Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Steam games will need to disclose kernel-level anti-cheat on store pages

gamingonlinux.com

Post reply on HN
Print view View original

221–230 of 660 posts

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#221

Post by bastard_op »

lomase wrote: post #167
bastard_op wrote: post #137

The problem is since Valve and Proton made windows games viable for Linux and the Steam Deck, most of that anti-cheat vermin does NOT work under Linux. Even if it did, if you run Linux, you likely take some objection to someone wanting to add kernel modules of unknown and/or ill repute to your pretty open-source kernel. Valve knows this, kernel-level anti-cheat is simply not practical for use with Linux as a consider…

I think the end goal of Valve is to support anticheats in Linux. But they want the Kernel to provide an API for it, so you don't need to run the anticheat like a driver.

But will a canned, defined api ever be good enough? As soon as someone paints a border, someone will step over it. It's the reason security products in windoze as well as anti-cheats require kernel-level access, and why outages like the crowdstrike one a few months ago occur and why microsoft lets it (for now).

It's an arms race, and no api will ever be good enough to keep a miscreant from working against logical choices. If I have to play a game that I have to assume someone is cheating, I really don't want to play that game, or at least with others of dubious reputation. This is why I run my own server for games I like to play with others I trust.

If someone wants to play competitively publicly with anti-cheats, they should opt-in to do so, but I'd like the option to not, and simply play local or private instances with my own general TOS. If diplomacy fails, a ban option for the server.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#222

Post by Levitating »

talldayo wrote: post #211
dbrueck wrote: post #176

The anti-cheat problem is long-running and complicated. If you choose not to run anti-cheat because you understand that these are opaque rootkits, good for you! That's a totally, 100% valid choice. But please keep in mind: - you are a tiny minority and not the target customer - online multiplayer games are an absurdly big business (i.e. there are huge incentives here) - no, you can't completely solve this server side…

> I'd love to see more curiosity from the HN community on this. I'd love to see more curiosity from developers - the disappointment is mutual. Instead of attempting to systematically stop all forms of cheating through innovative or competitive methods, it would appear the industry is converging on dangerous half-measures and excusing it with evidence from a clearly failing system. What should we, the users, expect? P…

> I'd love to see more curiosity from developers

Developers spent millions on Anti-Cheat. It's why entire products like EasyAntiCheat and BattleEye exists.

Valve spent a LOT of time and effort on VACNet, a server side machine learning based Anti-Cheat primarily trained only on CS:GO verdicts and it was awful still.

Developers know the common methods used by cheaters. That includes exploiting known vulnerable kernel drivers to run code in the kernel. The only way to monitor for this is to utilize a kernel module loaded before that of the cheater. That's why the current state of Anti-Cheat is the way it is.

The developers of various anti-cheats like Vanguard have been very transparent about this.[1]

[1]: https://www.leagueoflegends.com/en-us/news/dev/dev-null-anti...

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#223

Post by bigstrat2003 »

Thaxll wrote: post #204
bigstrat2003 wrote: post #71

Earlier quoted context omitted.

Perhaps, but it's far better to have cheaters and bots than to have games require a rootkit to play them.

You definitely don't play games, this is one of the reasons why people stop playing games.

I do play games, a lot. I even play multiplayer games. So, you're wrong.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#224

Post by bigstrat2003 »

Cthulhu_ wrote: post #85
bigstrat2003 wrote: post #71

Earlier quoted context omitted.

Perhaps, but it's far better to have cheaters and bots than to have games require a rootkit to play them.

Well no, because they ruin the online experience making people not play the game. (in theory, GTA online has had / still has huge problems with bots and cheats but still earns the publisher hundreds of millions a year)

I understand that cheaters suck. I'm saying that in this case, the cure (kernel access) is worse than the disease.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#225

Post by latexr »

dbrueck wrote: post #176

The anti-cheat problem is long-running and complicated. If you choose not to run anti-cheat because you understand that these are opaque rootkits, good for you! That's a totally, 100% valid choice. But please keep in mind: - you are a tiny minority and not the target customer - online multiplayer games are an absurdly big business (i.e. there are huge incentives here) - no, you can't completely solve this server side…

> I'd love to see more curiosity from the HN community on this.

