10 ms·

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. never seen that work in practice. > They should know which clie

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. never seen that work in practice. > They should know which client (or at least that a modified client) is being used. That's the modified client's job, not the original client's job. if the modified client is intentionally trying to be hidden, then its not going to show itself. Which is the cause of the whole everything > Extensions https://docs.vrchat.com/docs/what-is-udon https://docs.vrchat.com/docs/what-is-udon already exists > But if there's already a vibrant community of mods out there is there a vibrant community of mods? besides, they have actively told people to bugger off if they use a custom client for a while now, by the sounds of it (e.g. the two mods I could find, both said that you will likely get banned for using them)

_mb2v 4y ago
[dead]
- dom96 4y ago
  > It's an absolute shitshow, a media exposé waiting to happen. It's already happened. In the UK on Channel 4 at least: https://www.channel4.com/programmes/inside-the-metaverse-are-you-safe-dispatches https://www.channel4.com/programmes/inside-the-metaverse-are.... It shows many of the incidents you've described. Including things that you probably haven't experienced (the player was a black woman, so you can imagine what she experienced).
- GauntletWizard 4y ago
  Why would they ban their primary userbase?
- pteraspidomorph 4y ago
  - _mb2v 4y ago
    >You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!
    - pteraspidomorph 4y ago
      You're the one who has to explain yourself. > Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. "Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that? > There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there. > as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions. So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC. > if you manage to obtain their IP address via exploit or social engineering. IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.
      - _mb2v 4y ago
        [dead]
        pteraspidomorph 4y ago
        Glancing at the links you provided, I see some unfounded rumors and some (three?) references to the creation of avatars that overload users, causing them to crash (including one of the features in the bottom links). It's common knowledge that this is possible, and VRChat should probably do a better job of analyzing avatars at time of upload. EAC does not prevent this in any way, shape or form. I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this. The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does? I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
- _mb2v 4y ago
  [dead]
- prox 4y ago
  That’s bad. However none of the issues they have are unsolvable. Just add EAC and provide an official mod api through a workshop or launcher. Creating a healthy eco system of moderators is doable as well.
- Aeolun 4y ago
  > running around in nude avatars with giant ejaculating phalluses I can kinda see how this is fun the first time, or in a very specific age range, but I think the novelty would quickly wear off.
  - salawat 4y ago
    Ever heard of Eternal September?
AinderS 4y ago
> never seen that work in practice. Except in every competitive online game that predates EAC. Rule #1 in networked games is "don't trust the client".
- j16sdiz 4y ago
  That’s an endless arm race. They are complaining how much time they wasted on mods
  - AinderS 4y ago
    How is "don't trust the client" an arms race? But now we're moving past the simple empirical fact that for countless games it worked, and still works. > They are complaining how much time they wasted on mods You mean their complaint that they wasted time on bug reports coming from modded clients? And instead of using the obvious, dead simple solution of appending a client ID to the bug report to filter out modded clients, they prefer to use this as an excuse to add DRM? Guild Wars had a similar issue of getting bug reports from clients due to hardware errors. Did they ban all PCs not built by an authorized OEM? No - they simply added a hardware health check to their game, and ignored bug reports by clients that failed it.
    - p1necone 4y ago
      > How is "don't trust the client" an arms race? Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do. The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.
      - pixl97 4y ago
        >Just ban/kick if the client tries to do something it isn't supposed to do. Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.
p1necone 4y ago
> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. > never seen that work in practice. Isn't this solved by basically every game with a persistent economy? If e.g. Eve online or Runescape just trusted the client they would have fallen apart years ago (not mentioning WoW until the next para because its economy is less important/more isolated to each individual player than a lot of other mmos). Afaik in World of Warcraft (and by extension probably a lot of other similar games) a bunch of important stuff is totally serverside - your current HP/Mana/Inventory, skill cooldowns, buffs etc. None of that is controlled by the client, and the best you could do by hacking it would be to get it to temporarily show information that was different from what everyone else sees, and couldn't affect any other players. Movement in WoW (afaik) is a bit more of a hybrid thing - it's a mixture of the client immediately responding to player input, and the server only resetting player position/kicking people off the server if it determines that the player could not have performed that movement with their maximum speed. With a lot of games this isn't actually that hard either - you just encode rules about what players can do (max movement speed, rate limit amount of chat messages per second, abilities that that player has access to etc) and kick people from the server if their client claims they're doing anything impossible. In competitive shooters it's a bit different - you don't want to let clients send you technically legitimate "I shoot in this direction" commands that come from an aimbot instead of a mouse, so a multifaceted approach is important here. But VRChat isn't a competitive shooter. With turn based games it's really trivial, just have clients send you their decisions for each turn, run all the game logic server side and have the client be a dumb UX that plays the animations it's told to. =================================================== Having an authoritative client and just trying to detect cheating on the server is very difficult/impossible - but that's because it's totally the wrong way to solve the problem in the first place. You want to have the backend doing all the important logic, and have the client be as dumb as possible (or write a deterministic game engine and have the server replay the same inputs at the same time from the same state and boot people when the outcome doesn't match what they told you happened, but this requires engineering up front - it's not an easy thing to retrofit into an existing game). =================================================== Edit: Realised WoW is a good example for mods too - the client is moddable, but there's a clearly defined API for what mods are allowed to see/do. It works pretty well. Doing this the right way is not impossible, it's just probably more engineering effort than the devs of VRChat are willing to put in.
serf 4y ago
>never seen that work in practice. Linden Labs did just that -- and almost every other better-practices VR thing -- and it worked just fine. Linden Labs and their teething problems should be the bible for anyone starting a 'VR-experiences' style platform, but for some reason their past struggles have been widely ignored by the newer players in the field.
- kmeisthax 4y ago
  The problem is that if everyone with "metaverse" hype actually looked at Second Life[0], they'd realize that there's not really much to get hyped over. The final and most important lesson of Second Life was that most people do not want a 3D world chat room. [0] Or ActiveWorlds, or the metric buttload of VRML chat services before that...
  - Nursie 4y ago
    Yep. Some people do, they still have an audience, but it's not the revolution it was supposed to be. It's also a great example of a hype cycle - it was going to be the future, it was going to be everything, corporates had offices in there, universities had campuses, there were virtual music events and art galleries, there were real-dollar millionaires made from virtual real-estate. When the hype died down and the smoke cleared, there were still people wanting to use it, but not that many, and not in the way we were all told to expect, and the corporates realised they didn't need a bank branch or an SL office full of virtual meeting rooms in there after all. Neat sandbox with interesting ongoing uses, not the new centre of all our online lives.
    - Karrot_Kream 4y ago
      I think COVID and GenZ growing up on the internet has changed the equation. Will the metaverse take over the world? Probably not. But now that knowledge work has gone remote, entire countries remain blocked to tourists, and people are coming down with flus they need to isolate for 10 days for, I think having a virtual sandbox to socialize in has more appeal.
pteraspidomorph 4y ago
There is a vibrant community of mods. There are more than 30 thousand people in the modding group Discord. Compare to less than 70 thousand people online in the platform at time of writing - a sizeable minority of the community uses (and a subset of them needs) mods. There are more than 200 safe working mods right now.
Bytewave81 4y ago
Udon is not a modding API and was never intended to be one. It is purely a world-centric scripting system, which is great for building minigames inside VRchat, but not for extending the client's features on a global basis.
devwastaken 4y ago
Udon isn't an extension. There are many mods, authors, and tens of thousands of hours of work put in by game devs. It's disrespectful to be commenting about a subject you don't have experience with. It's only muddying the waters.
__alexs 4y ago
> never seen that work in practice it often doesn't work out even if you do ban modified clients. there's an impressive array of hacked clients for many games out there.

