15 ms·

I dig most of this article, and I do applaud the work Valve is doing for the Linux gaming ecosystem, but I draw a line at supporting kernel level anti-cheat dri

I dig most of this article, and I do applaud the work Valve is doing for the Linux gaming ecosystem, but I draw a line at supporting kernel level anti-cheat drivers. That trend in gaming bothers me to no end, and I refuse to knowingly install a game that features one. The presence of 15 year old script kiddies using aimbots does NOT IN ANY WAY justify having kernel level control over my machine, Linux or otherwise. Valve, and every other company that contributes to gaming in general, kindly stay the fuck out of our kernels. EDIT: I feel a few folks in the comments are getting mixed up between the concepts of DRM and kernel-level anti-cheat drivers. DRM is what keeps folks from pirating software, as well as diminishing the freedom of where and how you can install the software. It sucks, but I understand why it exists, and that isn't what I'm talking about here Kernel-level drivers, on the other hand, are drivers that run outside your sphere of influence (so-called user-space) and exist outside the checks and balances of your operating system that keep programs from doing whatever the hell they please. Add on the fact that these programs are black boxes by design, and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose. This is dangerous and unacceptable.

mensetmanusman 5y ago
But it should be an option for those that wants to play knowing there are probably fewer cheaters if they opt in. There will always be trade-offs in freedom when you try to implement rules to improve the freedom of those that want to play on a balanced playing field. This is true in society as well.
- Rooster61 5y ago
  It's not freedom, its security. DRM is neither here nor there as long as its in user-space. It sucks for the consumer, but I understand why companies do it even if I don't like it. Kernel level drivers are a whole different can o' worms. A corporation could make my gaming rig into part of what amounts to a spyware botnet with me being none the wiser other than encrypted traffic coming OUT of my machine. Those drivers by design are black boxes, and there is no way to monitor what your machine is actually doing. That shit shouldn't be on mine or anyone else's system, especially under the premise of a "fair gameplay environment".
  - maccard 5y ago
    > A corporation could make my gaming rig into part of what amounts to a spyware botnet with me being none the wiser other than encrypted traffic coming OUT of my machine For the average user they can do that with basic permissions anyway. I wouldn't notice a steady stream of 2-300 kbps of binary data uploading from my machine, for example. I'd chalk it down to shitty programming. On any windows or Linux system, there is nothing stopping a binary from sniffing your clipboard, reading your .ssh directory, or just deleting your home folder/filling the files with garbage.
1_player 5y ago
Honestly, I'm neutral about kernel level anticheat. I won't play any of those games, but this doesn't mean we should make porting games that make use of these technologies any harder.
- corpdronejuly 5y ago
  What I would love to see is open source kernel level anti-cheat. The issue of course is that would reveal just how much of our data those things Hoover up.
  - Thiez 5y ago
    How exactly would an open source anti-cheat do its job effectively?
    - toomanydoubts 5y ago
      Being opensource doesn't imply the game server will allow modified builds to work. Being able to see the code doesn't mean you will find a suitable way to circumvent the anticheat. That being said, I agree it would be harder to maintain an open source anticheat effectively.
      - demindiro 5y ago
        > Being opensource doesn't imply the game server will allow modified builds to work The client can lie about being modified. E.g. it can send false hashes.
    - Bancakes 5y ago
      The same way open source crypto libraries do.
      - sbarre 5y ago
        Please explain in more detail? I am curious to hear your theory on this.
Kuinox 5y ago
I wish you to play a competitive multiplayer game filled with cheaters. You don't know if your opponent is good or cheating. It simply kill all the fun. If it won't work on PC, multiplayer gaming will simply moves to consoles. Great, now you are stuck with a closed standard, with a closed OS, where you can't run the programs you want.
- izacus 5y ago
  > Great, now you are stuck with a closed standard, with a closed OS, where you can't run the programs you want. The DRM anticheat drivers turn Linux PCs into a closed standard, closed OS platforms where your software kills itself (even if it's single-player) when you step out of the locked down platform. You're trying to picture a difference where there is none.
  - danuker 5y ago
    This gets me thinking. They could strike deals with AMD and Nvidia to bundle some anticheat mechanisms in their proprietary Linux drivers.
    - judge2020 5y ago
      If I’m not mistaken, SGX was/is available to programs on Linux.
  - sbarre 5y ago
    There is a huge difference between one narrow-purpose component of your system being closed and a whole system being closed. Come on.
    - izacus 5y ago
      What DRM anticheat measures do is to monitor your whole system for modifications and kill the app if they detect changes. For example, they will make sure that your nVidia (or AMD) driver is one of the whitelisted hashes and hasn't been modified with a wallhack. This is why Linux users using Wine keep being banned from these platforms - they detect "unusual" runtime environment and ban the players because it doesn't fit into their narrow hash of an "acceptable" system. It is an outright definition of sealing off your OS from modification.
addandsubtract 5y ago
Maybe the compromise is to install the multiplayer module (and anti-cheat drivers) separately. Because coming from the other side of gamers fed up with cheaters, I've heard people wanting to install an anti-cheat which would overclock and kill the GPU of the cheater.
throwoutway 5y ago
I’m opposed to kernel drivers/root kits too, but I wouldn’t install this on my daily driver. I’d have a separate partition with a fresh Linux install. So I don’t personally have a problem with it as I’d just treat it as a gaming system that I consider compromised. I wouldn’t do any banking or browsing on it
- bee_rider 5y ago
