Can you cheat, and what stops you

The recording has to agree with itself

A flight arrives as a track: thousands of frames, each carrying a position, an altitude, speeds, an attitude and a clock. No single field can be trusted on its own. What can be checked is whether they agree with one another, because the relationships between them are physics rather than policy.

The distance between two consecutive positions has to match the ground speed reported across that interval. The altitude change has to match the reported vertical speed. A frame claiming to be on the ground cannot be far above it. The recording cannot go quiet for long, and near the ground, where the scoring happens, it has to be dense.

This changes what a lie costs. Editing one summary figure used to buy a perfect score. The same lie now has to be told consistently across thousands of frames whose positions, speeds, altitudes and clocks all constrain each other, which is most of the work of writing a flight simulator.

The flight has to have been possible

Separately, the flight is checked against the world it claims to have happened in. The track has to start and end near the airports on the paperwork. The block time has to be one an aeroplane could produce: nothing in the fleet blocks under five minutes or over eighteen hours. The average ground speed across the whole block, taxi included, has to be in range. A touchdown outside a plausible range is not scored as a landing at all.

The two figures that decide what you are paid, block time and touchdown rate, are derived here on the server from the track. The client sends its own version of both. Neither is used.

And we have to have watched it happen

The checks above raise the cost of forgery without ever closing it, because every byte they inspect was written on the pilot’s own computer. The last check is different in kind: it compares the flight against evidence the server recorded, on the server’s clock, while the flight was supposedly happening — the live position pings the client sends for the world map.

That evidence is not in the payload, so tampering with the payload cannot touch it. The load-bearing test is duration. A flight claiming ten hours of block time must have been transmitting to us across ten real hours, and there is no way to produce that after the fact.

Fabricating a flight therefore stops being a scripting problem and becomes a sitting-there-for-ten-hours problem, which is flying.

This has a cost we accepted on purpose. A pilot who flies with no connection to us has no evidence, and is not paid for that sector. The alternative was holding unwitnessed flights for manual review, and a queue is not a policy.

The grade is ours, not yours

The client grades your flight as it goes so you can watch it happen. None of that is what goes on the record. The server discards the client’s measurements, its landing figure and its samples, and recomputes all of them from the track using the same code the client ran. An honest client’s numbers match ours exactly, and the figures that set pay and rank are ours either way.

One measurement needs something outside the recording. Route efficiency is scored against the flight plan you filed, read from your dispatch rather than from the payload, because a client that supplied its own baseline could hand itself the badge. With no plan on file, that procedure is reported as not measurable rather than as failed.

The pause rule, and why it is about place

Pausing is allowed. It has to be: this is a hobby flown around a life, and an eight-hour sector does not fit between dinner and bed.

What licenses a pause is not its length. It is that the aeroplane is in the same place when the recording resumes. Freeze the simulator, walk away for an hour, come back, and the position, altitude, heading and speed are exactly what they were. Slew across the Gulf of Thailand and they are not, whether you took an hour over it or ninety seconds.

So a declared pause is accredited only when the frames either side of the hole agree. The client’s declaration says where to look. The track says whether to believe it.

What this does not claim

None of this makes forgery impossible, and we are not going to pretend it does. Someone prepared to write a self-consistent flight, transmit it in real time for the whole duration they are claiming, and keep every value inside its physical bounds can be paid for a sector they did not fly. What they cannot do is anything easier than that.

Two people cannot share one account either, and that falls out of the same machinery rather than a rule: overlapping block windows are refused. Sharing a licence key does nothing, because redemption is single use and binds to one pilot.

The honest summary is that the cheapest way to get a good score at SkyHub is to fly well, and the second cheapest is a great deal of work. That is the entire design goal.