Comment by bigyabai | Hacker News Reader

Comment by bigyabai | Hacker News Reader

Parent Full thread

> Steam Linux does not supported sealed/signed boot with secure attestation

Even if it did, you wouldn't stop DMA cheaters from hacking the game. This is the slippery slope we see on Windows with Ring 0 anticheat being defeated with spoofed PCI hardware.

That’s nice, but 99% of cheaters (pre-Win11, anyways) were software-only because the software is $0 with free same-day delivery. Turning off the spigot of pure-software cheating almost entirely empties today’s cesspool, which is partly why Windows 11 requires an TPM, and it won’t refill rapidly due to the simple obstacles of hardware product businesses.

I know that Nvidia’s been implementing attestation for the PCI links to AI GPUs recently, and iirc USB has supported it for a while now (though I’m not sure whether USB-IF has formalized it). I would be shocked if there isn’t already a DDR standard for same coming up in 6 or 7. It’ll take a while to for all this reach the consumer market but the alternative is, as you correctly observe, the gradual decline of trustworthiness of not only attested Win11 gaming PCs but also gaming consoles — but emptying the cesspool of the software cheaters in the meantime remains a sensible step to take.

See also:

https://ieeexplore.ieee.org/document/6258448 (2012)

https://memlab.ece.gatech.edu/papers/DSN_2023_2.pdf (2023)

https://pcisig.com/blog/ide-and-tdisp-overview-pcie%C2%AE-te... (2025)

https://docs.trustauthority.intel.com/main/articles/articles... (2026)

You're conceding my exact point back to me. Linux-compatible anticheat uses many of the same pre-TPM measures that Windows 10 used to combat software cheating, and prevents the 95% majority of software hacks and process injection. The remaining minority of cheaters cannot be stopped on Linux any easier than you can stop them on Windows. Both OSes have escape hatches that cannot be easily closed.

Which is why I said, even if Linux enforced TPMs, secure runtimes and signed kernels, you'd still be loading firmware blobs and trusting HID/PCI hardware just the same as Windows. Linux would still be attacked, singled-out and made a pariah regardless, so it's good that Valve and the kernel devs generally ignore these design suggestions.

Prediction duly recorded. I sure hope you’re right, but I’m too cynical after decades of ‘ignoring attestation makes the underlying problem go away’ from my Linux peers to consider a positive outcome likely.

Now I'm wondering if launching windows through a VM would allow me to play those games.

It does; I play games backed by Easy Anti Cheat on a VM Windows running on Nix. It does require fiddling with the settings to make it look like you’re not in a VM, but completely doable.

Look up a list of games that require secure boot; consider whether your VM has secure boot enabled or not (UTM on macOS has a pref for it inside the VM UEFI settings, for example) and consider whether the game(s) you're interested in require it (I believe there's maybe a dozen PvP games so far that do).

Reply on news.ycombinator.com