I never understood kernel level anti-cheat. People STILL cheat. lol
this post was submitted on 29 Jun 2025
453 points (99.1% liked)
Steam Deck
18408 readers
218 users here now
A place to discuss and support all things Steam Deck.
Replacement for r/steamdeck_linux.
As Lemmy doesn't have flairs yet, you can use these prefixes to indicate what type of post you have made, eg:
[Flair] My post title
The following is a list of suggested flairs:
[Discussion] - General discussion.
[Help] - A request for help or support.
[News] - News about the deck.
[PSA] - Sharing important information.
[Game] - News / info about a game on the deck.
[Update] - An update to a previous post.
[Meta] - Discussion about this community.
Some more Steam Deck specific flairs:
[Boot Screen] - Custom boot screens/videos.
[Selling] - If you are selling your deck.
These are not enforced, but they are encouraged.
Rules:
- Follow the rules of Sopuli
- Posts must be related to the Steam Deck in an obvious way.
- No piracy, there are other communities for that.
- Discussion of emulators are allowed, but no discussion on how to illegally acquire ROMs.
- This is a place of civil discussion, no trolling.
- Have fun.
founded 4 years ago
MODERATORS
Yes,
but game companies also want to spy on you and potentially sell your data. Even if they aren't selling it, the ability to do so increases the value to investors. This is the way tech companies talk about invasive software in general, FWIW.
load more comments
(6 replies)
To be fair, it certainly still makes cheating harder. If it didn't exist, you'd just see even more people cheating, but it's a pretty overkill way of system monitoring for such a relatively small benefit by comparison.
Massive privacy risk, only slightly better performance than other non-kernel monitoring.
Some games just need people back in the equation instead of relying on algorithms. Bring back the Game Master's to MMOs etc, these people are willing to work for peanuts and be happy, yet they still decided to cut costs by replacing them...
...wait, games don't have even a single person checking for cheaters, even casually? Like, they wholly rely on anticheat?
(PS, has been a decently long time since I played a game that needed anti cheat)
Depends on the game, really, but “relying” on anti-cheat is pretty common. Larger games tend to have teams who review cases that get flagged by the systems and players and do manual removal but these teams also tend to be quite small and unable to adequately handle the amount of cheating that occurs.
If gamers want to see cheaters less often, they need to pressure the companies to do human moderation in addition.
I'd argue the most effective anticheat is dedicated servers. Admin'ed a lot of CS, TFC, and Q3 servers growing up and it was easy enough to kick/ban any one hacking or being an unrepentant dick. Downside for the corps is, you can't gate all that dlc as easy when users have control.
I’d argue the same, actually. It takes people to moderate people and dedicated servers make it easiest. Modern match made games could still have admins, the company needs to pay for them.
I think people can vote to kick people but that’s it really
Sure, if you are comparing to having no anti-cheat at all... But there are tons of competitive games out there using more "traditional" anti-cheat that don't need kernal access that are doing fine.
Did you never play Fall Guys on PC?
I'd probably be okay with kernel level anti-cheats if they actually stopped cheaters. But they don't. Hell, the best anti-cheat I've ever seen that actually works isn't even made by the developers of the game; it's a mod! Blue Sentinel for Dark Souls 3. All it does is check if the files a player you're connecting to has deviate at all from your own, then prevents the connection if they are not 1:1 identical.
Basic anti-cheat already does this, but also with memory, because most cheats are reading/modifying what is in memory. I think the only ethical solution for anti-cheat is on the server side, with machine learning perhaps, kind of like VACnet.
The problem is that, with a good enough cheat, it can be impossible to distinguish from a very good player.
The best cheats use a secondary device emulating human input and reactions, which is practically undetectable.
A secondary device can't be identified by kernel level anti-cheat either. If you have a standalone device that identifies as a USB keyboard and mouse and then generates inputs that give you a 100% headshot count, there's nothing you could detect through the kernel, since all it detects are keystrokes and clicks.
You will never stop cheaters, ever. It's something we have to live with. It's annoying when it happens, but it's hardly the end of the world either.
So I'd rather have the AC running on the server and not invading my system.
Yeah and a lot of cheats know the anti cheat is checking memory so they also modify the anti cheat and essentially mess up their memory check to fool it into thinking nothing has been modified. It's just a cat and mouse game where the cheats bypass the anti cheat and the anti cheat adding more detectors.
