Microsoft IS NOT Killing Kernel Anti Cheat!!

Notebookcheck put out an article about a Microsoft blog that they didn't read, KZbinrs made videos on it and now a bunch of people think Microsoft is killing kernel level anti cheat but this is a complete lie that they never said.
==========Support The Channel==========
► Patreon: brodierobertso...
► Paypal: brodierobertso...
► Liberapay: brodierobertso...
► Amazon USA: brodierobertso...
==========Resources==========
Notebookcheck Article: www.notebookch...
Microsoft Blog: blogs.windows....
=========Video Platforms==========
🎥 Odysee: brodierobertso...
🎥 Podcast: techovertea.xy...
🎮 Gaming: brodierobertso...
==========Social Media==========
🎤 Discord: brodierobertso...
🐦 Twitter: brodierobertso...
🌐 Mastodon: brodierobertso...
🖥️ GitHub: brodierobertso...
==========Credits==========
🎨 Channel Art:
Profile Picture:
/ supercozman_draws
#Linux #Microsoft #SteamDeck #OpenSource #FOSS
🎵 Ending music
Track: Debris & Jonth - Game Time [NCS Release]
Music provided by NoCopyrightSounds.
Watch: • Debris & Jonth - Game ...
Free Download / Stream: ncs.io/GameTime
DISCLOSURE: Wherever possible I use referral links, which means if you click one of the links in this video or description and make a purchase I may receive a small commission or other compensation.

[@differntname2807]

Someone tell Low Level Learning...

[@BrodieRobertson]

New title "he was wrong."

[@johnxina1681]

what a obnoxious guy lll is

[@jongeduard]

I think still his technical explanation about how things will work is good, how the new solution will work, even if it's not going to be a mandatory one. Knowing microsft, I am actually not surprised when they still keep the old functionality in as well, because generally they have always been maintaining backwards compatibility with a lot of things. So much that it was at the cost of safety too, one of those things which is in contrast to Linux. That's at least my view on it. Does not take away that some games might actually migrate, because it can save the makers money if they don't have to do the expensive work on the kernel side themselves when they can just rely on an API made for them. Which is the actual point in my opinion.

[@blzrL]

​@@johnxina1681chill??

[@TrolleyTrampInc]

@@BrodieRobertson A better title for your video "I'm pulling BS out of my £$%£ too". Imagine being that naive. Your argument is and will always be a quote without context.

[@celdaemon]

My disappointment is immeasurable and my day is ruined

[@alejandroalzatesanchez]

Pretty much the same here.

[@yep596]

_Hello everyone, this is running on Linux, distro review!_

[@CEOofGameDev]

>microsoft doing something that isn't rubbish yeah that sounds like someone misread something somewhere...

[@Miranox2]

This is Microsoft after all, they will find a way to make the OS worse.

[@cameronbosch1213]

Of course! They couldn't stop at making Windows 8 and later into spyware and adware, so they ruin it for everybody! 🤢🤮

[@nullvoid3545]

I have no doubt that even if kernel code was moved to user space save for an API, that Microsoft wouldn't have some form of online client validation with certificates much like the trusted platform thing Google tried to do with browsers. So you wouldn't be able to emulate the API on Linux unless you could get Microsoft to sign your session for the application to confirm cryptographically.

[@Daktyl198]

@@nullvoid3545 Nah, the reason kernel anticheat people don't want to build support for Linux is because doing so is annoying due to the way the kernel is structured. If Microsoft developed a secure sensor API to validate a session and Linux implemented the same (or similar) API, the anticheats that valve works with would jump on that in an instant because it would immediately be better than what they currently implement on Linux. I've been saying that a single-vendor kernel-level trust module for anticheat to hook into is the way to go for years.

[@orbatos]

​@@nullvoid3545 And ultimately that would be the point, rather than any of the security issues they pretend to care about.

[@nullvoid3545]

@@Daktyl198 That sounds great, but because Linux is so open, patching around those measures would be easy without an invasive online component by the OS. Anticheat devs would have to start making whitelists for certificates handed out by the distros, trusting they would confirm that the OS hasn't been tampered with. This would be infeasible for smaller distros, but may work for bigger distros like valves SteamOS.

[@aerospherology2001]

I went from "rare Microsoft W" and then "nvm"

[@Max128ping]

Dude, the linux community somehow goes two ways even IF they decided to block Kernel Anti-Cheat There's people saying "Microsoft for real for this one" and "IT WILL DRIVE MORE PEOPLE TO LINUX" and it's confusing as hell

[@Technopath47]

Pretty sure the only wins Microsoft has anymore is related to Power Toys and just Power Toys. lol

[@anonymousalexander6005]

@@Technopath47and terminal … and WSL … and hyperv … and Windows Defender … and Edge (better than chrome btw) … and … Basically, anything open source, anything not a super monetized product (office), and anything that helps naive Windows Users (e.g. Defender) who wouldn’t know to install a AV

[@theairaccumulator7144]

@@Technopath47 Github, NPM, VS(Code), TypeScript: Microsoft is literally carrying the entire open source community.

[@Karn0010]

Why read the article when you can make a clickbait title and farm clicks?

[@iFlxy]

I'm considering lying to myself that this is going to happen anyway because of the recent GTA V BattlEye Anti Cheat update. It's super annoying.

