10 ms·

How Riot Games is fighting the war against video game hackers

59 points by badmonster 1y ago

josephcsible 1y ago
This article seems to be making all of the worst things about anti-cheat (kernel modules, mandatory Secure Boot/TPM, etc.) seem like good things. Why?
- nekitamo 1y ago
  The alternative is that the online games they're protecting become infested with cheaters, players depart, and the game closes down because it's no longer a viable business. It's not nice, I don't like running a kernel mode anti-cheat any more than you do, but I can see why it's necessary for preserving the competitive integrity of free-to-play shooter games like Valorant.
  - imchillyb 1y ago
    If one must give up kernel level security of their system to an untrusted 3rd party, was it really free?
    - Hikikomori 1y ago
      Stuff you run as your user can already read all your files and memory of processes of that user so you're already very exposed.
  - __alexs 1y ago
    They are already full of cheaters. DMA cards are undetectable even from kernel anti cheat.
    - doikor 1y ago
      The DMA card still needs to be installed, have drivers installed, firmware, etc. The anti cheat tests for that (the cheaters do mask the device spoofing the name/vendor/etc). Having to make new driver/firmware every time the anti cheat starts to detect it is way slower then just new software. Though at some point they will probably just automate it so that every customer gets their own driver and firmware matched with only their cheat software making this way harder but we are not there yet (and you would have to get all of these signed so following the cert chain should make it easier to find at least whos stolen cert they are using) Also the amount of people willing to buy another pc and DMA cards is way smaller making the chance of running into cheater in your match smaller.
      - az09mugen 1y ago
        That's a good idea indeed.
      - __alexs 1y ago
        Giving every customer their own firmware is already automated. Computer vision based cheats are also rapidly on the rise. You don't get wall hacks but you do top 1% reaction times and perfect tracking.
        fc417fc802 1y ago
        Elephant in the room is that any behavior based solution that can reliably detect computer vision based cheating obviates the need for kernel level anti-cheat because it more or less solved the detection problem.
    - abigail95 1y ago
      are you writing your own firmware or hotwiring the bus? there are many methods to detect this.
- doikor 1y ago
  Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is very hard (or impossible) to detect it from user land outside of behavior (which mostly happens on the server side). Only thing I can think of is Microsoft locking down Windows so hard that nothing outside of code written (well signed) by Microsoft can run with kernel level privileges but I think that is an even worse option. If you don't like it you can always just go and play any of the titles without kernel level anti-cheat and get a cheater in ~1/5th of your games (my experience in counter strike).
  - jjmarr 1y ago
    Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.
    - doikor 1y ago
      This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
- mvdtnz 1y ago
  They're neither inherently good nor bad but unfortunately necessary.
- johnnyanmac 1y ago
  Insert the quote about freedom vs securities. This author (or his sponsors) clearly made their choice. Makes me glad I prefer mostly single player content and never tolerate this stuff on my PC. If I gotta be locked down I'll just pick up a console.
- jokoon 1y ago
  It can be seen as a Chinese backdoor on western computers. I am not expert, but I think it's not necessarily the case? Cheating is really a plague right now, and the only way to mitigate it is using kernel anti cheat.
  - ronsor 1y ago
    And now AI can pretend to be input devices and need only video output. Kernel anti-cheat will be useless, and we'll be better off for it. If your solution is bad, it doesn't deserve to work. Find something else.
    - doikor 1y ago
      Though if the AI is only as good as a human can be it is not that desirable. If the cheat does "super human" stuff it can be detected from behavior on the server side though this is after the fact from processing some replay files and thus not that "great" for players as the cheater gets to ruin at least one game. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But it is something they acknowledge will be an issue at some point in the future. Personally I think for now AI is way too slow as all the computation needs to happen in a few milliseconds to really be effective. > Koskinas says he often worries about the use of AI for screen classification, to learn what human inputs look like, and how to reproduce them.
    - az09mugen 1y ago
      Since AI is everywhere you think it can be used to spot cheaters behaviours ?
      - ronsor 1y ago
        Yes, that's the real solution, not rootkits.
        mschuster91 1y ago
bee_rider 1y ago
It is really ridiculous that we’ve allowed all this kernel level spyware bullshit in the interest of something so frivolous as video game fairness. Matchmaking seemed like a neat idea in, like, 2007. In retrospect, it has damaged the industry substantially. All the oxygen has been sucked out of the community server space, etiquette is non-existent, and the aforementioned spyware.
