Should VAC Be More Invasive?
ฝัง
- เผยแพร่เมื่อ 6 พ.ค. 2024
- Would VAC be better if it had more access to your system? If it was always on? I ATTEMPT a reasoned look at a topic that I'm sure everybody is all sith about
0:00 - Kernel access?
1:16 - DRM
2:28 - Upholding VAC's reputation
4:55 - Beyond ring 0 access
6:17 - MONEY
8:50 - A different approach
MUSIC USED:
Digadig - • Digadig
Atomic Amnesia MMXX - • Atomic Amnesia MMXX
Caboosing - • Caboosing
Wistful Winds - • Wistful winds
Cruising the Countryside - • Cruising the countryside
Crossing Those Islands - • Wistful winds - เกม
In South Korea, cheaters could be punished with up to 5 years in jail or fines exceeding $40,000.
Dear Lord
It also requires everyone to sign up for online play with an id. Considering the fact that americans are opposed to even having an id card in the first place, I have a feeling it won't be a possibility.
based
@@suspecm6316 No ID, but SSN and drivers' licenses (of differing levels of IDness dependent on the state). And it is changing, like with the real ID changes to licenses in the US. These are still not the same as an actual ID, but getting closer over time.
You should get 5 years in jail for not cheating in video games
Even kernel based anti-cheat can be bypassed with hardware devices and increasingly sophisticated methods. Obviously the barrier for entry will be much greater but the cat and mouse game will always live on. The drawbacks of essentially having to bundle a rootkit with your game should not be taken lightly.
can, but it happens so much less often its almost a non-issue
Yes my cousins cheat in valorant regularly. People don’t accuse them cause they think they’re smurfs. I think people in valorant think it’s a non issue so they don’t suspect it.
that why i dont play valo cuz i dont want a stick all the way up my butthole
This is a bot comment, isn't it?
@@evan12697 it's only a non-issue right now because it's unnecessary. as soon as it becomes necessary to continue cheating, it will become an issue.
No. Back door callers aren’t just tinfoil. The kernel is serious fucking business. You create a back door just by having a bug - it doesn’t have to be intentional. Valve doesn’t want to put that in ppls computers because they’ll be responsible for
developers should avoid kernel level anticheat at all cost, simply because Linus Torvalds will murder them in their sleep if they implement it.
crap the reddit sniper moved to youtube!
Big hack things happen all the time in the world of software. Its just ignorance I think.
AMD and Intel CPUs all have backdoors. Throw away your entire PC bro!
@@MrKarlhub405then you just haven’t been paying attention. In a recent Apex legends tournament, in the middle of the tournament, a player’s computer was compromised through a backdoor in the anticheat. This stuff does happen. The more games with kernel level cheat detection, the more common this will become
Kernel level AC is simply annoying, doesn't allow you to install ReShade, or mod the game at all and if you have some non-standard stuff like Process Hacker (misleading name btw, it's better task manager) installed they throw a fit, quite often even when the program is not running.
And the best part is that it has, well, kernel level access, why is that an issue?
A) The developers have complete access to your PC and since it's not open source, you don't know what it's doing or what kind of information it might be reporting to the company
B) if the developers fuck up, they just created a possible attack vector that can be used by malware to infect your PC in the worst possible way
the word hacking in its original software development meaning meant "fiddling with" or "messing about" software. process hacker stems from that culture :D
considering Valve has repeatedly allowed RCE exploits to exist in CSGO, CS2, and TF2. i pray to god it does not get kernel level ac.
I expect very large cyber attacks thru these anti-cheats to happen one day. Some people are already working on it for ransomware.
Companies spy on you everyday and sell your information, this isn't new information. If it stops rampant cheating it shouldn't be an issue. Of course there will be drawbacks with kernel level, but with a game being virtually unplayable its a step that should be considered,
Then can you do all this while turning off the AC? I mean you will only need the AC when playing the respective game, right? Why keep it on all the time?
StarForce actually bricked my Windows 7 PC when I installed an old game that required it. Only after a full reset the PC worked again. It's real
Same Windows 10 after installing Toca 3 not remembering some DRM can destroy the boot instructions..
If you could reset it, it wasn't bricked(sorry i couldn't help myself)
yup,recently bootlooped my win10 after installing cmr 2005 BUT there is a quick fix, while in system repair mode get into the console and remove starforce driver files from system32
@@somenamethatdoesntmatter It's pretty hard to brick bios, but bricking a os is still bricking
@@somenamethatdoesntmatter it's ok
If history has taught us anything, Valve will never take a simple, temporary solution when they think a more permanent solution is on the horizon. Valve time can be a bitch, but it often pays dividends.
exactly. and the people who shit on valve during this cs2 crisis will dickride them the hardest.
you mean just like their subtick networking still isn't better than regular 128 tick?
@@89gauna but it's not worse either, so who even cares rn?
If history has taught us anything, VAC = Valve Allows Cheating. We all know 3rd party cheats with spinbot can be played for weeks, months or even years without ban, but now there is more permanent solution as sv_cheats is back on official servers. No need to use 3rd party dubious soft, just use a proper command!
And they made it free to play so even if you somehow get banned, you can just create new account and go back to cheating in no time! Classic Valve.
if valve has tought me anything, its that they will make the best gaming experience and then completely abandon it (tf2, episode 3)
My Linux is allergic to invasive anti-cheats
can't believe they killed battlefield 5 recently with new update
@@TehObLiVioUs maybe it is because hacker is word for both, cheater and software developer and most software developers are coding for GNU/Linux🤣 EA is a company of dumb people, they did not only killed online, but they killed single player with anti-cheat too 🤣
thats why ur linux aint getting games made for it lmfao
@@grubo8884 Oh god the horror i can't play bad shooters with lootboxes, cries in rpg
@@SpyrosFilippopoulos i didnt know tux racer is an rpg
As a Linux user, I ideologically can not accept kernel level anti-cheat unless I can run the game in a virtual machine without the fear of getting banned.
Wouldn't matter anyway with us Linux users, we can modify the kernel, so we could just modify the Linux kernel to lie to the anti-cheat.
@@Spartan322 the anti cheat can check cryptographic hashes to prevent that, or require using a 'known good' kernel only
@@mega_gamer93 That only works if you can't modify the kernel.
this is the real answer to the problem though, both AMD and Intel have secure VM implementations meant to run enterprise crap in untrusted datacenters, and most windows machines already run on Hyper-V. just put the Xbox game OS on it, figure out how to pipe peripherals and audio through a pipe and run all your broken game code somewhere I don't have to worry about it, and where cheaters can't just DMA in
And you think cheaters wouldn't do the same? What's the purpose of a kernel level AC then???
At this point I just don't believe they have anything. The insane spin botters and fast shoot isn't even being detected when it should be so easy, they even banned people for spinning mouse too fast absolutely insane
They disabled it to collect more data for AI. I'm 100% sure
@@hehmde at this point there are more bots than players
And people bitched and moaned about it, I wouldn' t be surprised if the backlash is what got that feature disabled. Though in my eyes if you want to pretend that you have a spin bot then you might as well be treated as a spin bot. Kind of like if you wave an airsoft gun around in front of police, I am pretty sure they will not care that it was just a toy gun, it's indistinguishable at a glance (this might not be understandable for a few country residents if in yours there is a restriction that the muzzle has to be painted orange or blue, there is no such requirement elsewhere) from a real gun so you get treated like you are carrying a real gun.
It’s currently a honeypot situation they are collecting cheat sigs a ban wave will likely happen when they are ready
@@hehmde The amounts of copium you are inhaling is astonishing
One problem of kernel level anticheat besides the unnecessary access level on your pc, is that anti cheats are softwares, and EVERY software has vulnerabilities, meaning that if one day vanguard get “hacked” or anything, the person/group behind this would have TOTAL control of your machine, that’s why every single person that cares about cybersecurity hates it. It’s effective, but there are another ways you can do the same thing but without kernel level access.
