It's the subject of many flame wars between players on game forums. I am a (ARPG) player myself and my stance is that cheating in loot based games is detrimental to the multiplayer experience and should be combated aggressively. By cheating I mean the use of bots, duping of items and the use of hacks / exploits that otherwise give an unfair advantage. I know there are lots of people who feel the same way about this. This is evident by the many outcries from players when they are about to toss in the towel because playing it legit basically means they are wasting their time trying to compete against the cheaters.

The opposing side is a group of players who sometimes go as far as claiming that without the bots and dupes, people would stop playing because of lack of (high end) items in the game economy. Another statement often heard is "you can just play it single player if you don't like the situation, nobody forces you to go multiplayer". But what it boils down to is of course greed and also real world money with virtual goods being sold for cash. And a group of players who violate the EULA and in many cases seem to get away with it.

It's my feeling as a player that companies should do more to combat this situation. They make the decision to have a multiplayer aspect in their game so they should also make sure they enforce their own EULA and not have multiplayer ruined by a bunch of cheaters.

Again, this is from my view as a player. I hope I can get some responses from people here who have experience with this subject as developer or as member of a development team.

Possible reasons I can think of why enforcing game play security (let's call it that way) is complicated are:

1) The game's business model doesn't allow for enough staff to keep moderating after release. The problem is related to not want / be able to spend much on this after release.

This because games with subscription based business models seem to do much more to combat the problem.

2) The problem is underestimated or simply not given enough thought during development of the game. Maybe the subject was just not very high on the agenda during development.

3) Bandwidth is an issue. Locking and bolting everything down would take bandwidth that can be used on other things instead.

4) Players will always find holes in the security no matter what.

That's just a few points that I hope will trigger a discussion. I'm really interested to see how developers look at this problem. If you have experience in this please let me hear it.

By cheating I mean the use of bots, duping of items and the use of hacks / exploits that otherwise give an unfair advantage.

All of these should have been considered as part of the game design and addressed as business decisions. People will attempt to cheat. There is always the analog hole. You will always have people who are exceptionally skilled whose behavior is nearly identical to bot behavior. There will always be exploits. That is real life, and the designs and technical assessments need to account for it.

Online games have the feature that they can be fine-tuned after launch. Bugs can be fixed, trading rates adjusted, and new features implemented that serve as a resource sink.

For the additional items in your post:

1) business model doesn't allow for

Business decision. Having 24/7 monitoring means either paying people for the job, or having enough trusted community members who can help with the task.

2) problem is underestimated or not given enough thought during development

"Fix it after launch" is not ideal, but sometimes is the most cost effective business decision. Having a product that is a commercial success with some defects is generally better than not having a product. Of course, as the number of problems increases the commercial viability plummets, so the business risk is substantial, but still a business decision.

3) bandwidth

I think you mean development resources and project scope, but yes, you need to decide what is important enough to take action on versus what can be monitored and fixed if necessary versus what can be ignored.

4) Players will find holes

Yes, they always will. Good design and implementation can help discover them quickly. Better design and implementation will detect it and immediately respond.

Well, I think as a business it is important to distance itself from "player outcries"...

if something makes people rage, but they continue playing nonetheless, obviously its not really detrimental to business. And as a player, I doubt that players are really as angry about the exploits as they make it look like online... or its only a small vocal minority that is leading a rage-war, most probably because of other agendas.

Somebody got access to a highend item he shouldn't have too... yet its an ingame item that is properly balanced, and others can get it to by just playing longer / better... well, big deal. Clearly a hole that needs to be plugged, as players might be less inclined to face the grind if the item is available with an exploit. And clearly, part of the accomplishment of owning an item is gone when its no longer clear if you got it legally or not.

Hardly the "sky-is-falling" scenario some people make it look like.

Duping of items is quite similar... clearly something that again might be detrimental for peoples readyness to grind, and feelings of accomplishment. Additionally, if players can trade ingame items, that might really upset the ingame economy.

Again, hardly something that breaks your game to the core.