- giancarlostoro 1y ago
  I refuse to buy a ton of games because they are hot garbage these days. Its pretty obvious what gamers want and they will shower their money at it. Look at Oblivion remastered. It had bare minimum marketing if you can even claim it had any marketing.
  - johnnyanmac 1y ago
    Tbf, a part of the issues causing since rampant cheating comes from the fact that those Riot games are indeed "what gamers want". There's definitely a divide in community between single player darlings like BGS's output and these "free" competitive service games like League or Apex or whatnot.
    - giancarlostoro 1y ago
      My point being, a lot of games seem to disable Linux due to cheating concerns. They get none of my money. Rust can sit there and gather rust in my steam library until the end of time.
      - johnnyanmac 1y ago
        Okay. I sympathize but you're the literal 1% of the target market for most games. Devs will take that risk.
- unclad5968 1y ago
  Then don't play those video games. Seems simple to me. Community servers are doing fine in games where that makes sense, Minecraft for example. Counter strike has community servers too and people cheat there all the time.
OrvalWintermute 1y ago
I just uninstalled ALL Riot Games from my Gaming Computer. Reason: Vanguard was crashing another Unity based game I play nonstop. It also seemed to decrease system stability in general. I will never play another Riot Game so long as this software is a part of it.
- jokoon 1y ago
  I wonder who makes that anticheat, I mean in what country. Obviously they have so many users, they might need to fix it. I can imagine that Microsoft might try to help them doing things right.
  - frosting1337 1y ago
    Vanguard is developed in the USA, though I think Riot also has security people in Dublin.
  - xeonmc 1y ago
    Tencent has a 100% equity on Riot Games
jokoon 1y ago
I stopped playing counter strike like 2 months ago after playing for 6 months, because I was getting paranoid about closet cheaters. My trust in the game eroded, even though cheaters are not there all the time. Closet cheaters are cheating in subtle ways, which make it impossible to know if they're really cheating. It's a constant analysis of "is he cheating or am I bad?", and most of the time, I could not really know. It's a psychologically toxic experience as I cannot focus on the game itself. I was enjoying the game, but that paranoia made things just unbearable. I suspect china/russia are actively paying people to make effective cheating software, as it's also a lucrative business. Even a few pro players are cheating. Those online FPS are rotten to the core. Apparently valve doesn't seem to care that much, because they probably know that there is a big overlap between cheaters and people who trade skins, who are a big source of income. Too bad!
- vips7L 1y ago
  Honestly this sounds like you’ve just over thought it. You’ve played CS for 6 months, you are bad!
  - skupig 1y ago
    CS has a concept of "trust factor" which groups people more likely to be cheating in the same game. If you ever queue with a friend with a low trust factor (which happens a lot if they're on a smurf account), there are cheaters in pretty much every game... seeing that many blatant cheaters has really made me think there must be a lot of smarter cheaters flying under the radar in regular games. It's basically impossible to tell whether someone is wallhacking or if they have really good game sense.
  - brnaftr361 1y ago
    I've played for many years including CS1.6, CS:S, GO, and 2. I regularly snoop profiles and overwhelmingly there are accounts with 1 game, all F2P games, short account lives, low hours (CS2, GO + account), low or no commendations, low match count, blocked stat tracking... Slews of markers that these are less-than-legit, either smurfing (IMO a form of cheating) or outright hacking. Then they coincidentally overperform for their respective rank. That's without mentioning coming across numerous individuals with [sometimes multiple] bans recorded on their accounts. My account is 20 years old. And has several games with hundreds of hours including a couple of perfect games, not to mention a hundred or more games. Also phone verified. I don't expect everyone to have similar accounts, but it's seldom I'm matched against anything even remotely similar, say 5 year old accounts with similar playtimes in non-F2P games, though many profiles are private, which itself is - I think - also suspicious since virtually everyone leverages aliases on Steam so I can't really imagine a case for this other than obscuration, though I'm certain some people do it for privacy reasons I expect that rationale is rare. Beyond that I would say there are a lot of suspicious individuals I've been matched against in both premier and comp . Regardless of whether or not they're smurfs it makes MM obnoxious if only because you end up matched against people who rage and ruin 45m-1h of your time by competing illicitly. The MM algo is also just shit without these considerations lumped on top of it. I regularly play with my friends who rank lower and that draws my rank down so we get matched in low ranks, resulting in violent pubstomping. Of course I play on my only account, so I'm sure I get hackusated a lot, which would ostensibly get my trust factor drug through the mud. I suppose that's a solid incentive for smurfing on its own, especially since the system is opaque. It's all pretty bad, frankly. Faceit is hardly better, a lot of the community is pretty toxic and obnoxious salty tryhard metabangers that aren't fun to play with.
