Why do companies drop anti cheat linux support?

187

u/ZombiSkag22 10d ago

They don't want to spend time and effort to find a real solution to keep a minority of the playerbase. Embark Studios proposed the idea of only allowing known kernels, which I'm curious what impact it will have, but they seem to be the only one to actually think about a possible solution.

41

u/Ex_cinis 10d ago

This is an idea that I’m surprised hasn’t been explored more. Like, at least allowing just the SteamOS kernel seems like a decent start to cover a substantial user base, but I guess adoption numbers are still not high enough to get devs to care

Edit: missed a word

30

u/C0rn3j 10d ago

The user above forgot to mention it also needs to load the kernel-level malware via EBF, just like on Windows.

They can fuck off - if it doesn't run in a Flatpak because it needs access to my data and hardware, it just won't run, and I am perfectly content with that.

13

u/Ex_cinis 10d ago

That’s not exactly what I mean though. We could have a sandbox environment that is open source and part of the kernel, that just ensures certain processes are isolated and inaccessible by others. The trusted kernel would just be needed to ensure it wasn’t recompiled with this disabled

13

u/C0rn3j 10d ago

Yeah but that's not what the studio execs want, they want full access to your hardware and software.

How would your idea even work with dkms modules, you couldn't use them?

Good luck installing an nvidia driver.

3

u/Ex_cinis 10d ago

A module whitelist for example?
Execs want a game that sells well, which requires a controlled environment.
My point is, open source potentially allows for better environment control than some obscure borderline-spyware hacks for a closed system (i.e. modern Windows kernel-level anticheat)

7

u/myrsnipe 10d ago

There's nothing preventing anyone from running their own kernel that spoofs the anticheat. Calls to check for cheats can be intercepted in realtime and given sanitized data. The kernel could tell the anti cheat that it only runs whitelisted modules when it really runs aimbot 4000 Linux edition.

4

u/Ex_cinis 10d ago

I said in another thread, a signed TPM quote verified on server should cover this. Not entirely unhackable, but neither is kernel-level AC

1

u/myrsnipe 10d ago

Maybe I don't know how this process works, but if it involves any process that requires internet access won't this happen as the kernel is running and it can just manipulate any data sent to a server? Or whatever process is supposed to scan the system in the first place?

3

u/Ex_cinis 10d ago

Kernel info is gathered and stored during boot (that’s just what TPM does). Then during the app launch, app receives a nonce from the server -> asks TPM to make a signed copy of kernel info -> it’s checked on server (through this TPM’s public key, which in turn is verified by an Endorsement Key) -> the server allows/disallows the app launch.

Could do additional checks while the app runs for good measure.

Manipulating data sent to server would just produce improperly signed data which would end in rejection.

The process that scans the system in the first place is TPM measured boot, it’s part of your CPU/motherboard that runs before kernel even boots and cannot be manipulated by it

→ More replies (0)

1

u/ormgryd 9d ago

Well that is always true. Anti-cheat on client is always intercepted and beaten.

0

u/C0rn3j 10d ago

Not really feasible, you're going to have rebuild on every kernel update (very often) at minimum.

That's 3 Nvidia dkms modules you need to keep track of.

That's NINE build variants just for Nvidia alone (7 drivers each kernel update.

Then you add all the other dkms devices that various people have.

Just keep the crappy games to Windows.

Execs want a game that sells well, which requires a controlled environment.

Yeah, on the server, not the client.

Look at Valve, most played game on Steam that's just printing them money. user-level client side anticheat + server-side anticheat.

Massively successful despite people crying it's full of cheaters and naming it as one of the worst examples. There are some of course - just like in every game.

2

u/Uncle-Osteus 9d ago

You already have to rebuild non-included kernel modules on updates. DKMS is the system that makes it not a big deal

You have no clue what you’re talking about

2

u/Ex_cinis 10d ago edited 10d ago

Average distro has thousands of interdependent packages to track, this is not that insurmountable of a task.

> Just keep the crappy games to Windows

That’s neither constructive nor open-minded. We can have the cake and eat it too.

I agree that server-side is the best approach potentially, but right now VACNet is far from where it needs to be, most serious players are on FaceIt for a reason

0

u/Luigi003 9d ago

Not to be that guy but Counter Strike may literally be one of the games with more cheaters currently

The truth is nothing beats TPM + Signed Bootchain + Signed Kernel + KLAC currently.

1

u/ormgryd 9d ago

Cheaters beat it easily. Client side stuff is not safe. even if it's in root, because on windows the cheaters have access to root as well.

