4 likes on him complaining that modlogs being public is something bad, cowards that only want to be shitty in the shadows.

They do this with Early Access and people still lose their shit about empty content and unfinished graphics in a game they paid $10 for.

To put it very simply, the 'kernel' has significant control over your OS as it essentially runs above everything else in terms of system privileges.

It runs at startup, so this means if you install a game with kernel-level anticheat, the moment your system turns on, the game's publisher has software running on your system that can restrict the installation of a particular driver, stop certain software from running, or, even insidiously spy on your system's activity if they wished to. (and reverse-engineering the code to figure out if they are spying on you is a felony because of DRM-related laws)

It basically means trusting every single game publisher with kernel-level anticheat in their games to have a full view into your system, and the ability to effectively control it, without any legal recourse or transparency, all to try (and usually fail) to stop cheating in games.

Easy, a bug in battle eye forced me to reinstall windows, this kernel access has to go.

Adding kernel malware after the fact should entitle every single owner who requests one to a full refund no matter how long has passed.

Because there are kernel-level cheats

What you proposed can very easily be bypassed without even needing kernel access by just editing the executable code that checks hashes to always return true

Modern cheats for multiplayer games don't modify local files (or attribute values in memory), since the server validates everything anyway. They're about giving you information that's available but not shown in the game (like see-through walls, or exact skill ranges), or manipulate input (dodge enemy damage, easy combos). Those cheat can run in kernel mode (or at least evade detection from user mode), so the anti-cheat needs kernel mode to be more effective.

They can prevent you from running cheats that other anti-cheats can't detect. For instance, they could modify the value in memory so that your calculated hash always succeeds even when it's modified. This doesn't stop cheating though; it just means cheaters have to use cheat hardware that exists at a layer that even kernel anti-cheat can't detect.

And then a game gets updated so the hashes don't match and uh oh, everything is fucked. Oh, but we can change the hashes of the files in the executable! Yeah, so can they. People modding shit into the executable is basically a given. Let alone the fact that you'd need to sit through a steam "validation of files" length of time every time you'd need to launch a game (because validation works exactly as you have described).

What is gained is that it has access to more information. Some cheats use an entirely different program / process that reads memory and outputs info that is available to the game but hidden from the player. Like a client needs to know where a person on the other team is to be able to draw their model. So you read that, you put a little box over where they are, and bang you have wallhacks.

You don't need to modify the files to modify data in memory.

It runs with higher priveleges than you have and can see anything that happens on your computer.

It also creates a giant additional attack vector.

Try this one.

Eli5: your PC has different access levels a program can run at. This prevents a malicious or badly coded program from completely fucking your computer. Kernel level anti cheat runs at the lowest level access that exists under windows. It can do basically whatever it wants to your PC, and if a backdoor is coded in (happens way more than you'd think), it gives malware basically total access to your PC.

It will benefit those that care and won't negatively impact the experience for those that don't.

Win, win.