Those aren't saboteurs… I believe scoring is done on the client side so they got the point and are rushing to do the next shape.

They either need to do scoring server side, or there needs to be some sort of locking.

I’m actually quite proud of having implemented the scoring client-side. It helps keep the load on the server down. Looking up all possible formations is somewhat computationally intensive.

It does create some problems when some clients have high latency and don't detect the formation in time, but I think it's fixable. One way could be to make the computation redundant, e.g. get three pixels to do the detection instead of one, and consider the formation valid if 2 out of 3 of them report success.

Don't get me wrong. I totally agree that you made the right choice, especially for the node knockout.

This might be completely over the top but perhaps you should look into lag compensation technique that FPS games use. There is a global state on the server and the clients send their command with a timestamp. The server then looks at the global state XXXms ago.

You're going to need global state and scoring if you ever want a leaderboard (otherwise people will just game it).

You could also just make it so that it doesn't show the clock during the last three seconds or something. Show "calculating..." or something and give people whatever the greatest lag time is grace period.

Anyway, great game. You got my vote.

Verifying that a pixel is valid is much, much, much less intensive than searching for all possible valid pixels. You could do the scoring client-side, with the server verifying.

That wouldn't take care of a formation not being detected because the pixel responsible for it has very high latency or is disconnecting. I think this kind of false negative is a much bigger issue than the false positives.