> If the cloud service you’re using doesn’t support OIDC or any other ephemeral access keys, then you should store them encrypted. There’s numerous ways you can do this, from password managers to just using PGP/GPG directly. Just make sure you aren’t pasting them into your shell otherwise you’ll then have those keys in plain text in your .history file.
This doesn't really help though, for a supply chain attack, because you're still going to need to decrypt those keys for your code to read at some point, and the attacker has visibility on that, right?
Like the shell isn't the only thing the attacker has access to, they also have access to variables set in your code.
I agree it doesn’t keep you completely safe. However scanning the file system for plain text secrets is significantly easier than the alternatives.
For example, for vars to be read, you’d need the compromised code to be part of your the same project. But if you scan the file system, you can pick up secrets for any project written in any language, even those which differ from the code base that pulled the compromised module.
This example applies directly to the article; it wasn’t their core code base that ran the compromised code but instead an experimental repository.
Furthermore, we can see from these supply chain attacks that they do scan the file system. So we do know that encrypting secrets adds a layer of protection against the attacks happening in the wild.
In an ideal world, we’d use OIDC everywhere and not need hardcoded access keys. But in instances where we can’t, encrypting them is better than not.
It's certainly a smaller surface that could help. For instance, a compromised dev dependency that isn't used in the production build would not be able to get to secrets for prod environments at that point. If your local tooling for interacting with prod stuff (for debugging, etc) is set up in a more secure way that doesn't mean long-lived high-value secrets staying on the filesystem, then other compromised things have less access to them. Add good, phishing-resistant 2FA on top, and even with a keylogger to grab your web login creds for that AWS browser-based auth flow, an attacker couldn't re-use it remotely.
(And that sort of ephemeral-login-for-aws-tooling-from-local-env is a standard part of compliance processes that I've gone through.)
He's using it correctly, in its secondary sense of "belonging or appropriate to an earlier period, especially so as to seem conspicuously old-fashioned or outdated."
Still not quite convinced that the adjective should be applied to the website itself in a quite loose use of the word.
Warner Bros anachronistically keeps this website online would be a simple fix; here used to reference and to point out that maintaining an untouched 1996 promotional site at it's original location is not typical for the lifecycle of a website, usually the publisher would rather redirect clicks to some current offer.
Othwerwise there is no anachronism here with the website itself, just it's location under the original URL and not in some archive only.
The website itself fulfilled its purpose for promoting the movie when it was released and simply continues to exist.
You wouldn’t call posters, magazines, or other artifacts from the ’90s anachronistic just for still existing.
Being retrievable doesn’t make something outdated by itself.
“Anachronistic” would apply only if a new promotional site were created today to look like this—though that would more likely be called “retro.”
Or if the movie industry insisted on using CSS-free table layouts for all its promotional websites, similar to other norms or laws that feel anachronistic because they no longer match current needs.
Sadly the whole piece reads like it was written 80%+ by an LLM too, seriously why all the emojis?
But apparently this is where content is heading in general.
Probably not. Kernel level anti cheat is the problem. I know BF6 isn't proton safe. Fortnite is the same.
GTA VI will probably run single player on proton fine, GTA V does. Multiplayer will probably not.
The multiplayer with kernel level anti cheat will keep Sony safe through at least another generation; Microsoft is less safe as they're so vulnerable this generation anyway.
There's a circular opportunity though - if the SteamOS market share gets anywhere, then it might become worth it for these developers to support anti-cheat on the that platform. Some systems (notably BattleEye) actually have Linux support, they just need to enable it, but there's no incentive for them to do so.
> Some systems (notably BattleEye) actually have Linux support, they just need to enable it, but there's no incentive for them to do so.
This isn't really true. As GP said, there isn't a kernel level anti cheat for linux. You can switch a flick on BattleEye to run on linux but it wont be a kernel level as it is on windows. So there is an incentive for them to not turn it on because it simply is the worse version than the windows one. As far as I know even on windows you get cheats even if it is kernel level. Meaning, allowing linux you'd probably be flooded with cheaters if you already get them on windows.
> Meaning, allowing linux you'd probably be flooded with cheaters if you already get them on windows.
There's an easy way to not get cheaters, or at least to slow down their impact: stop making your games "free to play". When cheaters have to buy 60€ games everytime they get b&, eventually they'll run out of money.