ziggure 1y ago
Are these rootkits?
- ronsor 1y ago
  Yes. That's the point.
  - doikor 1y ago
    Not a rootkit but it does run at kernel level. If Vanguard is a rootkit then so is every anti-virus software (including Microsoft Defender which is on by default) For example wikipedia description of a rootkit is "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software." Vanguard does not mask its existence or the existence of other software nor does it get/give access to unauthorized users (you authorized it during install so by definition it is not unauthorized). You don't manually give permissions to actual rootkits and they do their best to try and hide their existence.
to-too-two 1y ago
This might be a terrible idea, and likely would never work for a multitude of reasons, but I was wondering if everyone in the future were gaming via streaming services that way players wouldn’t be running the game on their own hardware or software.
- jauntywundrkind 1y ago
  Part of what scares me about React Server Components is that it very directly matches the web down this path. Instead of APIs and data and a front end app, the web becomes a view screen for computetion running far far away. The Flutter vision feels very similar, treating the web as a big canvas to draw pixels on.
- doikor 1y ago
  Very unlikely to happen anytime soon in competitive shooters like Valorant where gamers spend thousands of dollars just to get a few millisecond advantage from faster monitor, mouse, etc. Adding an extra 5 or 10ms of delay would be a massive issue (especially bad if it is an inconsistent delay)
doikor 1y ago
One thing to note is that Microsoft is planning some kind of kernel anti tampering system in future that hopefully will give us user level anti cheats that actually work. Though some will very likely see this as some kind of "we don't control our computers anymore" move. https://www.leagueoflegends.com/en-us/news/dev/dev-vanguard-x-lol-retrospective/ https://www.leagueoflegends.com/en-us/news/dev/dev-vanguard-... > “On Demand” Vanguard > "As was foretold, a future will eventually arrive where we can rely on the security features of Windows to protect its own kernel, instead of protecting it from boot with a driver. This will allow us the opportunity to start our anti-cheat services when the game client runs, provided the end-user has opted into all of these features. We’ll have more communication on this topic early next year, but if you’re on Windows 11 and on relatively recent hardware, we wanted to let you know that you won’t have to tolerate the taskbar icon forever (even though we worked very hard on Vanguard’s logo)." https://blogs.windows.com/windowsexperience/2024/11/19/windows-security-and-resiliency-protecting-your-business/ https://blogs.windows.com/windowsexperience/2024/11/19/windo... > "To help our customers and partners increase resilience, we are developing new Windows capabilities that will allow security product developers to build their products outside of kernel mode. This means security products, like anti-virus solutions, can run in user mode just as apps do. This change will help security developers provide a high level of security, easier recovery, and there will be less impact to Windows in the event of a crash or mistake. A private preview will be made available for our security product ecosystem in July 2025."
- ronsor 1y ago
  > Though some will very likely see this as some kind of "we don't control our computers anymore" move. This is actually great because Microsoft "security" systems are notoriously easy to pwn. Workarounds will appear almost instantly.
  - doikor 1y ago
    Some of their stuff is but afaik xbox one and series x/s security model have not been broken. Obviously with those they have control of both the hardware and software making achieving it much easier. Also with xbox one and series x/s they have the dev mode thingie lowering the interest in trying to hack the retail mode.
smallstepforman 1y ago
Secure boot is a problem for users with secondary alternative OS’s (eg Haiku). I even have a DOS tool which needs high precision timing which no general purpose multitasking OS can provide. These alternative systems are hampered by secure boot. And speaking of up to date video drivers, these checks are a plague of usability. If I have stable driver rev 235, why would I install latest buggy version 246? Eg. AMD has 2 flavours of drivers, Adrenalin which has “optimisations”, but crashes, and the Pro drivers which are older but more stable, and have 10 bit support, more colour spaces etc. I’m done dealing with experimental drivers, give me stability 100% time. Games which insist that I run experimental drivers and secure boot can get stuffed.
prkl 1y ago
