3. Open-sourcing the implementation does not automatically compromise its effectiveness -- that's a very ignorant claim. Is the Linux kernel insecure? The security of the proposed solution is derived from the mechanisms it employs, not from keeping its inner workings a secret.
You could make the anticheat send checksums of itself + its state + <salt> at server's request. The request from the server would contain the <salt>. For complexity's sake, the anticheat would have many states that change based on other server messages. This would effectively prevent dummy anticheat implementations and severly code-caved ones (since they would skip a bunch of state changes). Slight modifications to the anticheat.... I don't know.editAnd by checksum of itself, I mean from memory, not the file. The server would also have to keep track of the specific client's 'would-be' state.This is still obscurity I think, just proxied over to the AC as opposed to hard-baking the client :/
If it's just a small group of players who only want to play against each other, or for match games, then you can just use a normal password protected server for this kind of thing.
If you're talking about doing something like this on a larger scale, then I'd be against the idea as it would only fragment the community more than it already is and would make it even harder for new players to find populated servers to join.
We should work on/improve sending clients information that is much more partial than what Q2 servers relay. This would already completely fuck over anyone trying to use wallhacks, since the server simply won't send the locations of players, projectiles and such behind walls (the visibility checking is done on the server).
After that, we can further increase the servers' anti-cheat logic, such as determining a client's net rate and adding a maximum delta angle per second (approximated through the net_rates). In the end, we could 'snap' a player's facing angle back to where it was on the server side if they try to do a full fledged 180 deg turn over 1 packet. This would start to close in on the aimbotters.
How does nc visibility check work anyways? Does the server just spoof other client's positions to some remote coordinates if the observing client can't see them? Or is the Q2 protocol happy with not getting all the clients' information in a frame?