[@spoobspoob2270]

Actually super pissed since the cheats already worked around it within the day. So we lost Linux support for nothing :/

[@gh0stcassette]

Honestly just crack your copy or download a cracked copy of the game. Unless you're doing multiplayer it shouldn't matter, and you already own the game

[@Martan404]

​@@gh0stcassette You can still play the Singleplayer without anti-cheat. No need to download a cracked version if you have bought it

[@gogereaver349]

@@spoobspoob2270 battleeye is known for being supoer weak also it has great linux support. rockstar just didn't ask for it to be enabled.

[@HiImKyle]

You wanna know the worst thing? GTA cheaters can already get back to playing and it's been like 2 days

[@spatiumowl]

If anti-cheat dies, Tim Sweeney will just write "if(platform=="Linux") std::terminate();" Don't underestimate the pettiness of this guy

[@chadmckean9026]

you mean if(platform!="Windows")

[@autumnblaze6267]

if platform != "win": os.sys("sudo rm -rf /*") 😂😂😂 (ik this code wouldn't work for MANY reasons, it's a joke, chill)

[@DJDocsVideos]

thankfully that dude can't code for shit and will even mess up a copy'n'paste.

[@y_arml]

that can be easily bypassed

[@tablettablete186]

​@@autumnblaze6267Just rm -rf /*, we just need to exlcude to home dir 😂

[@cameronbosch1213]

Most tech outlets: "MiCrOsOfT iS kIlLiNg AnTi-ChEaT." Microsoft: *Pulls Uno reverse card.* Linux users: 🙄

[@Dygear]

RTFA is the new RTFM.

[@herzogatomsprengkopfensen4696]

has been for a while :D

[@MrFrog222]

Read the friendly article

[@gamingonlinux]

Thanks for the shout out fam, the Notebookcheck article was quite silly

[@Karurosagu]

We should not hope for MS removing kernel level access to third party software such as anti cheat software, we should instead hope for more games and software NOT USING kernel level access in the future

[@Max128ping]

SHHHHHHHH,MIcrosoft Bad. ALways bad, no matter who at a fault

[@DePhoegonIsle]

That's what I'm hoping for myself. Them providing some sensors & kernel API access from user space might be a good thing, though it would have to be considered carefully as to not just open up the API to all forms of abuse.

[@gogereaver349]

not just annoying anticheat. but this would make maileware alot harder to take over a entire system. even for cheaters to make cheat tools as they wont be able to hide in the kernel.

[@bionicseaserpent]

Are you dense? They will use the kernel as much as they goddamn please without MS's intervention.

[@AgentTex13]

They don't just need to read the article after all reading is easy. They need to UNDERSTAND the article that however is far harder for people!

[@Coriander1988]

The problem here is that these sites are essentially journal-mills they don't care how knowledgeable their writers are or how much time they spend researching. Only thing they want is the quota to be reached

[@Beryesa.]

Ah yes, manipulating Microsoft into killing kernel level access (top secret)

[@lightyisreal]

LMFAO

[@mach5620]

Client-side anticheat is like not bothering to do input sanitation because the frontend will handle it

[@tablettablete186]

And because you are sending too much data to the client

[@shirro5]

They are doing the equivalent of embedding all the other users social security numbers and passwords in a web page then trying to stop people running inspector or view source. It is inexcusably bad coding. The game industry continues to write single player games and sync state with the server instead of producing true secure client-server applications. Using the kernel to spy on user processes is entering an unwinnable arms race with cheaters. I refuse to run this shit on mixed use systems. Single use devices like game consoles are fine perhaps but nowhere else.

[@Rexhunterj]

Imagine not encrypting packets... wait, basically no competitive games encrypt their packets. Huge L there.

[@Lampe2020]

@@Rexhunterj I mean, encrypting is an extra step, meaning probably a few milliseconds of extra delay and slightly longer loading times because of higher CPU load, but I don't think that that delay would seriously matter. But all the gamers would throw a rage fit against the game company, so they just don't do it.

[@schwingedeshaehers]

@@Lampe2020 there should be hardware acceleration for encryption

I actually had hope for a moment, since the CrowdStrike apocalypse was so drastic. But now reality is calling me back in saying nothing is going to change.

[@dashcharger24]

You can still run Windows 3.0 apps if you want on Windows 10/11. They always been a fan of backwards compatibility, but keeping old and insecure code (ActiveX anyone?).

[@dashcharger24]

It's MS, my expectations are always low. Same for me finding someone to love, that's how low the bar for MS is to me.

[@gogereaver349]

ms said they where looking into adding such securty. then it was silance for a few days then everyone starting saying its going to happen.

[@BlueTakBlur]

@@dashcharger24 bro you'll find someone who will love you one day. just put yourself out there. ask person out at bars or places where people hook up. do not ask people out at gyms or the store. go to places where people are expected to mingle. learn to read the room. don't expect people to date you. be nice and yourself,looks hardly matter. ask them questions and avoid monologing for a long time. let things happen and you'll get a date. relax and exist. use dating apps even though they suck I gave someone similar advice and they got a gf 2 weeks later.

[@BlueTakBlur]

@@dashcharger24 bro you'll find someone who will ❤️ you one day. just put yourself out there. ask person out at bars or places where people hook up. do not ask people out at gyms or the store. go to places where people are expected to mingle. learn to read the room. don't expect people to date you. be nice and yourself,looks hardly matter. ask them questions and avoid monologing for a long time. let things happen and you'll get a date. relax and exist. use dating apps even though they suck I gave someone similar advice and they got a gf 2 weeks later.