"every person who cares about cybersecurity" yeah. those people don't work in it. its pretty obvious you don't need "muh kernel level" to do damage to someones livelihood. even user level access is enough to do that. And elevated access (so any program in ring 3) can install a driver which is kernel level, so it makes no difference to where it starts
@@mevgayming There is a difference though. Full access allows much more...
Hackers usually don't do shizz to ruin people's livelihood, they do it to earn money... Having FULL access to someone's computer gives you more methods to be able to earn money, and you'd be able to skip anti-virus software, as well as software firewalls on the computer.
It makes quite a significant difference where it starts.
@@mevgayming yep, thats also correct, but having any kinda of software with kernel level access is like having a big target on your head, it's easy to have control of anyone machine, but if you are cautious, you are at less risk. Obviously it's not easy to gain access to any software like vanguard, but it's just another way for you to be in "danger".
@@SioxerNikita if you have ring 3 admin access you can just elevate to a kernel driver...
@@mevgayming Not just "just"
>Install super invasive spyware "anticheat" software to play your favorite online game
>Game dies after 11 months when either the sequel comes out or the studio goes defunct
>No support causes exploits to be discovered
>Exploiters get through the back door
>Because the spyware can't be uninstalled without rebuying Windows, most users keep it on their systems
>Everyone who has it installed instantly gets malwares, trojans, and other viruses put on their devices and their identities stolen through backdoor exploiters
>Even if you installed the spyware through other games, you're still affected
>The twelve billion page EULA has a clause in Chapter 112, Section 81, Paragraph 14, Line 57 that clearly states they bear no legal responsibility should just such an exploit occur
>No one can do anything about it
>Studios who make online games still continue to add the spyware in, despite everyone knowing how broken and useless it is
>Be Denuvo
Wrong website
@ceciliacole5098 you clearly have NO IDEA what are you spewing at all which it's so sad 💀
just stop buying these games, holy shit, the #1 reason why gaming is so shit nowadays is because people can't help themselves from coooomsoming non-stop...
@ceciliacole5098who stores passwords in plain text? lmao
holy crap the text actually turned green guys
There's literally 0 reason to play official matchmaking right now. You either get people who are rage hacking from warmup, or toggle when they start losing or think you're cheating because you're doing better than them. Had back to back games last week where 2 guys were spinbotting from warmup at 11k and then the next game someone toggled because I killed 3 people in a 1v5 and then lost the round, but apparently the shot I hit on them was hacks. Guy didn't even have to leave the game so he was already injected, either turned them on or ramped them up because he was hittin them scout headies. When I called him out he just said he learned it from me, implying I was hacking. Uninstalled, no point.
i was queuing 4-man on vertigo a couple of weeks ago. i got an ace ct pistol round, instantly called hacks. at least two enemies toggled, and do you wanna know how we found out for sure? because the 5th player on our team, our random pickup, had walls and told us what they were doing. jesus christ.
I remember this in CS go, I played on global and people would just increase their hacks if they saw you were too good.
Go professional 😊
Good on you, do something fun with your time :)
This is a really well put together video and I feel so happy to have someone like you in the CS community, who isn't just here for publicity stunts and to seek attention by being the loudest at saying the current popular thing, but rather constructing your thoughts in a way that's a lot more mature.
Yup, I agree. I feel like hackers are going to be a problem, and the VAC/trust system/Overwatch are great ways to combat hackers, better than Vanguard.
I have been playing Valorant a lot recently, and the number of hackers there has increased a lot.
wow what a nothing statement with mo proof whatsever, give it up man valorant has less cheaters than cs. I even have to say that and i hate that game
@@Iluvxi Very immature reaction from most of the CS community imo "valorant less cheaters, cs more cheaters, meaning valve lazy money grabbing fucks this game is dead". This video is more than that. It's not an excuse as to why it's the way it is, neither is it denying that things are not working right now, even in the slightest. But the situation is more complex than whatever answer a big part of the community is looking for, and this video does a great attempt at explaining that said complexity.
And jumping on the hate wagon and making another video titled "I QUIT (THE STATE OF CS2)" for attention grabbing, is not going to help anyone
We also know that valve is very much aware of the problem and it's their number one priority to solve it. So this horrid state the game is in right now is most likely not going to last too long.
@@ynelcs
TBH I've had more of a cheating problem in games with EAC than CS2 recently. Granted it was abysmal at launch & even a while after it was pretty bad but I've had more consistent good matches where if someone was cheating, they're not doing it in an obvious way like they use too.
like, if you even watch those people that's only your L
Phil, pls save surf. All the servers are dead. What can be done? Possibly make it a main menu gamemode?
you can use external sites like xplay or cyberchoke. they work great for me. but there are still some bugs...
Making it a main menu gamemode as a niche gamemode is frankly silly... Then other custom gamemodes would also demand it, etc, etc.
thats actually a pretty good idea like how tf2 has alt gamemodes in its matchmaking
@@SioxerNikitawhat are you talking about, how is having more gamemodes in main menu a bad thing
@@SioxerNikita arms race was quite niche before they added it to the main menu.
Other gamemodes aren't as iconic as surf, but even if they were to demand a spot on the main menu, who cares? Hell, i'd love to see minigames, jailbreak, and such on the main menu.
It's a pipe dream, but i sure hope they care enough about surf to keep it alive.
Let’s see, we’ve got EFI cheats, DMA cheats, and custom microcontroller cheats. While a kernel level anti-cheat may be effective at raising the bar, it’s not perfect.
Its also useless on Linux, you can just add to the Linux kernel to lie to the anti-cheat so it thinks you're always legit.
My man, the people who have those kinds of cheats are an extremely small minority. So small that you shouldn't even care about them. VAC literally allows public cheats downloaded from some obscure forums to work with no problem. A kernel level anticheat would solve this problem instantly. That is why Valorant appears as having no cheaters, because Vanguard actually works at banning kids who use public cheats, which represent the big majority of cheaters.
@@grigorecosmin kernel level doesn't make an anticheat good, it just gives it higher priority, valve could make VAC a lot better without actually making it have kernel level. so idk why you think that there's a miracle that suddenly makes all cheats disappear, pretty much everyone that has basic knowledge of how anticheat works hates kernel access ACs
@@Spartan322there's secure boot but then you dog nvidia users because their driver is a proprietary addon that has to be self-signed
@@maisatanel I don't dog Nvida for anything, only thing I hate about them is their unwillingness to cooperate with OSS.
No. You do not need to access to my entire system for a *video game*.
never stopped anyone. Look at Valorant. Look at Genshin Impact ffs.
any game with EAC (Apex, DBD, etc) even our beloved Faceit AC have access in kernel lvl so why not VAC?
You’re already doing this when you install software as admin lmao
Then No. You don't have the right to complain about cheaters.
@@nicky4092 -EAC is not kernel level AC.- "Others do it, so it's okay if I do it too" is not a valid argument.
1:17 I'm really glad we're back to non-painful audio levels with this track
Digging into the meme is great once, afterwards I'm watching all of his videos at 10% :c
We’re not caboosing with this one 🚂😔
blursed profile picture
I think that the plan to use AI to detect cheats is a really smart move, considering that most players can accurately spot a cheater just by looking at their POV, if you had an AI that basically does the same thing but without having to enslave people for it to run consistently, than you'd have an amazing anticheat that doesn't require any crazy file access.
That wouldnt make the anticheat amazing, maybe for a short term. There is already something called 'legit cheating' which are cheats used and makes you look very legit that even an expert would have a hard time to say if hes cheating. Anticheat will always be a game of cat and mouse and just like richard lewis said, there wont be a 100% detecting rate anticheat ever. Maybe less people would cheat but cheaters forever will be there just like crime in a city or corruption in government.
