5 ms·

>You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!

by _mb2v 4y ago

pteraspidomorph 4y ago
You're the one who has to explain yourself. > Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. "Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that? > There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there. > as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions. So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC. > if you manage to obtain their IP address via exploit or social engineering. IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.
- _mb2v 4y ago
  [dead]
  - pteraspidomorph 4y ago
    Glancing at the links you provided, I see some unfounded rumors and some (three?) references to the creation of avatars that overload users, causing them to crash (including one of the features in the bottom links). It's common knowledge that this is possible, and VRChat should probably do a better job of analyzing avatars at time of upload. EAC does not prevent this in any way, shape or form. I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this. The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does? I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
    - _mb2v 4y ago
      It sounds like you’re a VRChat mod user who is unhappy with the new update, and thinks I am defending it based on the bad mods it will ban. This is not what is happening. I am ambivalent to negative on EAC. The purpose of my comment above is to raise awareness of the bad parts of VRChat generally, especially to HN users unfamiliar with this game and its risks for younger users. I think EAC is a bandaid that will negatively impact good users and have minimal impact on bad actors. Many mods are used for malicious purposes. This doesn’t mean ‘ban mods,’ it means patch the holes bad mods exploit.
      - pteraspidomorph 4y ago
        I agree with your sentiment there for sure, but this is a submission about EAC. You have filled it with off-topic comments in a way that makes it seem you don't understand what the conversation is about. You made a very misleading statement when asked about the modding community that strongly implies it's mainly nefarious and exploitative, and that's what I replied to. You know who has patched some of those holes you're talking about? Modders. There are mods that mitigate crasher avatars.
        _mb2v 4y ago
        I submit that the problem is actually bigger than you think, there are in fact more malicious mods than you realize, and drastic measures should be taken. I don’t think EAC is the right fix and I think it’s being made for the wrong reasons. Most regular users don’t use or know about anti-crasher mods, and in any case the problems are inherent to the game’s design. Fixing those problems should be VRChat’s main goal. The OP is about VRChat mods. I started talking about malicious mods and segued into bad stuff on VRChat in general, which I think is both relevant and interesting to HN users. If you don’t like it, I encourage you to help remove the bad stuff.
  - numpad0 4y ago
    Hey since you claim to be a knowledgeable VRC user - which I have no reasons to doubt - do you think it’s all about those crashers or could it be also to stop avatar rips, maybe foreshadowing microtransactions? I’m completely uninitiated on VRC, but I do see some artists who have been offering VRC avatars and accessories through external services like booth.pm for couple years by now. Rips and thrown-together pirated models was a huge problem at least initially, and I would imagine would only be helped by mods. Could this be that VRC is finally moving onto integrating avatar/editor marketplace and locking down on “illegal” avatars as part of that move?
    - LordDragonfang 4y ago
      I think avatar data is stored in a cache file, so banning modified clients won't necessarily prevent rips.
      - pteraspidomorph 4y ago
        For the sake of understanding the problem, any avatar marked as public can, or at least could (I can't say I've looked into this problem recently) be obtained in the following manner (DON'T do this, as it's still both a violation of the TOS and copyright infringement): - Change into the avatar. - Ask the VRChat API (backend) for information on yourself (this requires no special permissions). - Use the link contained in the response JSON to download the avatar to your computer (it's how the official client obtains it, too) - Unpack it with literally any Unity asset pack extractor, of which there are several. The asset pack is not secured in any way. Note how mods are conspicuously absent from all of these steps. I'm an avatar maker myself, and at this point my stance is that I can't be responsible for people stealing assets from me that I'm not allowed to redistribute, but I'm open to directly giving anyone anything I'm allowed to redistribute, and to teach them how to implement, download or purchase everything else. It's a load off my mind.

>You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!

by _mb2v 4y ago

>You have no idea what you're talking about regarding mods. Like, at all. Enlighten us!

You're the one who has to explain yourself. > Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. "Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that? > There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there. > as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions. So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC. > if you manage to obtain their IP address via exploit or social engineering. IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.

_mb2v 4y ago
[dead]
- pteraspidomorph 4y ago
  Glancing at the links you provided, I see some unfounded rumors and some (three?) references to the creation of avatars that overload users, causing them to crash (including one of the features in the bottom links). It's common knowledge that this is possible, and VRChat should probably do a better job of analyzing avatars at time of upload. EAC does not prevent this in any way, shape or form. I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this. The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does? I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
  - _mb2v 4y ago
    It sounds like you’re a VRChat mod user who is unhappy with the new update, and thinks I am defending it based on the bad mods it will ban. This is not what is happening. I am ambivalent to negative on EAC. The purpose of my comment above is to raise awareness of the bad parts of VRChat generally, especially to HN users unfamiliar with this game and its risks for younger users. I think EAC is a bandaid that will negatively impact good users and have minimal impact on bad actors. Many mods are used for malicious purposes. This doesn’t mean ‘ban mods,’ it means patch the holes bad mods exploit.
    - pteraspidomorph 4y ago
      I agree with your sentiment there for sure, but this is a submission about EAC. You have filled it with off-topic comments in a way that makes it seem you don't understand what the conversation is about. You made a very misleading statement when asked about the modding community that strongly implies it's mainly nefarious and exploitative, and that's what I replied to. You know who has patched some of those holes you're talking about? Modders. There are mods that mitigate crasher avatars.
      - _mb2v 4y ago
        I submit that the problem is actually bigger than you think, there are in fact more malicious mods than you realize, and drastic measures should be taken. I don’t think EAC is the right fix and I think it’s being made for the wrong reasons. Most regular users don’t use or know about anti-crasher mods, and in any case the problems are inherent to the game’s design. Fixing those problems should be VRChat’s main goal. The OP is about VRChat mods. I started talking about malicious mods and segued into bad stuff on VRChat in general, which I think is both relevant and interesting to HN users. If you don’t like it, I encourage you to help remove the bad stuff.
- numpad0 4y ago
  Hey since you claim to be a knowledgeable VRC user - which I have no reasons to doubt - do you think it’s all about those crashers or could it be also to stop avatar rips, maybe foreshadowing microtransactions? I’m completely uninitiated on VRC, but I do see some artists who have been offering VRC avatars and accessories through external services like booth.pm for couple years by now. Rips and thrown-together pirated models was a huge problem at least initially, and I would imagine would only be helped by mods. Could this be that VRC is finally moving onto integrating avatar/editor marketplace and locking down on “illegal” avatars as part of that move?
  - LordDragonfang 4y ago
    I think avatar data is stored in a cache file, so banning modified clients won't necessarily prevent rips.
    - pteraspidomorph 4y ago
      For the sake of understanding the problem, any avatar marked as public can, or at least could (I can't say I've looked into this problem recently) be obtained in the following manner (DON'T do this, as it's still both a violation of the TOS and copyright infringement): - Change into the avatar. - Ask the VRChat API (backend) for information on yourself (this requires no special permissions). - Use the link contained in the response JSON to download the avatar to your computer (it's how the official client obtains it, too) - Unpack it with literally any Unity asset pack extractor, of which there are several. The asset pack is not secured in any way. Note how mods are conspicuously absent from all of these steps. I'm an avatar maker myself, and at this point my stance is that I can't be responsible for people stealing assets from me that I'm not allowed to redistribute, but I'm open to directly giving anyone anything I'm allowed to redistribute, and to teach them how to implement, download or purchase everything else. It's a load off my mind.