This reads like privacy-invasion propaganda directly from the Chinese state. "Look how great we are at having full control over your PC. You know, to battle cheaters!". Kernel-level anticheat is ridiculous. Especially when your data becomes a gaping would ready for the chinese state to stick their fingers into and twist around. It's like the police installing mandatory cameras in everyones house to catch thieves (if society here is games with kernel-level cheats). I want to go back to the days of Windows 7. When there was minimal corporate bloat in the ecosystem, no ads in the startmenu, and when game studios actually knew what they were talking about and had some balls to stand up for their values.
- charcircuit 1y ago
  Riot doesn't use a kernel anticheat on mac os because Apple provides sufficient security from their OS. Once Microsoft eventually catches up Riot will not need a kernel level anticheat for Windows. The ridiculous thing is how Microsoft has failed to secure Windows from cheaters despite it being a problem for such a long time.
  - 7qW24A 1y ago
    Yeah but that’s an interesting technical point, more suited to 2015 HN - in 2025 we can’t let technical matters get in the way of our Sinophobia…
    - throw10920 1y ago
      There is precisely zero Sinophobia in the parent thread. Conflating criticism of a country's government with discrimination against that country's people is a very old state propaganda technique that is deeply evil and you should be ashamed of yourself.
      - pessimizer 1y ago
        This thread is actually about criticism of Riot Games, not any country's government. But for some reason, whenever Westerners do things to other Westerners, they call each other Chinese. In the not-racist way that one does that.
shmerl 1y ago
> Much of Koskinas and his team’s efforts stem from Vanguard having the deepest level of access to a gamer’s computer Why would you trust anyone to do that? It's malware style access. Client side anti-cheats that need kernel level access are unacceptable, that's why I'd never play any games with such garbage. Instead of this, let these companies focus on server side anti-cheats that detect behaviors that can be defined as cheating. Shouldn't AI be good for these kind of tasks? But of course it's cheaper for them to slap malware on user computers and call it a day.
snailmailman 1y ago
It’s not extremely often, but still happens occasionally - when I click the League of Legends shortcut, rather than getting to play, I get presented with a blue screen, and a kernel exception of some kind. But riot continues to push this narrative that Vanguard works flawlessly. It doesn’t break computers. Nobody has issues. Cheaters are being prevented. And yet - sometimes I can’t get into a game because it crashes. And then the client complains that vanguard is unhappy and I have to reboot and so I’m late to the game and my team starts way behind. That bug hasn’t happened in a while at least- lately the blue screens occur before getting into a match. I guess I don’t get temp banned anymore but any blue screens are unacceptable.
arh68 1y ago
Meanwhile, a ~year since Riot required Vanguard, League/Valorant playerbase isn't really any smaller. If anything, it's continued to grow. The players do not seem to mind. At all. Basically a non-issue for 99%. I'm not terribly surprised so many here find kernel anti-cheat "unacceptable" or "ridiculous" or whatever, but there's just no there there. Microsoft has kernel access: are they selling my stuff, too ? I don't pay for Firefox: are they auctioning off my passwords? I guess it's fun to speculate; I can make unfalsifiable claims all day
- fc417fc802 1y ago
  It's a bit different when it's the core functionality that you selected the vendor for. I'd never use a closed source password manager. I don't use Microsoft for my OS, although it happens that I do generally trust them on account of their size and reputation. They have a very strong vested interest in not getting caught doing something like that. Spying isn't the only concern. I don't generally want to grant anything unnecessary ring 0 because of the security implications. I certainly don't trust the security practices of most game studios to any great degree.
oliwarner 1y ago
This Koskinas character seems a little frayed. Hyperfocused on punishing people, to the point where he's helping exploit writers to get an in, and then fervorously banning all their customers on release. Back when anyone could run their own game server, logging was way more prevalent. Many games let you replay an entire match and it was comically trivial to playback and spot superhuman recoil control, aim snapping, wall hacks, etc etc etc. We had kickvote and Overwatch to farm this out to players in near-real time. But instead of improving this (esp with "AI"), or just adding some financial loss to being banned, these free-to-play monsters need the lowest level system introspection. Seems a bit suss to me. "You can play my game for nothing but I need root?" No thank you. Charge a one-off £5 for an account. 95% of your cheaters evaporate if they can't freely cycle accounts.
waltercool 1y ago
[dead]
b0dhimind 1y ago
Riot can burn in a trash heap, they banned me for cussing someone out who was doing the same to rest of team.