In both cases, these exploits are ONLY bad because of common design decisions. If a player cannot trade duped items, he cannot influence the economy. You might even implement a mechanic that would punish a player for selling the same item over and over again to NPCs (for example by slashing the sale price for every consecutive item sale after the first).

And to be honest, I am not sure that the ability to trade items, or the ability for an ingame economy to fluctuate because of player action is really adding all that much to player investment. Many online games flourish without it, and seeing how games that implement it have to watch their ingame economy, I dare to say its not worth it in the end.

The fact a player got a highend weapon by an exploit, safe from "hurting other players feelings", is only a problem because of design decision. If a game has a robust PvP mode, for example one that levels all players, by for example egalizing their weapons stats, the cheated super weapon has little influence on the game play of others.

Using bots in loot based games is another big outcry I only understand half. Sure, having to do the full grind while the player next to is farming his levels while sitting before the telly and having a blast might be annoying... but maybe sit back just a moment and think about WHY that is annyoing to you!

Maybe there is again a design flaw revealed by the fact that the exploiting of bots annoys other players? Because as long as we are not talking about a teambased game (where bots are quite annoying, not as annoying as bad players that are statistically WORSE THAN BOTS, but still annoying), no player has any detrimental effect on their own gameplay because there is a bot farming next to them. Sure, the bot might be farming away the loot and enemies faster than they can click themselves... that is again not a problem caused by the bot, a player could spawn camp enemies and suck away all loot with quick fingers.

The design flaw here is simple: The game is just not fun to play! If you don't enjoy the grind enough to warrant the long hours playing, then maybe the guy running the bot for the grind is doing the only sane thing: letting a machine do the work for him, and enjoying his free time doing something he actually ENJOYS!

There are many online games that where able to design a gameplay that was fun even when played for 100s of hours... I cannot remember an ARPG that falls into this category, but then I am no diehard ARPG Fan.

I can tell that it never bother me much to grind tanks in World of tanks. The gameplay is fun even when you have to play 100s of matches to get the next vehicle... it simply never becomes stale, if you enjoy that game. And while some vehicles might be less fun to play, the gameplay itself is never the bore some longwinding online games become when you have to click the same button over and over again without thinking to reach the next level.

And yes, there are bots in WoT, and they annoy people. But this is a teambased game, the only reason why other players are pissed is because the bot is taking a slot in the team that could be used by a good player, or maybe a unicum. People are just as pissed when they find out they have an incompetent player or troll in their team... at least the incompetent player might not be doing it on purpose. Still, the problem is not the bot, but the missing contribution to the team effort.

There are all kind of real, concerning hacks and exploits that are directly detrimental to players enjoyment of a game. They cannot be designed around, other than increasing the security. Aim Hacks and the likes.

Again, in a PvE game not so much of a problem. Design the game so the grind is fun, PvP is tightly controlled, and so is ingame economy. Most of the exploits you listed will no longer be a problem for 99% of players.

The rest is the angry minority that is always angry. Do something visible to appease them, but don't expect them to shut up. And never invest too much into these actions. The important part was designing the game to make the fallout of the hacks less severe. Because your game will be hacked. Your security will fail. And your players will complain.

Disclaimer: I am NOT saying that the exploiters themselves are not damaging to the business. Potentially. They are getting the full movie while only paying for 10 minutes, so to speak. They ARE annoying your playerbase.

All I am saying is if you want to protect your business from these losses, do it while it is cheap, not when it has become very expensive. And don't be fooled by players emotions. Like everything on the internet, they are intensified tenfold.

If you want to defend against [X] you need to know what [X] wants. That's what most people miss when trying to fix holes, it's figuring out why people go for those holes and how to fight the ennemy, not the hole he uses.

In the case of large abusers they typically do it for profit, you don't need to fix the hole, you need to make it so going through the hole is not profitable. For example make sure the account creation is not automatable (not just a silly captcha, but quota of account creation per ip and per short ip block range). This is important because if you fix exploits and ban exploiters you accomplish NOTHING if banned people can immediately come back from the ban on a new account and exploit their way back to the top and farming in a couple days. So before working on exploit fixing, make sure finding exploiter makes sense and you kill their business model when you find them.