  This seems like a real benefit to Linux. Just installing it on a new partition would be a tricky proposition on Windows. In Linux it is the obvious solution. As an added bonus, you could look into doing some of the latency tuning stuff and not have to worry about messing up your work partition.
5co 5y ago
dagw 5y ago
If I played competitive video games seriously I would absolutely want them to take cheating seriously and take any necessary measure to stop it. At the same time I think they should also make the most serious kernel/driver level anti-cheat software optional. If you don't to want to install it you can still play the game, just not on any of the 'pro' servers. Think of it a bit like doping tests in sports. As long as you're just competing in amateur races for fun then take all the steroids you want. Once you want to start competing in serious races be prepared for people demanding blood and urine samples.
- sbarre 5y ago
  The problem with this logic is that most multiplayer games have post-sale economies with cosmetics and other add-ons, and I would guess that most of those sales comes from casual players. So while anti-cheat helps protect the pro/serious players (who in some ways are community/marketing leaders in this world of Twitch and YouTube), it also creates a fair environment for all the casual and aspiring players who keep spending money on the game in droves.
  - 0xedd 5y ago
    Your argument falls short. Pro cheating uses hardware to cheat. It streams the video output and keyboard/mouse input to an AI/ML. Making these kernel anti-cheat useless there. Casual players looking to spend money on cosmetics aren't affected by cheaters because the system influencing the players to buy isn't affected by the cheaters. The way most of these "influence systems" work is by using marketing strategies. It'll augment your match, or otherwise the players you meet, to see cosmetics you don't have. Coupled with gambling mechanics to induce addiction and sheer marketing material ("best offer now!") makes for this whole pro-kernel-anti-cheat industry move highly dubious. Source: i worked at a company that writes such systems. The day I decided to quit was when my naive ass heard the team lead, on a recruitment call, explain to a candidate what we do: "we refine a company's ability to get kids addicted". It's a completely different game (no pun intended) than what news outlets want us to think.
    - 5y ago
ineedasername 5y ago
People that like to play those games can always dual boot so that kernel-level access doesn't run on the non-gaming OS. It's not ideal, but it allows Linux gaming without compromising your kernel for non-gaming work. Or if you want the option of switching without a reboot you can run another linux instance in a VM, even a VM that uses a logical partition instead of its own image so that you can also boot normally into that partition when you want. Again, not ideal, but if you're committed to Linux then it's still better than being forced into Windows for gaming.
Bancakes 5y ago
Game devs should know who's cheating serverside. After all, that's where most of the logic takes place, specifically because they don't trust users.
foobarian 5y ago
It's not like video card companies don't have black boxes in the kernel. Maybe nVidia will make an anti-cheat API and then it's gonna be a choice between "have a 3d accelerator at all" and "clean kernel."
- heyens 5y ago
  Which is why people who care about stuff like this use an AMD GPU, whose driver is open sourced and mainlined in the kernel. This is not perfect since there are still BLOBs, but it does help a lot.
motoboi 5y ago
Competitive gaming is a thing. For those cases, Valve can distribute a linux gaming OS with anti-cheat mechanisms. Then restrict competitive participation to that OS. That or giving up the problem.
judge2020 5y ago
> Add on the fact that these programs are black boxes by design, and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose. Unless you run flatpak, nix, lxc containers, or some other process isolation scheme, all programs on eg. A debian desktop have this sort of free reign. It’s not uncommon for accidents to happen that take out chunks of a system[0]. 0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...
- gurkendoktor 5y ago
  > Unless you run flatpak... Well yes, sandboxing should be the goal! Installing Steam from Flathub is a good first step on desktop machines. But as long as games require anti-cheat software at the kernel level, I'll keep a Windows partition around to sandbox the gaming world as a whole.
- account42 5y ago
  A more topical example: https://github.com/ValveSoftware/steam-for-linux/issues/3671 https://github.com/ValveSoftware/steam-for-linux/issues/3671
charcircuit 5y ago
>and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose This is the case for user level anticheats too. 99% of what a malware wants to do it can do from userspace.
matheusmoreira 5y ago
Completely agree. My computer is my computer and they need to stop trying to own it. I should be able to install and use the software I paid for without some unknown kernel module getting forced into my machine. Proprietary software is bad enough. Nobody cares that they "need" to do it, that's a line they can't cross and if it means their games have cheaters on them so be it.
txdv 5y ago
With all the machine learning we have, game makers could train models to spot hackers. The hacking patterns were obvious even during counter strike 1.6 days. Maybe they got more subtle? I don't play a lot of FPS, but In Dota2 I see a bunch of hackers where the replay literally shows you how they do not even react with their mouse to a threat that appears suddenly but still manage to cast a spell somehow. I don't even think that machine learning is needed to detect that kind of hack.
- d3fault 5y ago
  As far as I'm aware Valve does use ML (called VACnet) to detect cheaters. At the time of the GDC talk[0] it was only implemented for CSGO but it could've expanded since then [0] https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc
mikepurvis 5y ago
> free reign In case you're curious, it's a horse thing: https://www.merriam-webster.com/words-at-play/usage-free-rein-vs-free-reign https://www.merriam-webster.com/words-at-play/usage-free-rei...
steadyready 5y ago
