> I only toyed with it for a few weeks as I then grew disinterested but that definitely left a sour taste in my mouth for the "effectiveness" of VAC if a script kiddie like me at the time could throw together something custom in just a few hours, I'm sure it'd be much easier now with ChatGPT...
The thing is, VAC doesn't immediately ban you. Or anyone else. It's looking for suspicious patterns across hundreds if not thousands of players and collecting evidence over weeks if not months to make sure they got relatively low false-positive rates and don't end up banning people for a Windows update gone wrong... and additionally, it raises the iteration time for cheat developers as well, and that's the true point. Show cheaters immediately that they're spotted and the only thing you enter is an immediate arms race.
Your way of writing a cheat was probably detected but since no one else used it, VAC didn't trigger.
Blizzard's battle.net used to do that. They'd ban in waves. I imagine immediate bans would make it much easier for cheat authors to figure out which cheats were detectable and which weren't.
I haven't followed recently, but what I have understood is that clear known old public hacks can result immediate ban. For newest hacks they will gather cohort and then do them in wave. Thus making it harder to evade detection or notice what exactly was detected this time.
If people want to test these kinds of exploits, you can do so on a server that is not VAC-secured. That won't risk your account being VAC banned. (Of course, if you really want to be sure, use a secondary account and a server that's not VAC-secured)
Unlikely. Last I looked, VAC only looks at a few gross elements, like the names of the DLLs loaded into the game's process. If you don't match a blacklisted name, you're probably not detected.
And user account names. At least at one point you could catch a ban for having an account named "catbot" when running on a linux box. Admittedly that was probably quite a reasonable litmus test in practice even if not in principle.
I'm surprised someone remembers this, considering how long ago it was, the fact that Valve publicly denied this later, and that most people (on the side of publications reporting that situation initially and outside observers on reddit and other platforms) didn't understand/didn't care for the difference between linux user account names (that caused the bans at that time), steam display names, steam account names and steam custom profile urls.
I have a suspicion that that was FUD spread by the cheat creators. Back then I decided to test that by creating a user named like that and running Steam from there. My account did not receive a ban.
It was real, but maybe the username wasn't the only data point they used. Considering that:
1. Brand new Steam accounts were banned after logging in to Steam client, before even launching any game
2. Replacing "catbot" in user accounts with a random string stopped the bans completely
3. A linux VAC module, dumped similarly to the method described in the article, had access to usernames - I think it was via a getpwent() call. It also collected some other info about the environment (I don't have that binary anymore).
You can probably agree that user account names played at least some role in the bans, even if they weren't the only factor.
* I can't provide concrete evidence for either of those three points as the events took place 8 years ago, feel free to not take my word for it. Maybe you can find someone else from that circle who still has dumped VAC binaries, links to the empty banned accounts or a clone of bot orchestration software repository with a commit that renamed the user accounts and stopped the bans. Maybe even chat logs from that era.
Anyway, at this point it's just a funny piece of tf2 cheating history that has zero impact on anything anymore. So you might as well think it was all fake and I'm just making stuff up, it doesn't matter.
The thing is, VAC doesn't immediately ban you. Or anyone else. It's looking for suspicious patterns across hundreds if not thousands of players and collecting evidence over weeks if not months to make sure they got relatively low false-positive rates and don't end up banning people for a Windows update gone wrong... and additionally, it raises the iteration time for cheat developers as well, and that's the true point. Show cheaters immediately that they're spotted and the only thing you enter is an immediate arms race.
Your way of writing a cheat was probably detected but since no one else used it, VAC didn't trigger.