_mb2v 4y ago

[dead]

dom96 4y ago
> It's an absolute shitshow, a media exposé waiting to happen. It's already happened. In the UK on Channel 4 at least: https://www.channel4.com/programmes/inside-the-metaverse-are-you-safe-dispatches https://www.channel4.com/programmes/inside-the-metaverse-are.... It shows many of the incidents you've described. Including things that you probably haven't experienced (the player was a black woman, so you can imagine what she experienced).
GauntletWizard 4y ago
Why would they ban their primary userbase?
pteraspidomorph 4y ago
- _mb2v 4y ago
  >You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!
  - pteraspidomorph 4y ago
    You're the one who has to explain yourself. > Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. "Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that? > There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there. > as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions. So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC. > if you manage to obtain their IP address via exploit or social engineering. IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.
    - _mb2v 4y ago
      [dead]
      - pteraspidomorph 4y ago
        Glancing at the links you provided, I see some unfounded rumors and some (three?) references to the creation of avatars that overload users, causing them to crash (including one of the features in the bottom links). It's common knowledge that this is possible, and VRChat should probably do a better job of analyzing avatars at time of upload. EAC does not prevent this in any way, shape or form. I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this. The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does? I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
_mb2v 4y ago
[dead]
prox 4y ago
That’s bad. However none of the issues they have are unsolvable. Just add EAC and provide an official mod api through a workshop or launcher. Creating a healthy eco system of moderators is doable as well.
Aeolun 4y ago
> running around in nude avatars with giant ejaculating phalluses I can kinda see how this is fun the first time, or in a very specific age range, but I think the novelty would quickly wear off.
- salawat 4y ago
  Ever heard of Eternal September?