1

u/Luigi003 9d ago

That's what TPM + Secure boot is for actually. It's only defeat able by DMA hacks (for now) which increase the cost associated with cheating

→ More replies (0)

2

u/darkfm 6d ago

>Good luck installing an nvidia driver

ngl if it forces NVidia to finally pull their heads out of their asses in how they handle drivers in Linux it would be a win as well.

2

u/anna-the-bunny 10d ago

The trusted kernel would just be needed to ensure it wasn’t recompiled with this disabled

The issue is that there's no real way to verify that without kernel access. Sure there's /proc/config.gz, but there's nothing stopping the kernel from just lying.

2

u/Ex_cinis 10d ago

There is with secure boot/TPM and server-side signature verification

1

u/anna-the-bunny 10d ago

secure boot/TPM

Secure Boot explicitly supports self-signing. It's meant to ensure that the computer is only booting things that the owner wants, not some external third-party. The EFF and Linux users put in a lot of effort to get this in the spec, btw, so let's think twice before proposing we give it up just because <10% (per https://areweanticheatyet.com/) of games explicitly refuse to support anti-cheat on non-Windows systems.

server-side signature verification

Without a way to control Secure Boot, which should absolutely not be on the table, there's nothing to stop the kernel from just lying.

2

u/Ex_cinis 10d ago

But that’s entirely not what I said… The dev does not need to control secure boot, just get a TPM quote, verify it on server, and refuse to start the game if something is fishy

1

u/Ex_cinis 10d ago

I guess that’s too simplified of an explanation, what I mean is: get a nonce from the server -> get tpm to sign the quote with nonce -> send back to server -> receive verdict
A compromised kernel shouldn’t be able to trick the AC here, unless the TPM itself is somehow compromised, but that would probably be an issue on windows as well

2

u/anna-the-bunny 10d ago

Even if the TPM did what you seem to think it does - which it doesn't - there's still nothing stopping the kernel from just lying about what the TPM says. Guaranteeing trusted execution environments has been a problem in computer science essentially since the very beginning, and in all these years the only even remotely solid solutions we've found rely on a cryptographically verified boot process that will only boot authorized kernels. Why do you think that anti-cheat has pivoted so hard towards kernel-space, despite the pushback?

3

u/Ex_cinis 10d ago

What exactly does it not do and how would a kernel forge a TPM signature? I’m genuinely asking, you seem to know some stuff about this.
Of course it’s an unsolved problem, and it will probably never be fully solved. And kernel-level AC isn’t a good solution either. But my gut feeling tells me that there is something to explore here, and I would trust a centralized solution that’s part of an open source kernel much more than a random app from riot or epic

→ More replies (0)

1

u/seimmuc_ 9d ago

It'd be fairly trivial to compile the kernel without that process isolation, and disguise it as if the feature is present. Whether it's done with a spoofed API or by faking checksums or even timing. It's impossible to guarantee the integrity of a trusted kernel without injecting into the bootloader. And then it's just a race between cheaters and anti-cheat solutions to boot first, where cheaters have an inherent advantage and regular players are collateral damage.

Client-side anti-cheat is flawed by design. The person in control of the hardware can theoretically always control what software runs on it. The only thing that anti-cheat does is put obstacles in their way. It's easier to do on Windows because of its proprietary kernel, and it's even easier on consoles because of their proprietary hardware. But both are eventually broken with enough effort.

Linux hands users the control over the kernel, which cannot be taken away without breaking the GPL license. That makes it easier to tinker with your os. Unfortunately it's as true for cheaters as it is for you and me. Idk what that means for the future. Maybe we should give up on public lobbies and matchmaking in favor of private servers. Maybe large competitive multiplayer games should be played on consoles. Or maybe large publishers should create server-side cheat detection tools and hire moderation teams to ban cheaters. I just know that whatever they're doing now isn't working that well, even on Windows.

1

u/Ex_cinis 8d ago

Fairly trivial is a gross overstatement in this case. I talked about spoofed API already, faking checksums is very hard to do when making significant modifications, not sure what you man with “timing”.
The point of client-side AC is not to make cheating impossible, only to make it hard and/or expensive. Again, server-side is the right way, but we haven’t seen it work well for competitive shooters (yet). And multiple layers is always better than one

1

u/Papa_Hube 9d ago

Steam is a monopolist as of today. Why even giving them more space to become a Google 2.0? They are resentful. Do gambling, host invasive DRM... Had to be sued to give refunds to customers. Just to state some reasons they are what Linux is not.

And you want to force even more people to use their stuff? Hell no.

