Fox

Guess it’s short for “federated reddit”?

The article is behind a paywall, so here is the link to the study: https://www.nature.com/articles/s41591-024-03063-x

Sound promising at a first glance.

Ah yes, it’s a cat and mouse game so we should just stop trying huh? Maybe we should stop testing for doping in professional sports completely because people beat the test haha.

It’s a nice straw man you put up there. Nobody said to stop trying other than you. So far I’ve only been pointing out all the negatives that come with kernel-level anti-cheat software. The cat and mouse phrase was specifically used to demonstrate that the ongoing struggle leads to the need to update the anti-cheat software resulting in the potential for more bugs, in turn increasing the odds of running into security and stability problems. I’m arguing for other, less invasive anti-cheat measures which don’t put the end user under general suspicion and force them to grant absolute control over their system to a third party.

But while we’re at it, you raise a good point. Doping in professional sports is done only at a high level. If we were to compare kernel-level anti-cheat measures to doping tests: Imagine you join a tiny local sports club in the middle of nowhere. Not only would they require you to take doping tests, but they would also gain permanent entry to your home and install cameras and microphones everywhere, promising - fingers crossed - to only use their tools to see if you’re above board and not doping. Having a third party have permanent entry to your home and constant surveillance sure sounds like a big security risk to me, especially when you consider that their measures aren’t 100% safe and can breached and abused by malicious actors. And yes, that is the equivalent of what is happening to your computer.

To reiterate: I’m not saying to let cheaters be and stop anti-cheat measures altogether. I’m arguing for less invasive and less dangerous anti-cheat software. Since the next three paragraphs you wrote are all about arguing against the straw man you put up, I’m ignoring those.

I even write bots for popular games that I play so it’s not like I’m not disadvantaged by this either.

I’m not sure why you wrote that. You’re part of the problem you helped to create and suffer from it, too. Do you want sympathy for suffering the consequences of your own actions?

You just need to find some actual conflict in your life and stop making this such a big issue. Will some anti cheat make a mistake and crash some machines or something inevitably? Yes for certain. […] It’s a non issue.

At this point, we’re entering personal opinion territory. For me, it is a big issue. Handing a third party the keys to my kingdom for a game seems wildly ignorant and naive to me. However, a lot of people simply don’t know about kernel-level anti-cheat, what they are and how they work. So I’m here to provide information which people can use to decide for themselves if they’re fine with it or not. Personally, I value the privacy, security and stability of my system. You don’t and that’s fine. But I can still criticize the currently employed methods and hope to influence how things are done.

I thought as much. But I also believe you shouldn’t just let misinformation like that go unchallenged. Not for people like him of course, but for everyone else reading this trying to learn and/or form an opinion.

No. There’s a huge difference if a program runs in user space or ring 0. Depending on the security policies and admin rights management on your system, malicious software can’t do anything. If you, the user, blindly click “ok” in Windows UAC prompts or run sudo on Linux without thinking, that’s on you. However, kernel-level anti-cheat software always has access and thus is a much more dangerous and sought-after attack vector.

Hell, if you wanted to make extra sure you could spin up a VM with GPU pass-through and play on there. But this is also not possible with kernel-level anti-cheat software because most detect they’re being run in a VM and refuse to start the game.

That’s only the security side of things. If software has shoddy code it will at worst crash itself if it’s not interacting with drivers too much (like games and graphics drivers - and even then the crashes happen because of bugs in the drivers in the first place). If it’s ring zero it can make your system unstable, crashing your entire system and not just the software itself.

Regarding “games that matter”, define your benchmark.

Are we talking about games that have the absolute top financial success? Sure, it’s all the competitive matchmaking games that rely on a somewhat believable competitive integrity of their games. But then again, most kernel-level anti-cheat systems don’t even prevent cheating. It’s a never-ending cat-and-mouse game at the cost of the customer’s privacy, security and stability of their system. Riot themselves have a recent blog post detailing that 1 in 15 League of Legends games had cheaters/scripters on average. Not only that, their new-ish kernel-level anti-cheat Vanguard - like all others - has been defeated. So they need to update. Change methods. Become more invasive. Just never-ending. And new/changed code always has the potential for new bugs, bringing us full circle to security and stability problems.

Or are we simply talking about games that are fun for the individual? There’s a wealth of Singleplayer/Co-op and/or PvE only games that are successful without any kind of invasive anti-cheat. To name a few (you only wanted one, but I’m in the mood): Cyberpunk 2077, Vampire Survivors (and all its offspring), Factorio, Satisfactory, Borderlands (1, 2, Pre-Sequel, 3, Tiny TIna’s Wonderlands), Skyrim, Fallout (3, 4, New Vegas), Starfield (I agree it was a flop, but it mattered), Baldur’s Gate 3 (which had incredible success).

Do I need to go on? This list isn’t even just a personal preference of mine. A lot of these titles were highly anticipated and are hugely successful.

So yeah, you should be sorry for spouting nonsense.

It’s not just privacy. Kernel level anti cheat software opens up a new attack vector for malicious actors, e.g. your computer is less secure. Your system also becomes less stable and is prone to crash more often. This is all dependent on the skill of the software engineers writing the kernel level anti cheat of course.

Unfortunately, most software, if not most of modern IT is a house of cards.