4 ms·

Ask HN: Why can't anti-cheat software work on Linux?

5 points by vednig 2y ago

Haeuserschlucht 2y ago
Be psyched that it doesn't. Anti-Cheat software is spyware at it's finest.
p_ing 2y ago
Valorant and the like use kernel modules. They run along side the most critical portions of the OS, just like many hardware drivers. This allows them to detect anything happening on the system. Kernel modules need to be written for the operating system, so this means there would need to be a userbase present on Linux/macOS to justify writing such a driver (writing kext for macOS is even more difficult as Apple has more or less banned them). You don't want these types of anti-cheat. I would encourage anyone looking into games that use kernel modules for anti-cheat to avoid them. Unfortunately user-mode anti-cheat has been defeated time and time again.
- vednig 2y ago
  why can't there be a separate emulated/psuedo layer over kernel that allows freezing the requested files in place specifically for the provided application?
  - p_ing 2y ago
    Anti-cheat needs to have a view into all other processes on the system. Many of these will detect if certain debugging-style software is running, or if a virtual machine is running, for example.
stop50 2y ago
Namespaces allow to fake filesystems, processes, users, devices. selinux, apparmor, ... can deny access for the anticheat.
Juliate 2y ago
Technically, anti-cheat requires control over the system (computer being used, room and network where the test happens). An open source operating system could be used to block or circumvent the control check points of said spyware. So installing it on your Linux workstation may not provide enough guarantees. But... the unasked question, but important one is: why install one on _your_ computer? If someone (school, org, whatever) needs you to pass a test, they can provide the whole package if they want to exert control over the whole context of the test. But submitting in advance to their own requirement (it's not _your_ requirement), by compromising your own computer? This may as well be a hidden purpose test, where refusing to install said software is the "good" answer. And if the employer doesn't accept/understand that, that's... problematic for them on a whole other level.
- vednig 2y ago
  if designed correctly could this work, say preventing sending out excessive network calls or notifying user if system is being monitored along with ability to exit it?
  - Juliate 2y ago
    What are you trying to achieve exactly?
    - vednig 2y ago
      i'm just testing the waters before diving full in on to including the ability for anti-cheat to work on a distro i'm working on
      - salawat 2y ago
        Don't. Stop normalizing and/or making simple these groups actions. Look. Not all things need be made. In point of fact, some should pointedly not. Systems that don't respect the sovereignty of the user are exactly the types of things we should not be enabling.
immibis 2y ago
There's more variation. Every Windows system is basically alike. Anything unusual is a cheat. Every Linux system is not alike. You could make one that works for Ubuntu. Anti-cheat often tries to detect suspicious modules, for example. On Linux, that suspicious module could be a buggy or obscure driver for some obscure piece of hardware. On Windows, at least it's signed by Microsoft saying "this is a real driver for an obscure piece of hardware".
- vednig 2y ago
  yeah, that is something I considered, there's no single source of truth in this scenario, there are some linux systems that would require specific patches to kernel, just to function properly, hence the requirement of some sort of open scanning tech
d3Xt3r 2y ago
You're mistaken, anti-cheat (some of them) do work on Linux[1], such as Easy AntiCheat, BattlEye, nProtect GameGuard etc. But not every game using these will work, since some of them require the developer to enable Linux support - which is usually as simple as ticking a box. Unfortunately, many game studios / publishers don't want to support Linux, for various reasons. Some of them even are even biased against Linux, such as Epic's Tim Sweeny, who has made several unsubstantiated nonsensical claims against Linux. Unfortunately there's not much you can do about these people / studios, besides boycotting their products and services. There's also a second category of anti-cheat (kernel-level), which will never work on Linux, as @p_ing elaborated. I second their opinion that you shouldn't run games which use these, even on Windows. The Crowdstrike incident has shown us how dangerous such programs can be (causing BSODs and instability). Kernel-level anti-cheat programs are even more dangerous, since they monitor everything on your PC, actively sabotages any inspection tools, and protects itself from being uninstalled - which is behaviour very akin to malware/rootkits. You should _never_ install such programs on your PC. Once again, the solution here is to vote with your wallet and boycott games and studios which use such solutions. [1] https://areweanticheatyet.com/ https://areweanticheatyet.com/
- vednig 2y ago
  i meant kernel level anti-cheats, though these have behavior akin to malware, unfortunately most popular games do require anti-cheat as well as some tests, which makes it even more important to have at least some sort of support for programs requiring that on Linux CrowdStrike was a global issue because of single source of failure, CrowdStrike itself, similarly if the support is delegated over to the OS or if the OS can somehow ascertain some level of relative stability in the system, widely used kernel rooting anti-cheat wouldn't be required

5 points by vednig 2y ago

Be psyched that it doesn't. Anti-Cheat software is spyware at it's finest.