If cheaters wanted to get around that, they could
load more comments
(3 replies)
This is what, the fourth time a Linux community gets excited about this? But that's actually not good for us at all. Much like Android's safety net, or the nightmare that is the Mac equivalent, the entire point will be creating an untouchable chain from the firmware to the final OS being booted, and only allowing some apps to use a specific API to attest this isn't compromised.
This is horrendous for people trying to modify the OS or, in a more relevant tone, run programs meant for that OS on an entirely different environment. Microsoft has slowly been moving towards making this work on PCs, mostly due to pressure from DRM providers like Netflix or banking apps, but unlike Apple they can't simply lock everything down at once and say "deal with it" because Windows lives by backwards compatibility. Either way, this is just another step towards this upcoming future.
If your favorite games now start asking Windows if the chain of trust is not tampered with... say goodbye to compatibility with Proton.
I don't think chain of trust and security through kernel-level access are fighting the same problem.
Usually chain of trust is to prevent app tampering, and kernel-level access is to prevent memory tampering.
I assume Windows is creating a new API for applications to monitor certain regions of memory for tampering without needing kernel access.
There already is a API for this with ebpf for Windows and it is the same API that can be used on Linux (because it originates from Linux).
https://microsoft.github.io/ebpf-for-windows/
EBPF still runs in Kernel space but in a much more limited and confined way.
Kernel level access is to stop access plain and simple. That includes user access rights absolutely.
And if Windows makes using their system super easy, there will likely be even more games with kernel level anti cheat. Classic embrace, extend, extinguish.
I'm not sure this will be an issue.
When a piece of software is checking for chain of trust, it's done primarily for security or DRM reasons. The benefits of verifying this chain of trust would make it a little harder for cheaters to inject code and it would be an extra hurdle for pirates to overcome, but the cost is that everyone that bought your game with the intent of playing it on Linux now has absolutely no way to make that happen. I'm not sure the loss in ~4% of your sales would be worth the benefit.
it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space
[Citation needed]
It seems like the point is that Microsoft would be developing some sort of alternative to the kernel with similar functionality for antivirus providers, that doesn't need to have kernel level access. Anticheat uses a lot of the same techniques as kernel level antivirus to detect malware, thus it would probably have to adapt to this new system.
I think the article is more commenting on how Microsoft is directly partnering with antivirus companies for this new system right now, while they're not directly partnering with anticheat companies, even though they'd probably have to migrate to this new system regardless.
Oh, so that's why Epic's Easy anticheat keeps having trouble. Microsoft might be using it as a trial run.
I get this and when I used windows I've had issues with kernel level anti-viruses, but why anti-viruses before anti-cheats? Surely an AV's kernel access is more important then an AC's access?
Microsoft's biggest concern here is another Crowd Strike like event, so they're prioritizing kernel modifications that impact businesses.
they're prioritizing kernel modifications that impact businesses.
Hence why the gamers are moving into Linux.
Being treated like a second class citizen after spending thousands of dollars on a hardware is a clown exercise.
Or letting some creeps like Satya run the rig like his own 🤢
The best anticheat is whitelisting. More coop games, why does it matter if the enemy force is a computer or player? As long as the AI is good enough.
Perhaps*, this is possibly* ok in games with projectile based attacks maybe* but hitscan weapons are not fun to play against when the "player" has no aiming delay.
Clownstrike*
For those who can't see the writing on the wall.
Privileged access will include admin access and eventually the ability to make changes to Windows is coming to an end.
The distribution will be enshitified from the install to the updates and you wont be able to do a thing. Exactly like android, ios ect.
Microsoft are doing the opposite of what customers want. The ONLY way this changes is with real competition. If you are only familiar with Microsoft as a professional. It's no time like the present to step outside the rent seekers and see what the rest of the industry is doing.
Another nail in the coffin
I'm curious to see how CompTIA responds to this. They already don't allow you to take their exams in a VM or any kind of Linux. Presumably for the same "concerns" that the anti-cheat industry has.
A useless certificate for a useless job.
As a holder of multiple CompTIA certificates I wholeheartedly agree that they're useless. Unfortunately they're by far the most common means of contractors (the actual people, not the companies) checking off the boxes to qualify for U.S. government IT contracts; which means they're still relevant.
view more: next ›