let your eyes/mind just wander?

</comment><comment><USER5> \- If Everyone's Reading, Who's Left to Write?

Feast well on your Faustus,

Stuff your face with Springstein,

and hold down the Hirst

Gorge freely on Gormley,

Mange bien on your Monet,

and swallow your Stones

Dine liberally on your Dickens,

Munch on McEwan,

And lick your Lloyd-Webber

Get shitfaced on Spielberg

Drunk on Dean Martin

and bollocksed on Big Brother

Chew well your Cosmo,

Bite hard on the Bard

Consumption is easy,

Creation is hard

<comment><USER6> If everybody's blogging, who's left to read?

The Internet is a billion rock stars on a billion stages. It used the audience up, but we felt important.

<comment><USER7> There's money to be made building stages and doing backstage work :-)

</comment></comment></comment><comment><USER8> Clay Johnson has a book and website, "The Information Diet: a case for conscious consumption", on this topic:

<http://www.informationdiet.com/>

<comment><USER9> I was going to suggest this, it's excellent and exactly what you're talking about. He encourages creation as it gives you a focus and goal for consuming online. Great stuff.

</comment></comment><comment><USER10> Sometimes I think we have an addiction addiction. To me, it sounds like real work is more boring than consuming information for the author. My solution? Find less boring "real" work. I generally find that the amount of time I spend on HN is proportional to how bored I am with my job. If the work really is interesting, I find that I almost have to force myself to use HN just to take a break.

</comment><comment><USER11> The problem of input (reading, listening, watching) without output (writing, speaking, doing) is that, at the end of the day, you have nothing to show for your time. And since none of us are telepaths, to the outside world, it is like you haven't even existed that day.

</comment><comment><USER12> >On the surface, it feels great; learning, gaining knowledge and understanding is fantastic [...] >but I need to be a creator, not a consumer

But _learning is also creative_. All knowledge must be conjectured afresh in the mind that learns it -- the process is the same whether the knowledge is known by others or not.

Knowledge gained from TV and browsing and consuming is of value in life, including in creative projects.

If one is feeling addicted or jaded or whatever then what this really means is that browsing has been used to _distract_ one from other, more pressing, problems, e.g. personal problems

There's no reason not to do both, in whatever ratio seems fit. Cutting oneself off from the culture would be detrimental to one's original work.

</comment><comment><USER13> Great post on something that affects me. Partially why I'm creating Skim.Me (<http://skim.me>). You tell us how much time you have and we curate your routine in one feed. All the content in one ecosystem. Not just news and social but all applicable verticals in the future. For those that are ok giving up their browsing history for us to analyze. Probably not everyone.

</comment><comment><USER14> I guess I don't agree with our current reverence for creation. It's easy to create things and shove them out into the world. The work that comes after, though, is unsexy, unglamorous, and usually less fun than the creation part. It's also where most of the value comes from.</comment>