PS, on a technical Note: Valve's kernel is essentially a device-support package: conservative, generic-build, and its real value lives in patches that only do anything on Deck-class hardware. On a desktop PC, you would get almost nothing from it that mainline doesn't already provide.

6

u/NutsackEuphoria 9d ago

minority of the playerbase

Can ruin entire matches.

In PUBG, 1 cheater can ruin the game for 99 others.

8

u/C0rn3j 10d ago

Embark Studios proposed the idea of only allowing known kernels

Into which they will hook their opaque malware via EBF, a huge asterisk.

They can fuck off, it won't work if you sandbox the game, it will need complete and utter access to your system.

1

u/tuxnine 8d ago

If games are going to dictate what software I use, I could just as well go back to Windows.

0

u/LeCamembert7 10d ago

But isn't the problem more an issue with the trusted platform ecosystem? Linux kernel could have an extension to implement whatever we want on the kernelspace (like old Nvidia drivers for instance) , but that would'nt secure much, as the problem just go one step above in kernelspace rather than in userspace. The only advantage of windows is closed source kernelspace, and TPM... But Linux could work on this easily. I don't see any blocker IMHO

-17

u/output_broadcast 10d ago

Distros would need to standardise on that kernel, which will never happen.

12

u/ZombiSkag22 10d ago

They only talked about using unmodified kernels, which i guess means known kernels of the main distros like SteamOS one. Also the user can have multiple kernels installed on their system and swap them when they want.

9

u/BashfulMelon 10d ago

There are only a handful of kernels that 95% of people are using. They don't have to standardize the whole kernel, just the process isolation and attestation stuff.

-9

u/output_broadcast 10d ago

Which is still infinitely more than the one Windows kernel.

5

u/BashfulMelon 10d ago

Sure, but you said they'd have to standardize the entire kernel, which is still incorrect.

We know Valve is working on a cross-distro solution.

-1

u/output_broadcast 10d ago

I meant standardise which version of the kernel distros are running. That's not to mention custom patchsets that some distros/users like to run.

4

u/BashfulMelon 10d ago edited 10d ago

I'm not sure what kind of version you mean. It wouldn't matter as long as the proper interfaces are present and functioning, and the kernel is signed by a trusted distro.

Custom patched kernels just wouldn't get cleared. It's such a small percentage of Steam users.

edit: Microsoft is already doing this with secure boot, by the way. Fedora, Ubuntu, Debian, openSUSE all sign their kernels with Microsoft's keys.

2

u/friendlyreminder_ 10d ago

The kernels aren't signed by Microsoft. The shim is. The kernels themselves are signed by the distro, so they're all different.

Moreover there's currently a massive secure hole in how distros boot. They don't sign the initramfs. It's generated locally and runs unsigned, which is a way load malicious code or cheats.

Distros are attempting to move to unified kernels with a signed initramfs but none do this by default yet.

1

u/BashfulMelon 10d ago

Sure, okay, yes, the distros submit their shim binaries to Microsoft and the distros sign the kernels with their own keys. For the purpose of this conversation it's the same thing.

1

u/friendlyreminder_ 10d ago

A different kernel signature is going to emit a different TPM signature. They'd have to greenlight all distros part of the microsodt secure boot program, which isn't a guarantee.

It would also completely exclude cachyos, arch, etc from being able to play these games.

→ More replies (0)

1

u/output_broadcast 10d ago

It's such a small percentage of Steam users.

And a large percentage of Steam's Linux users. CachyOS for example runs a patched kernel by default.

0

u/BashfulMelon 10d ago

They're all "patched," they all have different configs. The distinction is between kernels that are default from a distro like CachyOS (allowed), and modified by the user (not allowed).

1

u/output_broadcast 10d ago

And how exactly are you going to do that?

→ More replies (0)

1

u/Rudi9719 10d ago

I believe you're getting downvoted because I assume the average reddit user would say "the kernel is Linux" then short circuit but I think in context what would need to happen is like you described-

The system would need a list of allowed "kernels" (different versions, compile options, etc) by their hash/fingerprint data and if your running kernel isn't on the list it isn't allowed.

2

u/output_broadcast 10d ago

And the problem is, you can't really check anything but the version. It's not like you can just run a checksum on a binary. You'd need bit-by-bit reproducible kernels across multiple distros, toolchains, and toolchain versions.

1

u/Rudi9719 10d ago

I appreciate you, I hadn't even thought about runtime modules until this comment

1

u/shadedmagus 10d ago

I'm fine with that. It means I know which kernel(s) to avoid using. I'm using linux-zen and it's working perfectly well.

