Fortnite is coming to Linux

[u/TheNavyCrow]

[u/pomcomic]

I wonder what made Tim Sweeney change his mind about Linux, the spiteful prick

[u/BruhMamad → u/pomcomic]

Most likely Steam Deck and Steam Machine

[u/TantiVstone → u/BruhMamad]

Funny how he deliberately avoids naming SteamOS as a trusted distro

[u/20dogs → u/TantiVstone]

SteamOS doesn't support Secure Boot, it's not what someone would describe as having "a kernel signed by a trusted distro"

[u/returnofblank → u/20dogs]

Post also mentions some exceptions for handhelds, which I wonder how they'll accurately determine if a device is a handheld

[u/vytah → u/TantiVstone]

It's like that C++ conference slide that listed memory-safe languages recommended by NSA, and omitted Rust.

[u/needefsfolder → u/TantiVstone]

They explicitly stated that they're communicating with Valve about it though

[u/ForgetTheRuralJuror → u/BruhMamad]

Definitely. I bet there's at least a few insider devs that pushed for it as well

[u/segfaultsarecool → u/pomcomic]

Vibe coding it

[u/dpatel211 → u/segfaultsarecool]

I just saw the Twitter post from one of their accounts talking about how they revamped their games launcher by "vibe coding" the entire thing and I can't believe that they thought it would receive positive feedback lmao

[u/wolfannoy → u/dpatel211]

I just can't believe people are actually using it as a flex. If they want to normalise it, I don't think you would want to make it look it that way.

[u/arahman81 → u/dpatel211]

Don't forget the "it might be buggy" handwave lol.

Just keep using Heroic.

[u/Leprecon → u/arahman81]

Yeah, famously non buggy client heroic…

[u/LukeStargaze → u/Leprecon]

Is heroic known for being buggy? I never had a problem with it.

[u/Indolent_Bard → u/LukeStargaze]

Cloud sync and achievements are a little iffy from what I heard, for Gog as well.

[u/steakanabake → u/Leprecon]

i trust heroic over anything sweeny does.

[u/themusicalduck → u/dpatel211]

I tried it and it was super laggy and full of graphical glitches.

[u/Sparcky_McFizzBoom → u/segfaultsarecool]

Yeah, thanks but I'm not interested in having Tim Sweeney run AI slop on my hardware in kernelspace

[u/TeutonJon78 → u/pomcomic]

Decreasing revenue from Fortnite. W11 and AI HW scarcity pushing people to Linux, and Steam having a 100% monopoly in the space. And unofficial clients already make it work but prevent Epic from getting purchases. Plus people using unreal for production might want linux support for the asset part of the store.

When all your tooling and engines support Linux but you keep it off your own products due to spite or whatever, eventually the business case wins out.

[u/akio3 → u/TeutonJon78]

This might be it. A couple months ago, GOG also announced that they're finally working on making a Linux version of their launcher too.

[u/Busy-Scientist3851 → u/TeutonJon78]

I doubt people moving to Linux is causing any noticeable debt in Fornites revenue.

[u/Eremitt-thats-hermit → u/Busy-Scientist3851]

It’s not causing a dent, but releasing your game on the platform can boost your revenue. Linux lacks bug multiplayer games, the first to market will benefit the most.

[u/codespace → u/Busy-Scientist3851]

Hey! We've captured nearly 4% of the market share.

There are dozens of us! Dozens!

[u/rbmorse → u/codespace]

But not all of us play games.

[u/Omotai → u/rbmorse]

It's about 3% on Steam specifically.

[u/the_abortionat0r → u/pomcomic]

Money.

[u/Easy-Truck4725 → u/pomcomic]

Nothing. He hasn't changed his mind about anything, he just thinks vibe coding works.

[u/Dramatic_Mastodon_93 → u/pomcomic]

money

[u/Peepaw3443 → u/pomcomic]

They need more players and more engagement. They’ve tapped out every other platform and are bleeding players, which is why they never release actual player data. So the logical step is to open up to any other platform available.

They got so desperate not that long ago that they changed their policy to allow hackers and cheaters back into the game. The game is a shit show.

[u/omniuni → u/pomcomic]

Everything is AI coded now. I guess the AI kept making it compatible.

[u/Floturcocantsee → u/omniuni]

What makes me laugh super hard is all these vibe coded apps come out and for some reason the AI is really good at making it completely kosher on Linux. Like for instance, those slop coded Adobe apps have flawless wayland support and resize with no flickering or swapchain redraw funkiness it blew my mind honestly.

[u/IntQuant → u/Floturcocantsee]

Part of it is because ai writes things from scratch and can use newer languages/frameworks for this

[u/flappysack- → u/IntQuant]

I'd assume having everything open source is also ideal

[u/ElMarkuz → u/Floturcocantsee]

AI doesn't have to bother with learning obscure documentation of something devs wouldn't learn as a career investment as the market is so marginally low.

[u/Floturcocantsee → u/ElMarkuz]

I'm generally against vibecoding and a majority of AI use in software development (generally produces unmaintainable codebases). One thing I will die on the hill of AI for is using it to deal with the nightmare that is documentation. It's ridiculous the amount of time I've spent in my life reading documentation for a library or program only for it to be completely wrong or superseded by a newer version/removed. Being able to point a research assistant at the git repo and asking it questions has been a godsend.

[u/Gamiac → u/Floturcocantsee]

Yeah, LLMs are great at being essentially a super-Google.

[u/_Distrust_ → u/pomcomic]

If I’m not mistaken, DHH claimed credit as he apparently has been hounding Sweeney about it after going in deep on omarchy.

[u/pomcomic → u/_Distrust_]

ah yes, the millionnaire circlejerk, that tracks...

[u/TheOgGhadTurner]

I can’t believe Fortnite is still relevant

[u/CrashlandZorin → u/TheOgGhadTurner]

Tim Sweeny's gotta pay for his cocaine and hookers somehow, and Epic hasn't exactly had an original thought in a while...