59 points by badmonster 1y ago

This article seems to be making all of the worst things about anti-cheat (kernel modules, mandatory Secure Boot/TPM, etc.) seem like good things. Why?

nekitamo 1y ago
The alternative is that the online games they're protecting become infested with cheaters, players depart, and the game closes down because it's no longer a viable business. It's not nice, I don't like running a kernel mode anti-cheat any more than you do, but I can see why it's necessary for preserving the competitive integrity of free-to-play shooter games like Valorant.
- imchillyb 1y ago
  If one must give up kernel level security of their system to an untrusted 3rd party, was it really free?
  - Hikikomori 1y ago
    Stuff you run as your user can already read all your files and memory of processes of that user so you're already very exposed.
- __alexs 1y ago
  They are already full of cheaters. DMA cards are undetectable even from kernel anti cheat.
  - doikor 1y ago
    The DMA card still needs to be installed, have drivers installed, firmware, etc. The anti cheat tests for that (the cheaters do mask the device spoofing the name/vendor/etc). Having to make new driver/firmware every time the anti cheat starts to detect it is way slower then just new software. Though at some point they will probably just automate it so that every customer gets their own driver and firmware matched with only their cheat software making this way harder but we are not there yet (and you would have to get all of these signed so following the cert chain should make it easier to find at least whos stolen cert they are using) Also the amount of people willing to buy another pc and DMA cards is way smaller making the chance of running into cheater in your match smaller.
    - az09mugen 1y ago
      That's a good idea indeed.
    - __alexs 1y ago
      Giving every customer their own firmware is already automated. Computer vision based cheats are also rapidly on the rise. You don't get wall hacks but you do top 1% reaction times and perfect tracking.
      - fc417fc802 1y ago
        Elephant in the room is that any behavior based solution that can reliably detect computer vision based cheating obviates the need for kernel level anti-cheat because it more or less solved the detection problem.
  - abigail95 1y ago
    are you writing your own firmware or hotwiring the bus? there are many methods to detect this.
doikor 1y ago
Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is very hard (or impossible) to detect it from user land outside of behavior (which mostly happens on the server side). Only thing I can think of is Microsoft locking down Windows so hard that nothing outside of code written (well signed) by Microsoft can run with kernel level privileges but I think that is an even worse option. If you don't like it you can always just go and play any of the titles without kernel level anti-cheat and get a cheater in ~1/5th of your games (my experience in counter strike).
- jjmarr 1y ago
  Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.
  - doikor 1y ago
    This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
mvdtnz 1y ago
They're neither inherently good nor bad but unfortunately necessary.
johnnyanmac 1y ago
Insert the quote about freedom vs securities. This author (or his sponsors) clearly made their choice. Makes me glad I prefer mostly single player content and never tolerate this stuff on my PC. If I gotta be locked down I'll just pick up a console.
jokoon 1y ago
It can be seen as a Chinese backdoor on western computers. I am not expert, but I think it's not necessarily the case? Cheating is really a plague right now, and the only way to mitigate it is using kernel anti cheat.
- ronsor 1y ago
  And now AI can pretend to be input devices and need only video output. Kernel anti-cheat will be useless, and we'll be better off for it. If your solution is bad, it doesn't deserve to work. Find something else.
  - doikor 1y ago
    Though if the AI is only as good as a human can be it is not that desirable. If the cheat does "super human" stuff it can be detected from behavior on the server side though this is after the fact from processing some replay files and thus not that "great" for players as the cheater gets to ruin at least one game. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But it is something they acknowledge will be an issue at some point in the future. Personally I think for now AI is way too slow as all the computation needs to happen in a few milliseconds to really be effective. > Koskinas says he often worries about the use of AI for screen classification, to learn what human inputs look like, and how to reproduce them.
  - az09mugen 1y ago
    Since AI is everywhere you think it can be used to spot cheaters behaviours ?
    - ronsor 1y ago
      Yes, that's the real solution, not rootkits.
      - mschuster91 1y ago

bee_rider 1y ago

It is really ridiculous that we’ve allowed all this kernel level spyware bullshit in the interest of something so frivolous as video game fairness. Matchmaking seemed like a neat idea in, like, 2007. In retrospect, it has damaged the industry substantially. All the oxygen has been sucked out of the community server space, etiquette is non-existent, and the aforementioned spyware.