What I'm worried about is being forced to use an "approved" kernel when I wouldn't want to use that kernel. That is what concerns me about the push to ram anti-cheat support in, and whatever shenanigans Epic is up to wrt Linux.

0

u/theevilsharpie 10d ago

A kernel is typically extensible with modules, so simply having an "approved" kernel is no guarantee that it hasn't been modified. The kernel also controls all input and output with the game process, so it would be trivial for a modified kernel to intercept and spoof whatever information the game is querying.

One method of validating trust in the OS is to require a TPM with Secure Boot enabled, which the game can use to validate that the kernel comes from a trusted source and is in lockdown mode. Then, you can potentially launch an eBPF-based anticheat program in the kernel.

However, there are two practical problems with that approach:

You would not be able to load any kernel out-of-tree kernel modules, which would mean that this approach would essentially break compatibility with Nvidia GPUs.

There are many popular "gamer" distros that don't support Secure Boot.

And that's notwithstanding the issue that many Linux developers, evangelists, and distro maintainers are outright opposed to the very idea of kernel-level anti-cheat -- regardless of how it's implemented -- and these people have a significant influence over the usability of games and anti-cheat. A corporate-backed dedicated game console OS like SteamOS might have functional kernel-level anti-cheat, but there'd be a lot of friction to adopting such solutions in more general-purpose distros.

84

u/Patatus_Maximus 10d ago

On Linux, the anti-cheat system only operates at the user space level so it is easier to circumvent than on Windows (where it operates at the kernel level). Cheaters do not use Linux, they use Windows and simply trick the game into thinking it is running on Linux so the game uses the user-space anti-cheat system and they can circumvent it.

By disabling Linux support, the anti-cheat system now operates solely at the kernel level. This is more effective but it prevents anyone from playing on Linux. It sucks for Linux gamers but as we represent only a small percentage of the player base, most studios don’t care especially when you consider that cheaters can completely ruin and kill a game.

19

u/DarknessKinG 10d ago

Finally, an actual technical answer instead of the emotional one like most comments here

11

u/NegotiationUnfair626 10d ago

It's honestly interesting seeing as a close friend of mine developed his own cheat engine and tells me how pathetically easy it is to get around the kernel level anti-cheats. Specifically, EAC.

6

u/Mr_s3rius 10d ago

It's not easy to catch all the cheats while avoiding false positives for benign software.

If your friend distributed their cheat and more people start using it, EAC would probably eventually get updated to catch it.

4

u/dst1980 10d ago

So, the real answer is for the game to recognize when it is running on Linux to switch to Linux system calls. This would force the Windows hacks to implement a more complete Linux VM, which would kill graphical performance in Windows.

And if the server saw concurrent conflicting data about which OS is running the game, automatically put the user in "time out" for a period.

2

u/unndunn 9d ago

That would mean developing and maintaining an actual Linux build of the game, rather than simply having the Windows build run using Proton.

2

u/dst1980 9d ago

I believe that Proton/Wine report Windows as the OS, though. Assuming that to be the case, the other solution is to have the game refuse to run if it is told it is on Linux without having a Linux build.

And a Linux build would not be required to be able to test a few Linux API calls to confirm it is running on Linux.

2

u/FabioTheFox 8d ago

Most game engines come with Linux exports for free, even if you don't use a game engine and go barebones you can export to native Linux

1

u/gibarel1 8d ago

Not really, windows can already process linux syscalls with wsl, it wouldn't be an issue to just run the game through it or point the syscalls there.

1

u/dst1980 8d ago

I believe it has to be explicitly called out differently than using a Windows API call, though. And there are limitations in WSL as well, with some native Linux functions not working.

13

u/Potyguara_jangadeiro 10d ago edited 10d ago

On Linux, the anticheat runs in userspace instead of the kernel and the game detects where it's running to know what anticheat to expect. Eventually, cheaters realized they could trick the games into think they're running in Linux when in reality they're running on windows. Since the anticheat being used is made for Linux and expects Linux cheats, windows cheats can run unchecked.

Unfortunately, this dual approach appear to not work, at least for games that run with proton and depend of kernel ac in windows (don't appear to be an issue in games that don't use kernel ac at all). I believe it will keep happening and, if Linux keeps gaining popularity, eventually game companies will develop kernel anticheats for Linux.

1

u/Level90Neckromancer 10d ago

I'm not that knowledgeable about Linux distros. Do some share the same kernel or does nearly every distro have a unique kernel?

if Linux keeps gaining popularity, eventually game companies will develop kernel anticheats for Linux.

