Microsoft has long wanted to get vendors out of the kernel. It’s a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it’s likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
I never understood kernel level anti-cheat. People STILL cheat. lol
Yes,
but game companies also want to spy on you and potentially sell your data. Even if they aren’t selling it, the ability to do so increases the value to investors. This is the way tech companies talk about invasive software in general, FWIW.
To be fair, it certainly still makes cheating harder. If it didn’t exist, you’d just see even more people cheating, but it’s a pretty overkill way of system monitoring for such a relatively small benefit by comparison.
Massive privacy risk, only slightly better performance than other non-kernel monitoring.
Some games just need people back in the equation instead of relying on algorithms. Bring back the Game Master’s to MMOs etc, these people are willing to work for peanuts and be happy, yet they still decided to cut costs by replacing them…
…wait, games don’t have even a single person checking for cheaters, even casually? Like, they wholly rely on anticheat?
(PS, has been a decently long time since I played a game that needed anti cheat)
Depends on the game, really, but “relying” on anti-cheat is pretty common. Larger games tend to have teams who review cases that get flagged by the systems and players and do manual removal but these teams also tend to be quite small and unable to adequately handle the amount of cheating that occurs.
If gamers want to see cheaters less often, they need to pressure the companies to do human moderation in addition.
I’d probably be okay with kernel level anti-cheats if they actually stopped cheaters. But they don’t. Hell, the best anti-cheat I’ve ever seen that actually works isn’t even made by the developers of the game; it’s a mod! Blue Sentinel for Dark Souls 3. All it does is check if the files a player you’re connecting to has deviate at all from your own, then prevents the connection if they are not 1:1 identical.
If cheaters wanted to get around that, they could
Basic anti-cheat already does this, but also with memory, because most cheats are reading/modifying what is in memory. I think the only ethical solution for anti-cheat is on the server side, with machine learning perhaps, kind of like VACnet.
The problem is that, with a good enough cheat, it can be impossible to distinguish from a very good player.
The best cheats use a secondary device emulating human input and reactions, which is practically undetectable.A secondary device can’t be identified by kernel level anti-cheat either. If you have a standalone device that identifies as a USB keyboard and mouse and then generates inputs that give you a 100% headshot count, there’s nothing you could detect through the kernel, since all it detects are keystrokes and clicks.
You will never stop cheaters, ever. It’s something we have to live with. It’s annoying when it happens, but it’s hardly the end of the world either.
So I’d rather have the AC running on the server and not invading my system.
Yeah and a lot of cheats know the anti cheat is checking memory so they also modify the anti cheat and essentially mess up their memory check to fool it into thinking nothing has been modified. It’s just a cat and mouse game where the cheats bypass the anti cheat and the anti cheat adding more detectors.
"I’d probably be okay with kernel level anti-cheats if they actually stopped cheaters. "
“I’d be okay with espionage devices all around my house if it stopped documents from being forged.”
samepicturememe.jpg
All I use my machine for is gaming, so not having cheaters in games far outweighs the odds of being hacked by imaginary bogeymen.
I am not really talking about being hacked but about anyone but you having more control over your system then you.
Maybe in your case thats very little information but I am a tech hobbyist and if i do not have full control and knowledge about every aspect of a device i bought, do i really own it?
If a consumer can’t fully own it, it shouldnt be sold as such. I considered such deeply unethical and damaging to the future potential of technology.
Oh, so that’s why Epic’s Easy anticheat keeps having trouble. Microsoft might be using it as a trial run.
I get this and when I used windows I’ve had issues with kernel level anti-viruses, but why anti-viruses before anti-cheats? Surely an AV’s kernel access is more important then an AC’s access?
Microsoft’s biggest concern here is another Crowd Strike like event, so they’re prioritizing kernel modifications that impact businesses.
Clownstrike*
You realize this’ll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as “hacking”.
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to “unsupported platforms” will be relics of the past.
I believe that’s just fear-mongering. This has been a thing that Microsoft has wanted to do for a while, largely because having 3rd party code with direct kernel access is a huge problem in terms of stability and security unless you can be sure you know what all that code is doing.
They tried to do this in the past, arguing that anything that wanted kernel-level access had to Windows API calls instead, however Windows Defender which was bundled with the OS was exempt from this restriction. The EU argued that it gave Microsoft a competitive advantage in the AV space and mandated that if they wanted to do this, they had to follow their own rules which MS was not willing to do.
Instead, Microsoft dictated that any code that was going to run in the kernel had to be submitted to Microsoft for review, who would then approve or deny the code for use. The problem with this method is that it’s slow, so any AV that wanted to update their engine had to go through a code review process every time. Crowdstrike (and likely every other AV provider) got around this by having a component of their software with kernel-access that could read in data dynamically. This is what caused that worldwide BSOD problem a couple years back. The Crowdstrike component with kernel access loaded in a bad update that was not properly reviewed and it broke every system with the AV installed.
Overall, this change is a good thing and will force software vendors to actually operate securely rather than just asking for ring 0 access when they don’t need it. As always, if you’re worried about the changes MS is making, Linux is available and getting better day by day.