AI has a lot of false positives and false negatives tho
@@supermarkethobo9567no it does not.
And to avoid that they just don't turn it all the way up. It's not impossible to get it in a state where false positives are almost 0.
@@supermarkethobo9567 doing an overwatch 2.0 by human reviewing cases that was flagged for cheating by AI can help with that. besides, pretty sure valve already has a giant datapool of legit cheaters for it to learn from
@@piscessoedroen problem with it was that cheaters started messing up overwatch with false verdicts making it basicly useless
not sure if you used it before, but thanks for including "Cruising the countryside". first time i've heard it and i absolutely love it
h
@@mat1jaczyyyh
Starforce actually did manage to shatter a single cd(completely destroying the reader in the process) once. I suspect cd was already damaged a bit though but it did happen. It was a game borrowed from a friend and when I told him it exploded he did not believe me.
Hopefully there won't be any Cabossing business in this video.
Edit: it happened sooner than I thought.
we love caboosing in this household
I don't even notice it anymore, unless it rapes my ears.
what's cabossing?
@@rose_allen a song that phillip uses which a lot of us like, but a few really hate.
It's usually brought in really loud, and quiets down after that.
@@killingtimeitself ah ok, explains why web searches didn't help.
While I understand why people want aggressive anticheat to combat cheaters, I hate giving anything kernel permissions. I don't think people understand just how insane that level of access is. The administrator/root account has fewer permissions.
Since most cheats run at hardware/root level then they had no choice but to get on their level to combat isn't? Althrough its still bypassable, literally cat and mouse game and whenever evil company like valve gonna do something with that root level access.
if I were CIA and needed rootkits in many many PCs, I would definitely make Faceit secretly do it for me.
the fact is 90% of the player base dont care if they put in kernel anticheats we just want the cheating problem stopped. Valorant has it and millions are still playing, cs2 will die out mm is already dead if this continues.
Also in the 500 games of valorant up to immortal i havent met anyone blatant or like i felt is cheating whilst in mm it happens litterally every single fucking game
@@ijustlovethisname And you don't see that as a problem? 90% of people would be perfectly okay with giving up full and complete access to everything on their computer? That's a lack of understanding on their part. Kernel-level anticheats can and have been vectors for malware.
@@Jmcgee1125 No I don't see it as a problem, because I trust valve to hold my information safe and not abuse it also theres tons of other games which uses this type of AC because it works and VAC is useless, its time they implement it.
GW1 map ! 9:20, let' gooow, great stuff btw keep doin this !
or for a few lines of code you can detect someone spinning whilst getting 100% headshots with a fully automatic scout
4:10 made me actually laugh out loud. The timing and everything. Best TH-camr
I play on a Mac using whiskey bottle and I don’t think vac would like it if it was kernel level
macos isn't supported in cs2
@@baiatulputernic2698 that's why he said he's using whiskey bottle.
to clarify, whiskey bottle means he's running a wine container on macos ARM (Apple M series processor are ARM)
.
same goes for Linux
@@kajojo2399 no, cs2 supports linux natively (no wine or anything like that), with vac! Valve also has steamos and if they made a kernel AC it would have to run on
that aswell, I don't think they would drop all the work thy put into linux just like that.
short answer: no
longer answer: nothing should have kernel level access. its great power that I've not seen anything yet have the correct responsibility.
yea the big problem with Kernel access is if someone cracks that system the whole F****** network of cs2 could collapse overnight
@@kurtpunchesthings2411Just make the system secure enough like with Valorant.
@@kurtpunchesthings2411tell me about one case
@@kurtpunchesthings2411 then make it so its not gonna crack like every other popular game. valorant, fortnite, rust, rocketleague, or even faceit.
@@colbzyk2128 Not sure about fortnite, rust or faceit, but rocketleague doesn't have kernel level anticheat
I love your deep dives on these strange topics :)
CS2 is going through the TF2 problem, just with extra steps. The funniest thing is both games can win if they just use community servers.
The only way that everyone would permanently play on community servers is if matchmaking was removed, which is never going to happen.
I have great amounts of shadenfreude
community servesr have always been a big thing in tf2. What u mean?
You know, TF2 actually updated the game for 64bits and the bots are gone (for now)
@@zeeko6836 Not when Valve added matchmaking, it basically killed 90% of all good community servers.
quick answer: no, gaben shouldn't have ring zero access to my windows kernel
why not - you let tencent have ring zero access to your windows kernel 🥺
Agreed.
@@truestbluu
a) you do not know that, you dont even know if he isnt a linux main
b) giving an anticheat kernel level access makes almost 0 difference
out of all of the people I would like having kernel access, gaben is one of the few people I'd allow
I like gabe but I also don't need him in my linux kernel aswell.
Moreover, I don't beieve kernel-level ac is a perfect solution, it's invasive and imo it doesn't work good enough to justify it.
Thank you making a video addressing the issue. Don't know if it's a region thing but being put in Singapore servers it feels like more games have hackers than not, not in a salty way either as most the times the hacker/ hackers have been on my side (I just want a clean game).
To add onto it, I'm from Aus, but get 5 better ping to Singapore and can't do nothing about it because Valve offers a ping restrictor, not a region selector. The last 3 region blockers I've installed don't work and have pop ups that say "valve/ steam has reset server options"
One of my favourite examples of anti-piracy is when an audio plugin added it and it slowed everything down and made everything significantly bigger, so people would buy the plugin and then use the cracked version as it was superior
once phillip makes a video there will be an update next tuesday
Currently fighting StarForce in an ancient game. Seems like reversing it will be the only solution at this point...
bro the type who advocates surveillance cams on every possible public space
I would have never expected to see a reference to oldschool Guild Wars in a 3kliks video. You truly are a man of culture.
ngl if someone has a velocity of X and gets 3 headshots through a wall... Surely...
if someone flicks more than 30 degrees in a frame and ALWAYS lands perfectly: ban.
There are so many things that could be done without an invasive anticheat. I may be wrong, but surely stats required for this are possible to create even server side.
Considering people regularly do get 180s headshots on controller with 1 frame flickstick is probably not a good vector for detecting that
@@NabiYote No one is regularly doing that.
@@OfLastingThunder You'd be surprised, it was basically the default input method for csgo on deck and pretty much the standard modern gyro setup, it pretty much looks like cheating snapping to any direction on a controller and sonetimes you just get a headshot and get called a cheater, which felt kinda funny
@@OfLastingThunder I do that regularly with a mouse, what do you mean bro
@@NabiYote Absolutely, but 3, multiple rounds, etc... There are MANY things that are key pointers of ragehacks for example.
Heck, an internal Valve Overwatch system where really high scoring users (on this imaginary system) are manually reviewed. Most would be "yeah, they're spinning, ban"
3klicks posted about VAC, VAC Anti cheat fix is invevitable at this point. Thank you 3klickphilip u r truly a gem to the CS Community
Something people miss in these convos about kernel level anticheat:
I imagine the labor is very expensive
The current VAC is so effective you'd think CS doesn't even have an anti cheat system.
Brave comment
I actually wrote an email to gaben asking if they're gonna ship an anticheat with their new CS game. He says he reads all his mails. He didn't respond.
@@supEnoche says in the alyx dev commentary that he can't respond to all of them
@@supEnocLots of people read your comment, but most won't respond.
Can you really not understand the idea of reading and not replying?
@@GoldSrc_That's what was implied to begin with.