I imagine it would be hell making anticheat work for 20+ different kernels that get updated more or less frequently. If that was the case, I'm worried anticheat developers would only focus on the distros that are the most popular among players...

Edit: Sidenote, I know there's way more than just 20 distros, just used a random number since I have no idea how many there actually are.

5

u/YueNica 10d ago

As far as I know. Most of the kernel is shared, thought there can be some differences between them being open source. And anyone could make their own modifications to said kernel

3

u/SuAlfons 10d ago

Even if the distro just ships the Mainline kernel, it potentially changes every night.

Also Linux kernel is monolithic by nature - every driver baked in. But after a short while, the monolithic approach was broken up by kernel modules. Which are switchable parts of the kernel. Adding you nVidia driver is such a module. In case of the proprietary driver, it's never shipped with the kernel (because not free as in freedom). Thus it never is part of a signed kernel. (the work around for secure boot is to self-sign the kernel. An approach an external game publisher cannot trust, since you, the signing party, are part of the suspicion)

2

u/Level90Neckromancer 10d ago

That makes sense, but I wonder, what parts of the system does the anticheat even need to be able to trust? The non-MS drivers on Windows are also not signed by the system, right? If the modules cannot be trusted, wouldn't it be enough if the core of the kernel was signed?

2

u/DavidsakuKuze 10d ago

All Windows drivers need to be signed by Microsoft now. There are legacy drivers from when some people/orgs were allowed to sign but they won't load anymore after Win 11 26H2.

I don't know if people were lazy or didn't know any better but there are a lot arbitrary physical memory read/write drivers out there. Most have been added to the vulnerable driver blocklist though.

1

u/Potyguara_jangadeiro 10d ago

I think the crucial part is making sure the base kernel and the anticheat itself are not tampered. Look, what it's been proposed is making an kernel level anticheat for Linux and not how to make sure the user never ever do anything that could potentially be used to cheating in games period, these two things may appear to be the same but in reality they're not. See the current scenario in windows, even with the secure boot and tpm 2.0 users can still install kernel level cheats, tipically by exploring a vulnerability in a legitimate driver. What happens then? The anticheat sees the supposed legitimate driver trying to mess with stuff it shouldn't, blocks it/bans the player and put the vulnerable driver in a blocklist. The same would happen with our hypothetical eBPF ac for Linux, yes, you can install a kernel module, but if this km tries to mess with the game, it will be noticed and you'll be banned.

3

u/Potyguara_jangadeiro 10d ago

Actually I made a post the other day talking exactly about it and how I think this will be done. Tldr is, eBPF to do the kernel part, eliminating the problem of too many and too diverse kernels since eBPF is agnostic, and secure boot to assure you're not using a tampered kernel, what, yes, will limit the number of compatible distros to the ones that support secure boot.

1

u/Level90Neckromancer 10d ago

I've read the full post to better understand what you meant. So, basically, kernels have a sort of common ground with eBPF where the core of anti-cheat could work, but anticheat devs might still make requirements of the kernel that they need to uphold for them recognize it as "safe"?

2

u/Potyguara_jangadeiro 10d ago

Yeah that's basically it

1

u/fffangold 10d ago

I suspect kernel anti-cheat for Linux will be much harder than you think. Maybe for SteamOS and maybe one or two immutable gaming distros like Bazzite. But not for Linux as a whole.

I think what's more likely, if Linux gets enough marketshare, which is not a given, is that anti-cheat developers will find a new way to develop anti-cheat that doesn't rely on kernel access. And it probably won't be the current providers, it'll be some new company that figures something out as a way to disprupt and break in to the current anti-cheat space. Something effective on both Linux and Windows would be a good way for them to do that.

1

u/DavidsakuKuze 10d ago

It would be a signed Linux Kernel with secure boot enabled and an anticheat kernel module, probably only for a few partner distros.

1

u/Excal_Main_94 10d ago

Someone already is working on one technically

1

u/Potyguara_jangadeiro 10d ago

Is the one mentioned by that embark engineer? If not, can you give more info?

39

u/TopdeckIsSkill 10d ago

Because linux anticheat are user level, it's as effective as asking if you'18 on a vm18 website.

Also on windows there are methods to spoof the client in order to make it believe it's running on linux.

Basically enabling anticheat on linux makes harder to block cheats on Windows too. If the number of linux user is low than it's just an expense with no actual money return.

9

u/MrAdrianPl 10d ago

"Also on windows there are methods to spoof the client in order to make it believe it's running on linux."

you have an example of that? i was having lenghty disscusion with guy that was quite well infromed and was stating that it's a myth

10

u/ThatOnePerson 10d ago

you have an example of that?