[u/Kichigai → u/CrashlandZorin]

What are you talking about? They vibe coded the Epic Games Store to launch nominally faster than Steam! Not even Valve could have come up with that idea! /s

[u/ldn-ldn → u/TheOgGhadTurner]

Fortnite has about the same amount of monthly active users as the whole Steam with all games combined.

[u/TheOgGhadTurner → u/ldn-ldn]

3 million does not equal 11 million. That’s an impressive number that Fortnite still has but there’s still 11 million users on Steam that math does not math.

[u/ward2k → u/TheOgGhadTurner]

Fortnite has 110 million monthly active users

Steam has around 132 million monthly active users (with rumours it's now at 200 million)

I'm not sure where you got 3 and 11 million from

[u/SeroWriter → u/ward2k]

I think you both just googled the numbers and took the first result without knowing anything about their accuracy. These numbers are not publicly reported and there is no reliable way to estimate them.

A more trustworthy metric would be revenue. Fortnite earned 5-6 billion dollars in 2025 and Steam earned 15-20 billion, so Steam is 3-4 times bigger than Fortnite.

Obviously these numbers don't line up with your player counts which likely means that they're inaccurate or at least inflated in some way.

[u/ward2k → u/SeroWriter]

These numbers are not publicly reported and there is no reliable way to estimate them.

No? Steams figures come directly from steam themselves lol. So I'd say it's accurate

While Fortnite hasn't published results every single estimate online comes up to about the 110 million figures, so it's the best estimate we have

Fortnite earned 5-6 billion dollars in 2025 and Steam earned 15-20 billion, so Steam is 3-4 times bigger than Fortnite.

Fortnite is a free game, Steam is a marketplace. Of course steam makes more revenue

[u/KaydaCant → u/ward2k]

CCU: (daily peak)

Roblox: ~2.5 million (estimated)

Fortnite: 1.9 million

CS2: 1.2 million

CS2 and Dota 2 combined beat fortnite, which should make sense. Add aion 2, deadlock, and pubg and steam beats roblox.

[u/steve09089 → u/ward2k]

But that isn’t just PC, no?

[u/ward2k → u/steve09089]

Steam? Yes just PC

Fortnite? No, across all platforms

[u/Key_Sense9870 → u/ldn-ldn]

This^{^} it's huge. Together with minecraft, that is also a billion years old. 

[u/SausageKingOfCincy → u/ldn-ldn]

Dang you are right, thats wild.

[u/fortnut159 → u/TheOgGhadTurner]

It’s not only for fortnite any game with easy anti cheat can benefit from this

[u/TripleSecretSquirrel]

I've never played Fortnite and I'm not interested in playing it ever. I also don't care for Epic Games, but I think this is a clear win for Linux!

Easy Anti-Cheat is one of or perhaps the biggest/most common anti-cheat engines in gaming today, and basically every AAA game title requires their anti-cheat engine to run. Even if the game itself is Linux-compatible, if the anti-cheat isn't, then you can't run the game. In the past couple years, all of Valve's work on Proton means that basically every Windows game now runs flawlessly on Linux too... with the exception of anti-cheat engines.

I have a handful of friends who are big PC gamers and that's the last big excuse they have for staying on Windows. I don't expect that they'll all finally jump ship for Linux now, but some of them will!

[u/EZtheOG → u/TripleSecretSquirrel]

Tbh - I have 1 windows gaming laptop to play 3 AAA games that require EAC.

If they get EAC working in Linux? I’m assuming this opens up the other AAA games that use this to be playable on Linux. EAC is my only real blocker now.

[u/Sad-Cod-9584 → u/EZtheOG]

EAC already works with linux just fine. The devs literally only have to flick a switch that says "allow linux". What epic are doing is kernel-level anti cheat on linux, meaning they want to install a root kit to 'keep their games safe'.

[u/nightblackdragon → u/Sad-Cod-9584]

All Linux anti cheats including EAC work in user space which means they are way less efficient than kernel anti cheats. Also they won't move EAC to kernel module, they will utilize Secure Boot and eBPF for better protection.

[u/FathomRaven → u/Sad-Cod-9584]

EAC "worked" on Linux, but was generally considered much less capable than the windows version. Also, from what I'm seeing, EAC isn't actually going to be installing a kernel level anything, it's just going to be verifying that the kernel is unmodified. I think that's a pretty good win

[u/zzazzzz → u/Sad-Cod-9584]

"working" is doing a loooot of heavy lifting there bud.

EAC on linux is currently utterly useless and fully usermode. might as well not exist when even the most basic cheats can just get around it.

[u/DragonSlayerC → u/TripleSecretSquirrel]

The biggest issue with this right now is that it won't work on the Deck. The Deck doesn't have proper Secure Boot support, which is understandably a requirement for this anticheat. Hopefully Valve finally implements Secure Boot after this announcement.

[u/FineWolf → u/DragonSlayerC]

The Deck doesn't have proper Secure Boot support

It actually does.

It ships with an empty key hierarchy by default, and is in SetupMode, but the firmware fully supports Secure Boot, and you can enrol your own PK and then enrol whatever KEKs/DBs/DBXs you want (your own, your distro's, or Microsoft's for Windows) and the firmware will properly do all the things it is supposed to do.

The problem with the Steam Deck is that the UEFI setup user interfaces do not have any toggles for the user to manage Secure Boot. So if you do enrol your own PK and key hierarchy, you better know the UEFI APIs to unregister your PK and clear the key hierarchy, or else you are stuck with Secure Boot in UserMode with no way to turn it off or put it back into SetupMode without reflashing the EEPROM.

I run Secure Boot with CachyOS on my Steam Deck using my own keys with no problem (mostly because I have LUKS with TPM-auto unlocking; and I want to prevent a bootloader swap from being able to steal my keys on boot; thus only images I signed can run).

[u/fat_kaiju]

I suspect they're doing this because game consoles are eye-wateringly expensive and younger folk tend to have a lot of hand-me-down computers/laptops/'machines'.

[u/F9-0021 → u/fat_kaiju]

They're doing it because of the Steam Machine and similar boutique systems. If they cared about low end hardware, they would have brought it to Linux years ago, and they also would have bothered to optimize Fortnite and the engine it uses.