Valorant and the like use kernel modules. They run along side the most critical portions of the OS, just like many hardware drivers. This allows them to detect anything happening on the system. Kernel modules need to be written for the operating system, so this means there would need to be a userbase present on Linux/macOS to justify writing such a driver (writing kext for macOS is even more difficult as Apple has more or less banned them). You don't want these types of anti-cheat. I would encourage anyone looking into games that use kernel modules for anti-cheat to avoid them. Unfortunately user-mode anti-cheat has been defeated time and time again.

vednig 2y ago
why can't there be a separate emulated/psuedo layer over kernel that allows freezing the requested files in place specifically for the provided application?
- p_ing 2y ago
  Anti-cheat needs to have a view into all other processes on the system. Many of these will detect if certain debugging-style software is running, or if a virtual machine is running, for example.

stop50 2y ago

Namespaces allow to fake filesystems, processes, users, devices. selinux, apparmor, ... can deny access for the anticheat.

Juliate 2y ago

Technically, anti-cheat requires control over the system (computer being used, room and network where the test happens). An open source operating system could be used to block or circumvent the control check points of said spyware. So installing it on your Linux workstation may not provide enough guarantees. But... the unasked question, but important one is: why install one on _your_ computer? If someone (school, org, whatever) needs you to pass a test, they can provide the whole package if they want to exert control over the whole context of the test. But submitting in advance to their own requirement (it's not _your_ requirement), by compromising your own computer? This may as well be a hidden purpose test, where refusing to install said software is the "good" answer. And if the employer doesn't accept/understand that, that's... problematic for them on a whole other level.

vednig 2y ago
if designed correctly could this work, say preventing sending out excessive network calls or notifying user if system is being monitored along with ability to exit it?
- Juliate 2y ago
  What are you trying to achieve exactly?
  - vednig 2y ago
    i'm just testing the waters before diving full in on to including the ability for anti-cheat to work on a distro i'm working on
    - salawat 2y ago
      Don't. Stop normalizing and/or making simple these groups actions. Look. Not all things need be made. In point of fact, some should pointedly not. Systems that don't respect the sovereignty of the user are exactly the types of things we should not be enabling.

immibis 2y ago

There's more variation. Every Windows system is basically alike. Anything unusual is a cheat. Every Linux system is not alike. You could make one that works for Ubuntu. Anti-cheat often tries to detect suspicious modules, for example. On Linux, that suspicious module could be a buggy or obscure driver for some obscure piece of hardware. On Windows, at least it's signed by Microsoft saying "this is a real driver for an obscure piece of hardware".

vednig 2y ago
yeah, that is something I considered, there's no single source of truth in this scenario, there are some linux systems that would require specific patches to kernel, just to function properly, hence the requirement of some sort of open scanning tech

d3Xt3r 2y ago

You're mistaken, anti-cheat (some of them) do work on Linux[1], such as Easy AntiCheat, BattlEye, nProtect GameGuard etc. But not every game using these will work, since some of them require the developer to enable Linux support - which is usually as simple as ticking a box. Unfortunately, many game studios / publishers don't want to support Linux, for various reasons. Some of them even are even biased against Linux, such as Epic's Tim Sweeny, who has made several unsubstantiated nonsensical claims against Linux. Unfortunately there's not much you can do about these people / studios, besides boycotting their products and services. There's also a second category of anti-cheat (kernel-level), which will never work on Linux, as @p_ing elaborated. I second their opinion that you shouldn't run games which use these, even on Windows. The Crowdstrike incident has shown us how dangerous such programs can be (causing BSODs and instability). Kernel-level anti-cheat programs are even more dangerous, since they monitor everything on your PC, actively sabotages any inspection tools, and protects itself from being uninstalled - which is behaviour very akin to malware/rootkits. You should _never_ install such programs on your PC. Once again, the solution here is to vote with your wallet and boycott games and studios which use such solutions. [1] https://areweanticheatyet.com/ https://areweanticheatyet.com/

vednig 2y ago
i meant kernel level anti-cheats, though these have behavior akin to malware, unfortunately most popular games do require anti-cheat as well as some tests, which makes it even more important to have at least some sort of support for programs requiring that on Linux CrowdStrike was a global issue because of single source of failure, CrowdStrike itself, similarly if the support is delegated over to the OS or if the OS can somehow ascertain some level of relative stability in the system, widely used kernel rooting anti-cheat wouldn't be required