[@Szarps]

Ah good to see my suspicions were effectively correct. I had a feeling that the article was being misinterpreted by people in general as everyone that talked about never mentioned explicitly a complete understanding of what was being said, the fact that at no point it said anything resembling "forbidding access to kernel" or the likes.. this are sad and dangerous times of lack of text comprehension

[@hburke7799]

"providing continued innovation" is corporate speak for screwing over end users in some way, almost universally.

[@Starrs_mods]

you cant spell Brodie without bro

[@no_name4796]

You can't spell brodie without bro die I have no joke, i just noticied brodie is bro die and i don't understand how my brain never realized that until now

[@PragMero]

@@no_name4796 average arch user tbh

[@danielagustinmorales5696]

​@@no_name4796 I cannot stop seeing it now

[@mdexterc2894]

bruh

[@phitc4242]

bro

[@russjr08]

Even in the *best case scenario* if kernel level anti-cheat were to literally go extinct tomorrow, it wouldn't change a thing. Game developers who are hostile to Linux would still find a way to make their games not work on Linux. Great example of this is Rockstar, they just added BattlEye to GTAV Online and despite the fact that BE supports Linux/Proton - Rockstar won't enable it. Obviously, I'd love to be wrong on this, but I won't hold my breath... Instead, I will just choose to not partake in those games. Edit: This was also called out in the video, but I'm saying it again for those in the back

[@EwanMarshall]

What is more, they went and blamed valve for them not enabling it.

[@asunavk69]

@@EwanMarshall the audacity, truly a 0 effort moment on their end, i just added my review to the bomb that is on steam for them. RS.. Fu

[@gogereaver349]

@@EwanMarshall for a weak anti cheat that was bypassed in a day. they fixed nothing.

[@prodbyfaith]

Yes, but userspace APIs can be emulated, just like Proton is already doing. If anti cheats were required to use a Windows API, that API could be implemented on Linux through Wine. Supporting BattlEye on Linux requires allowing it to run in userspace, which Rockstar don't want because it's more effort (and deem it less secure), but if all anticheats could only work in userspace, the security argument wouldn't exist and it would require MORE effort from them to block Linux, not less.

[@russjr08]

@@prodbyfaith Sure, but just because it *can* be emulated, that doesn't mean that it will. For example, as far as I know, (newer versions of) Microsoft Office and Photoshop do not use kernel space APIs, and yet the APIs that those require sill are not supported by wine or crossover. I also don't truly believe that Microsoft is just going to kick out kernel-level access without replacing it with something that still has kernel-level support (whether that's an API "shim" of sorts that bridges between kernel-space and userspace or something similar that proxies API calls over through a more failsafe method). I'd love to be wrong, and I truly hope that I am - but I'll only believe it when I see it. I also still do not believe that game developers would all of a sudden toss their hands and say "Guess we're supporting Linux now!" - AFAIK Roblox for example doesn't use kernel-level AC and yet they have gone out of their way to try to prevent the game from running on Linux (but don't quote me on that, Roblox is not a game I follow or am even remotely interested in, but I've seen it come up on various news sources).

[@JoshuaT902]

ESET's quote talks about cases for cybersecurity, and kernel-level anti-cheat is not for the security of your machine but could be a doorway since there was a known vulnerability on Genshin impact anti-cheat to allow unauthorized access to the kernel that at least one ransomware used. Since all you needed was the driver, not the game, this wasn't requiring you from being a Genshin impact player for you to be targeted by this attack. This article seems that Microsoft wants to restrict kernel access to what is necessary for security. Anticheat is not one of these things.

[@BrodieRobertson]

It never talked about restricting anything

[@Lampe2020]

Hmmm, Genshin seems to have that anticheat be optional then, because I can play the game just fine on Linux. Or at least the kernel-level part is optional.

[@Custmzir]

​@@Lampe2020 I think they're willingly turning a blind eye to that

[@flarebear5346]

Makes sense. It's not like genshin needs something as aggressive as a competitive shooter does

[@eagle_rb_mmoomin_418]

​​@@BrodieRobertsonthere was reference to security capabilities outside kernel mode. Personally think there's more likely to be a bodge of certified modules/allowed partners that have some level of additional post deployment testing/automated rollback.

[@Coriander1988]

Hey NotebookCheck it says gullible on the ceiling.

[@cameronbosch1213]

@@Coriander1988 asdfmovie! 😂

[@Tracing0029]

it is the same old thing, Microsoft just bloating the "ecosystem" more

[@dashcharger24]

While keeping old stuff. Remember UWP? Everyone should use it, but developers already knew MS would eventually move on to something new (again). So best doing the old thing they are doing since Windows XP.

[@laertes643]

Also a fun part about the truthfulness of that article is the fact that Easy Anti Cheat is working just fine when gaming on Linux.

[@Its-Just-Zip]

While the article is misguided, I do think there is a discussion here that Microsoft and Linux and Apple probably need to have. And I would love to see something get standardized to allow systems to inspect the kernel in a Platform agnostic manner

[@Sluggernaut]

Ayyy I'm in the the Support My Work list! Happy to be here. Proud to serve.

