14 ms·

I'm not a VRchat user. But it's sad they decided to ban modified clients. Giving the community a way to customize their experience is a great way to grow an eco

I'm not a VRchat user. But it's sad they decided to ban modified clients. Giving the community a way to customize their experience is a great way to grow an ecosystem and learn about what your users want. The problems they mention are all solvable without banning mods: > Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues. These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. > Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes Keep a list of "blessed" open source clients that have a reputation, and allow people to report them. Chrome and Firefox extensions have solved this > Additionally, all modified clients – even ones that aren’t malicious – are a burden for creators. We regularly speak to many that have spent hours (or days) debugging user issues, only to realize that the culprit is a modified client. Provide better debugging info for your creators! They should know which client (or at least that a modified client) is being used. > This pain extends to VRChat support too – any time we update, we get a massive amount of bug reports that end up just being broken modifications Ditto. These tickets should be easy to auto-close if you force folks to include info about their client. I understand all this requires time and effort, and simply restricting the client-side of things is a low-cost solution. But if there's already a vibrant community of mods out there, I think you have a responsibility (and a vested interest) in trying to preserve that.

3np 4y ago
Yeah, I really don't get it here. For competitive games, I can see the argument and demand for anti-cheat. Here, though? Any actual problem it would solve is better addressed either server side or on the counterparty clients. It seems backwards to require full control of all client software rather than filtering out spam on the receiving and/or intermediary ends.
munchbunny 4y ago
> Provide better debugging info for your creators! They should know which client (or at least that a modified client) is being used. > Ditto. These tickets should be easy to auto-close if you force folks to include info about their client. As a (former) modder, though not for VRChat, I can definitely empathize with this. Code quality with mods is a freaking wild west where modularization isn't really a thing and everyone monkey-patches everything. Supporting your mod/content amidst other mods is in the gray area where the etiquette expects content creators to support their stuff even though there's no "warranty" on the label, so you get significant variance in how demanding players are or how accommodating content creators are. That said, I don't think anti-cheat is the answer here. Officially supporting mods and driving modified clients down a predictable path where you'll know when and how a client is modded seems like a better approach. Modders benefit from having real infrastructure to work with, and as the game dev you can ask players to turn off mods for troubleshooting.
asojfdowgh 4y ago
> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. never seen that work in practice. > They should know which client (or at least that a modified client) is being used. That's the modified client's job, not the original client's job. if the modified client is intentionally trying to be hidden, then its not going to show itself. Which is the cause of the whole everything > Extensions https://docs.vrchat.com/docs/what-is-udon https://docs.vrchat.com/docs/what-is-udon already exists > But if there's already a vibrant community of mods out there is there a vibrant community of mods? besides, they have actively told people to bugger off if they use a custom client for a while now, by the sounds of it (e.g. the two mods I could find, both said that you will likely get banned for using them)
- _mb2v 4y ago
  [dead]
  - dom96 4y ago
    > It's an absolute shitshow, a media exposé waiting to happen. It's already happened. In the UK on Channel 4 at least: https://www.channel4.com/programmes/inside-the-metaverse-are-you-safe-dispatches https://www.channel4.com/programmes/inside-the-metaverse-are.... It shows many of the incidents you've described. Including things that you probably haven't experienced (the player was a black woman, so you can imagine what she experienced).
  - GauntletWizard 4y ago
    Why would they ban their primary userbase?
  - pteraspidomorph 4y ago
    - _mb2v 4y ago
      >You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!
ge96 4y ago
> Malicious modified clients hehe there's a spiderman knuckles that spams webbing and it fills the entire room and you can't see anything it's funny.
- andybak 4y ago
  That's hilarious /s
DanielVZ 4y ago
I'm gonna play devil's advocate here. I pretty much agree with all your points, but what I see here is that VRChat developers or product people are choosing the solution that requires the least effort. They may have other features or fixes in their roadmap and decided to squash all the fixes into a single one: banning them. If I were them, given the popularity of modified clients I'd try to turn that into a feature that sets them appart from other competitors, but I still think it's a rational choice to ban them given how much developer time costs.