The open qualifiers for the major used kernel level cheats and people were still complaining cause you could still cheat. People crashed or had bad performance, and funniest of all, there were people online saying that they shouldve used a kernel level anti cheat INSTEAD of what they use now even though IT ALREADY WAS KERNEL LEVEL. People just think kernel means "good" or some shit, once you realize this you realize that most people are basically just asking valve to invent something that just somehow gets rid of the cheating problem. Its like asking tesla to just make flying cars that cost nothing to make and pose no threat to the environment. We are not that technologically advanced, and people dont seem to realize you cant just get this problem to "disappear" there are pros and cons to every approach and nothing you do can just suddenly pop a perfect anti cheat with no downsides that works forever into existence
No one is asking, or expecting, EVERY cheater to be taken care of for the rest of time. We are asking for things to be improved, and more of them caught regularly. While kernel level doesn't mean it's impossible, it does make it wildly more difficult and gets rid of MOST of the issues with cheaters. I'd be fine getting a cheater in 1 in 10-20 games, but as it stands, getting on average multiple a game is just too much. I feel lucky when I play two matches with no one blatantly ripping heads.
For real, people don't realize how much you can do in usermode. Kernel drivers are not some silver bullet that lets you magically detect everything, it's mostly just useful to load earlier and try to avoid anything being hooked before you can get to it.
@@OfLastingThunder I appreciate where you're coming from, but if you're just asking for things to be improved, and you don't know the technical details of how they're improved, _please_ do not ask for specific things. The thing OP is complaining about in this comment thread is that people use "kernel-level" as a stand-in for "good", even though A) kernel-level anticheat is not magic, B) it's not even the best option against entire categories of cheats (wallhax, for instance), and C) it comes with severe drawbacks in privacy and security.
@@OfLastingThunder the first point you make is obviously wrong but I understand its exaggerated expectations from a small number of people, but still the broader point is that people expect much more from it than can be reasonably expected, this much is obvious. I also really doubt what most people say about the cheater issue, I havent met anyone except for once in a community retake and im 18k, I was 20k a month ago but my friends 20k and above do say it has become unplayable and it wasnt for them a few weeks ago. The vast majority of people are not gonna be meeting nearly as many cheaters as they say I just simply dont believe that when you can see most of them are top 1% of the rankings so when some random pleb in 12k says he meets constant cheaters I dont believe him (not saying thats you btw just saying that I think in the first place the problem is massively exaggerated, in part due to the lack of trust in the system, which fair enough its obviously not working super well at the moment)
I dislike how you are implying that kernel access won't do anything.
If an anti-cheat is like trying to find zombies in a thick fog, then kernel-level access makes the zombies more visible -- but if the anti-cheat sucks at spotting zombies, no amount of kernel level access will help. Point is, kernel access isn't a magic cheater detector, it's a foundation to build upon, and a FAR more comprehensive one than we currently have.
That "Hack v Hack" quote reminds me of "Interview with a Cheater" you did a few years back. Honestly, that entire video is relaly interesting when you think about anti-cheat and…blarg, I am tired, it is like 3:15 AM.
this is a certified banger
Literally a decade and its still the same discussion.
For the record, Vanguard causes blue screens on some devices and caused plenty during tournament matches.
I have 2,000+ matches on Valorant over the past couple years and I've gotten around 10 blue screens, all during Valorant matches.
No other game does the same to my system.
well cs2 causes blue screens in some devices, like in EVERY pro match.
Great video. Very informative
Damn the Drok's Forge shortcut reference really was a blast from the past lmao
I think the endgame of multiplayer games is that everything is done serverside and the server only tells you what to render, the client knows nothing beyond the state of the UI and what it has been told. That way cheats have no data to go off beyond what you are intended to see.
That would be ideal, but I don't know how close we are to making that a reality.
That seems like a lot of server load
You wouldn't be able to wall-hack at that point, but that does nothing for aim-botting/trigger.
@@drjamaymay405 Thats the main drawback, the performance is absolutely there, but it would make operations much more expensive and basically mandate subscription models and very short lifetimes for games.
That turns the game immediately into a live service. A actual live service game with a honest purpose at least! 'AAA' make you pay while at the same time not having to pay for server side costs. Like GTA 5 Online is running on players computers and there is no Rockstar Server hosting the actual server your playing on. CoD and many games do the same.
Problem is lag/ping running it all on the server side. Are you going to stream the screen to the player? How is streaming games working out right now? Not like 240fps is feasible now is it.
Also the problem of cheaters are not going away now in the day and age of AI and people actually paying for cheats. Sure it can help out the cheating issues.
However. Is that going to be good enough if you have to pay $20 every month to play CS? Or maybe have to pay a hourly fee to play the game? Since we are talking about no cheating players having to rent a computer on a server somewhere to stop cheaters that will only find a way around it anyways.
Have played allot of WoT (World Of Tanks.) There really is not a good reason to cheat in that game. In many ways aiming your tanks cannon is not going to mean much since most of it is down to RNG. And wall hacking is not really a thing either in that game. Even then there is allot of cheaters in that game. And really in that F2P game your not so much buying loot boxes for skins. Instead you buy with real money a better tank then anyone else. AND then you load premium ammo and single match consumables. So really it is a P2W game. EVEN THEN people are using cheat clients and aimbots. Cheaters and horrible people are always a factor of life. There is no solution really outside of giving the actual players the tools and ability to clean the game/match themselves. And let like in this case Valve deal with the greafiers and denial of service attacks. Like if WoT started to charge the playerbase $20 every month? They had lost all of the players the wales (the actual costumers of the game) are playing agents. How is CS:2 going to turn out if most of the causal players leave? That is a real issues trying to move everything over to run server side. Costs. And keeping people interested to stick around.
If the actual players can clean out the individual bad actors working alone. While the game provider (valve) take care of groups of bad actors trying to game the system and turn the system agents the actual players there to play the freaking game? You actually have a slim chance of dealing with the real problem. And not a lazy unproductive solution like Valve wants. If 'AAA' games where able to get away with charging $20 a month for singleplayer games? It would have happened already. Just saying.
Heroes of Newerth did that, I played that game for 10 years and it NEVER had a cheater.
gotta love installing a kernel level backdoor that thousands of individuals are constantly working hard to gain control of.
I was curious if you still did mapping? and if you'd ever do a tutorial like you did for the source 1 editor
That final meme image reminds me of when I used to try playing CS with a Steam controller and the 'mouse intertia' setting (or whatever it was called) for the touchpads switched on. Anyone watching me play on Overwatch would have been 100% convinced I was a bot with the way my view moved in perfectly straight lines...
I think just about all client level anti cheats are just about useless. There will always be a higher level. If the anticheat is on the kernel level, the cheat will be on hypervisor level or via DMA boards. Kernel anticheats just open more holes to lower parts of the system which will only enable bad actors to get access to those parts more easily.
The best way (imo) to detect and mitigate cheaters is by server level anticheat, where the server will only send information to the client when needed thus lowering the effectiveness of ESPs and closely watch (either automatic or by humans) the behavior of player to detect aimbots.
Server level anticheat wont be perfect but so will be client level anticheat but I still think resources are better used in server level anticheat.
Edit: whoops, commented before watching the video...
why do people type when they have no idea what they are talking about? "hypervisor level" is easy to detect. DMA boards are already detected in faceit/esea
Even this is not enough i guess. If you read the latest vanguard blogpost, they started to implement Vanguard for League of Legends, which according to to post, runs mainly serverside, but still some 10% in top ranks are scripting (dodging spells etc.) so it's not a final solution. And it's not easy to implement, the server needs to calculate, when you can hear an enemy, or see him. Imagine on D2 where you can see pretty far.
I agree that there will always some "higher level" as you described, but a new cheater will think twice if he has to setup a vm etc.
@@Schlitzerkare I totally agree, no anticheat will catch 100% and there is some amount of scripting that you can never detect. I heard of some monitor that can do CV on the input signal and show some stuff in the middle of the screen when it detects something in the bottom right (ie, the map). Such things and devices that mimic a keyboard and insert keystroke will not be detectable at all.
I think the implementation will be easier than many people think. The math is mostly already there. Your GPU mostly calculates what is can see and should render and something similar with sounds wont be hard as well. Id be more afraid of the performance hit from such calculation.
