Discussion summary
Discussions around kernel anti-cheat highlight concerns about overreach, effectiveness, and privacy risks. Some argue kernel anti-cheats are unnecessary or risky, while others see them as effective for reducing cheating.
What the discussion says
- Kernel anti-cheats may be overreach and can be replaced by user-mode solutions.
- Effectiveness of kernel anti-cheats in stopping cheating is debated.
- Concerns about privacy and malware risks with kernel-level access.
- Some believe legal consequences are better than kernel anti-cheats.
- Detection of subtle cheating behaviors remains difficult.
“Kernel anti-cheats can be done from user mode too.”
“It has largely reduced cheating in competitive play.”
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Since you're not a gamer sorry but your opinion does not means much, you don't seem to realize how cheating is a problem in online games, it's not just an inconvenience, it kills games.by Thaxll
- I have purchased every Civilization (and closely related) game since III. I have played more hours of any single Civ than all other games combined.
I didn't buy Civ VII, because I don't buy malware. As long as it's got Denuvo, it's not a game I'm buying or playing.
by SwellJoe - Fuck Denuvo's parent company (Irdeto) too. They have been making DRM cards for austrian state TV for decades and thus making it a PITA to do something like broadcasting your TV signal over IP to the TVs in the house...by preisschild
- > So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private.
Yeah except that’s not the options here. Even with ring-0 there are lots of cheaters. Without it the game would be completely infested with them.
by _aavaa_ - I would still rather have that than let some game run in ring 0 TBH.by bigstrat2003
- > So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private.
You’re not a gamer so you don’t have a word here. I was a competitive gamer and I would happily accept even the game where you need a government id to be allowed to play in ranked/matchmaking. I do dual boot for gaming/home stuff though.
by galkk - I play a lot. Competitive shooters mostly. Most of them are unplayable for one or two reasons. Cross play (controllers with aim assist) and cheaters. As a PC player I would like to see no aim assist and actual consequences for cheating. I’ll gladly verify my real world identity, if it meant cheaters where banned once and forever. I’ve heard this is how it works in Korea (claim not verified) and could see it work here too as most of Europe has access to very UX friendly state sponsored digital ID.
If there were actual stakes to cheating, it would be less prevalent. Now you can create another account and keep playing. Often for free!
On a side note. How come replay analysis doesn’t catch more cheaters?
by wronex - > "How come replay analysis doesn’t catch more cheaters?"
1) There's too many players.
2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases, functional anti-cheats actually serve to vindicate these players.
by iscoelho - > During setup, I did a clean Windows 11 install
> Unfortunately the install was legacy MBR
> I was forced to convert the disk with mbr2gpt and spent about an hour manually rebuilding the boot drive to work under UEFI.
I'm surprised Windows 11 even booted on MBR, I was under the impression that after 7 all Windows installs had to be GPT/EFI, regardless of whether secure boot was on or not.
by nubinetwork - I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.by sgjohnson
- Most of the worries that people focus on already apply to programs running in userspace.by Hikikomori
- Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.by sushid
- Same. I write cheats for CS2 for my own amusement and it's 100% detectable by replay analysis.
If I'm reacting to information that I shouldn't have at a rate much much greater than the general population, then I'm not psychic, I'm just cheating.
This is also true for aiming, spray control, etc. All current cs2 cheaters are producing a very large and detectable audit trail of very suspicious plays in game, even if they think they're being sneaky. The resolution of the data looks like keeping track of your location and where you're aiming about every 15ms.
Here's some recent research that's related: https://arxiv.org/html/2508.06348v1
I can hide from a kernel module, but I can't hide from my own data trail.
There's only really two paths:
* We do kernel anti-cheat in trusted execution environments, which is bad for all the reasons in the article. When I break through this, you'll get the full "having a cheater" experience in your game.
* We do AI/ML heuristic-based detection to the point where cheaters are forced to behave exactly like non-cheating teammates or risk detection, cheating maybe only 10-20% above their previously established skill patterns. When I break through this, you'll have a normal game and I'll be kind of bored and nobody will be having the "cheaters in my game" experience even though I'm actually cheating.
In either case, I'm still going to try and beat the system for fun. Because video games.
- This article reminds me of Chesterton Fence - the author is complaining about something, without ever experiencing why it exists.by cowthulhu
- Unlike the Fence, kernel anti-cheat wasn't always there and won't be effective in the future with new AI-powered cheats growing.by ronsor
- I used to host pretty popular servers for several games (mostly the PvP survival kind), built a community around them, and developed custom admin software. It's hard to say I haven't experienced this first-hand, I fully understand the reasons for this to exist. Yet I 100% agree with the author, this went way too far long ago. This will NOT stop until the personal computers are forcibly locked into a fully attested hardware chain, for everyone not just gamers. The control over your personal computer will be eventually taken from you even if you never played a game in your entire life. And then cheats will simply move outside the machine entirely. No entertainment is worth it.