- aeternum 4y ago
  If the true goal is to enable creators, why not let the creators choose whether to require EAC to connect. It should not require much extra developer time at all to let both users and creators choose whether to join an EAC or non-EAC instance.
  - kfarr 4y ago
    Excellent idea, and in theory others could create better alternatives for centralized moderation.
- gexla 4y ago
  That's what I was going to say. The bullet points sound like a ton of work. And I'm sure the devs put considerable effort into exploring these points. There may have even been code in the repo to address these points.
- KennyBlanken 4y ago
  EAC is about protecting game files. This is to protect cosmetic sales, nothing else.
  - judge2020 4y ago
    You can already import any models you want (read: models you purchase from eg. gumroad) by uploading them through their unity sdk.
- 4y ago
intrasight 4y ago
Who else is just depressed as fuck to realize that our VR experiences are likely going to be hamstrung by things like EAC, and there's probably little that we'll be able to do about it. This is not the metaverse future that I had envisioned. I guess they think I need to be protected from a "Snow Crash".
- _mb2v 4y ago
  As a frequent VRChat user: the problem is entirely sloppy API design, poor to nonexistent moderation, a security team detached from reality (the team lead posts often in the VRChat Discord, or used to), and the fundamental problem of running a no-stakes social game where getting banned and losing your account is no obstacle to further bad behavior. Getting banned from WoW means you lose your time investment in level 60 and raid gear; getting banned from VRChat means you make a new dummy email and log right back in. Any VR game with real time investment doesn't have this problem.
- toofy 4y ago
  it isn’t clear to me how you could have expected anything but this… there are far too many hacks, too little moderation, and too little community pushback on bad actors. this will _always_ happen if the communities themselves don’t figure out a way to chase the trash out. it doesn’t matter if it’s a social network, it doesn’t matter if it’s a game, it doesn’t matter if it’s a forum. if it relies on money, then either the community will make trash unwelcome or the company will, and of course the company will do what’s the most convenient for them. we talk a lot about we want companies to keep things open for communities to run, then when companies try a hands off approach the communities sit by and do nothing while malicious actors take over lol. then, strangely, the communities who did nothing to address actual real problems act all shocked.
  - intrasight 4y ago
    Good points. There are solutions. A more transparent and community-oriented governance model would help.
- Karrot_Kream 4y ago
makeitdouble 4y ago
> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. This is a crazy hard problem that is plaguing the majority of our mainstream social platforms. Looking at Twitter/Facebook/Reddit etc. moderation+harassment is mostly solved by brute force community management, and is extremely costly, with a human component that is hard to ignore (Facebook moderators are plain miserable and prone to stay mentally hurt even after leaving the job) This is where Nintendo decided to bail out of the problem altogether by blocking personal interaction by default on their online platforms. If they don't have the resources to do it properly, limiting the attack surface feels like a sensible strategy.
- leviathant 4y ago
  >This is a crazy hard problem that is plaguing the majority of our mainstream social platforms. ...that rely on advertising. It's comparatively easy to moderate communities if you're willing to permanently ban bad actors. Trouble is, that shrinks your audience, which reduces advertising revenue. Reporting accounts on Twitter, Facebook, Instagram, et al, is a multi-step process of making excuses for why your reported post won't actually negatively impact the malicious account.
  - makeitdouble 4y ago
    As weird as it feels, this might actually be one of the very few cases where platforms are willing to throw users under the bus for better ad money... Youtube demonetizing creators with too aggressive stances is an example of that, but we also had Reddit banning whole subreddits when their sheer existence had a nefarious effect on the platform's ability to negotiate ads. When the choice comes down to more active users but lower prices offered, vs less users and better ad prices, platform tend to go for the latter I think (4/5/8 chan being exceptions)
judge2020 4y ago
Modified clients were already banned; this is a technical measure to enforce that policy.
tmpz22 4y ago
It’s a long list of excuses and they know it. It’s harder to monetize third party clients just admit it.
- andybak 4y ago
  I find that very naive. Moderating online communities is famously difficult and unavoidably expensive. This is well documented going back to MUDs on dialup BBS systems.
deleted 4y ago
[deleted]
godelski 4y ago
> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. Isn't VRchat... Spoken? It's kinda hard to rate limit and pattern match speech. Text is one thing but it's going to take some compute power to do what you're asking.