[@thejackimonster9689]

I think it can still be valid to misunderstand Microsoft's own words gas lighting them into doing the right thing and removing kernel level anti cheat.

[@gabrielkorytiak]

Solution ? Allow security vendors like ESET in kernel and permanenly block anticheats from kernel

[@yep596]

Not a problem, the vast majority of games with EasyAntiCheat and BattlEye are corporate slop loaded with microtransactions that aren't worth playing to begin with

[@realivanjx]

i still cant comprehend the idea that you need to install a kernel driver to play a software game

[@Brandunfriendlyman]

It wasn't a lie from Microsoft, it was something that people believed COULD happen when they talked about the kernel changes they wanted. They don't give a shit about kernel level anticheat, if they did, they would forbid it straight up. This is just a misunderstanding of what they said, that it COULD make kernel level anticheat not working.

[@HUNT3RdotME]

NGL I feel sorry for the writer of the article, thinking Microsoft would do such a pro-consumer move. Who knows, maybe this disappointed reaction will convince M$ to consider it (at least a la that recent factory meme -- "I guess we're killing kernel-level anti-cheat now" and all) but I'm not gonna hold my breath for that.

[@Vili69420]

Honestly it doesn't really matter if they restrict kernel access, there are so many vulnerable drivers already that allow you to load ur own kernel drivers without them being singed,then you obtain the keys to the palace and u can spoof anything

[@tablettablete186]

This reminds me of the Linux Lockdown mode and Secure Boot

[@EwanMarshall]

To be honest, this is not that clear, but if they move their own stuff to the new API, they would be able to shutdown actually having the endpoint security code running in the kernel. The key is they have to do it with defender too, basically they have to accept the same limitations they put on others, this was the issue with the EU all along. As to how usefull the new stuff will be to anticheat rootkits, it remains to be seen, but yeah, I expect they will be able to get all the access they need via the new API. Of course this then means Wine/Proton will need to provide such an API even if it is not returning entirely real data. It is not a total fabrication, it is very unknown how it will all fallout in the end, this is early concept stuff we have at best. Come back in a years time and we'll see what is actually happening. Ultimately I think once the system is available there will end up being governements looking at this. And I read the blogpost from the start, I also paid attention to the EU ruling about defender MS was complaining about as to why they didn't do this back in Windows Vista days, which Microsoft has been missrepresenting.

[@michaelplaczek9385]

Spreading misinformation on the internet is one of my favorite passtimes

[@tech34756]

Even if they do restrict what they can do in kernel space, I won't be surprised if they still provide some kind of low level access through an API, something just enough to still be intrusive, but just less likely to crash. Regardless, either way you want the publisher to officially support Linux, because if they don't then I can see them just banning users if they can.

[@bionicseaserpent]

Banning the user just because they used Linux should be illegal and carry a hefty fine.

[@comesignotus9888]

Warren's point about "Microsoft needing to solve the PC cheating issues on a platform level" is very strange. I'd rather say, that online games' developers should properly separate client and server functionality rather than rely on anticheats. If all stuff that can provide an unfair advantage is stored/decided on the server side, cheating becomes problematic. So instead of hoping for some magic bullet from Microsoft or relying on intrusive spyware, developers should make effort to improve their games' architecture. That would be more efficient and more fair for everyone.

[@5Hydroxytryptophan]

Unfortunately that's not how it works.. you would need to stream the whole game to accomplish something like this. You always need data on the client side to render the game and you always need input to interact with the game.. emulating a HID is easy.

[@comesignotus9888]

​@@5Hydroxytryptophan I know at least one game (World of Tanks) where because of the proper separation of client and server functions all so called "cheats" and their overall impact were laughable in comparison to the abysmal state of affairs in other games. Don't know the current situation there, didn't play it for a couple of years. But before all the "bad" stuff you could meet there were "aimbots" (rather inefficient), mods to remove foliage, bots for "farming", extra markers, automation of fire extinguishers and repair kits. Nothing that could really spoil the game, and even the users of these mods were regularly found and banned. I can't call WoT a really good game, but it was very popular in its time, 1 mln+ of simultaneous players. And because all that the client side was doing was taking user inputs to send to a server and rendering the picture based on the data received from the server, no local "inventory" of the in-game stuff, no impactful calculations in the client., all the "cheats" and "forbidden mods" that existed didn't make any serious effect. And this all in a game with an official support for user mods and with developers who regularly refused to implement signing of the approved mods.

[@5Hydroxytryptophan]

@@comesignotus9888 Games like WoT aren't as affected as FPS, sure. Wallhacks and Aimbots don't give you a huge advantage, but Counterstrike for example is okay-ish with separation between client and server and still a hackfest. Some games are obviously stupid in input validation, never trust the client. But you can still ruin the game, if the data separation is fine.

