Gaming on the GNU/Linux operating system.
Recommended news sources:
Related chat:
Related Communities:
Please be nice to other members. Anyone not being nice will be banned. Keep it fun, respectful and just be awesome to each other.
Funny how you can create a microkernel only to then fuck up privileges so bad that software (e.g. graphics drivers, anything running with real-time prio) can easily crash your system without recovery.
The architecture of Windows is both, remarkably good and weirdly underutilized.
Double win for linux
I have no problem with this.
Norton AV causes SO many issues with the software our clients use for home automation.. And not even issues which make sense. And so many AV apps cause nothing but problems
If they need low level access, they can request a userspace API from Microsoft and wait for it.
Probably a good move for them to make tbh. I like how CrowdStrike's name already sounds like it should be the name of a big malware/virus/zeroday. So we should have seen it coming.
They're going to implement something like eBPF for the Windows kernel. This will allow kernel-level modules to run with zero risk of crashing the kernel. If the module fails, it fails without taking down the kernel with it.
Linux already has this. It works great. If Windows gets this, all antivirus and anti-cheat software is going to have to transition.
Once that happens, it will be way easier to add anti-cheat software to Linux that operates the same as on Windows. It may be possible to load and unload it only when playing and actually having competition-grade gaming on Linux.
Of course, this is a security disaster that I wouldn't allow on any of my daily drivers, but I would enjoy playing Destiny on my Steamdeck if there's a legit way for me to do it.
According to wikipedia, both Windows and linux have it, and both are open source.
Believe it or not, a lot of companies, no matter how cool and secure their marketing sounds, are just seriously incompetent.
Microsoft is the Windows ME of corporations
At least windows ME was green.
I remember the screen always being blue on ME.
Imo, third party companies just shouldn't have access to the kernel level. Someone is always getting hacked, and having this level of access to potentially hundreds of millions of computers is a huge risk. Especially if it's for something trivial, like anticheat in Helldivers 2.
Enterprise level AVs are going to sit in the kernel so they can watch for anomalies in the OS. There are better EDRs out there than Crowdstrike, and virus definitions are an outdated way of detecting anamalous behavior anyway.
Yeah, those security agents can become attack vectors themselves, so running them kernel level is nuts.
and let someone into the kernel,
Problem is, that similarly to invasion of privacy, this is not visible, and so they don't understand what's happening. It's just one more program, what could happen? It's not like somebody coming and inspecting your house, in that it is not noticeable in practice.
@ReversalHatchery , I completely agree. My ring 0 is sacred and I can't prove there isn't anything in it already, but I wouldn't knowingly shove third party stuff into my kernel. I like to keep my apps restricted from anything they don't need on my system in userland. However, millions upon millions of people installed Tencent's Vanguard to play League of Legends like it wasn't any big deal (it is). If people want an inner ring security module, I suppose that's a bit their choice. 🤷🏽♂️
@mudle somehow, I don't think that's the way to resolve future problems, it just looks like Apple's way, which sometimes isn't great for customers
You have a point, but if Microsoft completely locks down the kernel, preventing any third party software/driver from running at the kernel-level, Anti-Cheat developers will have to find a new way to implement Anti-Cheat. This may open up the possibility of some newer form of Anti-Cheat being user-space; or at the very least NOT ring 0, which in-turn may open up the possibility of this new form of Anti-Cheat working underneath Linux.
Or maybe we're all still screwed because this new form of Anti-Cheat will perform on a basis that trusts that there is no third party access to the Windows kernel because of how restricted it is, therefore nullifying the need to be ring 0, but it still might not work under Linux due to the freedom/access users have to the kernel.
But then again, in order to implement any third party driver into the Windows kernel, it has to be signed and/or approved by Microsoft first (IIRC). But cheaters get around this through various means. So maybe nothing changes; but if Microsoft DOES restrict kerne-level access, this leads me to think that Anti-Cheat will have to change in some form or another, which may lead to it working on Linux.
TBH, The only way(s) I see Anti-Cheat moving forward at all, is:
@mudle btw afaik Valve's working on AI anticheat, which analyzes player's behaviour, I think nowadays that would be the most viable direction for non-kernel anticheats
I completely forgot about AI Anti-Cheat, lol. But yes, this is another form of Ant-Cheat that seems to be very effective. (Although I don't much like the idea)
@mudle well, AIs are usually controversial because they are trained on scraped data, but I don't think that this may be an option for video games
yes please. NO third party should have ring 0 access to your computer.
bonus: no kernel level anticheat to fuck with linux users
Why not have a structure in place that has Microsoft review/test code from third parties. At the end of the day it is Microsoft that took the public hit so they should be the last line of defence in this process.
Those that wish to have their code sit at the privileged/kernel level should either pay up or supply Microsoft with resources to do the tests Microsoft would require.
What shouldn't happen is third parties doing their work at a privileged level without the oversight.
If I understand it correctly, it already has been (at least formally) reviewed by microsoft before signing and allowing that signed code run kernel-mode. But the crowdstrike's driver module was not just running malware scanner on itself, it was interpreting what is basically unsigned code that was easier and faster to update. This unsigned files were the ones containing faulty update.
At least that what I understand from https://www.youtube.com/watch?v=wAzEJxOo1ts , it may not be entirely correct or I may have misunderstood.
But if it is true, it may be more sensible to make an API so software with specific permissions could access information needed to effectively function as antivirus, without being run in kernel mode.
But if it is true, it may be more sensible to make an API so software with specific permissions could access information needed to effectively function as antivirus, without being run in kernel mode.
I've come to this conclusion as well. I believe Apple has similar functionality with their "kernel-extensions", I believe it's called.