Dev Tracker - Discussion

I've come to the conclusion that SE needs botters to an extent to keep the markets where their "legit" players need and expect them to be. We as players are older, have more to do, and less time to play, so the pipelines of what RMT brings to the market have become necessary, or the normies are gonna get frustrated and quit.

I do believe there is a line, where the actions of those RMT interfere with the regular gameplay of those legit players, where SE steps in- but even those aren't 100% because they simply aren't putting the resources in to stopping it.

it's the plot of yakuza: like a dragon, basically

It's standard stuff.

The shot callers use low level guys to do the work and risk getting caught. Even when you know the exact dynamic, they won't (not can't, don't fall for that ***) act.

Botting has been going on from the start and will continue to happen as long as the game exists. The only way to reliably detect it at scale is with some kind of client side detection like what WoW used to do with Warden, but then that raises privacy issues like those that were raised when they found out what it was doing. Even that isn't a given (I remember when the Sony rootkit was being used to avoid detection by hiding bot processes from Warden). They also have to deal with the fact a major portion of the user base uses Windower since the vanilla client sucks, that opens up challenges of how you identify people using Lua to simply change gear vs do full on automation.

I think SE has given up on the bots that exist in their current form now. In the past, they were farming and camping NM camps, then controlling the market with item prices. Now aside from a few inconveniences like old Dyna, they are driven to farming JP and time gated content like Dyna-D/Omen and selling services. These things may drive RMT activity but they help the player base progress rather than limit it like they were before. IMO they do a lot less damage than they did 15 years ago, where competing for critical items like O.kotes was a losing battle that took weeks.

I also don't think tracing them is an easy problem. Whatever is going to be done as to be feasible at scale and programmatically. Using sphere bots as an example, they aren't going to dedicate staff to tracing each trade made by a farm bot back to ban the crafter. Doing it programmatically would risk catching people who were actual players and banning them instead. In years past they probably would've done that and not cared, but now I don't think they have the cycles/staff to do it and don't see it as worth the risk of banning innocent players. That said, it's easy enough to identify the JP bots, I just think they know it's a losing effort and keeping them contained where they are now is better than whatever else it is they could be doing. It's a lose-lose for them and leaving them alone is probably the better, less risky decision.

I still think the best way is to devalue what they are doing now via content. Who buys O.kotes anymore? That used to be a $$ item that is now worthless. If you reduce the value of what they are doing (e.g. spheres, jp) or make it harder to acquire what players want without participation, then you make it more difficult for them to bot it.

I also think Celebrindal is right, they likely see it as a necessary evil since it's a smaller player base that is older and doesn't have 6-8 hours a day to grind exp. That said, EP/ML has not given me confidence that they know how to solve this problem given the quantity required to get from 20->21.

This seems to be a central design philosophy in XIV, which makes gear both easy to get and tightly controlled in power, to the point that it's basically an afterthought.

There is quite a of bit of stuff they could do automated, simply by measuring the time it takes for an activity, the time a player's been in a zone repeating the same tasks, the time between requests for things, multiple of the same exact packet coming from multiple clients at the same IP being fired at the same time... it goes on and on, and that's just automated stuff. God forbid they lift a finger and just act on the reports they get.

Were the 4006 errors a trial run of something to come? To help calibrate it for false positives? Perhaps. So far, we've seen no real new punishments for those who were receiving them.

Then you have the issue of multiple people in the same household, which I know for a fact happens, just happen to use the same TP move or spell at the same time and there they go automated ban.

Let's say you are on whm in Odyssey and using cure III to heal someone and then your other half is on RDM in a Mlvl party using cure III and boom insta ban because the automated system caught you using the same spell on multiple clients. But you were innocent you say? Prove it you dirty RMT.

This is the problem that SE and the rest of the MMO market has to face while there might be multiple ways of auto detecting bots those same systems can also target actual players.

Let's not pretend that ffxi botters aren't blatantly obvious. ***like easyfarm and cureplease has no downtime. If you go for a 6 hour period and there is no interval where you went 20 seconds without performing an action, you're botting. Never mind the chinese ones, that go 24/7 at times.

Sharing accounts is already against TOS and there's obviously a threshold that can be set such that no legitimate player is likely to ever hit it.

They can ban you because it's Wednesday if they want to.

Watching players using Send/Multisend send duplicate actions repeatedly over time it's blatantly obvious. The same volley of packets for that dude's shitty *** Summoner burn party is blatant as hell. You can see people also doing it with their alts spamming Savage Blade at the same time repeatedly. On the server's end, it's the same packets simultaneously sent over and over, not a random WHM and RDM sending a random cure at the same time.

