Hacker News Reader

Comment by gbrown | Hacker News Reader

> Unreal Tournament 99 though, has plenty of servers that put some dlls for "anti-cheat" software on your computer before you join.

People put up with that?

View on HN

For reference, the anti-cheat plugin usually used by Unreal Tournament servers is AntiCheatEngine ("ACE")

https://ace.ut-files.com/index1a8f.html?p=about

Battle.net has been doing that since day 1, so if you played any game on Battle.net you have downloaded server provided code and executed locally with the privileges of the user running the game.

(when a client connects to a battle.net server, one of the early handshake steps is to download a fixed named MPQ file, which is a Blizzard proprietary archive protocol which contains a DLL that is loaded and a certain fixed named function runs from it, which will checksum your client binary and send the result to the server to compare and allow you to progress further)

I think there's a big difference between the game downloading a DLL straight from the game developers (not all that different from an update) and a game downloading a DLL from a random server you join (that could be run by anyone that you have no reason to trust and that you don't realize you're giving them full read-write access to your computer).

Exactly. Neither is ideal, but they're not exactly equivalent...

People are defending Riot Games installing an anti cheat driver, so that's not very surprising if you ask me.

Not just that, the driver starts on boot and stays running even when the game isn't running.

And removing the game doesn't remove the driver. You have to remove it separately.

Better than putting up with cheaters ruining the game.

Even if you actually believe this, Riot is not known for their high-quality code. This sounds a bit snarky but is entirely serious: Giving games root rights is bad enough, I absolutely don't want to run anything in kernel space from the same people who wrote the client for League of Legends.

And it's not even about trusting that Riot are not bad actors, tencent conspiracy nonsense aside, it's about leaving that trash running with that level of access in a way that some malicious process could use to elevate its permissions. That is the (ab)use case that worries me.

As someone who plays CSGO, I agree with you. I wish valve did something like this. I'm tired of matches getting ruined by cheaters, which happens very often.

Reply on news.ycombinator.com