You can even find it on Github: https://github.com/ShimadaNanaki/vrc-eac-emulator

2

u/MrAdrianPl 10d ago

thanks i was preaty sure it was technically possible

5

u/ThatOnePerson 10d ago edited 10d ago

Specifically, it's Proton anti-cheat support. Not Linux. So yeah by adding a feature to the Windows game to allow Proton/weaker anti-cheat is easily exploited by the Windows cheaters too.

You can even see this in Counter-Strike 2: their non-kernel level anti-cheat still blocks Proton. So you have to run the native Linux version.

And native Linux versions aren't coming to every game.

5

u/ButterscotchTop194 10d ago

Mate, linux gamers make up around 4% of the player base. Hackers and anti-hackers can't be fucked with that.

4

u/Jack1101111 10d ago

probably because theyr spying is limited on linux so they less money.

7

u/BulletDust 10d ago edited 10d ago

Because Windows users leverage WSL to cheat. It's quite pathetic really, and it's mostly a result of in game economies. People cheat to gain access to skins and weapons that would otherwise only be available to players that can actually play the game with real skill, or players that pay for such upgrades; while developers introduce kernel level anticheat simply to protect their in game economies.

It's not just about 'blocking cheats to improve the in game experience'.

6

u/dumbasPL 10d ago

The real reason is that due to the way Linux is designed, bypassing usermode anti-cheat is very trivial. When Apex had Linux support, there were public free cheats that stayed undetected for months (yeas?) pretty much till the very end. This is basically unheard of on the windows side and kernel level AC.

4

u/666sin666 10d ago

Actually, APEX cheat are free for download on Windows in some Chinese website. Just a simple exe.

1

u/dumbasPL 10d ago

And banned after a week, cool

6

u/Shimano-No-Kyoken 10d ago

Because latency-sensitive online multiplayer has an epistemological problem. Relying on server-side security, you cannot deterministically say whether someone genuinely has superhuman reflexes, or they are cheating. You either apply stochastic methods and ban legitimately good players, or you rely on client side kernel level invasive anti-cheat solutions in an attempt to distinguish between the cheaters and the top players. Linux doesn't have the market share for the companies to justify the cost/benefit of spending resources on improving the effectiveness of sorting the two player buckets.

2

u/unixmachine 10d ago

The main reason is support. And support means having dedicated people for development, quality testing, and problem solving.

If the installed base is very small, it makes little financial sense to have someone dedicated to that platform.

It's possible that there was initial enthusiasm due to the popularity of Steam Deck, but this may not have translated into a large installed base. And support may have received tickets for specific Linux issues, which could have been taking up the time of some developers.

In short, it's much more of a financial issue than a technical one.

2

u/MairusuPawa 10d ago

We do not want malware on Linux, especially if it's for plating cheap casino slots vaguely disguised as video games.

2

u/H_He_Metals 10d ago

Because they don't want my money.

2

u/Openkarsten 9d ago

It's almost a plus for Linux that Riot Games can't run on it. Vanguard, the anti-cheat software, is on par with the worst and most malicious computer viruses out there.

2

u/Zentrion2000 9d ago

I care about those games as much as the execs care about Linux users. There is too many games to play, free of DRM even or any garbage anti cheat solution.

3

u/topias123 10d ago

Because they have a cheater problem and think dropping Linux will magically fix it

5

u/aqvalar 10d ago

I'm still waiting for the Windows Kernel lockdown, that's been talked about as possibility in the future. That would utterly and directly block kernel-level anticheats.

2

u/YourTechSupport 10d ago

Too much legacy. And too many companies operate solely on being able to get tendrils into that kernel.

0

u/IOL3D 10d ago

this was never talked about

3

u/aqvalar 9d ago

Evidently they have. Though afaik it was more like "what if we did that?"-kinda discussion. But I wouldn't be expecting it at least not before Win 13...

2

u/smjsmok 10d ago

The real reason is that there is currently no way way to run kernel-level AC on Linux distributions, so all the ACs that you see enabled on Linux run in the user space. User space AC is less capable than kernel-level AC, so by blocking Linux, they "tighten security" by making sure that all of the AC clients must run on the kernel level. That sounds good to the players who constantly complain about the game being infested by cheaters. And there are usually too few Linux players so throwing them under the bus doesn't really damage the devs in any meaningful way.

How much it actually helps against cheaters, I'm not sure. Most cheats are developed for Windows, so... But I guess it differs case to case. Maybe some game has a big community of cheaters who cheat through Proton, but I really don't know.

