3 ms·

Now that this is being discussed and nvidia is finally phasing to an open source kernel implementation can we get MS and mainstream Linux distributions to shun

Now that this is being discussed and nvidia is finally phasing to an open source kernel implementation can we get MS and mainstream Linux distributions to shun away kernel extensions like Apple did? Software like crowdstrike, anti cheat and all operate like rootkits and basically own your machine. Go user space or go home. Allow it but make it hard. Put lots of warnings. Require enrolling custom keys.

cqqxo4zV46cp 2y ago
That doesn’t fix the issue being discussed at all though. All you’re doing is making it harder for the corporate IT departments that are going to install this anyway.
- irusensei 2y ago
  I don’t think so because doing so will mean those IT departments will lose OS support which is more critical. This will force those “benign rootkit” companies to implement their software properly to remain on the market. For reference crowdstrike on current MacOS is a network extension.
zozbot234 2y ago
Yes, please shun away kernel extensions for all real-world production settings. You'll probably always need to run kernel-level anti-cheat malware on your gaming rig, but a production machine is not a toy and should not be subject to the same standards.
- llm_trw 2y ago
  That's bullshit too. I can build a webcam with an rpi that will play CS better than any human and only communicate with the gaming PC through a mouse and keyboard. Anti-cheat systems need to look for movements that are super human, no rootkits required.
  - irusensei 2y ago
    Not to mention the fact that if one of those companies get infiltrated the attacker will have kernel level access to millions of computers. There is also the fact that some of these anti cheat software are bundled with popular games produced in China.
  - supriyo-biswas 2y ago
    > Anti-cheat systems need to look for movements that are super human, no rootkits required. That won't be effective for wallhack/ESP-style cheats.
    - josephcsible 2y ago
      Those kinds of cheats should be fixed by the server not sending information to the player's client that the player isn't supposed to know.
      - supriyo-biswas 2y ago
        That would be extremely limiting to do because of the constraints imposed by networked gaming; which requires that some data be locally available to the game locally to allow for immediate feedback. Just imagine if a web page had to send a network request to control a toggle or to show the contents of an accordion; that's what the game would turn into if this were to be done.
switch007 2y ago
> nvidia is finally phasing to an open source kernel implementation Like, for real - as in, Debian would be happy to include it in their main repo? Or lip service? (Assuming you meant their graphics drivers)
- irusensei 2y ago
  https://developer.nvidia.com/blog/nvidia-transitions-fully-towards-open-source-gpu-kernel-modules/ https://developer.nvidia.com/blog/nvidia-transitions-fully-t... Not upstreamed yet so I’m guessing it will take a while to reach Debian.
  - switch007 2y ago
    Wow. Exciting! Fingers crossed
- saghm 2y ago
  My recollection is that when they first started doing this a couple of years ago, they did it by pushing as much as possible from the driver to the device firmware, which is still not open source. I assume that the open source driver is in Debians repos by now.
- deleted 2y ago
  [deleted]
the8472 2y ago
Linux already considers kernels with proprietary modules tainted. And with secure boot you can lock it down so that root can't load kernel modules. It's up to the distro and user to decide whether they want to allow it or not.
- Ekaros 2y ago
  Issue here is that there is no reason for organization that mandates these sort of solution to not mandate them in what ever distro they will use or allow on their machines. In the end unless system is entirely locked down by the vendor without any compromise that will happen... And most of the time these customers will choose something else that is not entirely locked so they can have their security thingy...
immibis 2y ago
You mean shun closed-source kernel extensions? Because that open source Nvidia driver IS a kernel extension. So is my NIC driver.
- josephcsible 2y ago
  Shun out-of-tree kernel modules. The point is now that Nvidia is going open source, it'll be possible to get its driver into the mainline tree.
dist-epoch 2y ago
Despite popular opinion, it's the gamers which are requesting anti-cheat. Game companies couldn't care less if there are cheaters. If Windows shuts that down and cheating becomes easier, Windows will have a problem with gamers.

cqqxo4zV46cp 2y ago

That doesn’t fix the issue being discussed at all though. All you’re doing is making it harder for the corporate IT departments that are going to install this anyway.

irusensei 2y ago
I don’t think so because doing so will mean those IT departments will lose OS support which is more critical. This will force those “benign rootkit” companies to implement their software properly to remain on the market. For reference crowdstrike on current MacOS is a network extension.

zozbot234 2y ago

Yes, please shun away kernel extensions for all real-world production settings. You'll probably always need to run kernel-level anti-cheat malware on your gaming rig, but a production machine is not a toy and should not be subject to the same standards.

llm_trw 2y ago
That's bullshit too. I can build a webcam with an rpi that will play CS better than any human and only communicate with the gaming PC through a mouse and keyboard. Anti-cheat systems need to look for movements that are super human, no rootkits required.
- irusensei 2y ago
  Not to mention the fact that if one of those companies get infiltrated the attacker will have kernel level access to millions of computers. There is also the fact that some of these anti cheat software are bundled with popular games produced in China.
- supriyo-biswas 2y ago
  > Anti-cheat systems need to look for movements that are super human, no rootkits required. That won't be effective for wallhack/ESP-style cheats.
  - josephcsible 2y ago
    Those kinds of cheats should be fixed by the server not sending information to the player's client that the player isn't supposed to know.
    - supriyo-biswas 2y ago
      That would be extremely limiting to do because of the constraints imposed by networked gaming; which requires that some data be locally available to the game locally to allow for immediate feedback. Just imagine if a web page had to send a network request to control a toggle or to show the contents of an accordion; that's what the game would turn into if this were to be done.

switch007 2y ago

> nvidia is finally phasing to an open source kernel implementation Like, for real - as in, Debian would be happy to include it in their main repo? Or lip service? (Assuming you meant their graphics drivers)

irusensei 2y ago
https://developer.nvidia.com/blog/nvidia-transitions-fully-towards-open-source-gpu-kernel-modules/ https://developer.nvidia.com/blog/nvidia-transitions-fully-t... Not upstreamed yet so I’m guessing it will take a while to reach Debian.
- switch007 2y ago
  Wow. Exciting! Fingers crossed
saghm 2y ago
My recollection is that when they first started doing this a couple of years ago, they did it by pushing as much as possible from the driver to the device firmware, which is still not open source. I assume that the open source driver is in Debians repos by now.
deleted 2y ago
[deleted]

the8472 2y ago

Linux already considers kernels with proprietary modules tainted. And with secure boot you can lock it down so that root can't load kernel modules. It's up to the distro and user to decide whether they want to allow it or not.

Ekaros 2y ago
Issue here is that there is no reason for organization that mandates these sort of solution to not mandate them in what ever distro they will use or allow on their machines. In the end unless system is entirely locked down by the vendor without any compromise that will happen... And most of the time these customers will choose something else that is not entirely locked so they can have their security thingy...

immibis 2y ago

You mean shun closed-source kernel extensions? Because that open source Nvidia driver IS a kernel extension. So is my NIC driver.

josephcsible 2y ago
Shun out-of-tree kernel modules. The point is now that Nvidia is going open source, it'll be possible to get its driver into the mainline tree.

dist-epoch 2y ago

Despite popular opinion, it's the gamers which are requesting anti-cheat. Game companies couldn't care less if there are cheaters. If Windows shuts that down and cheating becomes easier, Windows will have a problem with gamers.