If anything the Tarkov ban treadmill is a way to drive sales. Even if some of them get disputed as fraudulent due to stolen card numbers, BSG may still come out ahead.
Battleeye games get flooded with cheaters no matter what. On most anti cheats is the same anyways. Just see tarkov for a battleeye game with rampant cheaters
These are not winner games these days. Gaming trends are so fast that indie games like the one where you play a duck with a gun is what's driving the gaming community these days.
That's a misconception. Majority of players are with the big Franchises, and they stay with them. The variety-gamers who are playing multiple different games are a minority, though they are a big crowd, loud and have for obvious reasons more attention, leading to this misconception. For example, Escape from Duckov, which you are speaking about, had at it's peak "just" roughly as many players as Battlefield 6 has on average every day. And Battlefield is the smaller one of the big games.
I don't think it's entirely the case. They are on franchises, but not the ones you think of - they're playing live service games that have been around for years. Games like League of Legends, Counterstrike, Fortnite, Dota, WoW, PUBG etc. Games like Battlefield are up there, but I don't think they're the games people mainly play over the years. (Although Fifa and GTA definitely are.)
For example, the top 10 games in Korean PC bangs last week were:
1. League of Legends
2. PUBG (I think)
3. Fifa
4. Valorant
5. Overwatch 2
6. Sudden Attack (a KR FPS game)
7. Maple Story
8. Lost Ark
9. Dungeon Fighter Online
10. StarCraft (Brood War, I believe)
The next 15: Diablo 2 Resurrection, World of Warcraft, Diablo 4, Lineage, Eternal Return, Path of Exile, Warcraft 3, Black Desert, Cyphers, Aion, Path of Exile 2, Diablo 3, StarCraft 2, Tales Runner, Final Fantasy 14.
Lineage and Brood War weren't even made in this millennium!
> I don't think it's entirely the case. They are on franchises, but not the ones you think of
I didn't name any franchise. I only mentioned Battlefield to compare it with the mentioned Duck-Game, as they are both on Steam where everyone can see the numbers. I mean if we are talking about the real big numbers, then we would be with Minecraft, Roblox, Fortnite, LoL, which are all not on Steam; making number-checking a tad harder.
> Games like Battlefield are up there, but I don't think they're the games people mainly play over the years.
As a Franchise it seems moving Fifa, very popular, but also seasonal peaks. Each new version shoves in players for a while, until they are satisfied again. Though, I don't really play them, so it's just external observation.
To be fair Brood War was like a national pastime in Korea for many many years and there are still pro tournaments held multiple times a year that draw a decent audience. That game will never die in Korea.
That's a lot of guesswork for such a strong claim as yours. You can actually see gaming distribution on open steamdb[1] stats and every year the amount of games avg player plays grows higher and higher.
A linux native game called Banana got almost a million concurrent player peak (compared to #1 CS2 having only 1.8M). This didn't exist 10 years ago - the gaming landscape is entirely different in 2025.
This call that gamers generally play 1 game only is extremely dated especially when flavor of the month games are extremely in right now. I'm sure Valve with the biggest gaming dataset in the world didn't just dive into this blind.
It's not guesswork, it's reading the statistics. Gaming Reports are regularly showing that the majority of gamers and income is with only a handful of games/franchises.
> You can actually see gaming distribution on open steamdb[1] stats and every year the amount of games avg player plays grows higher and higher.
Yes, because the market grows. But look at the numbers, the top is always with the same games, with the same numbers, which are usually in a complete different league then the rest. The Top 5 Games have usually 10-20 times as many players as every other games. And, be aware that this is only Steam. The gaming market is much, much bigger than just steam. Steam is kinda its own bubble with a skewed view.
I'm not saying steam or indie-market is small, but people looking at PC and Indie-games develop a kind of natural filter for the real behemoths of the market.
> A linux native game called Banana got almost a million concurrent player peak
We have at the moment >3 Billion Players. 1 Million gamers for a shady shortlived hype-game is not bad, but it's not even remotely winning the market, or setting a trend. At best, it's setting a trend in a specific niche. Valve wiped out billions of value in CS-Skins some week ago. That's more market-influence than a free game with shady skin-business will ever gain.
The reality of native Linux gaming must be really sad if the top example is in essence "NFT" generator with minimal if no gameplay...
It is essentially a software toy people left running to generate random items some of which ended up being speculated on generating some money for "players".