I did a lot of cheat development and always read the related forums. Let me tell you that kernel anti-cheats are the funniest and ugliest pieces of software out there. Almost ALL exhibit rootkit behaviour. Capture all OS events, dig through system and user directories, list all processes, fetch DNS and browser histories, block certain system calls, and more just to name a few. But hey! Their software (including drivers) are signed by Microsoft, so that’s alright :)) Funny part is that all those drivers are created by no other than ex-community members, under no advisory from system specialists or security experts. So guess what? Security vulnerabilities all around. Pretty much all their drivers are wide open and unsecure. Nice fun having persistent, kernel-level, system-trusted exploits auto-installed on your system! Oh, almost forgot, BattlEye has the ability to download custom bytecode from their servers and execute it. RCE baked right in. Good stuff. So your frustration is more than reasonable.. EDIT: I will try to find the posts pointing to all vulns that I mentioned, and cite them.
- dijit 5y ago
  As a person in the industry: Everything this person is saying is true. We need a real solution to this honestly, it’s not enough to just kick up a fuss about game devs including anti-cheat and ever-more-invasive anti-cheat, but actually providing solutions people can use. The economic incentives do not exist on consoles to cheat, so publishers are convinced that control of the platform is the problem.
  - enragedcacti 5y ago
    As someone in the industry, would you mind weighing in on Vanguard, the kernel level anti-cheat used for Valorant? On release they made a big deal about how small the kernel level portion is and how most of the complexity of the anti-cheat was still in user space. I'd be interested to hear how true that is and if that makes much of a difference in your mind how trustworthy it is.
    - dijit 5y ago
      I don’t have the code for that and it might require my studio to open a deal with vanguard to get access to the source. Generally speaking though; the size of the components that run in the kernel is not important. The kernel mode software can act as a window to the rest of the system.
jjkmk 5y ago
The problem is it's not just kids using public cheats. There are private cheats that really damage the integrity of competitive gaming. Counter Strike Global Offensive is a good example of this.
aceazzameen 5y ago
I've always wondered if just having a really strong matchmaking system would be enough. It would keep cheaters playing against cheaters. Pro players in theory shouldn't be as good as cheaters, so they'd be in their own rank. But I suppose cheaters could purposefully play poorly sometimes to keep their ranking down. Is that even worth it to cheaters? Downside to all of this is it would have to take longer to get into matches to keep players in their pools. I know games already do this, but they seem to match players up or down too quickly to keep the velocity of matches going. As I type this I realize this system wouldn't work. Pro players would complain about long waits whiles average players would play the most frequently. Lose pros and you lose average players.
- evanmoran 5y ago
  You already figure it out from the pro side, but it sadly is not enough on the casual side as well. The issue is streamers would show their audience how easy it is to cheat and this would lead to a perception by more casual gamers that cheating is rampant and so they would be less inclined to join. This reduces the audience, hitting worse match making (as you suggest), lower stream viewership, less game success for the studio, etc.
- bee_rider 5y ago
  As a pretty bad FPS player (was ok on consoles but never got the knack for aiming with a mouse in the same way), matchmaking works well enough for me. My better friends are always complaining about hackers, but I almost never encounter them.
berryton 5y ago
While I despise this kernel level bs, do you know how it is going to be implemented on Linux? As far as I understand, it is coming via Proton/Wine, so these programs would need some kind of kernel level access as well (if they don't have it currently)? Or maybe they're just emulating Windows kernel calls or something like that. I mean, less intrusive (but also less effective) in a Linux system.
mmind 5y ago
I fully agree. For me this is one of the main advantages of game streaming and why I think is the future. It is a way to prevent cheating and bad actors that does not require me giving kernel access to game developers. Also protects me from people learning my own IP via poor chat or multiplayer implementations.
dijit 5y ago
This comment deserves a much more detailed response than I'm able to give at the moment, but I can give some very brief thoughts: Let me say that I have been working in AAA online game development for more than 7 years now; I have worked on games that had 10's of millions of players, and these were full fat $60 AAA games. Cheating was the second[0] biggest issue of our games, it sucked the entire enjoyment out- getting ganked by a bunch of players shooting through walls is not fun. Why did we "allow" cheating?: Well, we never did, we used some of the best anti-cheat software we could afford, but it was still possible to cheat. "Don't trust the client" is a common response, but being fully synchronised to the server has drawbacks too; servers typically "tick" at about 10-20fps, theres a lot of tricks we pull off to make it seem as if it's going the 144-240Hz of your monitor, like showing hitmarkers (but not damage numbers) to make it feel as if it's fast, if your movements were synced to the server you would feel as though you were walking through water, as the movement would be very slow as it needs to do a 150ms round trip to sync a step. The truth of it is if we fully synchronised every action to the server: not only would it feel abhorrently slow; it would require a full 3d rendered simulation of the game world, we'd be able to run maybe 3-4 users on 40 core machines with 256G of ram... that's not feasible. "Don't make online games" is another common response to hearing the realities and difficulties of making these kinds of games. But I'd suggest, if that's your response; even if we made them that doesn't mean you have to install them. We're both making a decision here: We decided to make an online game because it can be a lot of fun, you decided to install an online game because it can be a lot of fun. Cheaters want to ruin that fun, we have woefully few tools to prevent that. (by the by: I'm not in favour of kernel level anti-cheat, but fuck are cheaters the bane of my existence). [0]: Biggest issue was actually bugs, but when we fixed bugs, cheaters were the next primary complaint.
- okamiueru 5y ago