[u/sharktail_tanker → u/fat_kaiju]

Most hand-me-downs won't have TPM or secure boot

[u/cookie_tech → u/sharktail_tanker]

Nearly every computer made in the last decade has TPM 2.0. I’d wager a majority of hand-me downs have TPM 2.0

[u/Fr0gm4n → u/cookie_tech]

We have a couple HP Z440 workstations that got taken out of use due to TPM 1.2. Turns out there is an upgrade path to TPM 2.0 by downgrading the firmware, using a tool to activate TPM 2.0, then updating the firmware. I'm plenty technical enough to do that but I'm sure a lot of end users that got these as hand-me-downs and after business inventory refreshes aren't.

[u/rdqsr → u/Fr0gm4n]

fTPM support can be hit or miss as well I've found. My last gaming machine had fTPM but it basically didn't work in Linux for one reason or another (likely something ACPI related). Granted I never bothered to update the UEFI firmware on it either so it might've had some bug that was fixed in a newer revision.

[u/Pyryara → u/sharktail_tanker]

I recently received a hand me down intel 5th gen, that doesn't even support windows 11 but it has a TPM module. Anything without TPM by default likely can't run Fortnite or any modern 3D game anyway.

[u/levkushtym → u/Pyryara]

I am enjoying my 2x xeon e5-2690s and a 1070 ti. No secure boot or even UEFI but good enough

[u/Chromiell]

Not my cup of tea since I don't play online games anymore, but hey, Linux is about choice and finally having the choice to play Fortnite on Linux is certainly welcomed, even though it will come with a rootkit.

[u/jdog320 → u/Chromiell]

If we define the rootkit as a kernel module, it literally says so on the first FAQ bullet point that they do not utilize a kernel module for the anticheat:

Does EAC Linux v2 use a kernel driver?

No. EAC Linux v2 does not install or load an anti-cheat kernel module. It uses security features already provided by the Linux kernel, together with an anti-cheat systemd service and eBPF programs.

While it sucks that you need to disable some linux features, according to them, you can just create a separate bootloader entry that disables kexec, enables the lockdown thing amongst other things. Certainly a compromise of inconveniencing the user to reboot if they want to play fortnite as opposed to creating a kernel module blob. We'll have to see if this implementation actually works in the real world.

[u/PMARC14 → u/jdog320]

It seems like a really solid design to have a low-level anticheat on Linux, and much preferred over dealing with how windows does it. I already restart anyway either on windows and enabling the services, or from Linux to windows if I want to play the game, it isn't much a loss if you want to play these sorts of games.

[u/jdog320 → u/PMARC14]

Yeah it's probably the best that they can come up (for now) with without upsetting the community with a kernel module that will probably be more intrusive. I do wonder though, if somehow a cheat dev manages to sign their cheat with a "well-known" key? What happens then?

[u/MorallyDeplorable → u/jdog320]

realistically they're introducing the same driver exploit cat and mouse game Windows had with things like winring0 and cheaters will be able to exploit drivers from root to get kernel access for the next decade without even worrying about having a signature

[u/chocopudding17 → u/jdog320]

That is some squishy wording around "kernel module" and such. eBPF is far more like kernel code than userland code. It's a little blurry, but still. Sketchy.

[u/shadedmagus → u/Chromiell]

It looks like they're planning on using capabilities already within Linux to extract user data, from a cursory read.

[u/DragonSlayerC → u/shadedmagus]

Yeah, it's just BPF LSM, which is used by various security modules like CrowdStrike Falcon and KubeArmor. It lets the BPF program read kernel data structure metadata, read the the systems memory (including both kernel and user space memory), and allows the program to block certain operations, like reading a sensitive file (it does not have arbitrary write access). It has way less access to the system than the kernel modules that they have in Windows, which allows the program to effectively do anything it wants there.

[u/oppai → u/Chromiell]

the word rootkit has lost all meaning

[u/New_Alps_5655]

Would a self signed Gentoo kernel with keys enrolled in TPM also work? Not that I'm ever going to play fortnite, just curious.

[u/Keelock → u/New_Alps_5655]

No, the cryptographic chain of trust starts with a root key they trust, and a self signed cert doesn't prove the kernel isn't enabling cheats, it just tells your motherboard TPM you trust it, which lets it boot.

[u/carsncode → u/New_Alps_5655]

When they say "signed by a trusted distro" they mean trusted by them. They don't care if it's trusted by you.

[u/temporary_legging → u/New_Alps_5655]

Judging by the 'signed by a trusted distro' bullet point, probably not. They will almost certainly check against a hardcoded whitelist of vendor signing keys rather than trusting locally enrolled MOKs.

[u/que11]

Damn, avoiding kernel level BS anti-cheat is one of the perks of using Linux.

[u/Shished → u/que11]

They are basically replacing the kernel driver with the same thing. eBPF programs are running in a kernel space and can read all user space memory.

[u/Fulrem → u/Shished]

There is a world of difference between the code of a kernel module and a sandboxed eBPF program. If you had ever had to fight with the eBPF verifier when writing a program you would understand this.

[u/Eldritch800XC → u/Shished]

No game is worth installing an ebpf watchdog on my private system. Not that I wanted to play Fortnite anyway, so nothing lost here...

[u/GameKing505 → u/que11]

The main perk of Linux is choice. And you can just choose not to play this game.

[u/Sufficient_Day627 → u/GameKing505]

Even when I was on winslop I made the choice not to play that garbage.

[u/PacmanAteMyRAM → u/que11]

No, it never has been. You can avoid them on Windows too. Letting people make the decision to play them here is a good thing.

[u/KayJune001]

“TPM 2.0 and Secure Boot Required” yeah im out.

[u/Unusual-Alex → u/KayJune001]

Thats also a hard "no" from me. Not that it matters i havent touched fortnite in several years.

[u/Moist_Professional64]

No hibernation with kernel lockdown 😭

[u/red-lichtie]

Nope, not giving EA games eBPF access, ever.

