Remote Code Execution like loading DLLs from a server and executing them sounds like malware.
It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha.
https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo...
Google and NSA have a "partnership".
Valve could also have such partnership in theory, through VAC, though unlikely in practice.
They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.
In all seriousness, DRM/anti-cheats => rootkits/rats. Don't fall for it. Demand better.
To my understanding, the latter is much more effectively solved server-side, but is more costly for the company to run.
I'd rather play a game with server-side anti-cheat than player-side-anti-cheat.
CS:GO actually have heuristics and ML to flag cheaters server-side, but that's only another line of defense - the majority of defense is on the client-side anti-cheat. It's called VACnet, and its bans are temporary - most likely because of false positives.
It's unfortunate, but it is how it is.
Separately though, anti-cheat is another ball of wax entirely, and I have extremely mixed feelings in this field. Generally I favor "cheat detection should be serverside, don't trust the client" from a general security perspective, but... I can totally see a valid case in there, somewhere, for more rigorous clientside checks. Somewhere along that line though is rootkits and malware, and... well, no, please tell me up front that you loaded your game engine with these things so I can save my money and purchase something else, thanks.
[0] Using a custom mapper, which will help initially to discourage low-effort bootlegs at the very least. It's open source though, and will not be too difficult to add to emulators, at which point the dumped ROM should play fine on them.
Yeah...
The simple fact is, it's simply not possible to have completely server-side cheat detection simply because you'll be relying purely on heuristics which could very well be wrong. It's just not going to be possible to tell the difference between a cheater and a really good player.
For any cheat detection to work, it has to be client-side.
Client-side cheat detection can work for tournaments, but it's way simpler there: the tournament provides the hardware, and the players aren't permitted to install anything. This doesn't irritate me quite as much from a security perspective of course, because I am not about to log into my banking site on the presumably insecure tournament device. It's also imperfect: a sufficiently motivated pro player might bypass whatever locks you installed on the thing, especially if they get to spend any time with that device unmonitored.
Even better than that, tournaments have a way better cheat detection method anyway: point a camera at the player's hands. It's suddenly really, really obvious if they're cheating!
At least for competitive AAA titles I don't see why there couldn't be a daily update of the core binary. None of the assets would change so it wouldn't be a large update by any means. In effect it would prevent cheating by imposing impossible work and latency requirements on the tool authors.
The cost of doing this is employing at least one person with deep compiler knowledge who is capable of maintaining the automated system. Obviously that's far too much to ask of indie devs and is probably also out of reach for older titles in most cases.
This is of course all aside from the obvious and common sense but more expensive solution of player flagging, human review, and a binning algorithm (such as trust factor). Avoids needing to ban anyone in the first place and has the added benefit of being at least mildly effective against computer vision based botting solutions (for which there is fundamentally no solution).
Or just private servers and let the individual admins sort it out but god forbid players be permitted to run their own communities corporate might lose out on profit if that were a thing (can't risk another DotA after all).
It is no coincidence that America and Japan, the two countries with the most draconian copyright protections, continue to be the dominant player in the game industry.
Profit motive and the ability to reinvest previous profits into future products is the greatest force multiplier in our planet’s history bar none. You can either suck it up like China did in the 90s and convert to a capitalist economy, or stay in the breadline forever. Oh, in this case, I mean play tux racer forever :P