These kinds of sweeping comments are as frequent as they are tiring. There are other comments like yours in this thread and yours is currently at the top. It has nothing to do with a lack of curiosity, you’re simply seeing the contrarian dynamic at play.

https://news.ycombinator.com/item?id=24215601

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#226

Post by Brian_K_White »

heromal wrote: post #97
nickphx wrote: post #65

Earlier quoted context omitted.

if you have a large enough player base to sample, you can determine who is cheating with math. EA Fairplay is pretty good.. Steam's VAC is good, and not some kernel level nonsense..

VAC is absolutely terrible, are you kidding? You have to rage to get VAC banned.

False positives with no process for recourse and nice perfect fingerprinting to prevent ban evasion is better?

I think they intentionally have the knob turned all the way up to 0.1 initially, for PR and lube reasons.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#227

Post by coretx »

bitwize wrote: post #144
dmonitor wrote: post #77

Earlier quoted context omitted.

The most recent study I saw showed that Denuvo significantly helps revenue capture within the first few months of a game's release https://www.sciencedirect.com/science/article/abs/pii/S18759...

[flagged]

DRM is not going away because the extra power it provides can be monetized.- Shareholders and investors want money at all cost. Ask anyone in any creative field. Very few are rights holders. They have food on their table despite DRM and their rights being coerced from them.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#228

Post by 0x457 »

screcth wrote: post #196
0x457 wrote: post #181

Earlier quoted context omitted.

But you are not installing a random anti-cheat kernel driver, you're installing anti-cheat kernel driver provided by a game you've already put on your computer. It's very much the same thing.

User space is not the same as kernel space. User space applications can't access hardware or physical memory. They can't bypass permissions enforced by the OS. None of that applies to hardware or kernel drivers.

Where did I say they are the same? We have a kernel-space thing (anti-cheat or gpu driver) and a user-space thing ((a game actually talks to both) that talks to a kernel-space thing.

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#229

Post by Levitating »

kulahan wrote: post #19
RobotToaster wrote: post #6

Earlier quoted context omitted.

Lets call them what they really are, rootkits.

Can't wait to find out what China hid in Riot's Vanguard rootkit for all their games. It's 100% a conspiracy theory, but nobody can convince me it's perfectly clean, or if it is, that there isn't an easy way to add some power to it quietly.

The vanguard drivers are signed by Microsoft, the procedure for which includes a safety audit by Microsoft.

The driver is just what the developers say it is (as with all other anti-cheat). It provides an untempered interface for the userland anti-cheat to use to get info from the kernel. Because modern cheats tend to alter the output of kernel syscalls by running in the kernel themselves.

I really don't see why anyone needs to think it's anything more than that.

If Tencent needed to spy on you so badly there's no reason kernel anti-cheats need anything to do with it...

Re: Steam games will need to disclose kernel-level anti-cheat on store pages

#230

Post by codebje »

prerok wrote: post #112
codebje wrote: post #62

Earlier quoted context omitted.

Rampant cheating will wreck competitive multiplayer games fast, so there are perspectives from which this critical. (I’d still lean towards expecting game houses to find another way, kernel drivers are still client side trust mechanisms).

Well, the problem is eventual consistency and these games have a hell to consolidate properly. One user is on a connection with 10ms latency, the other user is on 50 ms latency. Now, if first user does something, and second user can either do something to evade or can do something that actually prevents the first user from acting, how do you consolidate that? The actual timestamp of when exactly what happened helps i…

Remember that you don't need perfection: you need people to believe that they're likely enough to get caught that they don't want to use a pre-canned cheat, and you need just enough cheat detection mechanisms to make it hard for people to make new cheats. Not all of that has to be technological: you can spread rumours that your cheater ban waves are bigger than they actually are, for example, and that'll keep more people from even trying in the first place.

You don't have to trust the timestamp - and you shouldn't. You can use a bunch of methods to go from untrusted to grudgingly accepted: requiring monotonicity means cheating clients have to be permanently slower rather than selectively slower. Having tolerances for out of order packet rates or accepted deltas before discarding player actions will have some false positives for players on terrible networks, but will also reduce the impact of any possible timestamp-related cheats.

It can't be fully solved server side, not without sacrificing acceptable performance. I reckon it can probably be dealt with enough on server side to keep cheating to a tolerably low level. It's probably cheaper to just license a windows rootkit though.

Post reply on HN