[u/neoneat]

I dont wanna gate keep, but pretty sure it's still kernel-space level anti cheat, right?

[u/Leonardodafernandez → u/neoneat]

Absolutely, and BPF LSM actually gives control of your machine to the anticheat 

Linux kernel docs: 

"BPF programs allow runtime instrumentation of the LSM hooks by privileged users to implement system-wide MAC (Mandatory Access Control) and Audit policies using eBPF."

[u/MatchingTurret]

This means you can't enroll your own Machine Owner Key (MOK) to sign modules. Fedora's akmod won't work for this.

[u/Bitdomo92 → u/MatchingTurret]

I wonder how can we install nvidia drivers now, which is built against the kernel source, and we cannot sign it with a "trusted" singing key for secure boot.

[u/Ok-Eggplant-7569]

Maybe post a link to the official blog post as well: https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2

[u/chibiace]

then they will want age verification, the distros will only be corporate owned ones, can only install applications from the approved app store.

[u/SmurfingRedditBtw]

While I don't care about Fornite, this is about EAC getting better Linux support, which is an anticheat used by a lot of popular games. That could be great progress for gaming on Linux, and if it works well I imagine many other ACs will take a similar approach. Plus it's not using a kernel level anticheat, which is even better.

[u/uzlonewolf → u/SmurfingRedditBtw]

it's not using a kernel level anticheat

It is a kernel level anticheat, it's just using the kernel's existing eBPF framework instead of a new module.

[u/Sad-Cod-9584 → u/SmurfingRedditBtw]

This is making it a kernel level anticheat, hence all the fuss required to make it work.

[u/icehuck → u/SmurfingRedditBtw]

While I don't care about Fornite, this is about EAC getting better Linux support, which is an anticheat used by a lot of popular games. That could be great progress for gaming on Linux, and if it works well I imagine many other ACs will take a similar approach. Plus it's not using a kernel level anticheat, which is even better.

This is the first step in taking away the users abilities to control their own machine. You'll have a bunch of idiots who don't care about anything except getting free windows to play their games. They'll scream it on the top of their lungs about how great it is, and chase anyone else away.

[u/magnusmaster]

You think you were safe from Google Play Integrity on PCs? Think again! I'm sure Epic has good intentions here, but Google won't when they implement Play Integrity on Linux the exact same way Epic is implementing their anti-cheat. Then the World Economic Forum can just force all approved distros to ask for everyone's IDs.

https://www.cl.cam.ac.uk/archive/rja14/tcpa-faq.html

[u/Sufficient_Risk_8127]

YOU CAN EAC SHIT, EPIC

[u/notkizil]

is this supposed to be good news or bad news

[u/Busy-Scientist3851 → u/notkizil]

It's good news but people are somehow spinning it into a negative because it requires some of the same stuff it does on Windows like secure boot.

[u/redinktea → u/notkizil]

Aladeen

[u/oneiros5321 → u/notkizil]

I mean good news?
If you don't play it, that changes nothing for you...and for those who do play it, that's an opportunity to fully jump away from Windows.

[u/sryidontspeakpotato]

I’m happy to see more games coming to Linux, since Fortnite is one of the biggest I’m sure plenty will now see how many people are just sick of windows and we’re only holding back switching to Linux because they can’t play the games they wanted. That’s been several people’s holdout I know. They dual boot but they’ve had a few issues with dual booting so they’ve been ready to just stop needing to even switch between os just to play 1-3 games lol.

[u/The__Toast → u/sryidontspeakpotato]

It's weird that we're focusing on Fortnite here and not EAC being ported to Linux, that's huge. EAC is used by way more that Fortnite: Rust, Apex, Rocket League have all been pinned to Windows because of EAC.

Anticheat has been basically the last really big blocker to full Linux gaming.

This is a massive shift in the Linux versus Windows situation. Way bigger than one game.

[u/0nlyCrashes → u/The__Toast]

Rocket League is fine on Linux? I played it last week with no issues on CachyOS. Is it just the Epic Version?

[u/The__Toast → u/0nlyCrashes]

Actually great point and sent me down the google rabbit hole. I guess Epic already ported EAC to Linux a few months ago which is when Rocket League got support.

This specifically is a new version of EAC that's apparently much closer to the Windows version. Why Epic migrated Rocket League and not Fortnite I can't say, but I guess that's my confusion.

Rust still has not allowed proton players because of the lack of EAC support on Linux.

[u/RileyInkTheCat]

All those requirements just sound like a way to normalize locking down your distro. No way I am doing that crap ever.

Also how is Fortnite still relevant???

[u/Indolent_Bard → u/RileyInkTheCat]

Same reason as Super Smash Bros. Because every day they're adding new crossovers and celebrities and events.

Now John Wick can headshot Sabrina Carpenter before getting 360 no scoped by Goku, who gets ran over by a car driven by Aang from The Last Airbender, while Freddy Fazbeaer teabags Hollow Knight before Peter Griffin beats Charlie Morningstar from Hazbin Hotel to a rare gun and kills them both. Meanwhile, Godzilla is duking it out with Hatsune Miku. Doom Guy crosses swords with Kratos. Thanos lays the smackdown on Sonic the Hedgehog.

No, these are not mods. This is all real. It's basically third-party Smash Bros, everyone is here!

[u/Cold_Soft_4823]

all this to play a shitty toxic video game made to siphon as much money from children as possible lol i'm good.

[u/Waaytoomanytakenames]

Well that's good!

Not touching that shit but the more games come to linux the more support there will be for the kernel in general

[u/Dwedit]

Usually with secure boot, you do not have kernel modules signed by a third party, they are self-signed. It seems that this is explicitly banning building your own kernel modules and self-signing them?

[u/ZuriPL → u/Dwedit]

yes, and it shouldn't be surprising.

The point of secure boot is to validate the kernel modules don't contain any malicious stuff, where in this context malicious stuff would be cheating software. And you, as the user, can't be the trusted to claim your kernel modules don't contain cheats.