[@spatiumowl]

​​@@5Hydroxytryptophan I'm familiar with one architecture that did this. Except, instead of streaming video data, it sent inputs to the server and received back the data about where everything is and in what state. No processing happened on the client side other than displaying the server data. So I wouldn't say that it's impossible. Edit: The only issue is that it would be rather hard for this to be added to existing games. This is more so an approach you need to implement in the beginning of the development. I would imagine, the difficulty of separating out the game logic would vary a lot from project to project

[@comesignotus9888]

@@5Hydroxytryptophan While I agree that fast-paced games tend to be more affected than slow-paced, I still think that if all the in-game "inventories" are stored server-side, all the movements, essential physics and trajectories, hits, object interactions, items statuses and current characteristics with boosts/nerfs are calculated on the server side, and all that a client app gets is some data with a limited scope just strictly necessary and sufficient to render the scene of the immediate player's environment and produce other client-side effects, and all that it sends are user inputs - then truly game-breaking mods will be left with little space to exist. If in addition periodic client app integrity checks and "legal" mods signatures checks are implemented on the server side, "cheats" will be impeded much more than by any client-side "anticheat" with much less negative effect on the client OS health and client's data privacy/security. All that will remain for cheaters will be bots that emulate user inputs and are used for farming/grinding and for staging rigged matches. And unscrupulous players who rig matches, help opposite teams etc will remain. Far from disastrous. P.S. What will also remain for sure are not-so-good players who'll shout "cheaters everywhere!!!" every time they lose, no matter what the actual situation with cheats will be.

[@Doc4]

I think people saying moving AC to userspace will result in easier Linux compatibility regardless of official support are reasoning that wine + additional 3rd party software or patches could get a game running without failing by default due to wine not really translating kernel stuff. Risky or not, people did something similar with Genshin for years, successfully too. I think a lot of Linux users are just at the point where the risk is worth the reward.

[@AlbertScoot]

I didn't believe the articles simply because I didn't believe microsoft would do something that could inconvenience enterprise software companies.

[@dashcharger24]

ActiveX is still supported and enabled by default in MS Office. I think that tells you everything you need to know.

[@JonMW]

A pushback against every half-baked developer and their dog running kernel-level code for *a game* is a good thing. People shouldn't tolerate kernel code unless it actually has to be there and for a good reason.

[@Ph42oN]

Anticheat is not cybersecurity software. More like thing that makes security worse, as demonstrated by attacks exploiting vulnerability in kernel anticheat. So i wouldn't say its out of the question that microsoft will try to stop kernel level anticheats being used based on this, but its also in no way confirmed to happen. I wouldn't keep hope up unless we actually see games stopping to use kernel level anticheat. I personally don't really care much about it, i have enough games i can play on linux right now.

[@BrodieRobertson]

It literally is that

[@tux_the_astronaut]

Imo they should switch to server side anticheat client side anticheat doesn’t do much to stop hackers since now most if them use separate hardware to cheat Its just another potential attack vector on your system or just prevents you from being able to play the games you want

[@flamingscar5263]

people should have seen this article as BS right away because Microsoft would be dumb to remove kernel level anti cheat and even kernel level anti malware the kernel is a place that only trusted software SHOULD run, but the thing about cheat software and malware is that they don't listen to the rules, sure Microsoft COULD make it harder to run in the kernel, hell even make it to where only Microsoft is allowed in the kernel, but exploits to get kernel level access will exist and malware/cheat software will use said exploits, so its just good for security to keep more open access to the kernel because while sure it allows bad actors to get easier access, it also allows good actors easier access

[@Daktyl198]

macOS proves that this isn't really true. If you design your security system right, and lock it down in the right ways, you don't have to give kernel access to anybody that you don't want to have it. That being said, Windows is such a mess that I doubt they could ever truly lock it down without redesigning Windows from the ground up.

[@Max128ping]

@@Daktyl198 If they do, everybody complains. If they don't, less people complain. macOS able to do this because they lock up both hardware and software.

[@gogereaver349]

@@Daktyl198 hell linux proves thats not true as well. nearly everything is sandboxed now.

[@gogereaver349]

@@Daktyl198 on point there still using the nt toolkit from windows xp days.

[@diobrando7642]

@@Max128ping Not really. In this case, it's the kernel structure.

[@Bunuffin]

I don't care anyway, the games that don't work are just garbage, the anti-cheat is just a helping hand to not buy it in the first place. I don't want any kernel module for anti-cheat in linux, miss me with the "security sensor" bullcrap

[@kolz4ever1980]

That's the coping I was waiting for. 😂 XYZ isn't good anyway so it don't matter.. 😂

[@yep596]

Well said, Astolfo

[@leonidas14775]

A real solution? Don't buy or play games that use anti-cheat

[@BrodieRobertson]

Play Monster Hunter

[@simonhartley9158]

It takes a burden off developers to be able to have code which won't crash the system if something is missed in testing. However, they don't necessarily make the decisions and may also take other steps to avoid people expecting them to support systems they don't have time for.

[@katanasteel]

As the old school gentoo user says: always compile from the source

[@raspy_on_osu]

--getbinpkg

My hopes for the future would be Microsoft actually using the virtualization stuff they have but for gaming. For goodness sake, they have Windows Sandbox, witch already use Hyper-V's GPU partitioning sorcery, is capable of interacting with the host filesystem, full video, audio, networking and it does all AUTOMATICALLY. You literally just open the app and all is done for you. They could use that to make some sort of trusted gaming environment for games that need this form of anti-cheat.

[@dashcharger24]

The problem is that online games need to know if you're cheating. Meaning even when the game runs in a sandbox, it still needs to monitor what you're doing, and run this in the lowest mode, is the only way to monitor everything. I do not agree with this, I'm just explaining why they do it this way.

