I have an anti-cheat startup, and Linux support is a big priority for us. The segmentation problem on Linux is a real challenge for us. It’s likely we will only ever be able to support the big distros, and we also are exploring using TPM remote attestation. Both of these things take away user freedom to tinker with their systems, an ability Linux enthusiasts enjoy. But with this freedom implicitly comes with the freedom to cheat in online video games. I’m happy to hear thoughts on this.

> and we also are exploring using TPM remote attestation

I can already tell this is very likely not going to work fully, or even work for a sizeable chunk of Linux installations out there. Many platforms don't have TPMs, or have TPMs from unknown CAs. Or firmware that you're not aware of. Or even worse, people might just be running a Linux distribution that you don't know about. Or a patched kernel. Or a bootloader that doesn't measure the next stage into TPM. Not to mention, even the most popular distributions allow you to do anything with root access, things that you just won't be able to measure, but that might allow people to cheat.

TPMs really only make sense for _very_ controlled environments if you want to prevent hardware tampering at this level. The diversity of Linux distributions (and PCs in general) truly works against you here.

how would you stop someone sticking in a dodgy PCI card (disguised as an innocent one) that can read the entire machine's memory using DMA?

I’m not going to go into specifics but there are several software methods to both detect and prevent these sorts of attacks, since DMA requires cooperation from the host CPU. There are several anticheats in production today that employ these techniques with great success.

> since DMA requires cooperation from the host CPU

Not really. I mean, yes, in the sense that the IOMMU has to be configured to allow it, but after that, it's fair game. Any PCI device can read within the inbound translation window.

Require video card PCIe passthrough and host the game on KVM? Take something like firecracker or some runt kernel, don't do a full system vm, just enough to run the game and anti-cheat?

I guess I don’t understand what the goal of that would be, since the kvm host still must be trusted.

Why would Linux be a priority with you when actually no one use that platform at scale where anticheat matters?

For the same reason that I have decided to have our CI build and test on ARMv8, even though hardly any (PC) games are on that architecture. I try to be forward thinking, even if it may be a longshot. Apple's M1 may just bring an era of even further segmentation of desktop platforms. I want to be prepared for that.

I work in AAA studios and I worked on online anti cheat, you won't be able to sell your anti cheat if you advertise it as working on Linux, studios don't want there game running on Linux / virtualization because of cheating.

If they don’t want it on Linux it’s up to them. I’m just providing the tools to do it if they decide to be on that platform.

> Both of these things take away user freedom to tinker with their systems, an ability Linux enthusiasts enjoy.

I just want to play video games and I use linux - in order to play multiplayer video games I need anticheat and this means giving that up.

I would also argue that other than a minority of vocal users no one wakes up in the morning looking forward to tinker with their system, we just sometimes have to, doesn't mean we like it.

Yes, this is the big problem. Indie games usually run just fine in wine and don't do anything too advanced and just work out of the box; your biggest problem is probably going to be them installing stuff into weird places or directly onto C:\gamename.

The rootkit, driver signing enforcement, driver ACLing of anything it doesn't like, vulnerable drivers, all forms of emulation detection, failing any of those = permanent ban is a whole other problem.

Anticheats are anti-consumer; They restrict what you can do on your own machine. It's better not to have these games.

They also make some games actually playable, which is a shame.

Ultimately anti-cheat within the application itself, I find, should be considered acceptable whereas Riot's Vanguard/rootkit solution is an ugly hack. Valve seem to be showing it's possible via both automation (ML) and community judgement to make achieve results - the aim needs to ensure all players look "normal", not stop all cheats (the latter aim is impossible).

I mean good luck getting rid of the biggest games around then. The majority of the top 10 games on Steam are multiplayer games with anti-cheat systems in place. Even outside of Steam, Riot and Blizzard have games with huge player bases and they all use anti-cheat systems.

Ahh yes I will surely miss COD and FIFA /s

My bigger concern would be a permanent ban on an indie game.

I still prefer anticheat to having a multiplayer game ruined by players that move at 10x normal speed and dual-wield fully automatic, infinite-ammo sniper rifles rigged to never miss.

Uh, no its not fun to play a multiplayer game full of cheaters

The problem with anti cheat is that those are literally rootkits.

yup. i wonder if there's room for a different paradigm in the Linux community that works via some alternative like reporting or karma instead of spyware