I would say that‘s a bit overly simplified, as much as the indie or indie like game scene is thriving, so is the online multiplayer scene. Gaming is huge and just because one thing is big doesn’t mean another is not. Not a zero sum game here.
Sure but not being able to play 4 games is not an indication of success either way. It's not 2012 when you had to have Call of Duty - you can not have battlefield, cod or fort nite and still never run out of incredible, popular games to play.
If you have a bunch of friends that have battlefield/cod/fortnite and want to play them, they will still do so without you, or at least heavily pressure you into getting them.
I'm not sure what could that even mean from consumer pov - I'm not going to buy a platform because some of my friends might want me to play a specific game with me?
The pressure to get more games on your platform has never been as low as it is today and has never been this low on Steam itself. You could spend a lifetime with the current Steam library and never feel bored.
From product pov Valve feels very comfortable and I bet they have the data to back up this move with basically unlimited war chest. If anything I feel like Valve is pressuring game developers of these major games here - not the other way around.
That’s exactly the thought process of every teenager ever, and also most people who want to connect with their friends through gaming beyond their teenage years.
> I'm not sure what could that even mean from consumer pov - I'm not going to buy a platform because some of my friends might want me to play a specific game with me?
Yeah exactly. Depending how much you care about playing with friends compared to playing at all you might make that choice.
> I'm not sure what could that even mean from consumer pov - I'm not going to buy a platform because some of my friends might want me to play a specific game with me?
That's exactly how console sales worked in the past. I bought an Xbox because all my friends were playing Halo, and I wanted to join in...
The recent phenomenon of games supporting cross-play out of the gate is probably eating into this, but exclusives were a hell of a moat back in the day.
Sure, but those AAA games still exist, and people still want to play them.
As a gamer, why would you want to spend a few hundred bucks on a gaming box, when it isn't able to play the biggest hits? Who would want to deliberately limit their ecosystem to indie games?
There's a nonzero chance that BF6/GTA6/etc becomes a thing that everyone wants to play. If all your friends are raging about how much fun it is and are all playing together, aren't you going to regret buying a Steam Machine?
Sure, you can still play Super Meat Boy, but that doesn't matter - they regret what they can't do.
The sale success of the Steam Deck proves you wrong. The PC is the strongest platform for exclusives because most of everything ends up there eventually. The Xbox has no exclusives anymore, Sony is publishing everything on PC eventually. Only Nintendo remains as never publishing on PC. If you are flexible about your choice of multiplayer-only titles (if you're even interested in that type of things) then the Steam Machine is the best console.
Sony's in trouble; their crown jewels are all on PC right now! You can buy a Steam Machine next year and play all the Spider-Mensch, the Lost Hose, the Ghouls of Yo-Kai!
The Steam Deck has sold only 4 million units in 3 years, which is a rounding error in the console market, not a huge success. The Switch 2 has generally been considered a failure (due in no small part to a serious lack of interesting exclusives at launch) and has still sold more than 10M already, while the Switch sold 154M units and the PS5 has sold 84M.
LoL can't be played on the Steam Deck. This is common among the top multiplayer games due to anticheat.
It's almost certain no one bought a Steam Deck primarily to play DotA, and it remains to be seen if any has a meaningful impact on the Steam Machine, but I doubt it.
If there is a non-zero chance that I might want to play such a game, from time to time, I can stream it.
Why would I want to limit my options for occasional AAA gaming to the graphics supported by a particular console, when I can spring for GeForce Ultimate for a month and play BF6 with amazing graphics at 120 FPS, on my TV or my laptop, or my iPad or my phone? And play with even better graphics two years from now, as the state of the art advances.
Sure a different option would likely be best for people who know they want to play AAA, all the time. Although, even for many of these people, the Steam machine is probably a great second box for many, that gets you however many 100s or 1000s of titles they have in their Steam library.
But a fear based "you might miss out occasionally" argument is unpersuasive. Especially in a world where some games are exclusive. My swanky new PlayStation is no help if everyone is raving about the new Nintendo game.
>As a gamer, why would you want to spend a few hundred bucks on a gaming box, when it isn't able to play the biggest hits? Who would want to deliberately limit their ecosystem to indie games?
???
Look at steam top 100, sure there are 2 or 3 games you wont be able to play on there, but there rest work just fine. And sure there are popular games outside steam, but even if none of them worked (which is not true), for most gamers its a non issue. (And Valve is probably not really concerned about them)
The only games this limits are online competitive (most of the time FPS) games. There are plenty of gamers, myself included, that have 0 interest in such games.