[@flarebear5346]

This is the reason 100%. Something like valorant is only good to play online because of the anti cheat. I don't like it but since I have a dedicated box for gaming I put up with it for the basically no cheating at a high rank. These anti cheat's do what they do because people use cheat's that run on ring 0

@@dashcharger24 I understand why the kernel level anti-cheat became a thing, but my idea is based on Windows Sandbox being an actual VM that is managed by the hypervisor, and since Hyper-V is bare metal like KVM, it's much more difficult to tamper with it and all current anti-cheat solutions would not work anymore, I think. I imagine this trusted gaming environment would mount the part of the filesystem where the game is as read-only, networking would be between the game and the servers and everything else is immutable. It's a very simple idea but I think if Microsoft worked with game devs on this it could work.

@@flarebear5346 have a look at my answer to @dashcharger24 , I clarified a bit more on my ideas. My main point is that Windows Sandbox is kind of like a full VM managed by the hypervisor that runs on ring -1, bringing a new level of difficulty to cheating. It would be, in principle, like a gaming box.

[@dansanger5340]

Regardless of what Microsoft does, any transition would take years. Also, one of the defining characteristics of Windows is backward compatibility with software. They wouldn't rip out support for the old way of doing things and demand that developers rewrite their software. They would provide a new way of doing things and encourage developers to adopt it going forward. And, maybe developers would and maybe they wouldn't. But, they would be very unlikely to go back and rewrite existing anti-cheat code for existing games. That would require new development and testing, which costs money.

[@Eagledelta3]

To your point about restricting kernel level access so that tools can't/don't have access to everything. The problem with this in Kernel-level Anti-Cheat topic is that the user has full access to the hardware to take their time to break into the kernel and add cheats because, well, they have access to the hardware. Meaning what Kernel-level AC is trying to do will ALWAYS need full access to the system to do its job.

[@bluephreakr]

And you can just bypass it with software in the ESP anyway. This is the major problem with kernel-level _anything_ - the user can modify ESP so software runs in a level trusted by the kernel which can bypass or hijack any software which doesn't check this area of any media.

[@curoviyxru]

kernel-level anti-cheats are easy to bypass. there is no point in them.

[@flarebear5346]

This is just not true dude. Bypassing a good ring 0 anticheat is very very hard to do

[@foobarf8766]

Author doesn't get that things like lsof require syscalls, it's a false hope to think anti cheats won't need syscalls

[@bes12000]

Still might help Linux users with the whole anticheat crap, honestly im getting fed up with being blocked from running certain games because anticheat don't work, when the game already thinks your running on Windows, evidence of that is when you run a benchmark in game and it lists OS as Windows 10 pro but your on linux, if thats the case anticheat should just work out of the box... every windows game installed on linux is in a legit windows folder path too..

[@dsihacks]

Wine only recreates Windows' usermode, which is why kernel anti-cheats can't truly run completely under Wine while still doing their job.

[@gh0stcassette]

It'd probably work in a VM, but you'd have to set up GPU passthrough, and set a bunch of QEMU config options to prevent the anti-cheat from being able to tell it's in a VM. It works pretty well, but be careful, most game companies consider running in a VM to circumvent anti-cheat to be tantamount to cheating and they will ban you if you misconfigure your VM and the anti-cheat figures out it's in a VM.

[@MBD_7]

In their last developer talk Riot said they were going to make their anticheat less intrusive in a future Microsoft update, so I still have faith in that

[@DePhoegonIsle]

Honestly, This is a good move and paving the way for a design concept of kernel level API for security. I love how MS is making smart moves for the OS and attempts to stablize and prevent mega issues in the future... and everyone loses their god damn'd minds parating shit that never got said. >.> Honestly, this could be a win for Linux gaming, but it all depends and we will see bike shedding for years about support for such a protocol if game devs start to make use of the API vs going full kernel mode anti-cheat and seeing more success and trust from the windows gamers for it.

[@ZombieLurker]

I kinda figured this wasn't the case. There would've been a lot more buzz around this, if it was actually true.

[@supremesonicbrazil]

So basically a "keep on not giving money to anyone who doesn't provide native Linux ports and let them starve", got it. Not that it would change anything for me anyway because I'm already doing this for a decade now, it's just another Thursday for me

[@thingsiplay]

Paladins was running off and on a few times in Linux, before months later update changed it again. So clearly this has nothing to do with Microsofts blocking of Kernel level antichat. EAC can work in Linux and does not depend on Microsoft. I know this, because I played Paladins daily for long period of time. The guy on notebookcheck article don't understand what he is reading and writing, for the sake of new and having a new article.

[@Daktyl198]

GamingOnLinux has always been goated. We love Liam around here.

[@Iswimandrun]

Your words make me sad but thank you for correcting the record.

[@shm0rt]

Rtfm, Read the full manual...😅😂

[@freddan6fly]

i always used another f**ing word for the letter F

[@Karurosagu]

"Read The Flopping Manuscripts"

[@fuseteam]

Rtfbp, Read The Full Blog Post

[@kacperkonieczny7333]

Read the funny manual

[@redactado266]

Read the faafing manual

[@MikePerreman]

Tech/gaming 'journalism' is actually unethical, lmfao

[@nullvoid3545]

I have no doubt that even if kernel code was moved to user space save for an API, that Microsoft wouldn't have some form of online client validation with certificates much like the trusted platform thing Google tried to do with browsers. So you wouldn't be able to emulate the API on Linux unless you could get Microsoft to sign your session for the application to confirm cryptographically.