Running a script that sets up a VM with all necessary configuration to run cheats is going to be easy. And I don't think that the cheaters themself will think about it twice. After all they already install shady programs on their computers. This will just be one more non transparent thing that the installer does to their machine.
@@mevgayming bot accounts trying to trick people is the answer
Hypervisor level cheats can be protected against by secure boot. The hypervisor / kernel can also make sure that DMA boards aren't able to access the game's memory.
Thank you for making this. I am so tired of seeing 15 year olds on reddit saying "just do kernel level anti-cheat, the only thing I use my computer for is video games and the only thing I care about is CS2 cheaters".
If you install kernel level anything (rootkits) then your computer is no longer JUST your computer, comrade. Now it's Riot or Epic's computer too, along with any malicious actors inside their networks. Fuck that, no video game is worth backdooring your own computer, it's just not that serious
I mean honestly if it became common in games I'd probably just buy a computer just to use for games. I'm lucky to be a first world citizen where even making minimum wage that's not that big of deal but.
You could say the same about user level anticheat. VAC remotely downloads code over the internet to run. If someone at Valve wants that code to steal all your browser history or listen in on your mic they can do that right now.
damn found a 15 year old who doesnt know what kernel level means
Now it's Riot or Epic's computer too? Care to elaborate? Aren't all computers owned by Microsoft by that logic? lol
@@siddharthlohochab8029 wait until he hears about intel management engine and ring -3
This is a fantastic video
Thanks for the video!
what i dont get: isn't there a simple "server side" system that can detect when someone has a 100% hs rate with a scout and has 30+ kills? Atleast you would get rid of the super obvious cheaters.
I'm not sure but since that solution is so simple it must not be possible, otherwise someone would have tried it already.
My guess is that the server couldn't handle running the game and scanning for cheaters.
It can't stop wallers either sadly.
You could also have false positives with that, altought unlikely. Also, the cheaters/bots would just try different methods. Even 50% hs would ruin the game for others, and it could not be that easily detected.
You can't ban someone for 30 scout headshots because that can happen legit. What it needs to do is detect patterns associated with cheating (based on convicted cheaters POV)
so if someone get 30 scout headshoots they should be banned?
@@gabrielandy9272 in 99.99% of cases, yes absolutely.
it would be cool if VAC simply *fucking did anything*
then it gets bypassed and you're in the same spot again!
@@arson5304 oh shit you right, we better just stop even attempting anticheats and hand every game over to the cheaters, just give them the whole place for themselves. No point even trying if one guy might bypass it so just abandon the whole exercise
Literally this
A bit easy to say, I think that although their output leaves a lot to be desired they always deliver on quality (except for the one time with sv_cheats). I respect valve because it respects me by only releasing quality stuff or at the bare minimum patching broken stuff in a timely manner.
@@papakamirneron2514 idk man I'm not the one with an 8 billion dollar budget and a team of supposedly expert programmers, I'm just the dumb asshole who likes playing some games for an hour or two in the evening and only have one game in my library I can't play anymore because there's absolutely no fair competition anymore
Philip showing off the droknar running skip in gw during tge explanation of cheating made my day
I'm so sad we never got a word on overwatch and why it was disabled or not moved over to CS2. Did it not work well enough? What happened to it?
As soon as VAC gets kernel level access, im done playing Valve Multiplayer Games.
Me too.
So you don´t want to minimize encountering cheaters by about 95%?
@@leruty for how long.
@@leruty At the cost of allowing it to alter your system however they want and get all information, blocking apps that you were using for fan control for example. How about letting it format your whole drive? Because such level of access allows it to do that.
@@adgod725 Reminder unless you have the current up to date source code of the game, you do NOT know if they included anything malicious such as rootkits in your machine. You are severely sacrificing your security and privacy EVERY TIME YOU DOWNLOAD A CLOSED SOURCE GAME.
Running executables has always been a matter of trust, do you trust Valve? If you don't trust Valve adding kernel AC (which they will never do regardless) then you shouldn't trust installing any software made by them TO BEGIN WITH.
Kernel is a complete meme that hasn't stopped cheaters at all in other games.
Then what stops cheaters in every other game that has a kernel anti cheat because I don't see them.
@@colbzyk2128there's literally a video on TH-cam he references showing how people hack on valorant and the are discord servers with tens of thousands of people on discord that share cheats, you can't be serious
@@colbzyk2128 yeah, you don't see them. but they are still there. just not as blatant.
@@colbzyk2128 its more of question if you want to be living in police state (as company is literaly monitoring everything on your pc 24/7 all time even if your innocent and god knows what else they use that data , or sell it as databrokers sell this kind of data too) or you want cheats to be unprofitable
ill take valve approach any day of the week.
@@VarenvelDarakusand just like that the goalpost has been moved
Thx for including the whole reddit post. Here's my favourite bit for anyone who didn't catch it. "2. Do we care what porn sites you visit? Oh, dear god, no. My brain just melted." Gaben is a treasure.
Great vid!
Rootkit anti-cheats are only a brute force band-aid solution. They are going to be bypassed anyways, so in the end it'll only become an annoyance for the rest of the players while the bad actors it's supposed to target won't even think about it.
Then why doesn't Valorant have a cheating problem smart guyy?
@@eggsycroBecause cheats which workaround Kernel level anticheats cost way more then plain old cheating software
So in some cases the "professional cheaters" will almost always find a way to cheat, it's just that the normal cheaters will be stopped... Which I think is a step in the right direction
@@internetconspiracy7525 So if it makes cheating exponentially more rare, it's safe to say a kernel level anti cheat can work and RIOT's Vanguard is the best example of it.
@@eggsycro I personally totally agree with you, but I think it might deter fear of privacy in some individual's and as one wise man once said,
*"With great power comes great responsibility"*
I'll leave it at that.
@@internetconspiracy7525 Only for those who have no knowledge about how these things work.
Most people have no idea that VAC (which runs on the same privilege level as the game, and doesn't even require admin rights) could steal all of your stored passwords, credit cards, and browsing history.
Most multiplayer games now have kernel level anti cheats (Fortnite, PUBG, LoL, Valorant, Rainbow Six, Apex Legends, Rust, EFT, ...). It's the industry standard.
If VAC required kernel access, I would stop playing CS.
good riddance.
You are bot anyway stop from now
Alright nerd I wish you do stop playing CS
The amount of people that would get back into it/keep playing would dwarf those that quit because of kernel level access. Most people SAY they care about “security and privacy” but would download anything to play their favorite game. lol
@@yabski_ I agree. A kernel-level update on VAC would bring a lot of players back in hopes that the cheaters are gone. In the long run though, the cheaters will find ways to cheat and drive the players away again. And about people wanting to play their favorite game, I feel that. I've been playing CS on and off for over 10 years now. This got me thinking about buying a separate PC for games that require kernel level access, if it becomes a trend. Or maybe use my gaming PC only for games, and use something else for anything personal.
you should add that kernel cheat video to the description, someone else that hasn't watched it yet might want to
HAPPY MILLION BTW!!!!!!! 🎉🎉🎉🎉🎉
it would make no sense for valve to add kernel AC to VAC considering it would kill their games (admittedly only two games) on linux which is used on the steamdeck.
Good point, but I think they could probably cook something up for that.
You can make a kernel AC regardless of OS, but imo it makes more sense to just make VAC better rather than brute forcing it by upping its privileges
It could make sense, but like the video mentions, has its implications, tho kernel level anti cheat(as dkms i think) is possible on linux, but for a while they could also have the option to just have vac running at userspace and see how it would go.
Last I tried to run TF2 on Linux (OpenSuse Tumbleweed, about a month ago.) VAC let me play offline with a bot match only ones. When I quit the 'play with bots' match to change map? No. Now your not allowed to launch a offline play with bots game! And trying to go online VAC complained with a basic prompt that VAC would not allow me to play due to security issues. VAC complaining that a plain OpenSuse install running Steam? KDE? So you have to own a SteamDeck and play VAC games on that thing to avoid having to subscribe to Winblows? Or what? Install Arch Linux? If any actual cheaters are running Linux they would not be doing it on OpenSuse or Debian Valve.