3np 4y ago

Yeah, I really don't get it here. For competitive games, I can see the argument and demand for anti-cheat. Here, though? Any actual problem it would solve is better addressed either server side or on the counterparty clients. It seems backwards to require full control of all client software rather than filtering out spam on the receiving and/or intermediary ends.

munchbunny 4y ago

> Provide better debugging info for your creators! They should know which client (or at least that a modified client) is being used. > Ditto. These tickets should be easy to auto-close if you force folks to include info about their client. As a (former) modder, though not for VRChat, I can definitely empathize with this. Code quality with mods is a freaking wild west where modularization isn't really a thing and everyone monkey-patches everything. Supporting your mod/content amidst other mods is in the gray area where the etiquette expects content creators to support their stuff even though there's no "warranty" on the label, so you get significant variance in how demanding players are or how accommodating content creators are. That said, I don't think anti-cheat is the answer here. Officially supporting mods and driving modified clients down a predictable path where you'll know when and how a client is modded seems like a better approach. Modders benefit from having real infrastructure to work with, and as the game dev you can ask players to turn off mods for troubleshooting.

asojfdowgh 4y ago

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. never seen that work in practice. > They should know which client (or at least that a modified client) is being used. That's the modified client's job, not the original client's job. if the modified client is intentionally trying to be hidden, then its not going to show itself. Which is the cause of the whole everything > Extensions https://docs.vrchat.com/docs/what-is-udon https://docs.vrchat.com/docs/what-is-udon already exists > But if there's already a vibrant community of mods out there is there a vibrant community of mods? besides, they have actively told people to bugger off if they use a custom client for a while now, by the sounds of it (e.g. the two mods I could find, both said that you will likely get banned for using them)

_mb2v 4y ago
[dead]
- dom96 4y ago
  > It's an absolute shitshow, a media exposé waiting to happen. It's already happened. In the UK on Channel 4 at least: https://www.channel4.com/programmes/inside-the-metaverse-are-you-safe-dispatches https://www.channel4.com/programmes/inside-the-metaverse-are.... It shows many of the incidents you've described. Including things that you probably haven't experienced (the player was a black woman, so you can imagine what she experienced).
- GauntletWizard 4y ago
  Why would they ban their primary userbase?
- pteraspidomorph 4y ago
  - _mb2v 4y ago
    >You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!

ge96 4y ago

> Malicious modified clients hehe there's a spiderman knuckles that spams webbing and it fills the entire room and you can't see anything it's funny.

andybak 4y ago
That's hilarious /s

DanielVZ 4y ago

I'm gonna play devil's advocate here. I pretty much agree with all your points, but what I see here is that VRChat developers or product people are choosing the solution that requires the least effort. They may have other features or fixes in their roadmap and decided to squash all the fixes into a single one: banning them. If I were them, given the popularity of modified clients I'd try to turn that into a feature that sets them appart from other competitors, but I still think it's a rational choice to ban them given how much developer time costs.