Flag these occurrences, set a ceiling for an acceptable number of false positives in so much time, and then suspend accounts when they meet your limit. Done.

They don't have to explain it to you in jail anymore. You'd get kicked offline and an email notifying you of your suspension/ban and the general rule they state you violated. No appeals. No nothing.

Getting worked up over botting is a waste of time. They have a small team about would need to detect client side programs witch SE said they wouldnt do. Best hope honestly is to report them to STF and let them investigate. Other than people pos hacking SE isnt going to detect anyone other than some random bugs or glitches that get patched. Mabey new pol error was from new detection method, maybe it was just some crappy code they did on there back end. My Bet would be the later. This game was build to run with people on 56k and theres people with high latency everywhere. To get a program running that could detect with 100% accuracy would be a nightmare.

SO the TLDR version is this. Your best bet is to just report them to the STF if your bothered so bad.

A certain bot has been documented being reported one hundred times to the STF. Don't get your hopes up on that working either.

STF successful follow through rate lower than KC drop rate.

Everyone else: Make change to the system to auto detect botting, Report the botters to the STF, etc

Me:

and all of them risk alerting innocent players that then is needed to be sort through


"the time a player's been in a zone repeating the same tasks"
What is considered the same task ?
I've been in 48+ abysses EXP'ing back in the day am i a bot for that? i did leave a few time of the zone does that reset the timer because im human , then bot just needs to do the same thing

"The time between requests for things,"
how are you knowing it not just a human being lucky and also you can randomize timers in a bot so again meh not really

"multiple of the same exact packet"
i believe a lot of packet are identical and if a player can change that so can a bot


"clients at the same IP"
So now players living in a dorm are just botters?
again also easily to bypass with vpn's. and i will not catch botters that are not reusing ip. but will grab people that are simply multiboxing

"being fired at the same time"
nothing happens at the same time not even with botters. so you have to define a time threshold for this. is the same time within 10ms. 100ms 1000ms?


the problem is these are all nice concept if you complete ignore how the world works and that the fact these concept needs to be quantified.

Every solution is easy when you don't have to quantify it.

they have like 3 people working on the game. you want them to go after botters or add new content. You want them banned? Report them to stu on a jp client. and hope. bots have been around for 20 years and will be around til they close the servers.

I for one cannot believe this 20 year old game hasn't effortlessly solved a problem that every single MMO ever released continues to struggle with to this day.

Wow, how did some of you guys make it through secondary school with reading comprehension like that?

The bots will outlive us all.

They didn't fix the fact that indi spells instantly wear off when the level sync levels up.

The game changes, the bots evolve with it. This is the way, and will continue to be the way.

There is also a lot of talk about if I spend X amount of time in Y zone how do you tell if it wasn't human. The reason we have automated systems replacing what people may have use to do is because it's more efficient; that's exactly the reason bots do it too. Even if you spend 60+ hours in a zone, you are not capable of doing it at the same speed, and endurance level as a bot for 60 hours. Your concentration will break somewhere; you will stretch, stop to read a post on FFXIAH, something, somewhere.

Same thing goes for spamming commands and multiple other scenarios. When I play myself I tend to be more spammy with macros and pressing JA, but the client is also there to prevent these things from happening. So depending how how well this bot is written, it may have some effect to them determining as well.

Another thing to look at is if you go in to the gates zones, and look. You may think they are the worst thing that could exist in the game, but why are their parties always full of people standing around?

Not to mention things that Thorny pointed out, like multiple accounts, and other ToS stuff being broken and nobody minds. It's not our rules to bend. You accept them, or you don't abide by them.

Just a few thoughts.

I also would like to put a bit of focus unto the fact that SE for some reason, compared to other companies, has always been particularly cautious when it comes to banning people.

What may seem obvious to us, and maybe sometimes it really is while sometimes it's not, is not as simple for them.
It's like they need absolute undeniable proof before they can ban someone, and appearently the tools they have in their hands are less powerful than some of us imagine them to be.

I wonder about this excessive cautiousness though. I mean it's a private game, a private service, as far as legal matters are concerned they shouldn't need all these "proofs" to do whatever they want with their private server.
Even if they do a mistake and ban someone who didn't deserve to be banned, so what? They certainly won't go to jail for that, right?


Yet, for some reason, they have undoubtely been way more cautious than many other companies.
Is it an internal directive of SE?
Is it a socio-cultural difference between western and eastern companies?
I really don't know, I just wanted to emphasize that when you're a company and you're dealing with customers, you have different means, different ways and different perspective on topics that may seem overly simple and obvious to our eyes.