Yea sure Volvo. Grate job with your anti-cheat. Valve even removed a "bug" in TF2 that allowed you to spectate cheaters in game not that long ago. Like the hole 'Meet Your Match' update ruined the game. AND also removed every tool we had to kick cheaters on or own. CS:2 is the swan song. That being how they handled TF2. CS:GO? No you play CS:2 now. Ruined by cheaters and bots! If anyone believes that Valve is going to fix CS:2 bot problem? Then surely go and look up how they handled TF2.
Like really. I'm so happy that CS:2 is bot riddled. First time in years that CS players are aware how awful Valve truly is. And they are awful simply by not doing anything! It is such a Valve thing to do. HL3? Fix cheaters? No. All Valve dose now it bring in the money with Steam AND shut down communities attempts to fix there games for them! (Valve).
All VAC seems to be doing is like all anti-cheat and DRM. Ruin real players and costumers. I mean if a police is a drug dealer on the side? AKA: Valve makes money by cheaters? Yea...
Then okay, maybe cheaters are Valves costumers. Like how most of there costumers are gamblers trying to gamble for pixels in what should be a game where you play. Not a hat simulator... But nooo! TF2 and CS is not at all related. DOTA, DOTA, CS:GO, DOTA. CS:GO. And the funny thing is that Valve do not make singleplayer games anymore too! So really they are the best in the industry when it comes to upsetting people by doing NOTHING. It is quite wild and hilarious! Except that they are holding IP's that people want to see improving and be playable. Like CS and TF. Even EA is not evil enough to literally do nothing and upset people. Like I said. It would be hilarious if not so dam sad.
Kernel AC's can work on linux. There's a few that already do (Battleye, EAC and whatever HD2 uses). Difference is that the ones on linux run in user space rather than in the kernel.
Also, Linux. They kinda want to keep the game there
that's a non issue for native games, wouldn't hurt linux gamers if valve did this, well, we wouldn't like it...
@@cali6662 This would definitely be an issue. Can you imagine getting your entire user-base to install a Kernel module for VAC? That would be almost impossible.
@@cnr_0778to be fair valve is very open, so it's possible, but linux has so much possibilities and versions, that could be almost impossible to make it work 100% for every kernel version
This is the real answer right here. Steam decks, etc
@@cnr_0778idk, I can definitely imagine it. It's not that hard. As a bonus, Linux kernel modules are less invasive (source: vanguard devs complaining about them) and Valve is a more trust worthy company in general.
Philip have you considered making a follow up video talking about VACNET?
In the long term detecting symptoms (weird player behaviors) instead of trying to detect the cheat itself (no matter if it is kernel-level, hardware , etc..) seems to be the way to go, because no matter how much effort you place on hiding it, if you cheat you will always play with a different pattern, some may be obvious to experienced players (like weird crosshair placement) others might be only to AI (micro adjustments only possible by machine code).
For me Valve has the best solution in the long term, the problem seems to be the short/medium term, and that could be solved by bringing back Overwatch (fixed of course) and improving the thrust factor system.
That Guild Wars Map brings back beautiful memories.
I remember downloading Valorant so i could play with a few friends, and suddenly my PC was so much slower than before. I thought I had installed some kind of virus, but i decided to check Task Manager to check what was running at the time. I noticed that something 'Riot' was running in the background, so i uninstalled 'Riots' game, Valorant, and magically my PC ran significantly faster.
So from my own anectdotal experience, it must've been some kind of thing related to Valorant, and I'll hazard a guess that it was the Anti-Cheat software.
Its optional to have i run all the time. You can so that you only need to restart pc and have it open when you want to play valo
i am 99% sure that was just the riot client being ass lol, there's like a 50/50 chance it actually closes when you click the x button. the vanguard process has never had "riot" in its name.
@@dot0l Well that solves that mystery! That's absurd how a client can make a pc run so slow haha
@@fizheeyeah their client has been ass for the longest time. Also remember that the people who can't make a decent client that doesn't crash or slow down your PC and haven't made a demo viewer for their one game that really needs it, are thought to have made the best anti-cheat in the market. Food for thought.
Kernel based anti cheat systems are effective, only at the cost the internal privacy of your pc. This is essentially a well intentioned root kit that is just looking at and messing with memory at the lowest level. You should have insane levels of trust with the developers of the game to be consciously ok with this, due to the insane levels of potential breach of privacy. A factory reset of your computer will quite often not get rid of a rootkit installed in the kernel, so kernel level anti-cheats effectively embed themselves permanently, with the only way of removal being to either replace affected components or rebuild entirely. This could lead to false flags (as mentioned in the video) years after you've forgotten about it or even stopped playing the game entirely.
X2 mentioned! Im surprised phil is a fan but not disappointed!
I appreciate you mentioning Unity Research's great video on anti-cheats.
90% of current cheaters could be banned by writing a script that detects if a gun shoots faster than it's supossed to, hitting frequent bunny hops (10-20 jumps in a row continiously), if you have a stupid high spin rate AND kill enemies in a fast fashion, there's a lot of tiny scripts that can go a long way.
Problem is there has been a bug in cs2 since day 1 of limited test with people being able to fire an entire clip of bullets in 1 second. This would produce a ton of false bans. This is why that cheating style is rampant right now.
In case you don't know, aimbots tends to use noise generators to "simulate" hand movements
The problem is not to ban cheaters, but to not ban legit players
What about if I turn on cheats every half game or randomly so I don't have a high KDA but I make sure to keep it low, wouldn't that mean your script it's worthless?
@@gonzalologalso, their idea can already be thrown out at the “spinning quickly” part, due to people trolling with high sensitivities
In csgo admins on community servers had tools to detect perfect bhop rate and jump inputs per jump to help find scripts/ hackers actually . Would automatically ping you if someone pushed beyond legal possible limits.
Okay so someone who by sheer luck manages to legitimacy do 20 bhops in a row gets unfairly banned, meanwhile the people making hack clients notice what is causing the ban and have the it simply wait a moment every 19th jump, so cheaters never get caught by this after the first week.
This is going to be a long and rambly multi-part post.
============================================
I don't think Valve can realistically try to roll out kernel AC, primarily because they wouldn't have to just roll it for Windows' NT kernel, but also for Linux, some people say this isn't possible because we can just roll our own custom kernels and modify whatever we want, however, Linux users with Nvidia GPUs have been dealing with Nvidia's proprietary kernel modules for years, so Valve technically could drop "vac-dkms" for Linux if they really wanted... but with our kernels being open source and letting us customize them as we see fit we could indeed just modify them to lie to the AC and effectively bypass this hypothetical vac-dkms*. All that being said, the privacy concerns of kernel AC have always rang a bit hollow for me, ANY proprietary software that you run on your pc (discord, steam's client, steam games, your keyboard and mouse RGB software...) has access to everything your regular user has access to, which is where 99% of your actual sensitive information is, and you *don't know* what it is doing because you cannot see the code, any of these programs could spy on you if it chose to just as easily as vac can, but kernel access doesn't really do much more in that aspect unless you have multiple users in your system, since that would compromise them. The security concerns on the other hand are absolutely real since otherwise, a remote access vulnerability in a game would only give you user permissions, but with network-enabled software running in the kernel you're essentially leaving root ssh open at all times, which is even worse since some of these AC will run even while the game itself isn't. I don't believe there's a single valid reason for why a *videogame* would require kernel access to my main workstation, it violates the principle of least privilege.
