Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Server authoritative movement with client prediction and rollback/replay support. In this example, the client exploits by moving a wall out of the way. But the server owns the movement. The client has failed predictions due to the exploit, and rolls back. #RobloxDev

sleitnick's profile picture

sleitnick

38,862 subscribers

20,523 Aufrufe • vor 1 Jahr •via X (Twitter)

Gaming#RobloxDev
LIVE

Anya Rossi• Live Now

Private livecam show

11 Kommentare

Profilbild von Totsie
Totsievor 1 Jahr

can't you use raycasting for noclip prevention without server authoritive movement

Profilbild von Soccer Bot™
Soccer Bot™vor 2 Jahren

Match Summary 💙 Get an absolute overview of your server several times - with the new Match Summary. Relax and never miss a game again. Activate the new function for your server today. Try Soccer Bot™:

Profilbild von DevGuy
DevGuyvor 1 Jahr

If the server owns the movement, wouldn't the movement be laggy? Try adding 1-second replication lag on studio.

Profilbild von sleitnick
sleitnickvor 1 Jahr

This IS with replication lag. That's what client prediction is for

Profilbild von Andrew D
Andrew Dvor 1 Jahr

gameplay loop when :^)

Profilbild von sleitnick
sleitnickvor 1 Jahr

Yeah I've gotta still figure that out lol

Profilbild von Cedralian
Cedralianvor 1 Jahr

Nice anti cheat!

Profilbild von FaultyScript
FaultyScriptvor 1 Jahr

He’s always cookin

Profilbild von nakiyu
nakiyuvor 1 Jahr

I’m not deeply into coding, but I’m really curious about what I'm seeing. Does this mean exploits like moving or spinning unanchored parts (e.g., walls or objects) would be prevented or made unusable?

Profilbild von sleitnick
sleitnickvor 1 Jahr

The server auth part makes any exploits pretty much impossible. The rollback (that rubberbanding effect) is just a result of the client "mispredicting" the move, i.e. the client and server disagreed with what the move should be, so the client moved back to the last verified move.

Profilbild von DabidarZ
DabidarZvor 1 Jahr

CLEAN ASF

Ähnliche Videos

Roblox's server authority beta is almost here! It prevents clientside hacks by making the server the final decider of what actually happened. You have to provide inputs that the server equally consumes or else the client will mispredict and rollback.
1:53

Roblox's server authority beta is almost here! It prevents clientside hacks by making the server the final decider of what actually happened. You have to provide inputs that the server equally consumes or else the client will mispredict and rollback.

Max ¯\_(ツ)_/¯

63,285 Aufrufe • vor 9 Monaten

In LiveView, we keep the state in one place - the server - and it simplifies a lot. But sometimes the state on the client is preferred, or even necessary, and we can't use LiveView for that part. Unless we have a LiveView that runs on the client 👀 Using Popcorn, we managed to run LiveView fully in the browser – here's a POC 🎉 The approach is to have a fully client-side LiveView rendered by a server-side one, and they can communicate with each other. Try it out:
0:25

In LiveView, we keep the state in one place - the server - and it simplifies a lot. But sometimes the state on the client is preferred, or even necessary, and we can't use LiveView for that part. Unless we have a LiveView that runs on the client 👀 Using Popcorn, we managed to run LiveView fully in the browser – here's a POC 🎉 The approach is to have a fully client-side LiveView rendered by a server-side one, and they can communicate with each other. Try it out:

Elixir by Software Mansion

13,558 Aufrufe • vor 9 Monaten

React tip: "use client" misconceptions (1/5) 🚫 You need to mark EVERY individual file with "use client" to ensure it is a Client Component. ✅ You only need to mark each client entry point ONCE. Modules imported into a "use client" file are already part of the client bundle. (0:05) Adding "use client" to `3.js` marks the file as a client entry point, including it in the client bundle. (0:11) Importing `d()` into `3.js` (a client entry point) also includes it in the client bundle. (0:14) Adding "use client" to `4.js` has no additional bundling effect on `d()` because it is already part of the client bundle. (0:23) All modules (and their dependencies) imported to `3.js` are included in the client bundle. (0:26) Removing "use client" from `3.js` moves it and its dependencies into the server bundle.
0:33

React tip: "use client" misconceptions (1/5) 🚫 You need to mark EVERY individual file with "use client" to ensure it is a Client Component. ✅ You only need to mark each client entry point ONCE. Modules imported into a "use client" file are already part of the client bundle. (0:05) Adding "use client" to `3.js` marks the file as a client entry point, including it in the client bundle. (0:11) Importing `d()` into `3.js` (a client entry point) also includes it in the client bundle. (0:14) Adding "use client" to `4.js` has no additional bundling effect on `d()` because it is already part of the client bundle. (0:23) All modules (and their dependencies) imported to `3.js` are included in the client bundle. (0:26) Removing "use client" from `3.js` moves it and its dependencies into the server bundle.

