The User Is Always the Boss – An Opinion on Linux and Anticheat

Wow. It took them a decade to finally vibe code a shopping cart. Amazing.

I'm not sure how vibe-coding is a flex? "Programming is hard." Yeah, jobs take effort, that's why it's your fucking job! This reads like begging aimed at shareholders, because I can't imagine any PR person looking at this and thinking the customer would be happy. "We use AI, we're hip, we're the future! We're going places and we're valuable!"

It is as clear as ever that Tim Sweeny continues to completely fail to understand why Valve has such a loyal following from gamers everywhere. The overhead of running Steam is well worth the conveniences it provides that competitors don't offer. If you disagree, then you aren't using any of the other launchers either - they all center around some social network or some other reason to get you to use their software, all of them are hefty, and most of them are proprietary. Well, okay, there ARE very vocal weirdos (astroturfers) who use a centralized storefront that isn't Steam and try to argue that Steam alone is "bloat". I think it's also curious that Epic never once brings up the Steam Deck or SteamOS, which people will undoubtedly use the new Epic store with.

But I digress. There's bigger issues with this that people are not talking about.

After years and years of Linux not being able to run some mainstream live service games, the following two are, predictably, the predominant opinions you'll see from Linux users:

Who the fuck cares? I don't play Fortnite and I never will.

Finally! This will get Fortnite players to use Linux, and convince other developers/publishers to adopt Linux as well!

It's understandable. We've conditioned ourselves to want support from proprietary software vendors because it's long been the thing holding us back in the eyes of the mainstream. And if you're already using Linux, you're happy with what you have. Fortnite is not a good game either, speaking from thousands of hours of hands-on experience. There are good things about it, but it's been swallowed by the live service forever-death.

I don't want Fortnite to come to Linux. The problem is not really about Fortnite, but one of Fortnite's anticheats: EasyAntiCheat.

See, the reason we've needed support from developers to make these games work on Linux despite not getting an official port is because they use kernel level anticheat. This has a lot of problems which I'll touch on in a later section, the biggest of which is that The User Is Always The Boss. For now, all you need to know is that Linux and Windows have different kernel APIs and different architecture. WINE handles most of these, but privileged anticheats make a lot of assumptions about the software you're running that don't hold up under WINE. No amount of coercion will fix this without neutering the anticheat entirely, which is a cat-and-mouse game as hackers attempt the same thing, and anticheat vendors push updates to delay them further.

Valve asked developers to make a compromise. With the developer's permission, EAC and Battleye will use a special, unprivileged anticheat for Linux when they detect that they are running under Proton or WINE. Obviously, this defeats the whole point of having an anticheat in the kernel. If a cheater cannot crack a kernel module, they can install Linux instead.

You might then be surprised to learn that, today, almost all cheating happens on Windows. As it turns out, kernel level anticheat is total bullshit (The User Is Always The Boss). Also, pasters buying cheat software from reverse engineers don't want to switch operating systems just to play a video game. Nobody does.

Epic is not content with accepting this reality. They want their kernel level anticheat on Linux. Which means they need to trust that the kernel has not been tampered with by the user. As Windows and macOS have shown us, this is literally impossible, but that has not stopped them from trying. EACv2 is Epic's shot at bringing kernel anticheats to Linux. It will require a verified kernel running in secure boot, signed by a key that the anticheat trusts.

(I am aware that EACv2 technically does not run in the kernel and does not carry all of the security implications that entails, but the security requirements go that far, so I am calling it a kernel level anticheat.)

This is not only going to get people to install malware on potentially millions of Linux systems in the future, but it actually hurts Linux adoption.

Secure Boot is a feature on many platforms, including most UEFI-based IBM PCs, that prevents the computer from booting if the EFI executable is not signed by a trusted party. The firmware has a list of trusted public keys which it will use to verify the signature of the software it runs. Linux and Windows NT are just EFI programs, as are their bootloaders.

The original purpose of this was to deter rootkits. If you, the user, want to know that you're actually booting your operating system and not some fake chainloader that'll infect you, this is great. You can self-sign your kernel and bootloader, or use a key from a vendor you trust who signs them for you (Microsoft, Google, or Apple, in most cases). Secure Boot is a big part of anti-forensics technology on smartphones and Mac computers.

However, many developers of proprietary software have turned this around and tried to use it as a tool to verify system integrity against users. You need secure boot and a proprietary, well-known operating system from a "trusted" vendor to enjoy things like Widevine, Vanguard anticheat, et cetera. This doesn't work because The User Is Always The Boss. He or she has the physical hardware and can, sans some kind of exploit, easily ensure that it only runs the code they authorized. As an outside third party, you can't. You just have to hope that the computer reports its own condition honestly and faithfully, and that whatever walls you put up will annoy people enough they won't try to change that. Which, as history has taught us, has never worked - not for long anyway.