giancarlostoro 1y ago
I refuse to buy a ton of games because they are hot garbage these days. Its pretty obvious what gamers want and they will shower their money at it. Look at Oblivion remastered. It had bare minimum marketing if you can even claim it had any marketing.
- johnnyanmac 1y ago
  Tbf, a part of the issues causing since rampant cheating comes from the fact that those Riot games are indeed "what gamers want". There's definitely a divide in community between single player darlings like BGS's output and these "free" competitive service games like League or Apex or whatnot.
  - giancarlostoro 1y ago
    My point being, a lot of games seem to disable Linux due to cheating concerns. They get none of my money. Rust can sit there and gather rust in my steam library until the end of time.
    - johnnyanmac 1y ago
      Okay. I sympathize but you're the literal 1% of the target market for most games. Devs will take that risk.
unclad5968 1y ago
Then don't play those video games. Seems simple to me. Community servers are doing fine in games where that makes sense, Minecraft for example. Counter strike has community servers too and people cheat there all the time.

OrvalWintermute 1y ago

I just uninstalled ALL Riot Games from my Gaming Computer. Reason: Vanguard was crashing another Unity based game I play nonstop. It also seemed to decrease system stability in general. I will never play another Riot Game so long as this software is a part of it.

jokoon 1y ago
I wonder who makes that anticheat, I mean in what country. Obviously they have so many users, they might need to fix it. I can imagine that Microsoft might try to help them doing things right.
- frosting1337 1y ago
  Vanguard is developed in the USA, though I think Riot also has security people in Dublin.
- xeonmc 1y ago
  Tencent has a 100% equity on Riot Games

jokoon 1y ago

I stopped playing counter strike like 2 months ago after playing for 6 months, because I was getting paranoid about closet cheaters. My trust in the game eroded, even though cheaters are not there all the time. Closet cheaters are cheating in subtle ways, which make it impossible to know if they're really cheating. It's a constant analysis of "is he cheating or am I bad?", and most of the time, I could not really know. It's a psychologically toxic experience as I cannot focus on the game itself. I was enjoying the game, but that paranoia made things just unbearable. I suspect china/russia are actively paying people to make effective cheating software, as it's also a lucrative business. Even a few pro players are cheating. Those online FPS are rotten to the core. Apparently valve doesn't seem to care that much, because they probably know that there is a big overlap between cheaters and people who trade skins, who are a big source of income. Too bad!

vips7L 1y ago
Honestly this sounds like you’ve just over thought it. You’ve played CS for 6 months, you are bad!
- skupig 1y ago
  CS has a concept of "trust factor" which groups people more likely to be cheating in the same game. If you ever queue with a friend with a low trust factor (which happens a lot if they're on a smurf account), there are cheaters in pretty much every game... seeing that many blatant cheaters has really made me think there must be a lot of smarter cheaters flying under the radar in regular games. It's basically impossible to tell whether someone is wallhacking or if they have really good game sense.
- brnaftr361 1y ago
  I've played for many years including CS1.6, CS:S, GO, and 2. I regularly snoop profiles and overwhelmingly there are accounts with 1 game, all F2P games, short account lives, low hours (CS2, GO + account), low or no commendations, low match count, blocked stat tracking... Slews of markers that these are less-than-legit, either smurfing (IMO a form of cheating) or outright hacking. Then they coincidentally overperform for their respective rank. That's without mentioning coming across numerous individuals with [sometimes multiple] bans recorded on their accounts. My account is 20 years old. And has several games with hundreds of hours including a couple of perfect games, not to mention a hundred or more games. Also phone verified. I don't expect everyone to have similar accounts, but it's seldom I'm matched against anything even remotely similar, say 5 year old accounts with similar playtimes in non-F2P games, though many profiles are private, which itself is - I think - also suspicious since virtually everyone leverages aliases on Steam so I can't really imagine a case for this other than obscuration, though I'm certain some people do it for privacy reasons I expect that rationale is rare. Beyond that I would say there are a lot of suspicious individuals I've been matched against in both premier and comp . Regardless of whether or not they're smurfs it makes MM obnoxious if only because you end up matched against people who rage and ruin 45m-1h of your time by competing illicitly. The MM algo is also just shit without these considerations lumped on top of it. I regularly play with my friends who rank lower and that draws my rank down so we get matched in low ranks, resulting in violent pubstomping. Of course I play on my only account, so I'm sure I get hackusated a lot, which would ostensibly get my trust factor drug through the mud. I suppose that's a solid incentive for smurfing on its own, especially since the system is opaque. It's all pretty bad, frankly. Faceit is hardly better, a lot of the community is pretty toxic and obnoxious salty tryhard metabangers that aren't fun to play with.