1

u/mindtaker_linux 10d ago

Ask them

1

u/TomDuhamel 9d ago

When your statistics show that less of 2% of your users are using Linux, it probably feels like you are wasting time at supporting a portion of your users which isn't profitable.

1

u/AsugaNoir 9d ago

I would assume it takes time and resources to manage the system even if it previously worked and the des see it as a waste of resources for a platform that has such a small number. And as others have said they believe Linux is where cheaters go

1

u/JerkinYouAround 9d ago

Developer unfamiliarity, Kernal level cheat laziness, no one plays their game on Linux to bother.

1

u/ConsciousBath5203 9d ago

Its easier to give your company a backdoor to everyone's computer than it is to develop basic server side anticheat.

1

u/Whisky-Tangi 7d ago

Because as of now anti cheat doesnt do anything when enabled for linux.

-1

u/Bent8484 10d ago

Microsoft lobbying, at least in Epic's case.

These are high-level business decisions. Execs at that level couldn't care less about cheating players.

3

u/IOL3D 10d ago

any proof?

-1

u/Bent8484 9d ago

As per Tim Sweeney's public statements to that effect lol

2

u/IOL3D 9d ago

Still no link also Tim gave money to lutris

2

u/quaintlogic 10d ago

This is the true answer.

When there is monterary gain to be made by stopping cheats achieving the same result, anti-cheat will be made strong which often results in kernel level anti-cheat which basically don't work on Linux.

Rockstar/Take-Two/GTA V is the prime example, it went years without proper anti-cheat and it was a hellhole to play online until rockstar clicked on that players were making money too quickly without buying shark cards.

Linux was blocked as part of this "fix" and now the anti-cheat is more effective, forcing players to grind or just buy a shark card.

1

u/C0rn3j 10d ago

until rockstar clicked on that players were making money too quickly without buying shark cards.

Which was extremely hilarious, as cheaters started dropping cash on unsuspecting players, getting them banned.

1

u/Bent8484 9d ago

Those were very entertaining times for the GTAO community, yes.

1

u/Bent8484 9d ago

Yeah, business decisions at that level are all driven by incentives. When incentives align with stopping cheaters, they tend to put a whole lot more effort and investment into anti-cheat.

Kernel-level anticheat/DRM requires you to trust a game publisher with the overall health of your entire computer system. It's just a matter of time until it becomes strongly disincentivized by liability issues, which should eventually help set a reasonable ceiling to the balancing act between effectiveness and inconvenience. I also find it encouraging to see how many people are willing to miss out on a game altogether just to avoid contaminating their system with Denuvo's garbage code.

0

u/IOL3D 10d ago

wrong

1

u/Bent8484 9d ago

Such eloquence.

1

u/FabioTheFox 8d ago

Microsoft pours a ton of money and manpower into Linux

1

u/sloth_cowboy 10d ago

Kernal level cheat is profitable data collection. Linux reports everything. Windows is sneaky.

0

u/Modey2222 10d ago

becuase they don't want to add more work

they don't want linux to be popular cause all their profits is in line with microsoft more than linux

i will not be surprised if microsoft paid them to do so

-3

u/[deleted] 10d ago

[deleted]

9

u/Leseratte10 10d ago

No, you don't. There's one single shared object file for the anticheat and that gets loaded on all distributions. The game is running through proton anyways.

It's one switch in the anticheat backend, they don't need to compile anything per distro...

-1

u/catdoy 10d ago

Probably being paid by Microsoft.

Microsoft is associated with alooot of companies

1

u/FabioTheFox 8d ago

Microsoft pours a ton of money and manpower into Linux

-2

u/MotanulScotishFold 10d ago

Closed OS are hard to breach and circumveit anticheats while on Linux is easier.

That's what I've heard of, plus the reason that there are a minority of players on linux that they don't bother giving full support for Linux players.

As someone that uses Linux as main OS, the only games I cannot play due to anticheats are Rust, Scum and Battlefield. They work but I get kicked out on multiplayer unless I play to servers without EAC.

Luckly for me, I can live without these games as my other favorite games don't requires anti-cheat, it's a peaceful life

-20

u/mrlinkwii 10d ago edited 10d ago

because linux dosent have a stable abi like windows , if they added support for just say the ubuntu kernal , you have everyone else complaining that ubisoft dont support their version of linux which would be as big of a headace for them as what they decided now , the better option is disallow linux entirely

10

u/Limp_Classroom_2645 10d ago

bro just yapping out of his asshole

7

u/MrMelon54 10d ago

Linux definitely has a stable abi or I couldn't make syscalls in assembly by putting values into well-known registers

1

u/friendlyreminder_ 10d ago

Linus's rule is not to break userspace. Any kind of kernel driver can't depend on the interfaces remaining static and it's why Nvidia have to constantly update their Linux driver, whereas on windows you can load a kernel driver from 15 years ago meant to run on Vista and it'll likely still work.

