Comment by dijit | Hacker News Reader

Comment by dijit | Hacker News Reader

Parent Full thread

I work in gamedev.

A kernel module is easier to make on Linux than on Windows.

The only person who would say otherwise has clearly never written anything on that level on Windows. It's not just uneasy: it's Sisyphean. The code-signing signature you need alone is an order of magnitude more difficult to obtain than the development burden of an appropriately defensive kernel module.

We gamedevs don't even need "full control", just a moderate amount of checking for tampering of our application memory and a scan of the proclist and device tree. It's like, not much. The reason it's in the kernel is because we need to get "under" the cheat engines so that the OS doesn't lie to us, linux doesn't make that aspect harder or easier, just different.

Easyanticheat already supports Linux if you enable it in your Epic developer settings. The limitation here is that developers know that gamers are mostly running windows so the support burden isn't worth it.

For now.

> A kernel module is easier to make on Linux than on Windows.

That's cool, but you can't enforce that the rest of the kernel hasn't been modified with that kernel module. You need a chain of trust.

> We gamedevs don't even need "full control", just a moderate amount of checking for tampering of our application memory and a scan of the proclist and device tree. It's like, not much. The reason it's in the kernel is because we need to get "under" the cheat engines so that the OS doesn't lie to us, linux doesn't make that aspect harder or easier, just different.

Windows requires drivers to be signed. Just because you wrote a Linux kernel driver, doesn't mean that when I run it, that you can trust it in any way.

> Easyanticheat already supports Linux if you enable it in your Epic developer settings. The limitation here is that developers know that gamers are mostly running windows so the support burden isn't worth it.

It doesn't support it with KLA. Bypassing this kind of anti-cheat on Linux is relatively trivial compared to windows with KLA.

> Windows requires drivers to be signed. Just because you wrote a Linux kernel driver, doesn't mean that when I run it, that you can trust it in any way.

There is a lot of signed malware for Windows.

There's not much Kernel Level malware singed in Windows (drivers have more scrutiny for whatever that's worth). Regardless, the point is that companies using KLA rely on the relative difficulty of circumventing protections implemented in a signed kernel, running signed drivers, on a machine where there is some chain of trust.

You don't need to take my word for it, Tim Sweeney said it himself (using dirty innuendos and weasel words, but anyway). EAC supports Linux, but doesn't utilise KLA (for many reasons), and doesn't make the same claims about protection as it does on Windows.

Reply on news.ycombinator.com