  Was there an attempt at detecting cheaters by modeling human reaction times and otherwise inputs, and thus detecting non-human like inputs?
  - dijit 5y ago
    Yes. Here's a good perspective on the situation by someone who was cheating: https://www.reddit.com/r/thedivision/comments/4k17n8/confessions_of_a_cheater_and_the_current_problems/ https://www.reddit.com/r/thedivision/comments/4k17n8/confess...
nindalf 5y ago
I’m not sure I understand peoples objections to the existence of anti-cheat software. As far as I can tell, as long as we don’t play these games, it doesn’t affect us at all right? I can’t play Valorant on Linux today because the developer won’t offer it. Even if they started offering it tomorrow then with a Linux anti-cheat, it’s existence wouldn’t bother me because I don’t play it. What’s the issue here, really? Who’s being affected by a game they don’t play and don’t want to play?
delecti 5y ago
> and I refuse to knowingly install a game that features one Yes, and that's the decision you have available to you. I would make the same decision, but I still think the developers are smart to put those kernel level anti-cheat schemes in their games. I don't do much multiplayer gaming anyway, but when I have, rampant cheating entirely ruins the experience.
Ragnarork 5y ago
Very interesting to see this criticism in a topic about Valve, who don't go there with VAC, and are often criticized for not going the kernel level anti-cheat route (by a chunk of the playerbase that thinks it will solve cheating). They even backpedaled when people found out that they were analyzing your DNS cache on Windows to search for known cheat provider websites.[0] [0]. https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
- deleted 5y ago
  [deleted]
- btdmaster 5y ago
  You should not need to reverse engineer a piece of software for it to not spy on your network activity. Either way, it's not clear whether resolving cheatsite.com is that well-correlated with cheating. There's a reason why this is called Hacker News.
  - Ragnarork 5y ago
    That's another topic, but that's kind of my point: Valve weren't doing anything akin to kernel-level shenanigans, and even without that, some of the stuff they did already backfired because of privacy concerns. Since then, they've focused on other avenues to combat cheating (e.g. Overwatch, a replay reviewing system involving the community, or VACnet, a ML model that they trained to recognize in-game behaviours linked to cheating).
LinuxBender 5y ago
I agree with this. In my professional past I always pushed back on kernel modules unless everyone on the project agreed that once installed this was no longer Linux but rather a proprietary appliance and the 3rd party is now responsible for the uptime and security of the server. The DevOps and operations teams are entirely off the hook for supporting that appliance. I won most battles, lost a few. There was always some vendor trying to sell a SSD card that required a kernel module instead of just presenting itself as a generic SAS devices really a really high queue depth. I would make an exception if someone managed to get Linus Torvalds to sign off their kernel code. Nobody ever bothered and there were always awkward but predictable silent pauses from vendors. Oh and add to this all of the servers handled the most sensitive data to ever touch the internet. Vendors would sometimes entertain the idea of their code getting 3rd party code and security reviews but it never got past the idea stage.
gunapologist99 5y ago
From a gaming perspective, it might be the most "fun" to deliberately choose games that are older and less popular, since then the streamers (those who are also cheaters) aren't really focused on them, since they won't get the views/clicks to see how "good" they are. In other words, follow the money. No one is watching someone else play Super Tux Kart on Twitch. (lol) They're watching someone play the latest AAA game, where the financial incentives to cheat are the highest.
outworlder 5y ago
> The presence of 15 year old script kiddies using aimbots does NOT IN ANY WAY justify having kernel level control over my machine, Linux or otherwise. Valve, and every other company that contributes to gaming in general, kindly stay the fuck out of our kernels. I agree that we should take a stance and I don't like kernel-level drivers any more than you do. Kernel-level drivers are required on Windows. However, we even know if this is also going to be required on Linux?
deleted 5y ago
[deleted]
torginus 5y ago
Are they advocating for that? I thought that, for example, doing a secure boot from a trusted disk image, and consequently not allowing to touch any system-critical components, as well as a good process sandbox model could ensure that cheating is very, very hard, undetectable cheating even more so - and the rootkit-like behavior of anti cheats could be constrained to the sandbox - let's say that the anti cheat software replaces common software libraries with introspectable versions with something like OverlayFS, but since the whole game runs in a Docker container, it cannot affect the rest of your system. Generally speaking, I was also livid when I learned about how Riot planned to solve cheating in Valorant with it's own rootkit - and I think Microsoft isn't crazy about the idea either. My two cents are on this being one of the major reasons MS decided to make TPM mandatory for Windows 11.
MisterTea 5y ago
Agreed. I don't play these kinds of games so I don't care. However, I do play some more casual games and I would immensely care if an anti-cheat kernel driver were necessary for A. Steam to run or B. Any game to run. At that point steam is dead to me as I don't need steam.
db65edfc7996 5y ago
>I draw a line at supporting kernel level anti-cheat drivers Especially given the poor record of video game companies to take security seriously [0]. Even Rockstar's cash cow game [1], there was the lowest of low hanging performance fruit available that was not addressed by any ongoing effort. Why should I believe that any game company rushing to push some release out the door is going to take their kernel patch seriously? Security is hard and Intel/AMD/professional kernel devs screw it up all the time. [0] https://www.vice.com/en/article/wjwd8n/hacker-drops-steam-zero-day-after-being-banned-from-valve-bug-bounty-program https://www.vice.com/en/article/wjwd8n/hacker-drops-steam-ze... [1] https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... Edit: fixed the formatting