Delba

157,416 Aufrufe • vor 2 Jahren

If you’re playing on MonkeyTilt, the outcome might already be decided BEFORE you bet “The cryptography behind every bet has always been sound” We tested it It isn’t... we sent two different client seeds for the same nonce same result both times the server is ignoring the client seed entirely the player has ZERO influence on outcomes — what we did — opened the MonkeyTilt provably fair verifier with a revealed server seed entered nonce 1 → got 3.04x changed the client seed same server seed, same nonce → 3.04x changed it again → 3.04x the client seed has ZERO effect on the outcome — why this matters — in a provably fair system the outcome is derived from: -server seed -client seed -nonce the client seed exists so the player contributes randomness the server CAN’T predict if it’s ignored the server knows every outcome BEFORE you bet the hash commitment proves nothing because the server already controls all the inputs — not a frontend bug — we checked the network traffic the verifier sends a WebSocket request with: -client seed -server seed -nonce the server receives different client seeds and returns the same result anyway request 1 → client_seed “Clientseed123456789” → 3.04x request 2 → client_seed “NEWSEED12345” → 3.04x this is the server ignoring input not a display issue — live bet traffic — placing a Limbo bet returns: -random_multiplier -total_payout -round_closed that’s it no hash no seed reference no nonce no proof seeds are fetched from a separate endpoint game engine and seed system are DISCONNECTED — nonce verification — you can only verify nonces you’ve already played in a real system all outcomes are predetermined once the server seed is committed - they’re deterministic blocking future nonces suggests results don’t exist until you bet — summary — -client seed ignored by server -no cryptographic proof in bet responses -game engine and seed system DISCONNECTED -nonce verification restricted this isn’t provably fair it looks like provably fair UI on top of server side RNG MonkeyTilt should probably address this anyone can verify this themselves in 60 seconds - open the verifier, change the client seed, watch the result stay the same
0:46

If you’re playing on MonkeyTilt, the outcome might already be decided BEFORE you bet “The cryptography behind every bet has always been sound” We tested it It isn’t... we sent two different client seeds for the same nonce same result both times the server is ignoring the client seed entirely the player has ZERO influence on outcomes — what we did — opened the MonkeyTilt provably fair verifier with a revealed server seed entered nonce 1 → got 3.04x changed the client seed same server seed, same nonce → 3.04x changed it again → 3.04x the client seed has ZERO effect on the outcome — why this matters — in a provably fair system the outcome is derived from: -server seed -client seed -nonce the client seed exists so the player contributes randomness the server CAN’T predict if it’s ignored the server knows every outcome BEFORE you bet the hash commitment proves nothing because the server already controls all the inputs — not a frontend bug — we checked the network traffic the verifier sends a WebSocket request with: -client seed -server seed -nonce the server receives different client seeds and returns the same result anyway request 1 → client_seed “Clientseed123456789” → 3.04x request 2 → client_seed “NEWSEED12345” → 3.04x this is the server ignoring input not a display issue — live bet traffic — placing a Limbo bet returns: -random_multiplier -total_payout -round_closed that’s it no hash no seed reference no nonce no proof seeds are fetched from a separate endpoint game engine and seed system are DISCONNECTED — nonce verification — you can only verify nonces you’ve already played in a real system all outcomes are predetermined once the server seed is committed - they’re deterministic blocking future nonces suggests results don’t exist until you bet — summary — -client seed ignored by server -no cryptographic proof in bet responses -game engine and seed system DISCONNECTED -nonce verification restricted this isn’t provably fair it looks like provably fair UI on top of server side RNG MonkeyTilt should probably address this anyone can verify this themselves in 60 seconds - open the verifier, change the client seed, watch the result stay the same

CoinBets🔍

20,973 Aufrufe • vor 6 Monaten

Your AI stack just stopped being closed. 🔓 TanStack AI now speaks AG-UI client-to-server. - The same client hits any AG-UI server. - Any AG-UI client hits a TanStack server. Zero breaking changes. Migration guide in the tweet below 👇
0:30