Now with that said what's missing is going further than easy to bypass "simple" checks and go instead with much more complex (and thus cpu intensive) checks that do not always run server side.

Take diablo for example, you could rank the "value" of a player by having values for character level (obviously not linear, 100X lv 1 character isn't 1 lv 100), important trade items, gold etc etc. Assign a value to each player online based on that and have a dedicated ressource "checker" process that only checks one game at a time, randomly, that is intensive (maybe as intensive as a full game simulation but that only runs on 1 or 2 games at a time among a couple hundred per server) and that has better of falling on "valuable" accounts. Have that do thorought checks (you can afford it, it only runs on a few select people at a time) and check those against an expected value (for example steps to next target area vs average steps to next area if you don't know where it is to check for maphacks etc), if someone has out of whack values then have a GM monitor it. This allows very complex auto checks by ignoring meaningless accounts and focusing on the big ones with no way to know if you're being checked or not (so if you always cheat, and own a lot, you will get caught) while having a very little amount of Manpower on the situation and combined with "good" banning (that is banning the account and deleting everything that was traded for non equal value to it in game) you make it a net loss for the botter (loses his Investment, knows he will get caught if he climbs back too fast as he will be monitored early, annoys his customers because since they are high value his mule accounts also get banned with everything he has and he can't refund etc etc).

Well, I think as a business it is important to distance itself from "player outcries"...

if something makes people rage, but they continue playing nonetheless, obviously its not really detrimental to business. And as a player, I doubt that players are really as angry about the exploits as they make it look like online... or its only a small vocal minority that is leading a rage-war, most probably because of other agendas.

If you want to defend against [X] you need to know what [X] wants. That's what most people miss when trying to fix holes, it's figuring out why people go for those holes and how to fight the ennemy, not the hole he uses.

In the case of large abusers they typically do it for profit, you don't need to fix the hole, you need to make it so going through the hole is not profitable. For example make sure the account creation is not automatable (not just a silly captcha, but quota of account creation per ip and per short ip block range). This is important because if you fix exploits and ban exploiters you accomplish NOTHING if banned people can immediately come back from the ban on a new account and exploit their way back to the top and farming in a couple days. So before working on exploit fixing, make sure finding exploiter makes sense and you kill their business model when you find them.

Now with that said what's missing is going further than easy to bypass "simple" checks and go instead with much more complex (and thus cpu intensive) checks that do not always run server side.

Take diablo for example, you could rank the "value" of a player by having values for character level (obviously not linear, 100X lv 1 character isn't 1 lv 100), important trade items, gold etc etc. Assign a value to each player online based on that and have a dedicated ressource "checker" process that only checks one game at a time, randomly, that is intensive (maybe as intensive as a full game simulation but that only runs on 1 or 2 games at a time among a couple hundred per server) and that has better of falling on "valuable" accounts. Have that do thorought checks (you can afford it, it only runs on a few select people at a time) and check those against an expected value (for example steps to next target area vs average steps to next area if you don't know where it is to check for maphacks etc), if someone has out of whack values then have a GM monitor it. This allows very complex auto checks by ignoring meaningless accounts and focusing on the big ones with no way to know if you're being checked or not (so if you always cheat, and own a lot, you will get caught) while having a very little amount of Manpower on the situation and combined with "good" banning (that is banning the account and deleting everything that was traded for non equal value to it in game) you make it a net loss for the botter (loses his Investment, knows he will get caught if he climbs back too fast as he will be monitored early, annoys his customers because since they are high value his mule accounts also get banned with everything he has and he can't refund etc etc).