===========================================
Since I'm already writing a comment, I want to also mention that I've been a big fan of your channel(s) for many years (since the first (modern) Odgrub video on 2kiks) and I love your particular style of video and narration, but it's always broken my heart a little to see that, despite being super into technical things, like game engines, graphic technologies and whatnot, you don't have much interest on Linux things, even though you got yourself a steam deck. I remember a video about the steam deck where you mentioned you couldn't screen record "because it's Linux" and I just didn't really understand what that was about, and it makes me think you could get a lot out of getting a little more into it and learning about it, it's a whole world full of interesting things that 2kliks could get dozens of videos out of, you could even more easily tinker and mess around with newer AI models and whatnot, and I'd personally be more than happy to walk you through some things. I know a lot of users are akin to the vegans of computing, but there's a whole rabbit hole of cool things underneath that surface and when you really know it, it makes a lot of sense why Valve decided to stick to it rather than use Windows for their handheld.
===========================================
Nice to see that Unity Research video getting some love it was so good. Cheers
~sesu
* edited point about vac-dkms to reflect input from @Spartan322
paragraphs motherfucker, do you know them?
Thanks for your thoughts, I learned something new today.
"I don't believe there's a single valid reason for why a videogame would require kernel access to my main workstation, it violates the principle of least privilege." Oh really? What about not having to deal with fucking cheaters 24/7 like in all online Valve games (CS2, TF2, D2 etc.). You may not like it but kernel level anti-cheats are the only ones that demonstrably work right now. Do they work 100% of the time? Of course not but nothing is full proof and what matters is that they work 95% of the time or even more because it's a lot more difficult/expensive to cheat with kernel lvl AC. I disagree with Philip because while yes cheaters are always trying to overcome everything, ask anyone who plays Valorant/FACEIT how many cheaters they encountered in the hundreds or thousands of hours they have. I bet you less than someone who's been playing premier for a week at 20k+. So In my opinion If Valve is too incompetent to make a kernel lvl AC themselves than they should just buy FACEIT and implement it into the base game. Otherwise the game will die outside of those who choose to play on FACEIT.
@@genericwhiteguy69 it's a videogame, no reason to give it ownership of my hardware, even less so the hardware where I do taxes and porn ;3
@@genericwhiteguy69 it's a video game my guy, my workstation is for a lot more than vidya, I do taxes and *[redacted]* in it too ;3
The problem is that CS:GO's VAC, in its later years, was heavily dependent on AI to recognize potential cheaters. However, it took Valve *years* to train this AI up properly.
Unfortunately, CS2 runs on a new engine with new code, and this means they need to completely retrain their AI Anti-Cheat. While it likely won't take *as* long to train, as I expect Source 2 was deliberately coded to better mould with this AI, the process will certainly not be quick.
The thing with invasive anti-cheat software is actually trusting the company that makes it. Like Vanguard, Tencent owned means authoritarian government owned.
I can never understand the argument of "oh but it doesn't detect every single possible cheat so it's not worth considering" like valorant doesn't have orders of magnitude less cheaters in ranked
@9:04
"VAC is still there to catch the casual cheaters who are using free and easily accessible cheats."
Meanwhile, TF2's Casual Mode:
To be fair, most of TF2's casual mode aren't cheaters. They aren't even players. They're just bots.
@@Bokatrice
Yes, and it's all the more egregious that VAC can't insta-ban *_a literally automated cheating process._*
lol, that final 9 in the slay the spire clip made me cry
Before going with the invasive measures, especially for Counter Strike, I'd like to see measures like Overwatch revisited, as well as systems that notify players when one of their reports results in a ban. Games like Overwatch 2 and Rust already do this, and it makes me and all my friends far more likely to report someone AND provide useful information when we see the results of our efforts. If there is STILL a huge problem after both of those measures, then I'd be more open hearing arguments about invasive systems, personally!
Something to consider is that Valve is pushing for Linux, hard. Has been for some time, now. And Kernel access for an anti-cheat on Linux is a much more complicated issue, not only because of how Linux users are on average *much more* sensitive to privacy issues and invasive software, but also because making this work on Linux based distrubitions systems would be a massive technical hassle for tons of reasons.Valve put a ton of work for gaming to be a thing on Linux, you could argue that they're single handedly responsible for gaming being basically a thing on Linux, that's how hard they pushed for it. It's simple: _For CS2 to get a Kernel Based Anti-Cheat, _*_they have to drop CS2 for Linux._*
And kernel level anti-cheat on Linux would be useless because you could just modify the kernel to lie to the anti-cheat and there is nothing that could be done to stop it.
@@Spartan322I feel like just forcing cheaters to install Linux would be an additional barrier to cheating though. Wasn't VAC completely nonfunctional on Linux builds of TF2 for years and no one noticed because it was easier to install cheats on Windows than install Linux first then install cheats?
@@Rayndalf I don't recall that, but the cheats were already bypassing VAC anyway, so going through the hassle of dealing with Linux is pointless if you already have cheats that work fine, VAC's never been a very good method against cheating.
@@Spartan322 VAC definitely needs some work. I was mostly commenting on the "oh but Linux exists so you can't make VAC better" thing I hear sometimes. Even if cheating is easier on Linux many will stay on Windows. Forcing cheaters to install Linux is a meaningful barrier.
@@Rayndalf I'm not saying VAC couldn't be better, but kernel anti-cheat is the dumbest solution for all sorts of reasons, any good solution should be done via social engineering, like never ban them, just segregate them from the rest of the community, the only reason most of them make new accounts is because they get banned, they didn't care about low trust factor, only when they got banned.
Anti-cheat that does more than scanning what you are trying to inject into the game is really creepy. I can understand habit tracking, but ring-0 is just a no go. I'm not having you brick my system for "my safety."
This is one of the reasons why I'm glad I use linux. AC's that support linux run in the userspace rather than in the kernel.
Though it's a bit of a double edged sword. Since that is also the one of the reasons why some developers don't enable the Linux support if they're using an AC that supports linux.
it's not for your safety. it's like being searched before entering an airplane, you are agreeing to wave your privacy for access to the plane (game), you are the suspect, not the civilian.
@@TheInfectous I will not ever make an equivalent comparison of travel that could make me lose my life to a game that's meant to be fun. This is a poor reason to possibly compromise my PC and privacy.
@@BauliusTorvoltosKernel level anticheat is possible on Linux too.
Also doesn't actually work on Linux.
Hey, I like the new upbeat fast music
I think I had a good idea; being able to opt in to different levels of anti cheat, entry being basically community servers and full anti cheat being like Kernal level
VAC is currently on Ring 3? That's so sus.
I get that kernel level AC is not perfect and is still vulnerable to hardware cheats and whatnot, but brother getting hardware cheats is a big ass hurdle compared to downloading a random cheat software for some website, I feel that its a tired and not all that convincing argument against it.
As it stands, anyone that is frustrated enough can just go online and download cheats and ruin the game, I've even seen ads for the on youtube, with developers showcasing their cheats, but getting hardware cheats requires more in depth investigation, they seem to be harder to find online, and I feel it's in general a step above software cheats in terms of commitment, at the very least some frustrated kid has to at least wait a few days before their cheating device arrives in the mail.
Valve rolls out very invasive AC, a week later all cheats are even more advanced and still work (because of how much money there is in the cheating industry)
Actually Kernal anti cheats dont prevent normal cheating, it just detects them easier. So if you can farm accounts faster than ban waves you can play with cheats all the time anyways. Hardware cheats are to be undetected.
" getting hardware cheats is a big ass hurdle compared to downloading a random cheat software for some website" It's truly not. It's like ordering literally anything from the internet instead of having instant access. Big whoop.
@@perfectlyroundcircle I mean afaik hardware cheats are also more expensive than software, and the waiting time for the thing to arrive, while definitely not a big barrier, is a barrier, taking into account that a HUGE percentage of cheaters just download them impulsively and start cheating immediately.