Your AI stack just stopped being closed. 🔓 TanStack AI now speaks AG-UI client-to-server. - The same client hits any AG-UI server. - Any AG-UI client hits a TanStack server. Zero breaking changes. Migration guide in the tweet below 👇

TANSTACK

79,086 Aufrufe • vor 4 Monaten

How to refactor an existing client component into a server component? 1. Move the state to the URL 2. Move data fetching to the server 3. Isolate interactivity into a smaller client component
0:56

How to refactor an existing client component into a server component? 1. Move the state to the URL 2. Move data fetching to the server 3. Isolate interactivity into a smaller client component

Alex Sidorenko

112,401 Aufrufe • vor 3 Jahren

❌ Avoid resolving a promise in a server component and block rendering. ✅ Resolve the promise in the client side with `Reac.use()`
0:37

❌ Avoid resolving a promise in a server component and block rendering. ✅ Resolve the promise in the client side with `Reac.use()`

George Moller

47,215 Aufrufe • vor 1 Jahr

If you want to be able to call server functions from the client, RPC is often the move. The Bun + Better Call combo gets you a fullstack solution in very little code. Server, Client, bundling and HMR 👌 had to record a little video showing the setup
3:26

If you want to be able to call server functions from the client, RPC is often the move. The Bun + Better Call combo gets you a fullstack solution in very little code. Server, Client, bundling and HMR 👌 had to record a little video showing the setup

Wes Bos

103,785 Aufrufe • vor 11 Monaten

Built a procedural open world with SpacetimeDB as the backend. Every terrain chunk, tree, and stone is server-authoritative. The client subscribes and the world just appears, consistent across every connected player, no REST endpoints, no polling, no manual sync logic. The database is the game server. Now to fill it with agents!
0:30

Built a procedural open world with SpacetimeDB as the backend. Every terrain chunk, tree, and stone is server-authoritative. The client subscribes and the world just appears, consistent across every connected player, no REST endpoints, no polling, no manual sync logic. The database is the game server. Now to fill it with agents!

Martin Erlić

30,206 Aufrufe • vor 7 Monaten

Pam Bondi claims “the Epstein Client List doesn’t exist” and yet we have found a letter with her signature on it, stating that she has RECEIVED the Epstein Client List, on the official DOJ Server These people WILL be exposed and held accountable
0:58

Pam Bondi claims “the Epstein Client List doesn’t exist” and yet we have found a letter with her signature on it, stating that she has RECEIVED the Epstein Client List, on the official DOJ Server These people WILL be exposed and held accountable

Boogie Rae

26,282 Aufrufe • vor 1 Jahr

What is even crazier is. The client discovered him through a video that had only 200 views, and the opportunity eventually led to him going to see the client in person and check out the business. Make content and take on any client. Bye.
4:07

What is even crazier is. The client discovered him through a video that had only 200 views, and the opportunity eventually led to him going to see the client in person and check out the business. Make content and take on any client. Bye.

Technical Ben

113,188 Aufrufe • vor 1 Monat

I've finally published a new version of next-international, my fully typesafe i18n library for Next.js This release adds initial support for the App Router, with both Client and Server Components:
0:32

I've finally published a new version of next-international, my fully typesafe i18n library for Next.js This release adds initial support for the App Router, with both Client and Server Components:

Tom Lienard

42,459 Aufrufe • vor 3 Jahren

The big Minecraft client launch time battle! Oh, and by the way, who has the best launch animation? 🤔🤓
0:53

The big Minecraft client launch time battle! Oh, and by the way, who has the best launch animation? 🤔🤓

LabyMod

202,788 Aufrufe • vor 3 Jahren

The difference between a $1m client and a $25,000 client
0:33

The difference between a $1m client and a $25,000 client

Financial Dystopia

849,540 Aufrufe • vor 11 Monaten

Next.js security tip: Use "server only" for the code that should never be exposed to the client.
0:29

Next.js security tip: Use "server only" for the code that should never be exposed to the client.

Alex Sidorenko

109,311 Aufrufe • vor 1 Jahr

Server Authority is now available for all creators. Block physics-based exploits like speed hacks without custom anti-cheat code, while prediction and rollback help preserve a responsive player experience. Learn more on the #RobloxDev forum.
0:32

Server Authority is now available for all creators. Block physics-based exploits like speed hacks without custom anti-cheat code, while prediction and rollback help preserve a responsive player experience. Learn more on the #RobloxDev forum.

Roblox

775,974 Aufrufe • vor 2 Monaten