Agreed. I believe anticipating player behavior is key and also preventing them to rush back to the top in a single day is simply necessary if you want to slow them down. Taking D3 as an example, nothing was put in place to prevent the players rushing through the content. It wasn't even an illegal exploit, all that was needed was a friend who has access to the highest difficulty. In case a player got banned he could buy a new copy and send a friend-request to his high lvl buddy. Who would make a game in Act 4 normal and invite him in. Now the lvl 1 character is in act 4 normal and has simply skipped 3 acts. With monster lvl set to max for max xp leeching the high lvl player clears areas with the lvl 1 following him, rapidly leveling. After reaching the minimum character lvl to access nightmare difficulty it's rinse and repeat in nightmare. Then the same again for hell difficulty and the new character has reached the lvl cap and can access inferno. Within a day the player is back botting again, probably in a matter of hours if helped by an experienced rusher.

Kind of naive I think, strange to say the least that this is so simple to do.

I believe it's indeed a minority but there is a reason they are more vocal then the rest of the players. And I believe, at least for the ones who are true legit players there are no other agendas. I can speak for myself to illustrate this. I am a truly legit player and have played Diablo 2 since the demo. I still play it now and then and I still refresh my characters so they don't expire. I think I've got thousands of hours of D2 playtime under my belt. This is an estimation that I make by looking at the hours I played Diablo 3, this game logged how many hours were played per character. Besides having my job I managed to log over 1000 hours in D3 in one year. I then uninstalled D3 and went back to D2 because this game has so much more to offer a hardcore ARPG player. Okay. Now imagine if you are, as a player, passionate about a game (in this case D2) and you are sinking a huge amount of time into it, playing it legit. You know you are basically wasting your time because there's cheating going on all levels of game play and you have the impression the company isn't doing much about it. I think this is an important point. If you see prove that the company is actively monitoring the game and fixing exploits and dupes then it's a different situation. But what do you do when your impression is they don't do much apart from fixing the critical exploits. In Blizzard's case you can report hacks and exploits but doing so doesn't seem to get you any result. So you go to their community website and put it out there. It's very easy to have as you say a "rage-war" happening between you (what the others then call a vocal minority) and them (what the hardcore players call the fanboys). In reality it's more like the casual players vs the more dedicated players. And Blizzard locking the thread without replying to the topic.

I can understand why Blizzard cannot keep supporting D2 as they did in the early days of the game but the game is still being sold. I just googled it and where I live there is a gold edition D2 (whatever gold edition is I don't know) selling for around 15 euros. So I feel players still have a point when they complain about lack of support.

PS. I know they do have ban waves at times but this is to little to late as the damage has already been done.

It will differ from game to game but at least in D2 the bots and dupes have a big impact. In a new ladder season the farming bots crash the price of items in the game economy real quick. For legit players this sucks as their items become worthless very quickly. Also, trading items in D2 means engaging with other players and trading items with them face to face using the trade window in game which is part of the fun. Farming bots ruining the game economy also means they take trading enjoyment out of the game for legit players.

Another thing happening together with the farming bots is the rise of item-selling websites. What really sucks here is that they want to advertise their stuff so they use bots again to spam public multiplayer games. In the case of D2 it is still so bad that upon creating a pub game it fills immediately with spam bots that start spamming screens full of crap where you should go to buy your items.

Sometimes I visit the Bnet D3 forums to see what's up and there are always complaints about bots on the leader boards. It's an example of a game where trading is taken out of the equation and now the problem is players using xp-bots to get them on the leader boards. It may sound like it's no big deal but from what I read Non-Seasonal D3 is almost dead and players do Seasons to a) start afresh and 2) leader boards. So the bots here do have an impact.

Dupes in D2 are bad for various reasons. Duped+cubed runes are sold by all item webshops, adding to their spam. It's also possible that you trade for an item ingame and it turns out to be an unperm dupe. Meaning that the item you traded for with currency you played for suddenly "poofs" from your character or inventory when it's identified by the server as a dupe and gets deleted.

As for business, how damaging these cheats are I don't know but I think companies don't like to see their community forums full of complaining players. In the case of critical exploits like the server-rollback exploit in D2 that went public a few ladders ago they have no choice but take action to patch the hole. It made the game unplayable, about every 15 minutes players were crashing the server if they didn't like the stats they rolled on a certain item.