In short even if 0 online FPS games are playable on steam console(which is not true), there are still 10s of millions of gamers, who wouldn't care.
As far as why wouldn't people pick something that can play 100% of games is because they cant. Even the best PC cant play Nintendo games, not all PS games are on PC or xbox, etc. You always have a trade off. And plenty of people still buy PC's,Deck, PS5's and Switch consoles.
My guess id more people won't buy it because, they want better specs, not because a few games wont work on them.
But that still leaves millions, potentially tens of millions of people.
Nonsense. People don't buy a PS5 and regret they can't play League of Legends. There's been games exclusive to one platform or the other since the dawn of time, yet people still buy them for the games they do have.
That thing is going to run a ton of games that other consoles don't.
Few customers are going to replace their PC with it, but if you have the cash and want to add a sleek console to your living room that will also stream from your desktop in a pinch, it's probably a great deal.
No, and I understand if that's a deal-breaker for you, but for me I refuse avoid kernel level anticheat wherever possible, so I'm none too fussed about it. If a game wants to run malware, it can do it on a console where it's nice and segmented off from my general-purpose computing.
I can’t speak for brendo, but I do most of my gaming on a separate PC-class machine from my home workstation, both of which are separate from my work laptop and personal laptop.
I game primarily on my Linux PC, including multiplayer games. I do have a PS5 and other game consoles, though honestly, they see more use as set-top boxes than they do as gaming devices. I have a separate Windows laptop for work.
But not with a separate user? As a process running under your normal user can access all your files and even memory of all your running processes by that user. Its not just kernel stuff that is bad.
5 years ago, if someone told you about a commercial Linux gaming console. You were right to laugh.
Now, with IA cheating being the norm now, I think Valve has a real chance to add a microchip to "certify" its console and so playing Fornite (or over 3A) on it.
Will be a added value over a gaming PC, I don't think they will miss this opportunity for too long.
At least to start. Microsoft strongly encourages all Xbox games to also come out on PC, though they sometimes release later. I cannot find any game developed originally for Xbox Series X|S where this hasn't happened eventually (and the developers definitively aren't still working on the PC version).
I think Valve has a fairly good grasp of what they addressable market is at this point with the Steam Deck having been out for so long.
The value proposition is basically play your existing Steam library (and emulated games but that will be left unsaid) in 4k on your TV with an interface suited for it. I am not sure they are that dependent of upcoming games.
I will probably buy one because I really enjoy my Deck and I would like to play some more taxing games on a large screen from time to time and I’m never going to buy a PS5 because I have no interest in tying myself to Sony and playing exclusively on my TV.
If you can’t play Fortnite on it it sounds like a great time to line up a lawsuit against Epic Games for refusing to allow you to play Fortnite on the Steam box.
I can see developers work on SteamOS anticheat soon, once it gains more traction (chicken / egg problem though). Those games are available on mobile phones and consoles as well, so "windows" is not a requirement.
I think that the idea is that if you get enough users on Linux, it seems foolish from the game studio's perspective not to add Linux support to their anticheat.
It's possible that 'adding Linux support' would take the form of just making the anticheat optional.
Maybe playing with the anticheat enabled makes you immune to being reported for cheating (because they can verify down to the kernel level that you aren't), but you can still play without it (but without the immunity from being reported).
Obviously they wouldn't do this in today's market because there's no incentive to do so, but if a significant portion of gamers moved to Linux, offering a Linux solution might become a reasonable choice for game studios.
Optional anti-cheat could be really interesting. Make it a matchmaking option; let the players decide who they want to play with. This effectively makes "PC without Anti-cheat" a new platform in cross-platform match making.
I can imagine a whole scene popping up where everyone cheats to the max, creating whole new game modes.
This already existed in CS:GO, it was called Hack vs Hack. Private servers could choose whether to run anticheat or not. You'd see some with names like HvH and join to find people spinning in circles and comparing which aimbot was the most dominant.
> I can imagine a whole scene popping up where everyone cheats to the max, creating whole new game modes.
That would be very interesting. I also bet that people would start developing bots that play the game better than a human could and eventually it would essentially turn into digital BattleBots.
This depends heavily on how customised the linux is. Back in the day Amazon had to fork Android to add kernel-level support for DRM, otherwise the studios weren't going to permit streaming video on Fire tablets. One could imagine Valve adding an optional kernel DRM module to solve the same problem.