ziggure 1y ago

Are these rootkits?

ronsor 1y ago
Yes. That's the point.
- doikor 1y ago
  Not a rootkit but it does run at kernel level. If Vanguard is a rootkit then so is every anti-virus software (including Microsoft Defender which is on by default) For example wikipedia description of a rootkit is "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software." Vanguard does not mask its existence or the existence of other software nor does it get/give access to unauthorized users (you authorized it during install so by definition it is not unauthorized). You don't manually give permissions to actual rootkits and they do their best to try and hide their existence.

to-too-two 1y ago

This might be a terrible idea, and likely would never work for a multitude of reasons, but I was wondering if everyone in the future were gaming via streaming services that way players wouldn’t be running the game on their own hardware or software.

jauntywundrkind 1y ago
Part of what scares me about React Server Components is that it very directly matches the web down this path. Instead of APIs and data and a front end app, the web becomes a view screen for computetion running far far away. The Flutter vision feels very similar, treating the web as a big canvas to draw pixels on.
doikor 1y ago
Very unlikely to happen anytime soon in competitive shooters like Valorant where gamers spend thousands of dollars just to get a few millisecond advantage from faster monitor, mouse, etc. Adding an extra 5 or 10ms of delay would be a massive issue (especially bad if it is an inconsistent delay)

doikor 1y ago

One thing to note is that Microsoft is planning some kind of kernel anti tampering system in future that hopefully will give us user level anti cheats that actually work. Though some will very likely see this as some kind of "we don't control our computers anymore" move. https://www.leagueoflegends.com/en-us/news/dev/dev-vanguard-x-lol-retrospective/ https://www.leagueoflegends.com/en-us/news/dev/dev-vanguard-... > “On Demand” Vanguard > "As was foretold, a future will eventually arrive where we can rely on the security features of Windows to protect its own kernel, instead of protecting it from boot with a driver. This will allow us the opportunity to start our anti-cheat services when the game client runs, provided the end-user has opted into all of these features. We’ll have more communication on this topic early next year, but if you’re on Windows 11 and on relatively recent hardware, we wanted to let you know that you won’t have to tolerate the taskbar icon forever (even though we worked very hard on Vanguard’s logo)." https://blogs.windows.com/windowsexperience/2024/11/19/windows-security-and-resiliency-protecting-your-business/ https://blogs.windows.com/windowsexperience/2024/11/19/windo... > "To help our customers and partners increase resilience, we are developing new Windows capabilities that will allow security product developers to build their products outside of kernel mode. This means security products, like anti-virus solutions, can run in user mode just as apps do. This change will help security developers provide a high level of security, easier recovery, and there will be less impact to Windows in the event of a crash or mistake. A private preview will be made available for our security product ecosystem in July 2025."

ronsor 1y ago
> Though some will very likely see this as some kind of "we don't control our computers anymore" move. This is actually great because Microsoft "security" systems are notoriously easy to pwn. Workarounds will appear almost instantly.
- doikor 1y ago
  Some of their stuff is but afaik xbox one and series x/s security model have not been broken. Obviously with those they have control of both the hardware and software making achieving it much easier. Also with xbox one and series x/s they have the dev mode thingie lowering the interest in trying to hack the retail mode.

smallstepforman 1y ago

Secure boot is a problem for users with secondary alternative OS’s (eg Haiku). I even have a DOS tool which needs high precision timing which no general purpose multitasking OS can provide. These alternative systems are hampered by secure boot. And speaking of up to date video drivers, these checks are a plague of usability. If I have stable driver rev 235, why would I install latest buggy version 246? Eg. AMD has 2 flavours of drivers, Adrenalin which has “optimisations”, but crashes, and the Pro drivers which are older but more stable, and have 10 bit support, more colour spaces etc. I’m done dealing with experimental drivers, give me stability 100% time. Games which insist that I run experimental drivers and secure boot can get stuffed.