Overall it's surely not positive to have your game / franchise associated with bots and exploits.

Just to make it clear, as I think that wasn't so clear from my first post: I am not saying that exploits, cheats and bots are not a legit concern, not am I saying they don't damage the business of the dev and the fun of players.

What I wanted to say is twofold: Cheats will always be around, there is nothing you can do against that other than fighting the biggest fires at the time. Fighting cheating is extremly time consuming and thuis expensive, the bigger the game, the more costs get out of hand.

So we clearly see that cheating is something we should do something about, yet we will often lack the funds to do more than just small firefighting.

Now, instead of trying to put all the money we've got to fighting cheats, and running out of it before every leak is filled, we should sit back and think about WHY cheating is so bad.

With that out of the way, let me pick up the discussion again:

1) Diablo: Yes, I can see how this game would suffer from cheaters. The important part here is to analyze the damage of cheats in case of this game. AFAIK most of the game is actually PvE, so there is no direct distraction to other players gameplay.

The only problem I currently see is that this games main longterm motivation to play (I would say only, but then, I was never so much into D2 or D3 as you seem to be) stems from item collection. Given that cheating and duping does lower the uniqueness and achievement of the legally obtained items...

Now, is there anything design related that could be done (too late for D2 and maybe also D3, but this is a game dev forum, sooo...) to prevent a new ARPG that is just as much into item collection from suffering so much from cheating?

How could we make not the act of obtaining a new weapon/armour/hat what is the most satisfing, but the act of actually sinking playtime into that goal, or actually using that weapon? Would it be possible to design an ARPG that is just as compelling, but focuses player satisfaction on a part of the game that is less easy to get via cheats than items?

3) Lack of support: I understand everyone complaining about that in online games. But I also understand the other side. Online games are a business. A business that needs to feed more people than most players are aware of.

And fighting cheating is expensive, really expensive. So as long as the dev is actively trying to fight exploits, you can complain that he doesn't do enough, or doesn't put out the big fires first... point is he does what is expected of him, he tries to fight a fire that cannot be extinguished with the resources he has...

As to support for D2.... boooooy that game is like ancient! I mean, I am amazed you still can play it online! Now, if you and thousands of others would be ready to continue paying subs to keep blizzard from loosing money on supporting the game, the situation might be slightly different. But I don't think you will find many that are ready to shell out for that.

4) Cheating damaging business and gamebreaking cheats: As you say yourself, if a cheat is gamebreaking, blizzared does something about it. That is what I would expect of a game developer...

As for the non-gamebreaking cheats and exploits... well, they are rightfully lower on the list. Don't think its GOOD for a game, yet a game developer going broke clearly is even worse.

We both know blizzard is far from going broke... yet they are a business, if an investment will not bring a return, or not enough to warrant the cost, they will not make it. Hence good luck waiting on official D2 Support.

Luck, I totally understand your frustration. Yet we sometimes need to sit back and remember that a) its just a game (thus people cheating are not "worse than <insert dictator of you choice>"), b) its a business (thus the developer has neither a responisbility in keeping a game up as a museum piece, nor to act on every whim of the players), and c) that every game has a core expierience (Meaning if housing is broken in your combat oriented ARPG, and magic attacks are too, you cannot expect the dev to prioritize fixing housing).