You still lose because the dev team has to split their attention.
And anyway I (and many other people!) have valid keys for basically all widevine streams extracted from supposedly secure android devices. That DRM approach ended up failing miserably and torrent sites are full of WEB-DLs.
But you can still stream video on normal Android devices, no? My Motorola phone supports Disney+. Why did studios object to streaming on Fire tablets unless it had kernel DRM but they're fine with streaming on easily-rootable phones?
Battlefield 6 might never run on the average Linux desktop, but I could see a future where it would run on Steam hardware in an end-to-end Secure Boot environment.
I find it much more likely that Valve enables Secure Boot on their Steam hardware.
I imagine that if this happens, it will be followed by popular Linux distros finally becoming serious about their Secure Boot implementations, instead of simply shimming it or seen as a rarely-used feature reserved for enterprise distros like RHEL.
Some of us actually think that having some sort of validation that our OS hasn't been tampered with is a feature and not a bug. It's only a problem when companies parlay that validation into anti-consumer DRM - but that's a political problem, not a technological one.
All the platforms that went all-in on secure boot like things and attestation are anti-consumer hellholes that slurp all your data. The evidence just does not look good. Maybe Linux is different, but it's swimming against the tide here. It would be the first of it's kind.
A few anti-cheat systems rather than inspecting the local machine look for things like impossibly fast target acquisition in FPS games, or the server noticing when a shot is taken on an opponent who’s supposed to be totally obscured. Those aren’t perfect, but they don’t require kernel-level anticheat.
Jesus, since when Fortnite and BF6 became gaming benchmark nowadays?
In order to 'win' a console generation there needs to be support for the games people want to play. Capitalism is a literal popularity contest, and any console that doesn't have Fortnite, COD, FIFA, etc won't win, regardless of what you or I might think of the games.
The reason why Steam can't win a console generation is simply because Microsoft, Sony, and Nintendo have enough sway over publishers (especially ones they own) than they stop popular games being available on a rival platform. They market it as 'exclusives' but really it's just anti-consumer.
Also consistently the most played game on Steam by a fair margin. That doesn't necessarily make it the most played PC game since some big titles like League and Fortnite aren't on Steam, but it's at least close.
I dont give the slightest of shits about CS but have you seen the figures? It's doing absurdly well. In addition the separate economy for skins peaked at 6 billion recently.
This. And when a service goes down it's a lot easier to explain to your client/boss that "half the internet is down" than "our boutique solution is broken so it's just us actually".
To me this kind of sounds like the other side of the same thing. Lunchpail scientists accumulate data within an area of research made interesting by a landmark work by a big name. Future big names make breakthroughs by drawing together a lot of the lunchpail work. etc etc
I found out recently that I've been paying for Prime Video since 2020. I think I did legitimately sign up for it. That's not my complaint.
But it's fairly scummy how it doesn't seem to send you any email, the payments have a very vague generic coding like "AMZ2318971239", and the actual subscription management is super buried. I only noticed it, after years of using Amazon a fair bit, when I went deep into my account panes looking for something else.
You're assuming the conclusion in order to argue against it. It's slightly surprising to me that this is not obvious and actually, pretty common. You can't argue against X ("It isn't completely obvious that is bogus") by assuming X ("far-fetched thing").
I don't mean this in derogatory sense.
I wasslightly...hm...confused when reading this. When I see something in the news, to the degree that I trust the source, I see it only as a statement of fact, and unless I trust the commentator, I ignore the comment. I only expect descriptive accuracy from the news. This sometimes requires resources that individuals don't generally have.
When I read a personal blog article articulating a personal opinion, presenting evidence and trying to make a case for their conclusion, I usually apply a different standard. From them, I expect sound reasoning, which often requires a form of independence/neutrality that news organizations don't have.
And I can't say that this article is structured as a sequence of QEDs, so to speak. It doesn't seem like the conclusions follow from the premisses. That's not to say is wrong, just that if it is right, it would be in part by accident.
No, I'm not a bot, I just wanted it have it as reply to the article itself too, separate from this reply. It has been pasted exactly once and edited accordingly. Also, my account is 15 years old :)
> On January 24, 2025, security researchers from Kudelski Security disclosed a vulnerability to us through our Vulnerability Disclosure Program (VDP). The researchers identified that Rubocop, one of our tools, was running outside our secure sandbox environment—a configuration that deviated from our standard security protocols.