prkl 1y ago

This reads like privacy-invasion propaganda directly from the Chinese state. "Look how great we are at having full control over your PC. You know, to battle cheaters!". Kernel-level anticheat is ridiculous. Especially when your data becomes a gaping would ready for the chinese state to stick their fingers into and twist around. It's like the police installing mandatory cameras in everyones house to catch thieves (if society here is games with kernel-level cheats). I want to go back to the days of Windows 7. When there was minimal corporate bloat in the ecosystem, no ads in the startmenu, and when game studios actually knew what they were talking about and had some balls to stand up for their values.

charcircuit 1y ago
Riot doesn't use a kernel anticheat on mac os because Apple provides sufficient security from their OS. Once Microsoft eventually catches up Riot will not need a kernel level anticheat for Windows. The ridiculous thing is how Microsoft has failed to secure Windows from cheaters despite it being a problem for such a long time.
- 7qW24A 1y ago
  Yeah but that’s an interesting technical point, more suited to 2015 HN - in 2025 we can’t let technical matters get in the way of our Sinophobia…
  - throw10920 1y ago
    There is precisely zero Sinophobia in the parent thread. Conflating criticism of a country's government with discrimination against that country's people is a very old state propaganda technique that is deeply evil and you should be ashamed of yourself.
    - pessimizer 1y ago
      This thread is actually about criticism of Riot Games, not any country's government. But for some reason, whenever Westerners do things to other Westerners, they call each other Chinese. In the not-racist way that one does that.

shmerl 1y ago

> Much of Koskinas and his team’s efforts stem from Vanguard having the deepest level of access to a gamer’s computer Why would you trust anyone to do that? It's malware style access. Client side anti-cheats that need kernel level access are unacceptable, that's why I'd never play any games with such garbage. Instead of this, let these companies focus on server side anti-cheats that detect behaviors that can be defined as cheating. Shouldn't AI be good for these kind of tasks? But of course it's cheaper for them to slap malware on user computers and call it a day.

snailmailman 1y ago

It’s not extremely often, but still happens occasionally - when I click the League of Legends shortcut, rather than getting to play, I get presented with a blue screen, and a kernel exception of some kind. But riot continues to push this narrative that Vanguard works flawlessly. It doesn’t break computers. Nobody has issues. Cheaters are being prevented. And yet - sometimes I can’t get into a game because it crashes. And then the client complains that vanguard is unhappy and I have to reboot and so I’m late to the game and my team starts way behind. That bug hasn’t happened in a while at least- lately the blue screens occur before getting into a match. I guess I don’t get temp banned anymore but any blue screens are unacceptable.

arh68 1y ago

Meanwhile, a ~year since Riot required Vanguard, League/Valorant playerbase isn't really any smaller. If anything, it's continued to grow. The players do not seem to mind. At all. Basically a non-issue for 99%. I'm not terribly surprised so many here find kernel anti-cheat "unacceptable" or "ridiculous" or whatever, but there's just no there there. Microsoft has kernel access: are they selling my stuff, too ? I don't pay for Firefox: are they auctioning off my passwords? I guess it's fun to speculate; I can make unfalsifiable claims all day

fc417fc802 1y ago
It's a bit different when it's the core functionality that you selected the vendor for. I'd never use a closed source password manager. I don't use Microsoft for my OS, although it happens that I do generally trust them on account of their size and reputation. They have a very strong vested interest in not getting caught doing something like that. Spying isn't the only concern. I don't generally want to grant anything unnecessary ring 0 because of the security implications. I certainly don't trust the security practices of most game studios to any great degree.

oliwarner 1y ago

This Koskinas character seems a little frayed. Hyperfocused on punishing people, to the point where he's helping exploit writers to get an in, and then fervorously banning all their customers on release. Back when anyone could run their own game server, logging was way more prevalent. Many games let you replay an entire match and it was comically trivial to playback and spot superhuman recoil control, aim snapping, wall hacks, etc etc etc. We had kickvote and Overwatch to farm this out to players in near-real time. But instead of improving this (esp with "AI"), or just adding some financial loss to being banned, these free-to-play monsters need the lowest level system introspection. Seems a bit suss to me. "You can play my game for nothing but I need root?" No thank you. Charge a one-off £5 for an account. 95% of your cheaters evaporate if they can't freely cycle accounts.

waltercool 1y ago

[dead]

b0dhimind 1y ago

Riot can burn in a trash heap, they banned me for cussing someone out who was doing the same to rest of team.