I believe it's indeed a minority but there is a reason they are more vocal then the rest of the players. And I believe, at least for the ones who are true legit players there are no other agendas. I can speak for myself to illustrate this. I am a truly legit player and have played Diablo 2 since the demo. I still play it now and then and I still refresh my characters so they don't expire. I think I've got thousands of hours of D2 playtime under my belt. This is an estimation that I make by looking at the hours I played Diablo 3, this game logged how many hours were played per character. Besides having my job I managed to log over 1000 hours in D3 in one year. I then uninstalled D3 and went back to D2 because this game has so much more to offer a hardcore ARPG player. Okay. Now imagine if you are, as a player, passionate about a game (in this case D2) and you are sinking a huge amount of time into it, playing it legit. You know you are basically wasting your time because there's cheating going on all levels of game play and you have the impression the company isn't doing much about it. I think this is an important point. If you see prove that the company is actively monitoring the game and fixing exploits and dupes then it's a different situation. But what do you do when your impression is they don't do much apart from fixing the critical exploits. In Blizzard's case you can report hacks and exploits but doing so doesn't seem to get you any result. So you go to their community website and put it out there. It's very easy to have as you say a "rage-war" happening between you (what the others then call a vocal minority) and them (what the hardcore players call the fanboys). In reality it's more like the casual players vs the more dedicated players. And Blizzard locking the thread without replying to the topic.

I can understand why Blizzard cannot keep supporting D2 as they did in the early days of the game but the game is still being sold. I just googled it and where I live there is a gold edition D2 (whatever gold edition is I don't know) selling for around 15 euros. So I feel players still have a point when they complain about lack of support.

PS. I know they do have ban waves at times but this is to little to late as the damage has already been done.

It will differ from game to game but at least in D2 the bots and dupes have a big impact. In a new ladder season the farming bots crash the price of items in the game economy real quick. For legit players this sucks as their items become worthless very quickly. Also, trading items in D2 means engaging with other players and trading items with them face to face using the trade window in game which is part of the fun. Farming bots ruining the game economy also means they take trading enjoyment out of the game for legit players.

Another thing happening together with the farming bots is the rise of item-selling websites. What really sucks here is that they want to advertise their stuff so they use bots again to spam public multiplayer games. In the case of D2 it is still so bad that upon creating a pub game it fills immediately with spam bots that start spamming screens full of crap where you should go to buy your items.

Sometimes I visit the Bnet D3 forums to see what's up and there are always complaints about bots on the leader boards. It's an example of a game where trading is taken out of the equation and now the problem is players using xp-bots to get them on the leader boards. It may sound like it's no big deal but from what I read Non-Seasonal D3 is almost dead and players do Seasons to a) start afresh and 2) leader boards. So the bots here do have an impact.

Dupes in D2 are bad for various reasons. Duped+cubed runes are sold by all item webshops, adding to their spam. It's also possible that you trade for an item ingame and it turns out to be an unperm dupe. Meaning that the item you traded for with currency you played for suddenly "poofs" from your character or inventory when it's identified by the server as a dupe and gets deleted.

As for business, how damaging these cheats are I don't know but I think companies don't like to see their community forums full of complaining players. In the case of critical exploits like the server-rollback exploit in D2 that went public a few ladders ago they have no choice but take action to patch the hole. It made the game unplayable, about every 15 minutes players were crashing the server if they didn't like the stats they rolled on a certain item.

Overall it's surely not positive to have your game / franchise associated with bots and exploits.

Just to make it clear, as I think that wasn't so clear from my first post: I am not saying that exploits, cheats and bots are not a legit concern, not am I saying they don't damage the business of the dev and the fun of players.

What I wanted to say is twofold: Cheats will always be around, there is nothing you can do against that other than fighting the biggest fires at the time. Fighting cheating is extremly time consuming and thuis expensive, the bigger the game, the more costs get out of hand.

So we clearly see that cheating is something we should do something about, yet we will often lack the funds to do more than just small firefighting.

Now, instead of trying to put all the money we've got to fighting cheats, and running out of it before every leak is filled, we should sit back and think about WHY cheating is so bad.

With that out of the way, let me pick up the discussion again:

1) Diablo: Yes, I can see how this game would suffer from cheaters. The important part here is to analyze the damage of cheats in case of this game. AFAIK most of the game is actually PvE, so there is no direct distraction to other players gameplay.

The only problem I currently see is that this games main longterm motivation to play (I would say only, but then, I was never so much into D2 or D3 as you seem to be) stems from item collection. Given that cheating and duping does lower the uniqueness and achievement of the legally obtained items...

