No kidding. After spending so much effort on verifying that the code I'm running comes from trusted sources and that I have a decently secure system, I can't help but feel dirty after allowing some sort of weird DRM/anti-cheat service that needs to phone home just so I'm able to play a game I loved from 5 or 6 years ago.

Pretty much all of them are root kits. EAC, Battle Eye, Valorant Vanguard, Faceit AC, ESEA AC, Denuvo AC

If the price for not getting that crap installed on my system is a few triple A multiplayer games, then so be it.

What's the issue with giving out kernel mode access? Almost everyone is gaming on single user systems anyways.

Riot's Valorant rootkit is active from boot and actively monitors everything you run and will block things it doesn't like or doesn't recognize.

Most of the other kernel anticheat rootkits are more polite and don't run until a game starts them, at least.

In general having a bunch of random stuff from video games running with kernel permissions is spooky. You never know whether someone will find an exploit in one of them, or if it will cause performance, stability or data integrity problems.

> Riot's Valorant rootkit is active from boot and actively monitors everything you run and will block things it doesn't like or doesn't recognize.

Honestly, if I was responsible for building an anti-cheat system this is the way I'd go about it. Anything that can run that you don't know about (e.g. because it ran before you started) is a potential risk.

Cheaters now exploit boot loaders to side step this, funnily enough

Doesn't giving kernel mode access mean that if the game developer's CI is hacked, an attacker could push full compromise exploits down the channel?

Aren't there some security benefits from trying to confine apps to user land?

Userland can run DoS attacks, it can mine crypto, it can run keyloggers, it can steal, encrypt, and delete your files, it can make your system not properly startup, it can replace sudo or other programs that ask for passwords with a custom version, it can steal whatever's on your clipboard, it can infect other operating systems (depends how they are mounted), and much more.

User land can also gain kernel access pretty trivially