mensetmanusman 5y ago

But it should be an option for those that wants to play knowing there are probably fewer cheaters if they opt in. There will always be trade-offs in freedom when you try to implement rules to improve the freedom of those that want to play on a balanced playing field. This is true in society as well.

Rooster61 5y ago
It's not freedom, its security. DRM is neither here nor there as long as its in user-space. It sucks for the consumer, but I understand why companies do it even if I don't like it. Kernel level drivers are a whole different can o' worms. A corporation could make my gaming rig into part of what amounts to a spyware botnet with me being none the wiser other than encrypted traffic coming OUT of my machine. Those drivers by design are black boxes, and there is no way to monitor what your machine is actually doing. That shit shouldn't be on mine or anyone else's system, especially under the premise of a "fair gameplay environment".
- maccard 5y ago
  > A corporation could make my gaming rig into part of what amounts to a spyware botnet with me being none the wiser other than encrypted traffic coming OUT of my machine For the average user they can do that with basic permissions anyway. I wouldn't notice a steady stream of 2-300 kbps of binary data uploading from my machine, for example. I'd chalk it down to shitty programming. On any windows or Linux system, there is nothing stopping a binary from sniffing your clipboard, reading your .ssh directory, or just deleting your home folder/filling the files with garbage.

1_player 5y ago

Honestly, I'm neutral about kernel level anticheat. I won't play any of those games, but this doesn't mean we should make porting games that make use of these technologies any harder.

corpdronejuly 5y ago
What I would love to see is open source kernel level anti-cheat. The issue of course is that would reveal just how much of our data those things Hoover up.
- Thiez 5y ago
  How exactly would an open source anti-cheat do its job effectively?
  - toomanydoubts 5y ago
    Being opensource doesn't imply the game server will allow modified builds to work. Being able to see the code doesn't mean you will find a suitable way to circumvent the anticheat. That being said, I agree it would be harder to maintain an open source anticheat effectively.
    - demindiro 5y ago
      > Being opensource doesn't imply the game server will allow modified builds to work The client can lie about being modified. E.g. it can send false hashes.
  - Bancakes 5y ago
    The same way open source crypto libraries do.
    - sbarre 5y ago
      Please explain in more detail? I am curious to hear your theory on this.

Kuinox 5y ago

I wish you to play a competitive multiplayer game filled with cheaters. You don't know if your opponent is good or cheating. It simply kill all the fun. If it won't work on PC, multiplayer gaming will simply moves to consoles. Great, now you are stuck with a closed standard, with a closed OS, where you can't run the programs you want.

izacus 5y ago
> Great, now you are stuck with a closed standard, with a closed OS, where you can't run the programs you want. The DRM anticheat drivers turn Linux PCs into a closed standard, closed OS platforms where your software kills itself (even if it's single-player) when you step out of the locked down platform. You're trying to picture a difference where there is none.
- danuker 5y ago
  This gets me thinking. They could strike deals with AMD and Nvidia to bundle some anticheat mechanisms in their proprietary Linux drivers.
  - judge2020 5y ago
    If I’m not mistaken, SGX was/is available to programs on Linux.
- sbarre 5y ago
  There is a huge difference between one narrow-purpose component of your system being closed and a whole system being closed. Come on.
  - izacus 5y ago
    What DRM anticheat measures do is to monitor your whole system for modifications and kill the app if they detect changes. For example, they will make sure that your nVidia (or AMD) driver is one of the whitelisted hashes and hasn't been modified with a wallhack. This is why Linux users using Wine keep being banned from these platforms - they detect "unusual" runtime environment and ban the players because it doesn't fit into their narrow hash of an "acceptable" system. It is an outright definition of sealing off your OS from modification.

addandsubtract 5y ago

Maybe the compromise is to install the multiplayer module (and anti-cheat drivers) separately. Because coming from the other side of gamers fed up with cheaters, I've heard people wanting to install an anti-cheat which would overclock and kill the GPU of the cheater.

throwoutway 5y ago

I’m opposed to kernel drivers/root kits too, but I wouldn’t install this on my daily driver. I’d have a separate partition with a fresh Linux install. So I don’t personally have a problem with it as I’d just treat it as a gaming system that I consider compromised. I wouldn’t do any banking or browsing on it

bee_rider 5y ago
This seems like a real benefit to Linux. Just installing it on a new partition would be a tricky proposition on Windows. In Linux it is the obvious solution. As an added bonus, you could look into doing some of the latency tuning stuff and not have to worry about messing up your work partition.