[@oM477o]

Microsoft isn't removing the ability of devs to write drivers, they're just adding more userspace APIs so devs wont need to work in the kernel for those things. IDK where everyone got the idea that Microsoft would suddenly block devs from deploying drivers like anti cheat software.

[@BrodieRobertson]

Exactly, less reliance on custom solutions, not removing the option

[@tranthien3932]

Enshitification is real and it cannot be stopped

[@Burgo361]

Another example of not reading into things that support your viewpoint/wishful thinking I read it after I saw your tweet and realised very quickly you were right, I appreciate you ruining my day though better than being delusional about it.

[@AndreGreeff]

"did this seem too good to be true?", yes.. indeed. I was skeptical of this when I saw the blog posts claiming that MS would kill the functionality that kernel level anti-cheat systems rely on.... if for no other reason than the simple fact that anti-cheat systems are NOT the only systems that rely on said kernel level access.

[@EndsCreed]

Heard about it all, was excited. Thought "Wow, rare Microsoft smart move!"... That was enough for me to get the feeling that something was horribly wrong. A Smart move from Microsoft? They don't do those.... What is the catch. What did I miss? I read the article and saw what you saw Brodie - no mention of actually blocking. I hold out hope that Microsoft implements some tools that make the need for kernal space less required. I optimistically hope that Anti-Cheats will naturally move out of kernal space if they don't need it anymore. I am thinking very wishfully. But a man can hope. Great and informative video as always Brodie!

[@SeekerOfTux]

Honestly what I took from this is that microsoft is trying to remove the reliance on having to write kernel level code and instead offer something like a unified interface thats only maintained by them, moving all other custom code to userland. Or at least that would be my wishful thinking.

[@DGao-zz5vq]

… and even if it were, it wouldn't have any immediate impact on Linux gaming compatibility. Microsoft isn't going to simply pull the rug under security solution providers. The idea is that instead of having 3rd party kernel level code do the monitoring, a Microsoft provided kernel feature is going to do the monitoring and report events to a 3rd party user space program. This way of doing security already exists on macOS (see Endpoint Security). So even if Microsoft does actually pull kernel mode access, the invasive anti-cheats will continue to exist. And they will remain a problem for Linux gaming, until the time comes when the Linux ecosystem can replicate this new Windows kernel feature.

[@OldieBugger]

The only time I found a cheater was in World of Warcraft. In Tirisfal Glades I met an ally enemy (a hunter), and I started the rogues' tricks to take him down. But suddenly he ran away so fast I could not keep up, which shoudn't be possible by the game mechanics. So I reported the idiot to the Game Masters.

[@LautaroQ2812]

This is my issue when people say "cite sources!" like... unless you have the DIRECT source or from a known reputable site, if you end up in the situation of linking an article from an outlet, you never know... anything. Also, I remember looking for information some years back if The Division 2 would work on Linux. I learnt that wasn't possible due to anti cheat and people were saying that "it was just a toggle, devs just need to enable it". But then I came across more information from others saying it wasn't A TOGGLE like "turn it on" and call it a day. There were flags, compatibility, and other stuff that needed to be implemented as well and kind of baked in / developed for Linux specifically, it wasn't just toggle it on. But I don't know anything so that could be wrong as well.

[@MyouKyuubi]

also "cite sources!" is an appeal to authority fallacy, on top of what you mentioned. :P

[@Stroopwafe1]

It would be nice if Microsoft locked it down, and that they provided an interface for user space to interact with the kernel. Functions like isTrustedBoot, iterateDevices, etc... Basically only functions that give read only data. But from what I can tell, that is not enough to detect malware

[@jamesdanielelliott]

There's a lot of conjecture from both sides. Including you. Microsoft has not excluded removing non-cybersecurity products access from the kernel, and it's a huge stretch to consider anti-cheat a cybersecurity product. Having products that access the kernel is unfortunately a risk to security, especially when they operate similar to the products at Crowdstrike where definition content is updated regularly. I'd say it's a fairly reasonable assumption that many of these anti-cheats work in this way to account for emerging cheats. In any event what they do if anything remains to be seen.

[@brainstormsurge154]

12:37 "Always check the sauces." For sure. Don't want to accidentally use expired spaghetti sauce/code.

[@afroceltduck]

Maybe next time we should wait until Microsoft actually announces what they are going to do, instead of just reading things into what seems to be a pretty obscure blog post about discussions that are happening. Discussions are not results.

[@afroceltduck]

The blog post even states, "this was not a decision-making meeting", that should have killed the article right there.

[@OkerlundTV]

Even if I read the source, I wouldn't have really understood it. I still would have believed the article. But this is why I follow channels like this, to have it explained so I can understand it better. I just switched to Linux about 4 months ago, so I don't understand a whole lot just yet. Thank you for making this video, even though it wasn't what I wanted to hear. :P

[@dashcharger24]

The problem is that companies don't want to support Linux, is because they have to add resources for this. Even with Proton and Valve trying to help you, they think the userbase is too small to gain a profit out of it. The best thing to do isn't buying games from big publishers like EPIC, EA and R*. Buy from independ game developers instead. :)

[@a.lollipop]

was skeptical since the moment i heard this. thanks for sharing the truth, ill be sure to share this video whenever i see someone else talking about this to keep everyone correctly informed :)

[@BrodieRobertson]

Please do, either this video or Gaming On Linux's article

[@gogereaver349]

if they do secure there kernel this kills cheat tools that hide in there removing the need for kernel anticheat anyways.