AinderS 4y ago

> never seen that work in practice. Except in every competitive online game that predates EAC. Rule #1 in networked games is "don't trust the client".

j16sdiz 4y ago
That’s an endless arm race. They are complaining how much time they wasted on mods
- AinderS 4y ago
  How is "don't trust the client" an arms race? But now we're moving past the simple empirical fact that for countless games it worked, and still works. > They are complaining how much time they wasted on mods You mean their complaint that they wasted time on bug reports coming from modded clients? And instead of using the obvious, dead simple solution of appending a client ID to the bug report to filter out modded clients, they prefer to use this as an excuse to add DRM? Guild Wars had a similar issue of getting bug reports from clients due to hardware errors. Did they ban all PCs not built by an authorized OEM? No - they simply added a hardware health check to their game, and ignored bug reports by clients that failed it.
  - p1necone 4y ago
    > How is "don't trust the client" an arms race? Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do. The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.
    - pixl97 4y ago
      >Just ban/kick if the client tries to do something it isn't supposed to do. Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.

p1necone 4y ago

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc. > never seen that work in practice. Isn't this solved by basically every game with a persistent economy? If e.g. Eve online or Runescape just trusted the client they would have fallen apart years ago (not mentioning WoW until the next para because its economy is less important/more isolated to each individual player than a lot of other mmos). Afaik in World of Warcraft (and by extension probably a lot of other similar games) a bunch of important stuff is totally serverside - your current HP/Mana/Inventory, skill cooldowns, buffs etc. None of that is controlled by the client, and the best you could do by hacking it would be to get it to temporarily show information that was different from what everyone else sees, and couldn't affect any other players. Movement in WoW (afaik) is a bit more of a hybrid thing - it's a mixture of the client immediately responding to player input, and the server only resetting player position/kicking people off the server if it determines that the player could not have performed that movement with their maximum speed. With a lot of games this isn't actually that hard either - you just encode rules about what players can do (max movement speed, rate limit amount of chat messages per second, abilities that that player has access to etc) and kick people from the server if their client claims they're doing anything impossible. In competitive shooters it's a bit different - you don't want to let clients send you technically legitimate "I shoot in this direction" commands that come from an aimbot instead of a mouse, so a multifaceted approach is important here. But VRChat isn't a competitive shooter. With turn based games it's really trivial, just have clients send you their decisions for each turn, run all the game logic server side and have the client be a dumb UX that plays the animations it's told to. =================================================== Having an authoritative client and just trying to detect cheating on the server is very difficult/impossible - but that's because it's totally the wrong way to solve the problem in the first place. You want to have the backend doing all the important logic, and have the client be as dumb as possible (or write a deterministic game engine and have the server replay the same inputs at the same time from the same state and boot people when the outcome doesn't match what they told you happened, but this requires engineering up front - it's not an easy thing to retrofit into an existing game). =================================================== Edit: Realised WoW is a good example for mods too - the client is moddable, but there's a clearly defined API for what mods are allowed to see/do. It works pretty well. Doing this the right way is not impossible, it's just probably more engineering effort than the devs of VRChat are willing to put in.

serf 4y ago

>never seen that work in practice. Linden Labs did just that -- and almost every other better-practices VR thing -- and it worked just fine. Linden Labs and their teething problems should be the bible for anyone starting a 'VR-experiences' style platform, but for some reason their past struggles have been widely ignored by the newer players in the field.

kmeisthax 4y ago
The problem is that if everyone with "metaverse" hype actually looked at Second Life[0], they'd realize that there's not really much to get hyped over. The final and most important lesson of Second Life was that most people do not want a 3D world chat room. [0] Or ActiveWorlds, or the metric buttload of VRML chat services before that...
- Nursie 4y ago
  Yep. Some people do, they still have an audience, but it's not the revolution it was supposed to be. It's also a great example of a hype cycle - it was going to be the future, it was going to be everything, corporates had offices in there, universities had campuses, there were virtual music events and art galleries, there were real-dollar millionaires made from virtual real-estate. When the hype died down and the smoke cleared, there were still people wanting to use it, but not that many, and not in the way we were all told to expect, and the corporates realised they didn't need a bank branch or an SL office full of virtual meeting rooms in there after all. Neat sandbox with interesting ongoing uses, not the new centre of all our online lives.
  - Karrot_Kream 4y ago
    I think COVID and GenZ growing up on the internet has changed the equation. Will the metaverse take over the world? Probably not. But now that knowledge work has gone remote, entire countries remain blocked to tourists, and people are coming down with flus they need to isolate for 10 days for, I think having a virtual sandbox to socialize in has more appeal.

pteraspidomorph 4y ago

There is a vibrant community of mods. There are more than 30 thousand people in the modding group Discord. Compare to less than 70 thousand people online in the platform at time of writing - a sizeable minority of the community uses (and a subset of them needs) mods. There are more than 200 safe working mods right now.

Bytewave81 4y ago

Udon is not a modding API and was never intended to be one. It is purely a world-centric scripting system, which is great for building minigames inside VRchat, but not for extending the client's features on a global basis.

devwastaken 4y ago

Udon isn't an extension. There are many mods, authors, and tens of thousands of hours of work put in by game devs. It's disrespectful to be commenting about a subject you don't have experience with. It's only muddying the waters.

__alexs 4y ago

> never seen that work in practice it often doesn't work out even if you do ban modified clients. there's an impressive array of hacked clients for many games out there.