Starting from a certain point, the solution for cheating is better game design, more human involvement, and community building, not adding more restraints which will be circumvented in any case.
- I must admit I immediately questioned the credibility of the article when the author admitted they "aren't a gamer" and then started making allusions to vague political threads. Not to say these criticisms aren't valid, but they're a weird jumping off point
The reality is none of the companies want to do these things. Every step in this process locks out some subset of customers. And that's not including the ones who meet the technical requirements but are turned off enough by the decision to just avoid the games anyway
They're an unfortunate response to how utterly profitable and expansive cheating in online games has become. They cost the companies precious development time that could be spent making the game better to instead make it just vaguely "playable" for normal people
- > Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware
I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself.
> Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats followed into the kernel, and then below it into hypervisors
I think cheats moved into kernel space before anti-cheats did.
by ChocolateGod - long beforehand naturally. the arms race is as good of an excuse as any to trample user rights thoughby sitzkrieg
- Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations in memory in a specific order, which brings me to my point:
An anti-cheat mechanism can always be defeated if the cheater can access a lower order of abstraction from the mechanism. An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.
by glitchc - Uninstalled riot years ago, not playing games that dont run on linux with proton, problem solved and you should do the same.
Avoiding to play games that take over my system on a low-level is a no go, I can live without LoL or BF6 and I live even better :)
ignoring this problems means you don't care about your identity, data, privacy and you prefer to keep ignoring this and play the games that hype abd you like, but inside you know that long term your are profiled and such profiling will be used against you!
by giov4 - I play fighting games. Didn't even bother to try 2XKO on Windows because I knew I won't be able to play on Linux due to Vanguard.by Parae
- > I want to preface this with the fact that I’m not a gamer.
So you're prefacing it as someone who has never really dealt with the games you like to play getting totally infested with and nearly unplayable with so many cheaters in practically every lobby.
Its easy to think its something that's not needed if one never spends any time in the space.
Do they stop all cheats? No. Do they make the bar extensively higher to cheat? Absolutely. Even they point this out: "A DMA cheat is a separate FPGA card that sits in a PCIe slot and reads the game’s memory directly over the bus, while a second computer processes what it sees and feeds back aim and wallhacks..." Any random person can go run some executable they found on a forum, what percentage of the playerbase has these FPGA cards and a second computer to properly run these cheats? And even then, more modern systems can even detect these kinds of things.
Are there lots of problems with these anti-cheat platforms? Sure. Are they now often developed with ties to countries many wouldn't want have that deep of access to their computers? Sure. Is kernel-level anti-cheat overall as a concept overreach? Probably not for what a lot of players actively want. Players want systems to ensure everyone is playing on a somewhat equal playing field. Other than the games being rendered in the cloud I don't know any other real way to begin to enforce it.
> I would rather share a match with the occasional cheater
What if it wasn't "the occasional cheater" and instead was "nearly every match of every game you like to play"?
by vel0city - Yes, it is very rich for someone with no skin in the literal game to police what others do to their computers.
I don't play any games that use anticheat. But I also don't go out of my way to tell other players who knowingly, consensually installs games with anticheat so they can play them. It's like saying it is an invasion of privacy for cycling athletes to be subjected to doping tests. It's their game. Why does it bother you?
by pibaker - > So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private.
The article makes an argument that anti-cheat is not worth the trade-off, yet the author admits they are a non-gamer. Then they go on to present one example of anti-cheat that tells us all we need to know about actual gamers' preferences—FACEIT. For those who don't know, FACEIT is a third-party matchmaking service, primarily for CS2. People choose to go through the hoops of using third-party service that installs kernel-level anti-cheat on their computer because it helps to keep cheaters out of their games. This seems like pretty strong evidence that the author's argument is not a good representation of gamers' thoughts on this. I don't know what the actual solution is. I suspect if Valve made their own kernel-level anti-cheat people might trust it more, but it's still the same problem.
by km144 - The only acceptable and correct trade-off for anti-cheat is fully remote gaming + locked-down console, where the Game companies own the software and servers and hardware and just rent you a "play slice" via their locked-down console. I suspect even then, they will want to install tools to monitor you to satisfy their "analytics"by lenkite
- I suspect the only technical alternative would be the extreme of "this is not your system at all" mode, and necessarily involve dedicated hardware, where you can boot your computer as a "game console". I also suspect this would mean that mode would necessarily be the "primary" mode [1], PS2 style.by nomel
- Faceit has cheaters too by all accounts and some of the cheats have advanced to the point that not even kernel access under secure boot helps as they don't even run on the same device.
Behavioral patterns are a much better target.
If your cheats make you play like a legit player, who cares? It's the same as in the gym. People are bothered by people who look like Ahnold, and still can't lift one plate. Not the fattie who takes t to look like a normal person.
I think that's the spirit of VAC.
The only issue is it can't —or won't— detect people helicopter–hopping no–scope sniping around the map or terrible players who shoot you in the face every time in 12ms.
by avadodin