5co 5y ago

dagw 5y ago

If I played competitive video games seriously I would absolutely want them to take cheating seriously and take any necessary measure to stop it. At the same time I think they should also make the most serious kernel/driver level anti-cheat software optional. If you don't to want to install it you can still play the game, just not on any of the 'pro' servers. Think of it a bit like doping tests in sports. As long as you're just competing in amateur races for fun then take all the steroids you want. Once you want to start competing in serious races be prepared for people demanding blood and urine samples.

sbarre 5y ago
The problem with this logic is that most multiplayer games have post-sale economies with cosmetics and other add-ons, and I would guess that most of those sales comes from casual players. So while anti-cheat helps protect the pro/serious players (who in some ways are community/marketing leaders in this world of Twitch and YouTube), it also creates a fair environment for all the casual and aspiring players who keep spending money on the game in droves.
- 0xedd 5y ago
  Your argument falls short. Pro cheating uses hardware to cheat. It streams the video output and keyboard/mouse input to an AI/ML. Making these kernel anti-cheat useless there. Casual players looking to spend money on cosmetics aren't affected by cheaters because the system influencing the players to buy isn't affected by the cheaters. The way most of these "influence systems" work is by using marketing strategies. It'll augment your match, or otherwise the players you meet, to see cosmetics you don't have. Coupled with gambling mechanics to induce addiction and sheer marketing material ("best offer now!") makes for this whole pro-kernel-anti-cheat industry move highly dubious. Source: i worked at a company that writes such systems. The day I decided to quit was when my naive ass heard the team lead, on a recruitment call, explain to a candidate what we do: "we refine a company's ability to get kids addicted". It's a completely different game (no pun intended) than what news outlets want us to think.
  - 5y ago

ineedasername 5y ago

People that like to play those games can always dual boot so that kernel-level access doesn't run on the non-gaming OS. It's not ideal, but it allows Linux gaming without compromising your kernel for non-gaming work. Or if you want the option of switching without a reboot you can run another linux instance in a VM, even a VM that uses a logical partition instead of its own image so that you can also boot normally into that partition when you want. Again, not ideal, but if you're committed to Linux then it's still better than being forced into Windows for gaming.

Bancakes 5y ago

Game devs should know who's cheating serverside. After all, that's where most of the logic takes place, specifically because they don't trust users.

foobarian 5y ago

It's not like video card companies don't have black boxes in the kernel. Maybe nVidia will make an anti-cheat API and then it's gonna be a choice between "have a 3d accelerator at all" and "clean kernel."

heyens 5y ago
Which is why people who care about stuff like this use an AMD GPU, whose driver is open sourced and mainlined in the kernel. This is not perfect since there are still BLOBs, but it does help a lot.

motoboi 5y ago

Competitive gaming is a thing. For those cases, Valve can distribute a linux gaming OS with anti-cheat mechanisms. Then restrict competitive participation to that OS. That or giving up the problem.

judge2020 5y ago

> Add on the fact that these programs are black boxes by design, and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose. Unless you run flatpak, nix, lxc containers, or some other process isolation scheme, all programs on eg. A debian desktop have this sort of free reign. It’s not uncommon for accidents to happen that take out chunks of a system[0]. 0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...

gurkendoktor 5y ago
> Unless you run flatpak... Well yes, sandboxing should be the goal! Installing Steam from Flathub is a good first step on desktop machines. But as long as games require anti-cheat software at the kernel level, I'll keep a Windows partition around to sandbox the gaming world as a whole.
account42 5y ago
A more topical example: https://github.com/ValveSoftware/steam-for-linux/issues/3671 https://github.com/ValveSoftware/steam-for-linux/issues/3671

charcircuit 5y ago

>and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose This is the case for user level anticheats too. 99% of what a malware wants to do it can do from userspace.

matheusmoreira 5y ago

Completely agree. My computer is my computer and they need to stop trying to own it. I should be able to install and use the software I paid for without some unknown kernel module getting forced into my machine. Proprietary software is bad enough. Nobody cares that they "need" to do it, that's a line they can't cross and if it means their games have cheaters on them so be it.

txdv 5y ago

With all the machine learning we have, game makers could train models to spot hackers. The hacking patterns were obvious even during counter strike 1.6 days. Maybe they got more subtle? I don't play a lot of FPS, but In Dota2 I see a bunch of hackers where the replay literally shows you how they do not even react with their mouse to a threat that appears suddenly but still manage to cast a spell somehow. I don't even think that machine learning is needed to detect that kind of hack.

d3fault 5y ago
As far as I'm aware Valve does use ML (called VACnet) to detect cheaters. At the time of the GDC talk[0] it was only implemented for CSGO but it could've expanded since then [0] https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc

mikepurvis 5y ago

> free reign In case you're curious, it's a horse thing: https://www.merriam-webster.com/words-at-play/usage-free-rein-vs-free-reign https://www.merriam-webster.com/words-at-play/usage-free-rei...