[u/andymaclean19]

The killer part here is where it says that NVIDIA and other drivers need to be signed with a trusted key too. To most of us in r/linux that's the key we added to our BIOS which allows us to compile up drivers and sign them. For me it's in /var/lib/shim-signed/mok. THat's a trusted key.

FOr an anti-cheat I think their idea of a trusted key is what they say about the kernel. They mean all the drivers need to be signed by Ubuntu, Fedora, Debian or whoever. Basically signed by someone *they* trust.

So you can only play fortnite if you want to give up your ability to compile and run your own kernel drivers at all. That's bad news for my ex_su_axb35 driver which controls the fan speed curves on my hardware, for example.

I wonder how well the Linux community will take to restrictions like this. The 'tourist' crowd who essentially moved away from Windows and on to 'Not Windows' because a youtuber did so first probably don't care. But the actual Linux community? Will any of us be running this?

[u/imcheatingbtw → u/andymaclean19]

i think the Linux users who will be playing Fortnite and the Linux users who are compiling their own kernel drivers are in two completely seperate camps

[u/AthleteMindless7569 → u/imcheatingbtw]

The problem is not that if other games starts to follow the same path then its over

[u/powerslave_fifth → u/andymaclean19]

How many of the "actual Linux community" are bothering to compile their own kernel and drivers?

[u/Mammoth-Charge2553 → u/andymaclean19]

We're gunna start seeing "nvidia signed" kernels where it uses your gpu's compute in the background to generate memes for boomers

[u/pxgaming → u/andymaclean19]

From the replies, it seems a lot of people don't understand that "compiling your own kernel and drivers" includes having the distro handle it automatically for you via DKMS. This covers things like ZFS where most distros don't ship a precompiled binary because of licensing incompatibilities, but you can still install it like a normal package. You just don't *see* the fact that it's building from source, because the entire point of DKMS is to automate that. Linux does not have a stable ABI, so it's not like hardware manufacturers can just release a driver and get it signed like you can on Windows - it would need to be built for every kernel version shipped by every major distro and signed appropriately.

[u/Luculus04 → u/andymaclean19]

First reason to not do it is they require secure boot and tpm2.0 where many tourists that moved away because they cant get win11 due to lacking tpm2.0

Also secure boot on linux in my experience so far caused far too many problems then its worth if you can just have it off and not have any at all.

But thats just my take as someone that used it for just a year so far.

[u/CosmicTurtle24]

2021 me wouldve been so hyped

[u/An1nterestingName]

Secure Boot enabled

So it might as well not be coming.

[u/nostalgica1 → u/An1nterestingName]

Yeah, the little hype i had died when i seen all the stuff you have to do to play it

[u/Sad-Cod-9584 → u/nostalgica1]

They want to make it kernel-level with all the verification required to keep it signed and unmodified. Which is asinine. 

[u/VoodaGod]

would it be possible with multikernel to run both a trusted signed kernel for the game & anticheat and the whatever kernel i normally use?

[u/RedditFireBall]

I'm too much of a beginner so um why would TPM 2.0 be needed ? It runs perfectly on Windows 10 machines without tpm 2.0

[u/gmes78 → u/RedditFireBall]

That's because they don't want to punish people on older machines. But requiring the TPM was always the goal, as it does make it much easier to verify the integrity of the system.

On Linux, since there's no (real) previous version of the anti-cheat, requiring the TPM from the start is not as disruptive.

[u/Grandmaster_Caladrel]

This is terrible news! It's a domino towards me playing League of Legends again!

[u/Marcelocochon]

I don't mind. Fornite sucks

[u/Leonardodafernandez]

Linux kernel docs: 

"BPF programs allow runtime instrumentation of the LSM hooks by privileged users to implement system-wide MAC (Mandatory Access Control) and Audit policies using eBPF."

Yeah, fuck Epic games and their Spyware

[u/Gullible_Service_365]

So my custom built kernel won't work? Also I have secure boot off because the motherboard manufacture only supports Windows keys

[u/msthe_student → u/Gullible_Service_365]

motherboard manufacture only supports Windows keys

pretty sure that's not WHQL compliant

[u/Jealous_Diver_5624 → u/msthe_student]

It is, enrollment of custom keys and shipping of the third party MS key has been optional for a couple of years.

[u/king-kongus]

I'm never turning secure boot on anyways so does not matter. Kernel level anticheat is just too invasive for me. I moved to linux to get away from this kind of stuff.

[u/ElasticSpeakers → u/king-kongus]

yep, requiring Secure Boot is madness and kinda lazy

[u/LordDarthSaber]

Can someone explain what's the problem with secure boot enabled like I don't think thats a bad thing in general

[u/Jethro_Tell → u/LordDarthSaber]

Most likely it’s the stipulation that it’s a trusted OS kernel. So Ubuntu or fedora/redhat. Signed with a cert chain that starts with Microsoft I believe.

So if you’re me and you run arch and sign your own stuff with your own keys then it still doesn’t work. This doesn’t bother me but I assume that’s the main thing that people are balking at. Maybe it’s the extra work but Linux people have never balked at doing hard things the hard way.

On the other hand, I’d rather dual boot a second Linux distro for gaming than a windows install. Nice with file system and config overlap. So for me this is a non issue but I can see why people don’t love the path here.

[u/FineWolf → u/Jethro_Tell]

Signed with a cert chain that starts with Microsoft I believe.

No. There's no requirements for that. The keys could be the own distro's keys for the KEKs and DBs, you'll just have the responsibility as a user to enrol them using sbctl or other tooling provided by the distro.

There is absolutely no requirement that Microsoft be part of the signing chain.

[u/sernamenotdefined → u/Jethro_Tell]

This, I roll my own optimized kernel. Optimizations for my architecture. Only drivers I need baked in, hardly any modules.

I know the need is less than in the past where I ran with performance patchsets from some kernel maintainers because every cycle counts if you have models that run for days. Optimized streamlined kernel, hand optimized models etc...

