Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message About Vanguard From Our Security and Privacy Teams

riotgames.com

Post reply on HN
Print view View original

91–100 of 103 posts

Re: A Message About Vanguard From Our Security and Privacy Teams

#91

Post by Youden »

banachtarski wrote: post #90
Youden wrote: post #88

Earlier quoted context omitted.

I understand that but it feels like there's a lot of focus on client-side anti-cheat while cheats that should be trivially detected server-side still exist (like flying through the air in a game where that shouldn't be possible). Plus, there seems to be a lot of focus on client-side anti-cheat when a lot of it could be addressed server-side: > For example an aimbot that steadies your cursor on someone’s head or dodge…

Humans can and do in fact do all the things you suggest. False positives are generally to be avoided, and mitigations for reverse engineering are still required (anti debuggers, anti dll injection measures). All the stuff mentioned like not sending positions of people who aren’t visible are typically already done, but sometimes the position is needed for reasons you don’t understand. Like some gameplay ability to sud…

I'm not trying to condescend or be a backseat programmer, I apologize if my tone suggested otherwise. I know that I have no idea what I'm talking about and I know that there are plenty of competent game developers in the industry.

The problem is that I don't know what I don't know, so I can't directly ask it. The best thing I can do is to present the flawed results of my current understanding so that somebody more knowledgeable (such as yourself) can tear them apart and show me what it is that I'm missing.

> False positives are generally to be avoided

This sounds like the biggest difference to me. Generally in my limited experience in handling abuse on web platforms, the value of a single user is so low that a false positive doesn't really matter too much.

I suppose when it comes to games, each user represents a ~$60 investment and potentially a lot of time and emotional investment, so a false positive can't be so easily tolerated and there's an incentive to go to extreme ends (like intense client-side validation) that wouldn't make sense for say Twitter likes.

Re: A Message About Vanguard From Our Security and Privacy Teams

#92

Post by danaris »

hellcow wrote: post #72
sbarre wrote: post #67

Earlier quoted context omitted.

So let me ask you a question then.. Do you feel the same way about Microsoft and Apple, and every other company that provides a hardware driver for a modern computer, and whether state governments (USA included) put pressure on them to let them advance their agenda by using back doors in their drivers or software? Why is Riot special in all this? What, in your view, makes them more likely to be so secretly and so dee…

Your argument boils down to, "If one country has access, then every country should have access." I don't agree with that. It's clear the US has backdoors. That doesn't mean it's wise to invite China to add backdoors as well.

It's absolutely not clear that the US has backdoors into any Apple product. Apple has fought pretty hard to ensure that their devices remain something that a user can feel safe and secure storing their private data on.

Re: A Message About Vanguard From Our Security and Privacy Teams

#93

Post by danaris »

swiley wrote: post #33

League of legends is a real pain in the ass to play even when you’re doing everything right. Personally I don’t even like the game, it’s just popular so I played it to hang out with friends. The way their launcher handles updates is crazy inefficient and so it always takes hours to launch if it launches at all. It also runs terribly in wine.

...Hours? The longest update I've ever had for League of Legends (in the ~6 years I've been playing casually) is about 20 minutes. And I'm on Mac—not exactly the high-priority platform for them.

Since they changed their launcher system a few months ago, it's been unusual to have to wait more than ~2 minutes for a new patch.

Re: A Message About Vanguard From Our Security and Privacy Teams

#94

Post by dharmab »

gear54rus wrote: post #85
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

Are you sure that you've researched this thoroughly and there would be no problems with that PCI thing (compatibility, unknown errors, performance regressions)?

It's hardware-level passthrough with zero performance or compatibility hit. The catch is that the guest needs exclusive access to the device, i.e. you need two GPUs, one for the host and any other guests and one dedicated entirely to the passthrough VM. There's a few applications like Chromium that incorrectly detect the GPU configuration and need manual overrides.

Also, it helps to use a recent AMD card and the in-tree amdgpu driver instead of the out-of-tree nvidia driver.

Overall, you trade software problems for hardware problems (UEFI firmware versions can break the setup), but if you get it working it works great.

Re: A Message About Vanguard From Our Security and Privacy Teams

#95

Post by dharmab »

mormegil wrote: post #23
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

This was my exact plan for my (current) computer a few years ago. But after learning about all the real-world complications I became lazy and abandoned the idea. Is this in a realm of "easily achievable out-of-the-box on a standard Linux installation" now?