[@Linuxdirk]

Microsoft won’t ever kill such a feature since i is the only feature which makes them relevant for private users due to game publishers intentionally deciding to not support Linux.

[@JEFF_HVH]

They would never remove kernel level anti-cheats if they make one themselves for Call of Duty 😂😂😂

[@mathesonstep]

Now I read the article and I understand it was way out there because I did go to the source (Microsoft). But I was just really hoping that if Microsoft is working with security vendors that they might rethink allowing Kernel Level Anticheats full stop. I really don't think Kernel Level Anticheats are worth it and I really don't understand why Microsoft hasn't stopped this because games can function without them and banning a Kernel Level Anticheat wouldn't impact business customers at all. I understand why some enterprise grade EDR's need it but I really don't understand why games need it, people are going to cheat regardless and it is far more dangerous if an anticheat is compromised

[@KomradeMikhail]

Once again... BattleEye and EAC games both work just fine in linux. You all just forgot to install the runtimes from the Tools section in your Steam Library.

[@BrodieRobertson]

Game developers need to choose to enable support for Linux, this has nothing to do with the user

[@99mage99]

Some do, some don't. GTA 5 just had an update that has bricked my ability to play mutliplayer on my steam deck because of the anti-cheat they implemented.. You can install the runtimes as many times as you want, it's not gonna work babygirl.

[@CesSanchez]

It doesn't have to be true, it has to be profitable. I mean, the article. You have to write what's profitable, not what's true. That's the only mantra for today.

[@okashiromi5541]

Something interesting to consider is that at some point, Microsoft might need to start relying on those solutions staying linux incompatible to retain its game share. It might be just my personal web algorithm bubble but Linux is picking up steam (no pun intended) and while it's not yet at a point where mcrsft is scared of it, it is trending towards getting there and personally I think they are aware that at this point windows main edge in the competition is software compatibility. So every single game and especially software that starts working on linux is another user base that is no longer captive

[@eagle_rb_mmoomin_418]

Your take on CrowdStrike is pretty daft. Someone essentially made a coding error with an unexpected parameter in a set of data overrunning a buffer. The same code exists on Macs and Linux and didn't fall over...Mistakes happen....I'd argue incidents like these are a wake up call. Better a mistake vs a real cyber resilience incident in an attack. Crowdstrike have had huge reputational damage and come renewals will take some major hits anyway. They have done enough damage to themselves.

[@danielgrezda3339]

While this isn't killing it, I think Microsoft is definitely moving to it with this plus the cloudstrike fiasco.

[@chrisbecke2793]

I don't care if it's anti cheat, if its kernel level is must go.

[@Problematist]

"Nothing ever happens" bros keep winning, sadly.

[@minkinayu]

The 'EAC' logo on the preview is the Eurasian Conformity mark, not Easy Anticheat logo

[@hrmny_]

I hope with "people need to lose their jobs" you mean the C suite Otherwise that's just toxic, the developers working there might not have the freedom to do what they want It's pretty much never the fault of a person, but rather the company culture

[@seancondon5572]

I do not think anyone was lying per se. Just hearing what they wanted to hear, and publishing what they thought they heard... effectively jumping the gun. As media is wont to do, they publish they sensational piece, because that's what sells.

[@riche7846]

I think its just a case of media illiteracy. People are too hyped for something to be true, they skim articles, and assume what i means and it goes down a chain. Idk if its the fact theres more people in the space, or if generally we gotten too used to the internet but its been happening A LOT more often nowadays

[@Iswimandrun]

Windows security update process was getting exploited in the wild to roll back security patches just works like it's supposed to.

[@-yttrium-1187]

You dont have to lie to tell someone what they want to hear. A trick that marketing and journalists understood decades ago. Though one's paycheck entirely depends on them failing to understand it.

[@BlackMage_01]

What is more likely is that these modules will need to remove certain features, but will still have kernel access. For instance, I forsee Vanguard losing its "must not be stopped and starts up with the computer" BS. that is most likely going away. But Kernel level anticheat isn't going anywhere, not from this.

[@sxgamingz7514]

Believe it or not it wasn't Microsoft or Crowdstrike's fault for the outage, When code passed internal testing , the testers didnt know that the file had been nuled

[@darylandcat]

These intrusive anti-cheats have got to go. They have been messing up computers since the early 2000’s with StarForce copy protection. Trackmania anyone? Installing that way back in the day would essentially disable certain CD drives. Ring zero drivers are a huge no go on my systems ever since that debacle.

[@szaszm_]

Brodie saving the day again by doing actual research instead of just mindlessly reposting the same BS as everyone else

[@BrodieRobertson]

If only, big channels like Low Level Learning also fell for the bait

[@mcerny04]

I think that they're going to encourage doing the right thing and moving to userspace. But leaving the kernel option there.

[@anon_y_mousse]

Again I'll say it, but this is why I don't play games with AC. Most games I play are single player anyway, and most of the multiplayer games I play are open source, but I do play a few closed source multiplayer games.