In the 1999 Christmas season, Eric Raymond and John Carmack both theorized in an essay on Raymond's website that in the future, we would reach a point where anticheat software will have to rely on observing player behavior in-game, and we will have to accept that closet cheaters go undetected if we hope not to ban innocent players. The point of the essay was about security design in general and how it relates to the Free Software movement, not really about video games in particular, but it's still very relevant and I would encourage everyone to read it.

We have already reached the point where people are buying external cheat devices, that use either AI vision systems or PCI DMA to cheat in games. The latter might be deterrable in part through repeated obfuscation of software updates (treadmill work), as we already do now. But many developers, such as Valve, are taking the machine-learning route. And before Valve's VACNET, they had Overwatch (the CS:GO human-moderated anticheat, not the Blizzard game). Overwatch was a system in older versions of CS:GO that sent anonymous match demos from reported players to volunteers, and those volunteers would vote on whether or not the player in the demo was cheating. VACNET was trained on years of Overwatch case files. Gamers like to whine about Valve and say they "don't care about CS", despite the obvious evidence to the contrary, and pretending they know everything without having original ideas is something the CS fanbase is truly the best at. But Valve knows what they are doing. There is a reason that the old school client-side VAC is only a userland sigchecker, and not a heuristic-scanning kernel module like EAC. They caught onto this inevitability years ahead of the rest of the industry, and are going the behavioral analysis route, as we knew would happen back in the Quake era. AnyBrain, another anticheat vendor, is rolling out a similar solution. One of my favorite shooting games THE FINALS currently uses it, with questionable success.

For anyone who hasn't read the above essay or doesn't have a solid grasp on computers, the reason we can't "just fix the cheater problem" is simply this: The User Is Always The Boss. As I've been saying throughout this article, they control their computer, and you don't. And if you think you, the developer, control their computer with your software, you are begging for a hacker to prove you wrong. Once a hacker does it, they spread the knowledge and the tools to the less dedicated users. Because a video game requires participation from the user, meaning it needs data from their machine, it is fundamentally impossible to guarantee the data they give you came from where you think it did. The only way to almost promise this is if they're playing the game entirely on your computer, such as with cloud streaming. "Trusted Computing" as we've come to know it today through closed platforms and DRM is a fucking circus act. We will go as far as electrically glitching the chips to make them more vulnerable if we have to.

It's not like Epic Games does not know better. They even admit this, though far less bluntly, in a "we know what we're doing is wrong but we're going to say it like it's not" kind of way:

I showed this to a friend of mine, and he pointed out something. In 2026, we now live in a world where an AI can (horribly) reverse engineer complex systems in under a week. Surely the vibe-coding company can tell how ironic this is? The page describing this obfuscation-focused strategy is one click away from the one admitting they let a glorified word predictor build their store.

I trust my own judgement as a programmer, and the many hackers before me, way more than I trust gamers and salesmen. And I have a theory. It's a bit radical, I admit, but hear me out.

I firmly believe that anticheat solutions are scams.

Think about it. The smartest engineers in the world, trying to stop hackers using methods that make absolutely no sense. It is an impossible problem that people throw millions of dollars at hoping it will magically be fixed. We've begun marketing games on their anticheats now. Players obsess over them, they crave them because we've normalized it. They don't have the prerequisite knowledge to understand that it's bullshit.

The developers of these anticheats do, though. They have to, cybersecurity is their job. They should know better than anyone that putting their networked code in the kernel is a security nightmare, and that it's all for nothing. Many of them are formerly cheat developers. No self-respecting software engineer with that kind of talent would bother.

Think of all of the money studios make, and how much of that goes to DRM and anticheat. Imagine how much better games could be if we stopped wasting all of that time and money on Treadmill Work. The anticheat industry is in the business of selling snake oil to developers, and convincing players that a multiplayer game cannot be fun without it. It's devious, sneaky shit.

Before live service games and centralized social media, community servers were the norm. You would find a group of strangers to play with, maybe join them regularly and become friends. This has bred a lot of braindead power-tripping admins and echo-chambers, but the flip side of this is that cheaters were a non-issue for most players. The server you were comfortable playing on had its way of dealing with them, and it was effective, because everyone looked after their own players. And if there was a disagreement, or the admins were pulling some shenanigans, you formed your own splinter group. This still happens, believe it or not. Some of my friends reading this might remember our time playing on Q3Retro, before the drama ensued.

Many of these games also had a wonderful "voting" feature, where you could vote to temporarily ban a player from the current match. This gets abused sometimes, but it's a godsend when it counts.

When I play Xonotic,