steadyready 5y ago

I did a lot of cheat development and always read the related forums. Let me tell you that kernel anti-cheats are the funniest and ugliest pieces of software out there. Almost ALL exhibit rootkit behaviour. Capture all OS events, dig through system and user directories, list all processes, fetch DNS and browser histories, block certain system calls, and more just to name a few. But hey! Their software (including drivers) are signed by Microsoft, so that’s alright :)) Funny part is that all those drivers are created by no other than ex-community members, under no advisory from system specialists or security experts. So guess what? Security vulnerabilities all around. Pretty much all their drivers are wide open and unsecure. Nice fun having persistent, kernel-level, system-trusted exploits auto-installed on your system! Oh, almost forgot, BattlEye has the ability to download custom bytecode from their servers and execute it. RCE baked right in. Good stuff. So your frustration is more than reasonable.. EDIT: I will try to find the posts pointing to all vulns that I mentioned, and cite them.

dijit 5y ago
As a person in the industry: Everything this person is saying is true. We need a real solution to this honestly, it’s not enough to just kick up a fuss about game devs including anti-cheat and ever-more-invasive anti-cheat, but actually providing solutions people can use. The economic incentives do not exist on consoles to cheat, so publishers are convinced that control of the platform is the problem.
- enragedcacti 5y ago
  As someone in the industry, would you mind weighing in on Vanguard, the kernel level anti-cheat used for Valorant? On release they made a big deal about how small the kernel level portion is and how most of the complexity of the anti-cheat was still in user space. I'd be interested to hear how true that is and if that makes much of a difference in your mind how trustworthy it is.
  - dijit 5y ago
    I don’t have the code for that and it might require my studio to open a deal with vanguard to get access to the source. Generally speaking though; the size of the components that run in the kernel is not important. The kernel mode software can act as a window to the rest of the system.

jjkmk 5y ago

The problem is it's not just kids using public cheats. There are private cheats that really damage the integrity of competitive gaming. Counter Strike Global Offensive is a good example of this.

aceazzameen 5y ago

I've always wondered if just having a really strong matchmaking system would be enough. It would keep cheaters playing against cheaters. Pro players in theory shouldn't be as good as cheaters, so they'd be in their own rank. But I suppose cheaters could purposefully play poorly sometimes to keep their ranking down. Is that even worth it to cheaters? Downside to all of this is it would have to take longer to get into matches to keep players in their pools. I know games already do this, but they seem to match players up or down too quickly to keep the velocity of matches going. As I type this I realize this system wouldn't work. Pro players would complain about long waits whiles average players would play the most frequently. Lose pros and you lose average players.

evanmoran 5y ago
You already figure it out from the pro side, but it sadly is not enough on the casual side as well. The issue is streamers would show their audience how easy it is to cheat and this would lead to a perception by more casual gamers that cheating is rampant and so they would be less inclined to join. This reduces the audience, hitting worse match making (as you suggest), lower stream viewership, less game success for the studio, etc.
bee_rider 5y ago
As a pretty bad FPS player (was ok on consoles but never got the knack for aiming with a mouse in the same way), matchmaking works well enough for me. My better friends are always complaining about hackers, but I almost never encounter them.

berryton 5y ago

While I despise this kernel level bs, do you know how it is going to be implemented on Linux? As far as I understand, it is coming via Proton/Wine, so these programs would need some kind of kernel level access as well (if they don't have it currently)? Or maybe they're just emulating Windows kernel calls or something like that. I mean, less intrusive (but also less effective) in a Linux system.

mmind 5y ago

I fully agree. For me this is one of the main advantages of game streaming and why I think is the future. It is a way to prevent cheating and bad actors that does not require me giving kernel access to game developers. Also protects me from people learning my own IP via poor chat or multiplayer implementations.

dijit 5y ago

This comment deserves a much more detailed response than I'm able to give at the moment, but I can give some very brief thoughts: Let me say that I have been working in AAA online game development for more than 7 years now; I have worked on games that had 10's of millions of players, and these were full fat $60 AAA games. Cheating was the second[0] biggest issue of our games, it sucked the entire enjoyment out- getting ganked by a bunch of players shooting through walls is not fun. Why did we "allow" cheating?: Well, we never did, we used some of the best anti-cheat software we could afford, but it was still possible to cheat. "Don't trust the client" is a common response, but being fully synchronised to the server has drawbacks too; servers typically "tick" at about 10-20fps, theres a lot of tricks we pull off to make it seem as if it's going the 144-240Hz of your monitor, like showing hitmarkers (but not damage numbers) to make it feel as if it's fast, if your movements were synced to the server you would feel as though you were walking through water, as the movement would be very slow as it needs to do a 150ms round trip to sync a step. The truth of it is if we fully synchronised every action to the server: not only would it feel abhorrently slow; it would require a full 3d rendered simulation of the game world, we'd be able to run maybe 3-4 users on 40 core machines with 256G of ram... that's not feasible. "Don't make online games" is another common response to hearing the realities and difficulties of making these kinds of games. But I'd suggest, if that's your response; even if we made them that doesn't mean you have to install them. We're both making a decision here: We decided to make an online game because it can be a lot of fun, you decided to install an online game because it can be a lot of fun. Cheaters want to ruin that fun, we have woefully few tools to prevent that. (by the by: I'm not in favour of kernel level anti-cheat, but fuck are cheaters the bane of my existence). [0]: Biggest issue was actually bugs, but when we fixed bugs, cheaters were the next primary complaint.

okamiueru 5y ago
Was there an attempt at detecting cheaters by modeling human reaction times and otherwise inputs, and thus detecting non-human like inputs?
- dijit 5y ago
  Yes. Here's a good perspective on the situation by someone who was cheating: https://www.reddit.com/r/thedivision/comments/4k17n8/confessions_of_a_cheater_and_the_current_problems/ https://www.reddit.com/r/thedivision/comments/4k17n8/confess...