aeternum 4y ago
If the true goal is to enable creators, why not let the creators choose whether to require EAC to connect. It should not require much extra developer time at all to let both users and creators choose whether to join an EAC or non-EAC instance.
- kfarr 4y ago
  Excellent idea, and in theory others could create better alternatives for centralized moderation.
gexla 4y ago
That's what I was going to say. The bullet points sound like a ton of work. And I'm sure the devs put considerable effort into exploring these points. There may have even been code in the repo to address these points.
KennyBlanken 4y ago
EAC is about protecting game files. This is to protect cosmetic sales, nothing else.
- judge2020 4y ago
  You can already import any models you want (read: models you purchase from eg. gumroad) by uploading them through their unity sdk.
4y ago

intrasight 4y ago

Who else is just depressed as fuck to realize that our VR experiences are likely going to be hamstrung by things like EAC, and there's probably little that we'll be able to do about it. This is not the metaverse future that I had envisioned. I guess they think I need to be protected from a "Snow Crash".

_mb2v 4y ago
As a frequent VRChat user: the problem is entirely sloppy API design, poor to nonexistent moderation, a security team detached from reality (the team lead posts often in the VRChat Discord, or used to), and the fundamental problem of running a no-stakes social game where getting banned and losing your account is no obstacle to further bad behavior. Getting banned from WoW means you lose your time investment in level 60 and raid gear; getting banned from VRChat means you make a new dummy email and log right back in. Any VR game with real time investment doesn't have this problem.
toofy 4y ago
it isn’t clear to me how you could have expected anything but this… there are far too many hacks, too little moderation, and too little community pushback on bad actors. this will _always_ happen if the communities themselves don’t figure out a way to chase the trash out. it doesn’t matter if it’s a social network, it doesn’t matter if it’s a game, it doesn’t matter if it’s a forum. if it relies on money, then either the community will make trash unwelcome or the company will, and of course the company will do what’s the most convenient for them. we talk a lot about we want companies to keep things open for communities to run, then when companies try a hands off approach the communities sit by and do nothing while malicious actors take over lol. then, strangely, the communities who did nothing to address actual real problems act all shocked.
- intrasight 4y ago
  Good points. There are solutions. A more transparent and community-oriented governance model would help.
Karrot_Kream 4y ago

makeitdouble 4y ago

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. This is a crazy hard problem that is plaguing the majority of our mainstream social platforms. Looking at Twitter/Facebook/Reddit etc. moderation+harassment is mostly solved by brute force community management, and is extremely costly, with a human component that is hard to ignore (Facebook moderators are plain miserable and prone to stay mentally hurt even after leaving the job) This is where Nintendo decided to bail out of the problem altogether by blocking personal interaction by default on their online platforms. If they don't have the resources to do it properly, limiting the attack surface feels like a sensible strategy.

leviathant 4y ago
>This is a crazy hard problem that is plaguing the majority of our mainstream social platforms. ...that rely on advertising. It's comparatively easy to moderate communities if you're willing to permanently ban bad actors. Trouble is, that shrinks your audience, which reduces advertising revenue. Reporting accounts on Twitter, Facebook, Instagram, et al, is a multi-step process of making excuses for why your reported post won't actually negatively impact the malicious account.
- makeitdouble 4y ago
  As weird as it feels, this might actually be one of the very few cases where platforms are willing to throw users under the bus for better ad money... Youtube demonetizing creators with too aggressive stances is an example of that, but we also had Reddit banning whole subreddits when their sheer existence had a nefarious effect on the platform's ability to negotiate ads. When the choice comes down to more active users but lower prices offered, vs less users and better ad prices, platform tend to go for the latter I think (4/5/8 chan being exceptions)

judge2020 4y ago

Modified clients were already banned; this is a technical measure to enforce that policy.

tmpz22 4y ago

It’s a long list of excuses and they know it. It’s harder to monetize third party clients just admit it.

andybak 4y ago
I find that very naive. Moderating online communities is famously difficult and unavoidably expensive. This is well documented going back to MUDs on dialup BBS systems.

deleted 4y ago

[deleted]

godelski 4y ago

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. Isn't VRchat... Spoken? It's kinda hard to rate limit and pattern match speech. Text is one thing but it's going to take some compute power to do what you're asking.