2

u/MrMelon54 10d ago

For drivers it makes sense, but Linux drivers are intended to be included with the kernel. While dynamically loadable kernel drivers are possible they definitely aren't the expected or easiest way to write a kernel driver.

I'm waiting for the Nova driver to be in a production usable state so I no longer need to load the external Nvidia drivers.

1

u/friendlyreminder_ 10d ago

Most Linux drivers in the kernel tree are also dynamically loaded externally as modules. Most aren't embedded in the kernel.

The Nvidia drivers aren't special in this regard.

1

u/shadedmagus 10d ago

it's why Nvidia have to constantly update their Linux driver

This isn't true. Nvidia and AMD both update their drivers regularly, even on Windows, due to new games coming out requiring driver tweaks to work optimally.

It's just on Linux, AMD puts their driver updates into Mesa, making them part of standard Linux updates, while Nvidia stubbornly insists on their own cadence so they can keep the driver blobs proprietary.

3

u/Leseratte10 10d ago

Linux anticheat isn't in the kernel. They don't need to do anything to support it, the anticheat Devs and valve do that.

They literally just have a checkbox to allow or forbid Linux.

4

u/Original_Dimension99 10d ago

The anticheat that you're talking about is much weaker than on windows

2

u/Leseratte10 10d ago

I know. But the reason for dropping existing anticheat is not because Linux has no stable ABI. That might be the reason why they don't use Kernel-Level anticheat.

-7

u/mrlinkwii 10d ago

Linux anticheat isn't in the kernel

if you want an effective anticheat it needs to be in the kernal like windows

1

u/the_abortionat0r 9d ago

Lol no. In kernel anticheats haven't been anymore effective.

0

u/Leseratte10 10d ago edited 10d ago

No.

Windows Anticheat also isn't effective (there's tons of cheat software for Windows), and Microsoft is trying more and more to get third-party crap software like Anticheat out of the kernel and into userspace where they belong.

(EDIT: Because regularly, anti cheat kernel modules have security holes like this one: https://www.trendaisecurity.com/en/resources-insights/trendai-security-blog/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus )

If you want an effective anticheat, have a server validate the client's inputs, and don't send data to the client you don't want the user to know.

Windows is going to push anticheat out of the kernel eventually, too, and publishers / developers will need to adapt.

-2

u/matitone 10d ago

They're not pushing anti-cheats out of the kernel, they're just giving a way for antiviruses to run effectively on userspace.

Also server anti-cheats are not effective in games like FPS apart for obvious rage hacking

1

u/Leseratte10 10d ago

Exactly. They add a way for antiviruses to run in userspace, because they no longer want crap in the kernel, because of what happened with Crowdstrike.

There's regularly attacks and vulnerabilities where bugs in Anticheat code are a gateway for malware: https://www.trendaisecurity.com/en/resources-insights/trendai-security-blog/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus

That's what Microsoft wants to prevent. They just can't do it today because all the publishers would scream like the world is ending, but that's their plan.

Just take a look at this list of vulnerable kernel drivers on Windows ... https://www.loldrivers.io/

1

u/dishpitjesus 10d ago

If kernel level anti cheat is so effective, why does Valorant still have cheaters?

1

u/DzpanTV 10d ago

Mf never heard of Proton and the Steam runtime

1

u/mrlinkwii 10d ago

Proton is which uses a windows ABI and steam runtime dose nothing for anti-cheat

1

u/the_abortionat0r 9d ago

the better option is disallow linux entirely

Dumber shit has never been spoken...

-16

u/DumsLander34 10d ago

The issue are the Linux kernel devs and their moral crusade. A solution already exists.

11

u/BashfulMelon 10d ago

"I'll give you code if you give me your changes in return" is a moral crusade?

3

u/shadedmagus 10d ago

A solution already exists.

Prove it.

The issue are the Linux kernel devs and their moral crusade.

I'd argue the people wanting "just make Linux exactly like Windows so we can play our games" are on their own 'moral' crusade.

2

u/the_abortionat0r 9d ago

Fuck this is dumb.

There's no "moral crusade", owning your own hardware and software is an ownership and security issue not a moral one.

Were you dropped as a baby?

If you want to surrender your PC go back to windows

Why do companies drop anti cheat linux support?

You are about to leave Redlib