Now, is there anything design related that could be done (too late for D2 and maybe also D3, but this is a game dev forum, sooo...) to prevent a new ARPG that is just as much into item collection from suffering so much from cheating?

How could we make not the act of obtaining a new weapon/armour/hat what is the most satisfing, but the act of actually sinking playtime into that goal, or actually using that weapon? Would it be possible to design an ARPG that is just as compelling, but focuses player satisfaction on a part of the game that is less easy to get via cheats than items?

3) Lack of support: I understand everyone complaining about that in online games. But I also understand the other side. Online games are a business. A business that needs to feed more people than most players are aware of.

And fighting cheating is expensive, really expensive. So as long as the dev is actively trying to fight exploits, you can complain that he doesn't do enough, or doesn't put out the big fires first... point is he does what is expected of him, he tries to fight a fire that cannot be extinguished with the resources he has...

As to support for D2.... boooooy that game is like ancient! I mean, I am amazed you still can play it online! Now, if you and thousands of others would be ready to continue paying subs to keep blizzard from loosing money on supporting the game, the situation might be slightly different. But I don't think you will find many that are ready to shell out for that.

4) Cheating damaging business and gamebreaking cheats: As you say yourself, if a cheat is gamebreaking, blizzared does something about it. That is what I would expect of a game developer...

As for the non-gamebreaking cheats and exploits... well, they are rightfully lower on the list. Don't think its GOOD for a game, yet a game developer going broke clearly is even worse.

We both know blizzard is far from going broke... yet they are a business, if an investment will not bring a return, or not enough to warrant the cost, they will not make it. Hence good luck waiting on official D2 Support.

Luck, I totally understand your frustration. Yet we sometimes need to sit back and remember that a) its just a game (thus people cheating are not "worse than <insert dictator of you choice>"), b) its a business (thus the developer has neither a responisbility in keeping a game up as a museum piece, nor to act on every whim of the players), and c) that every game has a core expierience (Meaning if housing is broken in your combat oriented ARPG, and magic attacks are too, you cannot expect the dev to prioritize fixing housing).

I did not post this topic from the "frustrated player point". I've been frustrated playing D2 and seeing it all happen but that's a long time ago. Back then, there was still a feeling among the players that Blizzard would reclaim their "secure" servers from the cheaters. Nowadays everybody just takes D2 for what it is and that's it.

I'm surprised too, like you say, that D2 is still online after 16 years. However Blizzard can afford it and they seem to pride themselves that the game, after so long, still has interest from the players. What they don't know is what it really is that keeps the players playing D2. This is evident in how they designed D3 but then again there are clearly other forces at work in the company then 16 years ago ^_^

Just to make it clear, as I think that wasn't so clear from my first post: I am not saying that exploits, cheats and bots are not a legit concern, not am I saying they don't damage the business of the dev and the fun of players.

What I wanted to say is twofold: Cheats will always be around, there is nothing you can do against that other than fighting the biggest fires at the time. Fighting cheating is extremly time consuming and thuis expensive, the bigger the game, the more costs get out of hand.

So we clearly see that cheating is something we should do something about, yet we will often lack the funds to do more than just small firefighting.

Now, instead of trying to put all the money we've got to fighting cheats, and running out of it before every leak is filled, we should sit back and think about WHY cheating is so bad.

Saying that is like saying we shouldn't write secure programs, it makes no sense, it's ONLY expensive because it's tacked on as an afterthought when you try fo fix the gap in a game that itself is a giant hole, if you design it right then it's no more costly than any other bug fixing, it's only costly when it's design error fixing and you realize once it shipped that you made a massive exploit box that is flawed by design.

So instead of trying to put all the money fighting cheat, they should put substantially LESS money into it EARLIER as early as the DESIGN phase so that it can be handled efficiently and cheaply without diverting ressources once it ships.

Cheats won't "always be around", in a hosted multiplayer setting like those discussed there's nothing that has to be exploitable by design, it's just bad design and bugs, the former is expensive to fix, the later isn't, do the first one right and it's very achievable.