logoalt Hacker News

fookeryesterday at 9:45 PM11 repliesview on HN

The last remaining roadblock is kernel level anti-cheat frameworks.

Pretty horrible technology, and unfortunately a good majority of the gaming industry by revenue relies on it.


Replies

MegaDeKayyesterday at 11:38 PM

I'd say there are two remaining roadblocks. First and biggest is kernel level anti-cheat frameworks as you point out. But there's also no open source HDMI 2.1 implementation allowed by the HDMI cartel so people like me with an AMD card max out at 4K60 even for open source games like Visual Pinball (unless you count an adapter with hacked firmware between the card and the display). NVidia and Intel get away with it because they implement the functionality in their closed source blobs.

show 2 replies
marcyb5sttoday at 3:31 AM

I always wondered. Isn't exactly what eBPF would allow you to do?

Assuming that cheats work by reading (and modifying) the memory of the game process you can you can attach a kprobe to the sys_ptrace system call. Every time any process uses it, your eBPF program triggers. You can then capture the PID and UID of the requester and compare it against a whitelist (eg only the game engine can mess with the memory of that process). If the requester is unauthorized, the eBPF program can even override the return value to deny access before the kernel finishes the request.

Of course there are other attack vectors (like spoofing PID/process name), but eBPF covers them also.

All of this to say that Linux already has sane primitives to allow that, but that, as long as devs don't prioritize Linux, we won't see this happening.

show 1 reply
coppsilgoldyesterday at 10:53 PM

Competent cheat makers don't have much difficulty in defeating in-kernel anticheats on Windows. With the amount of insight and control available on Linux anticheat makers stand little chance.

The best Valve could do is offer a special locked down kernel with perhaps some anticheat capabilities and lock down the hardware with attestation. If they offer the sources and do verified builds it might even be accepted by some.

Doubt it would be popular or even successful on non-Valve machines. But I'm not an online gamer and couldn't care less about anticheats.

show 4 replies
dfxm12yesterday at 10:17 PM

You don't have to play these specific games though. I mean, what's your privacy, what's not being bombarded by ads in your OS worth to you? Have you taken an honest thought about this?

show 3 replies
jsheardyesterday at 10:02 PM

Another unresolved roadblock is Nvidia cards seriously underperforming in DX12 games under Proton compared to Windows. Implementing DX12 semantics on top of Vulkan runs into some nasty performance cliffs on their hardware, so Khronos is working on amending the Vulkan spec to smooth that over.

show 2 replies
hparadizyesterday at 9:52 PM

The Linux kernel has eBPF now so if they wanted to start spying on everything you do they can just do it.

show 2 replies
erutoday at 2:15 AM

Well, if you go by revenue, mobile gaming dwarfs all else.

drnick1yesterday at 10:21 PM

Clearly, when there will be enough Linux gamers another solution to the kernel-level anti-cheat issue will be found. After all, the most played competitive shooter is CS and Valve has does not use kernel-level AC.

show 3 replies
markus_zhangyesterday at 11:19 PM

I actually think it’s better to exclude the AAA games from Linux.