It's not that complicated. They have all the detection required. The issues are two fold.

1) banning is bad m'kay. Lost subs looks bad to investors and lowers profit. Any time you drop an account from the books you're shooting yourself in the foot. So it's done selectively.

2) boss of a boss of a boss of a boss has to approve everything

It really is that simple. They could banpocalypse right now with one line of code. But they'd take a million dollar a year hit. Or, they can do nothing, and lose nothing. Kind of a nobrainer tbh. Every decision is based on money, you want it to be more indepth than that, but that just isn't reality.

Personally, I don’t care if they ban the bots or not. So long as they don’t negatively effect the average person’s game time I don’t care.

That being said, if they’re auto stealing mobs from people or setting up in the most popular camps (such as the ones that used to be in Dho gates). Then ya, I think they should be banned.

That may be the case in the current game, but historically I don't think it is. They've pushed ban waves that caught up innocent people and bans that numbered in the thousands, some for ridiculous reasons (like "exploiting" Bubbling Bernie or being on the same CC #). I also have a hard time believing that when the STF was banning people in the thousands every month that all of them were RMT or guilty of RMT activity.

I think what we see now as the "gentler" SE is because they just don't have the staff to deal with it. It's also a tricky balance when your game client is two decades old and everyone is using an unauthorized client that has scripting APIs. I'm also pretty well convinced they don't and have never had extensive logging, again keeping in mind that solving storage issues at scale 20 years ago was a different animal than it is now. In years past, they'd convict you of using a fishing bot by sending you a /tell if you were reported and if you didn't respond, you'd get banned. These manual processes don't scale well with low staff and if the backend isn't architected with the necessary logging in mind from the start, there may be no solving it without a lot of development effort.

If you use fishing as an example, tracking and logging all fishing activity across the entire player base and watching for subtle patterns that indicate botting would be a really performance and storage intensive task. When you implement these sorts of checks or logging, you have to consider it happening thousands of times a minute across multiple servers, even with modern hardware, that could be a problem, even moreso when you start including a lot of the other hooks for other activity.

I've played a few other MMOs over the years and around the time FFXI was booming, most of them were a bit more conservative on banning and gave you more room to correct if you were doing something. SE has never really done that IMO, their ban hammer has always loomed as a risk of playing, being accused of something, then losing your character even if you did nothing wrong. I think this is a partial reflection of their lack of logging and evidence gathering ability in the game. I think this is also reflected in how they manage things like recovery of lost items or conflicts with drops.

There was actually an incident in the summer of 2009 that caught thousands of innocent players in a blanket ban. S-E's task force developed an automated script to catch RMT gardening bots, but tons of legitimate players used gardening as a source of income too. At the time elemental ores were in high demand, and one of the easiest sources to get them was through gardening. Calling S-E's customer support was complete trash too. The representatives would just read from their script, telling the player their account was flagged for RMT activity, and regardless what the player said that was the end of the story. That's how their customer rep always worked back in the day even when it was fully staffed. The people on the phone were clueless and had no authority to do anything beyond basic account stuff like name changes and payment updates.

It took months for the complains to actually get through, and they only did because the volume was too large for s-e to ignore. In the end many of those bans were reversed, but s-e lost business over that and I'm sure it left an impression on them. They haven't banned freely like that ever since.

Yea, I guess a counter point to my earlier post is that they somehow had the logging facilities to ban these folks, those "exploiting" bubbling bernie, and that Salvage thing

What are people doing to bubbly Bernie?! Nothing is sacred anymore.

Years ago a bunch of people were banned for exploiting him. The clocks used to not be R, so you could stack them in your inventory. Folks were killing him and filling up on clocks then trading them in. Keep in mind this is when the economy was considerably less inflated.

There was a ban wave and the clock was changed to Rare. I don't know how many were banned for it but from what I understood it was a handful of groups that had been farming it.

What makes everyone think they even want to get rid of the problem for good? Those RMT and bots are paying sub fees and stimulating the economy, when it gets bad enough they just do some pruning but I doubt the company wants them gone for good. Would seem to be common given that almost no MMO has fully gotten rid of RMT, just do some cleanup every now and then and keep business as usual.

The only thing I ever got out of doing bubbly bernie was calculating his max MP as a PLD using Aspir. This was after people discovered that kryptonberry NM in Pso'Xja would stop acting entirely when he runs out of MP, it made want to go around and find the max MP of other monsters, since prior to that I assumed that monsters had infinite MP.

By being able to properly debate without the need of insulting people that disagree with our arguments.
Please let me know if there is more you need explained, and ill happily assist you.