[u/Alia5_ → u/Jethro_Tell]

The nice thing is, you can just boot a different kernel, on your same OS install

[u/steve09089 → u/Alia5_]

That depends on whether the distro you chose is one that is going to ship a signed kernel, and whether that signed kernel comes with modules to run the hardware you have.

[u/eattherichnow → u/LordDarthSaber]

Secure boot doesn't bug me, but the requirement that a kernel is from a shortlist does. Though it doesn't affect me directly (I don't play Fortnite) it does bug me that this could be normalized.

[u/saturnv11 → u/LordDarthSaber]

I'm not an expert, but it sure makes installing a new OS a pain in the ass.

[u/Nejnop → u/LordDarthSaber]

I can't dual boot if it's enabled. Also disables some drivers on Linux for me (like wifi).

[u/Cienn017 → u/LordDarthSaber]

the same "you will own nothing" that android has but for computers.

you will be blocked from modifying your system and programs will refuse to run if you don't enable it, just like android.

[u/WolvenSpectre2 → u/LordDarthSaber]

• The SecureBoot code is not maintained like it should be
• TPM/SecureBoot is largely a Microsoft headed project
• The TPM is an Oxymoron. They don't trust you with the keys and the TPM module can be hardware profiled/fingerprinted and can be tracked when you attempt to be anonymous
• Credentials that can allow code execution on you machine are known by hackers and actually make your PC more vulnerable
• TPM/SecureBoot can allegedly be used to make your files inaccessable to you as though you were cryptojacked.

[u/FineWolf → u/WolvenSpectre2]

• The Secure Boot code is not maintained as it should be

False. First, most of it is handled by your UEFI firmware, not your bootloader. And for the part handled by your bootloader, GRUB and systemd-boot have excellent support. Secure Boot is often used in the server/enterprise space, both of which supports financially the implementation of it.

• TPM/SecureBoot is largely a Microsoft headed project

TPM standards are driven by the Trusted Computing Group (TPG), and Secure Boot is a UEFI standard.

It is a myth that both of those are Microsoft standards, they are not. Microsoft participated as a member of both consortium, but they are not leading the effort at all.

• The TPM is an Oxymoron. They don't trust you with the keys and the TPM module can be hardware profiled/fingerprinted and can be tracked when you attempt to be anonymous.

The point of the TPM is two fold:

• Provide a means to attest the firmware state and establish root-of-trust from the hardware upward. That's using the endorsement key hierarchy. The keys are indeed from the manufacturer for that specific key.

• Act as a HSM to hold your keys. That's a separate key hierarchy called the storage hierarchy that you fully control.

• Credentials that can allow code execution on you machine are known by hackers and actually make your PC more vulnerable

Everything uses assymetric encryption. Kernel images are to be signed using private keys you or "hackers" don't have access to.

This point is pure hogwash. FUD. Pure and simple.

• TPM/SecureBoot can allegedly be used to make your files inaccessable to you as though you were cryptojacked.

Rolls eyes. If you:

• Deliberately, as a user, use LUKS full-disk encryption.
• Deliberately, as a user, setup LUKS to ONLY use a TPM backed keyslot tied to a specific PCR value.
• And the PCR value changes due to a system configuration change.

Then yes. But you, as a user, deliberately made that poor choice.

EDIT: OP has replied and then blocked me. You know someone has rock solid arguments when they don't even want to discuss. Bad faith arguments as always. So I will address them here:

Most of the code is maintained by Microsoft

Microsoft doesn't write UEFI firmware, nor does UEFI Consortium publish a reference implementation. Most of the Secure Boot implementations out there are written by AMI and INSYDE CORP., the two biggest suppliers of UEFI firmware that motherboard manufacturers use. The UEFI consortium simply provides Test Tools to make sure your implementation matches the spec.

TCG does have a reference TPM implementation, but Intel is known not to use it, and AMD uses a heavily modified one.

The base code is not maintained to the level it should be and known exploits and certificate cloning have not been addressed in it for the past 5 years.

[CITATION NEEDED]. There are some certificates that were indeed leaked, and they were promptly added to DBXs as updates. An anti-cheat solution can verify that the DBXs are up-to-date by inspecting the EV_EFI_VARIABLE_DRIVER_CONFIG events of an attested log.

Yeah, the UEFI standard just favors Microsoft Software and technologies and implements their features with little or no room for competition

PCs tend to ship with Microsoft certificates as default yes. But there are plenty of other industries and other devices where Secure Boot is implemented, and no Microsoft certificates are used.

There is nothing in the specification that forces motherboard manufacturers to ship Microsoft certificates. The only reason this happens on PC hardware is that 90%+ of the user base installs Windows. There's nothing stopping you from putting your board into SetupMode, and loading your own keys.

BTW, the Linux Foundation is a UEFI consortium contributor. So is Canonical and Red Hat.

and as an IT professional on the Windows Platform I know very well what it does

In your context, it allows you to make sure only company hardware is allowed access to company resources. That's a good thing. And yes, it does that through the endorsement key hierarchy.

Oh really, this is just the most recent issues

• https://linuxsecurity.com/features/2-secure-boot-exploits-discovered
• https://www.binarly.io/blog/signed-and-dangerous-byovd-attacks-on-secure-boot
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secboot-UqFD8AvC

Not issues with Secure Boot, but issues with bootloader software signed by Microsoft. That said, that's exactly why the forbidden database (DBX) mechanism exists: to blocklist/revoke bootloader images with known exploit. Software is not perfect.

What I was speaking of was an encrypted volumetric sytem that had trusted their keys to the TPM, and then had those keys, and I point this out that this is ALLEGEDLY, they change your passphrase and then reset the TPM thus leaving you with no way to decrypt your PC, and this is a risk of an always on PC like a server, because the passphrase has to propagate.

So you state that you are "an IT professional on the Windows Platform I know very well what it does", and you don't even understand how people get locked out specifically of Bitlocker.

That happens when:

• A user doesn't know their recovery key (which is a static keyslot set in Bitlocker alongside the TPM-backed keyslot)
• One of three things happen:
  • The user's system configuration changes in such way that (by default), PCR 0,2,4,7 or 11 changes, thus preventing the TPM from releasing the key to the OS (as the key is locked to specific PCR values)
  • The user deliberately resets their TPM storage hierarchy
  • The user changes their CPU (thus changing their fTPM).