nindalf 5y ago

I’m not sure I understand peoples objections to the existence of anti-cheat software. As far as I can tell, as long as we don’t play these games, it doesn’t affect us at all right? I can’t play Valorant on Linux today because the developer won’t offer it. Even if they started offering it tomorrow then with a Linux anti-cheat, it’s existence wouldn’t bother me because I don’t play it. What’s the issue here, really? Who’s being affected by a game they don’t play and don’t want to play?

delecti 5y ago

> and I refuse to knowingly install a game that features one Yes, and that's the decision you have available to you. I would make the same decision, but I still think the developers are smart to put those kernel level anti-cheat schemes in their games. I don't do much multiplayer gaming anyway, but when I have, rampant cheating entirely ruins the experience.

Ragnarork 5y ago

Very interesting to see this criticism in a topic about Valve, who don't go there with VAC, and are often criticized for not going the kernel level anti-cheat route (by a chunk of the playerbase that thinks it will solve cheating). They even backpedaled when people found out that they were analyzing your DNS cache on Windows to search for known cheat provider websites.[0] [0]. https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...

deleted 5y ago
[deleted]
btdmaster 5y ago
You should not need to reverse engineer a piece of software for it to not spy on your network activity. Either way, it's not clear whether resolving cheatsite.com is that well-correlated with cheating. There's a reason why this is called Hacker News.
- Ragnarork 5y ago
  That's another topic, but that's kind of my point: Valve weren't doing anything akin to kernel-level shenanigans, and even without that, some of the stuff they did already backfired because of privacy concerns. Since then, they've focused on other avenues to combat cheating (e.g. Overwatch, a replay reviewing system involving the community, or VACnet, a ML model that they trained to recognize in-game behaviours linked to cheating).

LinuxBender 5y ago

I agree with this. In my professional past I always pushed back on kernel modules unless everyone on the project agreed that once installed this was no longer Linux but rather a proprietary appliance and the 3rd party is now responsible for the uptime and security of the server. The DevOps and operations teams are entirely off the hook for supporting that appliance. I won most battles, lost a few. There was always some vendor trying to sell a SSD card that required a kernel module instead of just presenting itself as a generic SAS devices really a really high queue depth. I would make an exception if someone managed to get Linus Torvalds to sign off their kernel code. Nobody ever bothered and there were always awkward but predictable silent pauses from vendors. Oh and add to this all of the servers handled the most sensitive data to ever touch the internet. Vendors would sometimes entertain the idea of their code getting 3rd party code and security reviews but it never got past the idea stage.

gunapologist99 5y ago

From a gaming perspective, it might be the most "fun" to deliberately choose games that are older and less popular, since then the streamers (those who are also cheaters) aren't really focused on them, since they won't get the views/clicks to see how "good" they are. In other words, follow the money. No one is watching someone else play Super Tux Kart on Twitch. (lol) They're watching someone play the latest AAA game, where the financial incentives to cheat are the highest.

outworlder 5y ago

> The presence of 15 year old script kiddies using aimbots does NOT IN ANY WAY justify having kernel level control over my machine, Linux or otherwise. Valve, and every other company that contributes to gaming in general, kindly stay the fuck out of our kernels. I agree that we should take a stance and I don't like kernel-level drivers any more than you do. Kernel-level drivers are required on Windows. However, we even know if this is also going to be required on Linux?

deleted 5y ago

[deleted]

torginus 5y ago

Are they advocating for that? I thought that, for example, doing a secure boot from a trusted disk image, and consequently not allowing to touch any system-critical components, as well as a good process sandbox model could ensure that cheating is very, very hard, undetectable cheating even more so - and the rootkit-like behavior of anti cheats could be constrained to the sandbox - let's say that the anti cheat software replaces common software libraries with introspectable versions with something like OverlayFS, but since the whole game runs in a Docker container, it cannot affect the rest of your system. Generally speaking, I was also livid when I learned about how Riot planned to solve cheating in Valorant with it's own rootkit - and I think Microsoft isn't crazy about the idea either. My two cents are on this being one of the major reasons MS decided to make TPM mandatory for Windows 11.

MisterTea 5y ago

Agreed. I don't play these kinds of games so I don't care. However, I do play some more casual games and I would immensely care if an anti-cheat kernel driver were necessary for A. Steam to run or B. Any game to run. At that point steam is dead to me as I don't need steam.

db65edfc7996 5y ago

>I draw a line at supporting kernel level anti-cheat drivers Especially given the poor record of video game companies to take security seriously [0]. Even Rockstar's cash cow game [1], there was the lowest of low hanging performance fruit available that was not addressed by any ongoing effort. Why should I believe that any game company rushing to push some release out the door is going to take their kernel patch seriously? Security is hard and Intel/AMD/professional kernel devs screw it up all the time. [0] https://www.vice.com/en/article/wjwd8n/hacker-drops-steam-zero-day-after-being-banned-from-valve-bug-bounty-program https://www.vice.com/en/article/wjwd8n/hacker-drops-steam-ze... [1] https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... Edit: fixed the formatting