Honestly, that last part sounds like a lie. Why would one task run in a drastically different architectural situation, and it happen to be the one exploited?
Yes, all the tools are fine and secure and sandoxed, just this one tool that was kind of randomly chosen by the security researcher because it is a tool that can execute Ruby code inside the environment - one could argue an especially dangerous tool to run - was not safe.
> Why would one task run in a drastically different architectural situation
Someone made a mistake. These things happen.
> and it happen to be the one exploited?
Why would the vulnerable service be the service that is exploited? It seems to me that's a far more likely scenario than the non-vulnerable service being exploited... no?
> > Why would one task run in a drastically different architectural situation
> Someone made a mistake. These things happen.
Some company didn't have appropriate processes in place.
For ISO27001 certification you at least need to pay lip service to having documents and policies about how you deploy secure platforms. (As annoying as ISO certification is, it does at least try to ensure you have thought about andedocumented stuff like this.)
Ah yes processes.... things done by humans. When stuff is done by humans, mistakes happen - no matter what the process is. Go do a search for the phrase "wondering how this could happen" and find millions of news articles about mistakes happening despite processes being in place!
> because researchers from Kudelski Security most likely tried different static analysis tools and they didn't work the way Rubocop did.
Yes but that's kind of the point - they say this issue that takes you directly from code execution to owning these high value credentials was only present on rubocop runnners but isn't it a bit coincidental that the package with (perhaps, since they chose it) the easiest route to code injection also happens to be the one where they "oops forgot" to improve the credentials management?
They do, seriously it is very common with male interactions. I have seen it first hand with tennis, golf, chess, and bowling. With golf easily being the most common
I find it helpful to tell people who I know only dabble in eg chess that I am "pretty good at chess" when they do not have enough context on things like Elo and FIDE ratings to be able to understand comparisons like that. Of course, if someone knows what Elo is or is an active chess player then I will more humbly just tell them I am only like 1600 on lichess.
I don't think this is necessarily bad. Compared to people who only dabble in things, someone who spends a decent amount of time on something actually is "pretty good" at it even though they might not be top tier to people within that same culture.
I think there is some popular (dan luu?) blog about this. You can actually pretty easily be in the top 1% of skill or knowledge on something, and while that doesn't make you a world expert by any means, it does kinda make you an expert to an average person. My 1600 rating is very good within the pool of people who know what chess is and can play it, even though it's not impressive at all for people who actively play chess.
Chess? Can't you just ask for their ELO? Or some proxy like chess.com rating? If you're good you must have played a lot of games. If you did, you got some number to back it up.
Tennis is competitive though and unlike golf there’s no form of handicap. When it comes to pick up tennis, it’s not fun playing against someone way below or way above your level. I refer to myself as mediocre at tennis so I can play against people who are around my level. People who are good refer to themselves as being good so that everyone enjoys themselves (and improves) on a court.
The difference between good and mediocre is significant. To the point that I cannot return a good tennis player’s serves. The difference between mediocre and post beginner is just as significant.
Having played both tennis and golf, I agree. It's a lot harder to play social tennis than social golf.
Two nice things about golf - the handicap system let's two players of different level engage in fun competition. (Yes, handicaps can be manipulated, but for the most part aren't. )
Second a very good player can play with a bad player, and both can have fun. The social factor is more important to the fun, and I've enjoyed tight games with people with hugely disparate handicaps.
With tennis I always want to play either someone just a little bit better than me. Someone who can help me get a bit better all the time. My enjoyment of the game depends a lot on their performance.
How do you overcome a wrong observation of a local maximum though (e.g. in your club maybe)?
I only experienced something like this once, late 90s. We thought of ourselves as pretty ok StarCraft players until we got some visitor to a lan party who basically demolished everyone. This was pre-ladder iirc so you only played a handful of games online.
In golf the handicap system is "global". Each player has a handicap index, which then translates into a course handicap. It's not perfect (different players have different strengths and weaknesses, which means some courses "suit" a game more than others) but generally the system is at least reasonably accurate.
Tennis of course is harder. You can only be as good as the people you are playing with.
This doesn't really help though, for a supply chain attack, because you're still going to need to decrypt those keys for your code to read at some point, and the attacker has visibility on that, right?
Like the shell isn't the only thing the attacker has access to, they also have access to variables set in your code.
reply