@@NoOne-ye5jf I'm not saying it's not a barrier. It would definitely reduce the amount of cheaters. But saying it's a big ass hurdle compared to buying instant cheats is a bit of an exaggeration. Most people know how to order things online. Serial cheaters, those who keep paying for subscriptions and buy used accounts, if they simply cannot use instant cheats anymore, they'll will just buy hardware cheats. It's not like they'll stop cheating. It will only make the barrier bigger. So, let us not not have the expectation that it's worth it to have kernel level AC. There might still be a ton of cheaters.
You have a great perspective on all of this. There is a reason you are the G.O.A.T!
Thanks for giving me trust in Valve again. I believed they were unmotivated to do anything as they still make millions daily, but you're right about the long run.
it has to do with corporate laws. Noone wants to get involved in some weird ass ACQUISITION. They can make a top tier anti cheat like face it but they wont because its pain in the ass to deal in terms of law and etc
Well you can't build a functioning kernel level anti-cheat on Linux for the simple fact the user can modify the kernel and make the anti-cheat useless.
Right now there is an AI in development which should be able to predict the behavior of clouds through analyzing patterns. Which is like the hardest thing to predict, ever. Now Valve, with their unlimited resources, wants to tell me they can't feed an AI with Rage-Hack-Demos to ban those players right away? They must have a hilarious amount of training data considering how long Overwatch was around.
Actually 🤓 its an indie company so only 2 people are working on this game.
@@stealthygamer22Its funny because VALVe is literally an indie company and has the lowest personnel count of all AAA games developing studios
If you don't do it right it'll just insta ban some people for having high mouse sensitivity, there's many variables to consider and if you're going to give a machine a ban button you sure as hell need to make it solid with it's verdicts
@@Suilujz Having no false positives is way more desirable than banning almost all cheater with legitimate player got caught in the process.
Kernel level anti-cheat is not something you can implement on Linux the way you can on Windows because on Linux there is no central distribution authority for the Linux kernel. No single organisation compiles copies of the kernel for you, including modules (including such a kernel level anti-cheat module). As such, even though the kernel supports module signing, you can just compile the kernel to disable this or use your own signing key. This means that a developer of a kernel level anti cheat can't go to "Linsoft Corporation" and say: Hey, can we get this kernel module signed so that users can install it but can't modify it.
As such, it would be trivial to reverse engineer any kernel level anti cheat module's userspace APIs and to replace it with a dummy module. Moreover, since the linux project wants to encourage people to contribute source code to the kernel, they don't provide stable kernelspace APIs. It's the reason why nvidia drivers for linux must be updated with every linux update and re-compiled. Effectively all these features which make linux open and pleasant for end-users to deal with, are obstacles to kernel level anti-cheat. Kernel-level anti-cheat requires more control over the user's computer than the user themselves have which is not possible in the context of a project like Linux.
What could technically work is if some entity created "gaming linux" which used efistub signed with collaboration from microsoft to implement a full secure-boot chain, which required secure boot, and where the signing keys for kernel modules were owned by that entity. Game developers could then go to that entity to get their custom kernel level anti-cheat modules signed and games could be required to run on that kernel. The issue is that because it would still have to be based on the open source linux project, the things I mentioned earlier would still apply. The userspace APIs would still be reverse-engineerable. Someone could still make a dummy module to run the game on other linux distributions without the signing restrictions. Even if the game used hardware attestation, it's possible to at the very least just use attestation forwarding (which I guess with more effort from "gaming linux" could be made more difficult).
Simply put, the issue is valve is invested in Linux support and would not be willing to forego Linux support in order to implement a more intrusive anti-cheat.
What you don't seem to talk about that in this video is also the privacy aspects. You meme about Gabe Newell finding out what porn you're watching, but anti-cheat software requires forfeiting your privacy. If you want to know effectively what it's like: VAC is like inviting someone to sit next to you whenever you your game. Kernel level anti cheats are like inviting someone to live with you and observe you 24/7 even when you're not gaming.
These analogies are not even that far fetched when it comes to how much other stuff people usually do on their computers.
Basically Homeless's video "Saving FPS Games - AI Anti-Cheat" was really interesting and promising and gave a sliver of hope for the future of online games. It would be interesting to hear Philips's thoughts on it
if i can turn the anticheat on and off when and only when I want it, sure thing, Vanguard needing a restart is dumb.
It's not dumb. You can turn it off at any point but if you want to play the game, you must reboot since the anticheat needs to validate the integrity of the system from the start.
So then basically whole kernel level AC is stupid because I think that's basically required for kernel level AC.
It simply does not work.
Anti cheat gets updated or get more invasive -> Hack programmers take a few weeks to catch up and find workarounds -> hack situation gets worse again -> Ac gets updated again -> And so it goes on and on and on....
honestly I think going back to the old system of small communities self regulating their player base is probably the only good way of getting a good grip on the situation, be it with a lot of drawbacks (ie. human bias, delays as humans might take longer to audit things, etc.)
allowing third party servers is a pretty good solution actually, especially since you could host hacked lobbies for people to fuck around in. Would be quite the match to watch.
Other servers can curate the player base, or ban people the community doesn't like.
@@killingtimeitself jup, the biggest problem tho is that most developers opt for "official" servers so they always have full control over their player base - sadly for the wrong reasons.
Thats why you almost never hear complains about old times. Cheater craze started somewhere in MW2 era when companies start to push for "lobbies". Before that you play on actual server with actual staff and if situation was out of control you can just switch to another server. Funny enough thats how i can actually enjoy BF5 - trough dedicated servers.
then it gets bypassed and you're in the same spot again!
@@MrComradeChannel Companies pushed for official servers because of consoles. PC games had server browsers for the longest time and that didnt change for a while.
thank you for this video!
one more point would be that kernel level anticheats can't run on every OS like Linux distros.
That Unity Research video is still the best, most comprehensive introduction to how cheaters cheat in games like counter-strike and I'm so glad you're giving it recognition
Flat point : Kernel would not have more success. We see plenty of cheaters still running rampant in games with Kernel anti cheat, its NOT the way forward, and with cheaters starting to make stronger cheats via algorithm learning, also wrongly called "ai", it will only become weaker. If I remember correctly, Valve is actually looking towards their own "ai" anticheat which I do feel has greater potential, knowing valve it wouldn't be as invasive as kernel and if tweaked right it'll probably be the new mainstay as it can actually detect what the player is doing and reacting to and see if it hints to cheating, also knowing valve it'll also probably not instantly ban them but rather flag them for review unless its absolutely blatant cheating, so we might still get some delays to bans.
Some might then say what 3kliks says in the video : "wouldn't the cheats just become more and more subtle" TO WHICH I REPLY : Yes, and that's still a win. There's plenty of videos of people outsmarting and even defeating cheaters, usually blatant ones, and despite the impossible odds they win it out because most cheaters aren't good players, they're script kiddies that threw some bucks at a programmer to use their garbage for the game, whether to act like they're good or because they enjoy making others suffer.
So I present this question to all who read this minor wall :
What is worse?
A Blatant cheater, wall hacking and aimbotting you, doesn't necessarily have to be a spinbot but if you spectate them you can definitely see them react to people moving through the walls, aiming towards heads before they're even supposed to know the person's there, locking onto it and never needing to aim for themselves and so on.
OR
A subtle cheater, forced to have the tiniest adjustments to their aim. Their cheats little more than a controller aim-assist, maybe they can still see through walls but they either have to keep a lock on their reactions for it or not have wallhacking to begin.
AI Anticheat will potentially give us that subtle cheater more than the blatant cheater, because the blatant cheater would be detected and banned, the subtle cheater will be forced to downgrade their cheats, to be subtle, else they get banned. When the cheats do little more than the equivalent of tiny accuracy bonus, a controller aim assist, then cheats stop becoming the annoying threat they usually are, you could beat these cheaters and sometimes not even realize they were trying to cheat to begin with, that's a WIN in my book.