At no point is the passphrase changed, at no point is anything syncing to a server or propagating (as the recovery key doesn't change). As for the "server" part, recovery keys on Windows CAN optionally be synced, either to Microsoft's server or to the attached enterprise Entra ID / Active Directory.

The user always has the option to add a password key slot to their Bitlocker partition using Add-BitlockerProtector, provided they have administrative access to their computer (which is not the case on business provided laptops normally).

The keyslots are only used to unlock a master data key, and that master data key never changes (as it is the key used to actually encrypt/decrypt the data).

LUKS on Linux follows a similar architecture. Keyslots are used to unlock a master key, which is then used to encrypt/decrypt data. You can absolutely have a TPM backed keyslot, and the same thing can happen to it.

And in both cases, the choice of encrypting the disk or not has absolutely nothing to do with the TPM. The TPM is only used for one specific type of keyslot, to support auto-unlocking on boot if the system is in a good, known operating state.

In both cases, TPM or no TPM slot, a software with administrative / root access can change your keyslots without your permission, locking you out of your data. The solution, in both cases, is to keep a backup of your headers, and don't trust shitty third-party software (or don't use full disk encryption if you don't see a benefit. I do, because I see the benefit).

this is a risk of an always on PC like a server, because the passphrase has to propagate

Technobabble. Why would full-disk encryption on a server be any different than on a non-server PC? What does "passphrase has to propagate" even mean? Servers often use HSM backed keyslots (PKCS#11) for full-disk encryption, backed by a dedicated HSM appliance. But from a technical perspective, it's a keyslot like any other. There is no "propagation".

Bitlocker specifically has TPM+PIN keyslots / protectors, where the PIN portion of the TPM+PIN slot can be network supplied via a DHCP field and a WDS server, but that's an entire different process, and the network administrator has the responsibility of enrolling devices and managing keys. Either way, there's also no "propagation" here; at bootup you either have the right PIN provided to you via DHCP+WDS, or you don't and the user is prompted for the PIN.

So in short, how are those Microsoft-Os you are having with your corporate breakfast, because you just seem to be eating the company line right up.

I'm a Linux-only user. The only Windows machine I have is the machine provided by my employer for work. All my Linux PCs are running with Secure Boot and Measured Boot, with Secure Boot in DeployedMode with my on CA, and no Microsoft key in sight.

[u/OatmealCoffeeMix → u/LordDarthSaber]

As I understand it, TPM is like putting a lock on your car which ultimately isn't yours.

Sure, you are given A key but it isn't THE key. It can open the lock with the approval of the true lock owner. That is fine if you can fully trust the lock's true owner.

Any sane person will eventually start to question that trust assumption though.

If they care enough, they'll do the research and, inevitably, it's rather obvious that the only person truly locked out of their car is the dummy who put a lock they don't fully own on it.

[u/soulfirethewolf → u/LordDarthSaber]

It’s a political thing. It’s a genuinely useful protection against malware that involves tampering with an OS. But it’s also controversial among greater open source enthusiasts because it essentially enforces specific operating systems via cryptography.

[u/GetsDeviled → u/soulfirethewolf]

It's kinda controversial because it puts in Microsoft's role in the trust chain.
You give them power over what's acceptable and what's not.

Perhaps Microsoft will break your distro for nuisance, and that won't be the first time.

[u/Suspicious_Kiwi_3343 → u/GetsDeviled]

Secure boot doesn’t necessarily have anything to do with Microsoft. Their keys are just distributed by BIOS manufacturers by default. You can load your own keys, or in the case of EAC you will be able to load other 3rd party keys they trust like fedora, Ubuntu, probably valve/steamOS.

[u/dragonitewolf223 → u/GetsDeviled]

This isn’t the case if you are not using Microsoft’s public keys, but realistically that is probably where this is headed.

[u/Nervous-Cockroach541]

I'm glad they're considering expanding their products to other platforms. I still won't play fortnite because it's a crappy game. But there are some security and privacy concerns that need to be addressed:

1. What system information, process metadata, and security events does EAC collect?
2. What data leaves the user's computer, who receives it, and how long is it retained?
3. Can eBPF programs observe unrelated applications, and what restrictions prevent over-monitoring?
4. Will the anti-cheat components be open source or independently audited to verify their behavior?
5. Can players use a separate gaming boot configuration without changing the security or configuration of their everyday environment?

I'm still concerned that a whitelist of "trusted" providers creates a governance issue. Kernel lockdown could also prevent legitimate administrative tasks.

Requiring all drivers and kernel modules to be signed could create a barrier for people using hardware not directly support by their distro, if you have uncommon hardware where you have to install the driver from the manufacture or third-party community driver, you'll be out of luck.

There's some real freedom and privacy trade offs with this, pretending there aren't is naive. But it's probably gives people who care about these games more freedom then just remaining stuck on windows.

[u/comradecannot]

What does "trusted key" mean? on distros that don't ship signed drivers you need to self-sign your drivers which can never be trusted by an anti-cheat.

[u/The_Real_Kingpurest]

Had to disable secure boot for nobara, and for my steamos box so I do t think this will be available for me :)

[u/3lfk1ng]

The Secure Boot requirement basically kills this.

[u/AlreadyReddit999]

Secure Boot enabled in BIOS

nope. i'm good

[u/Windy--]

All of this is completely antithetical to the spirit of Linux and open source.

[u/CybyAPI]

TPM? Yep my pc is already not supported😂🥀

Good thing i dont give a fuck about fornight

[u/oneiros5321]

Not for me, but I'm sure this will get other devs to do the same for their games and will bring a lot of people to Linux.

I see a lot of people saying that it is not a good news...if you're fully on Linux, you probably didn't care about Fortnite in the first place so it changes nothing for you.
It's a great news for those who play it and are stuck on Windows because of it though.