Assuming you have recent hardware and a compatible UEFI firmware, yes. https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVM...

Re: A Message About Vanguard From Our Security and Privacy Teams

#96

Post by dharmab »

blattimwind wrote: post #58
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

Most anti-cheats and some "DRM solutions" do not allow you to run inside a VM, trying to mask the fact you do might be enough to get banned. Even with PCI passthru you can't expect full performance (CPU is also still virtualized). It's much simpler to just have a second PC/laptop or dual-boot (less secure).

> CPU is also still virtualized

IOMMU also grants the guest hardware access to the CPU, although it does have to be shared between the host and guests.

Re: A Message About Vanguard From Our Security and Privacy Teams

#97

Post by nickflood »

dsr_ wrote: post #63

If people want to play games in anti-cheat environments, the only sensible solution I can see involves the reinvention of the cartridge. In this case, make the cartridge a bootable SSD which entirely avoids touching any other disk in the system (perhaps with the exception of an SD card or USB storage stick for saves.) The downsides include: - the game company now has to ship a complete OS and do hardware support. The…

Or just ship on consoles with keyboard/mouse support. Current gen consoles have not been jailbroken in their 7 years on the market.

Re: A Message About Vanguard From Our Security and Privacy Teams

#98

Post by sbarre »

hellcow wrote: post #89
sbarre wrote: post #87

Earlier quoted context omitted.

I am not arguing anything, and would never say anything that ridiculous. I just find it tedious and irrational to see people up in arms about this contrived and unlikely scenario (a video game company is going to spy on you - a random nobody - for a big bad foreign power), while not being up in arms about the much bigger and more likely vectors of compromise they are exposed to constantly (like your operating system…

You've thrown out two, new arguments: 1. "Nobody playing this game is important enough to be spied upon." It might surprise you to learn that some people in the military, congress, the DoD, and even important individuals in significant companies play video games. 2. "Some vulnerabilities exist, therefore any new vulnerabilities should be ignored or not discussed." All vulnerabilities should be considered, especially…

I'm not sure if you lack comprehension, or if you are just really paranoid and can only see things in absolutes, or if I'm writing poorly. But yet again you've taken what I've written and somehow twisted it into something ridiculous.

> It might surprise you to learn that some people in the military, congress, the DoD, and even important individuals in significant companies play video games.

Anyone in this scenario who is using the same computer to run any untrusted software (like all games) as they are using for their national security work is already compromising themselves.

> "Some vulnerabilities exist, therefore any new vulnerabilities should be ignored or not discussed."

This would be a more productive conversation if you addressed my points at face value, and made your own without twisting my words into whatever convenient position you want to argue against. That's the part I find tedious.

Everything is degrees.. you seem to only be willing to consider extremes.

Of course if you work in a sensitive position or are a likely target of foreign spying, you should take many more precautions. But that's not most people, in fact that's almost no one, statistically speaking. So if we're going to discuss likely compromise scenarios, the risk-reward on using a high-profile video game company as a vehicle for APT state-level actions starts to fall into "movie plot" territory, in my opinion.

And I never said that new vulnerabilities should be ignored or not discussed . Again, possible plausible.

In fact, you are basically contradicting yourself at this point because I first brought up way more plausible vulnerability scenarios (your underlying operating system being compromised) and you dismissed that in favour of some narrow and much more implausible scenario (a US-based video game company as a deep-state plant for a foreign government).

Keep moving those goal posts..

Re: A Message About Vanguard From Our Security and Privacy Teams

#99

Post by sbarre »

danaris wrote: post #92
hellcow wrote: post #72

Earlier quoted context omitted.

Your argument boils down to, "If one country has access, then every country should have access." I don't agree with that. It's clear the US has backdoors. That doesn't mean it's wise to invite China to add backdoors as well.

It's absolutely not clear that the US has backdoors into any Apple product. Apple has fought pretty hard to ensure that their devices remain something that a user can feel safe and secure storing their private data on.

I have no insider information here.

But if we're talking about plausibility, then it's much more likely that your underlying operating system, regardless of vendor - Microsoft and Apple are the major players - has been compromised in some manner, or contains the hooks for on-demand compromise if compelled by a state actor.

Post reply on HN