[u/Professional-Tap177]

Fucking hell, please let me use my own kernel ffs

[u/DeliciousIncident → u/Professional-Tap177]

That's the thing - they want the kernel not to be modified in any way, to prevent cheats. So no way they will let you do that.

At least you can dual-boot - have a separate Linux install just for gaming.

[u/Luigi003 → u/DeliciousIncident]

Only a separated Linux kernel for gaming, the same install otherwise

[u/sCeege → u/Professional-Tap177]

I have to imagine the overlap between Linux users that use their own kernel and people that play Fortnite of all games, would be pretty abysmal? I really feel like this affects very few people outside of people with a Steam Deck and the new console they made recently right?

[u/MelioraXI]

I don't really care for Fortnite but its a big step for gaming with anti-cheat on Linux however.

[u/Isacx123]

A kernel signed by a trusted distro

I don't play Fortnite but that is bad, custom kernels and community distros are getting the boot.

[u/Sync1211 → u/Isacx123]

You can switch kernels at boot time, so it's not that big of a deal.

And community distros can apply to be trusted as well.

The game publishers need some way to trust the game client and using standard kernel security features is a great way to do this.

I see this as an absolute win.

[u/Ismokecr4k → u/Isacx123]

It's that or kernel level anti-cheat. I think it's a good compromise IMO

[u/shdwchn10 → u/Ismokecr4k]

eBPF program is still a kernel level anti-cheat

[u/Bitdomo92]

So forget singing your own custom kernel like on gentoo, or using a distro which isnt debian ubuntu opensuse fedora. We are one fucking step away that PCs are becoming what mobile phones are now with locked bootloader and dogshits.

[u/fvancesco → u/Bitdomo92]

we're always gonna be able to do what tf we want (I hope so) but it might make some people switch, people switching > more support to linux

agree on the phones tho

[u/Sbatushe]

This is epic!

But well.. i'm against TPM and secure boot. And i also use UEFI and have an unisgned kernel. I want my kernel (and PC) to boot and run as fast as possible

[u/selvestenisse]

whatever shrinks windows market share the better. but im not reinstalling to get secure boot enabled.

[u/berkough]

Just a shade under a decade, and after all of Tim's crying and bitching about open platforms, he's finally bringing it to Linux.

[u/throw4way4today]

"Secure boot' and 'linux' in the same sentence does make me laugh

[u/Sahelantrophus]

if they're anal about the anticheat only running in userspace then this isn't a terrible compromise at all. sucks that from now on it's the choice between arch/gentoo or the big signed kernels if you care about playing certain games, but i guess it's a win-win

i don't play fortnite either, but i'm bummed to see the popularity of comments brushing these news off or even twisting it into the worst possible linux news because it's a plebeian game, like fortnite refusing to work wasn't one of the thorns that stopped people from switching to linux, and that this won't spearhead linux adoption

[u/NxtGenAuthor]

😂 yeah ok bud, I’m ganna turn on TPM 2.0 and secure boot on LINUX to play crap multiplayer games? Pretty sure that’s one of the reasons I left Microslop 😂

[u/Interesting-Bass9957]

So, to play Fortnite I have to:
1. Use a pre compiled trusted kernel
2. Use GRUB
3. Use signed drivers
And many more requirements. Unless EAC v2 don’t mind spending a lot of time writing in trusted certificates, this won’t be too bad.

[u/Opposite_Squirrel_79]

Cannot believed u still need signed keys for all this stuff

[u/RmJack]

Heard they were in the red, this supports that in my opinion. But sure, good, I won't be playing it.

[u/Present-Employ-997]

How enabled secure boot on cachy os?

[u/Woodpecker-Visible → u/Present-Employ-997]

You cant run this on cachy. Only dualboot for us with one of those distros above.

[u/Weak_Insurance_9367]

Not gonna work well with distributions like Gentoo, or someone, who patching kernel via out of tree patches or have their own kernel patches or tuning.

But I guess, from this topic, a lot of people like that idea being distribute/kernel locked coz they are “trusted”.

[u/NEO_IS_A_MACHINE]

doing everything possible to revive their dead af dogshit game

[u/ItWasVampires]

Probably trying to get ahead of it before someone vibe codes a Linux version of Fortnite (only half joking)

[u/ahorsenamedjeff]

Whole lot of bullshit to play a slop ass freeware game

[u/Ampera_]

Fine for direct to consumer devices like the Steam Deck, which is where most of the people interested in this are going to be. Definitely rather unkind requirements to anyone else.

I'd wonder how secure this is, since even in Linux, TPM and signing isn't necessarily fool-proof against dedicated hardware-level access injection attempts. Kernel command line or just having root access strikes me as a potential entrypoint at the very least.

[u/Archon-]

Do any distros even sign Nvidia drivers? I had to sign them myself to get it working on fedora and they probably wouldn't even trust 3rd party repos like rpmfusion

[u/Smugness1917 → u/Archon-]

AFAIK You sign the kernel modules. The driver is a blob shipped by Nvidia.

This part needs clarification.

[u/Apollo_Lol]

Fuck Epic Games and fuck Fortnite

[u/Sad-Cod-9584]

Yeah fuck that. They can keep their hands out of my kernel.

[u/vitimiti]

Oh yeah, I cannot wait to install an experimental rootkit on my perfectly functional system

[u/dragonitewolf223]

What this actually means:

• This won’t protect the game from cheating any better than EAC in userland would and will in fact make the system less secure. Hackers will break it, just like they’ve been doing on Windows for over a decade. Only honest players will get screwed over.
• These requirements restrict you to a RedHat-centric distribution (systemd) and make exercising your rights as a user impossible
• This is not a win for Linux adoption, actually it will probably convince more publishers to push kernel level anticheat to the benefit of nobody but the anticheat vendors.
• I would not put it past any of the companies involved to use this as an Embrace, Extend, Extinguish opportunity.

[u/thisChalkCrunchy → u/dragonitewolf223]

You classify Ubuntu as a RedHat-centric distro because it uses systemd?

[u/vjollila96]

so they still are asking tpm 2.0 etc? I might have pc that support those things but i'll pass