The most popular client mod is emmVRC:
Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API, as well as some clients which tie into DDoS services that will target specific users in-game if you manage to obtain their IP address via exploit or social engineering. These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions.
The game's moderation is essentially nonexistent. Anyone who does get banned for using mods, or sexually grooming underage users, or running around in nude avatars with giant ejaculating phalluses, or all of the above at the same time, can make a new account in a split second. They don't ban IPs, and only recently blocked most well-known VPN IP ranges.
I've got a folder full of OBS screen captures of ~a hundred inicidents like those just described. They don't tell you if reporting a user results in moderation, to "prevent bullying," but I can tell you that users I recorded months ago running modded clients and sexually grooming children (adult with NSFW avatar explaining earnestly why incest is OK to preteens) still log in daily. I stopped filing moderation tickets when I realized nothing was happening. It's an absolute shitshow, a media exposé waiting to happen. I haven't even mentioned the staff-curated default avatar worlds with Disney and Viacom copyrighted characters.
——
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
——
To be clear, banning mods and enforcing EAC won’t fix these problems. Improving moderation and patching the holes exploited by malicious mods will fix the problem.
It's already happened. In the UK on Channel 4 at least: https://www.channel4.com/programmes/inside-the-metaverse-are.... It shows many of the incidents you've described. Including things that you probably haven't experienced (the player was a black woman, so you can imagine what she experienced).
I can kinda see how this is fun the first time, or in a very specific age range, but I think the novelty would quickly wear off.
Enlighten us!
> Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client.
"Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that?
> There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API
This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there.
> as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions.
So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC.
> if you manage to obtain their IP address via exploit or social engineering.
IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
I’m curious why you so energetically promote a false, rosier view of the situation.
EAC does not prevent this in any way, shape or form.
I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this.
The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does?
I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
Many mods are used for malicious purposes. This doesn’t mean ‘ban mods,’ it means patch the holes bad mods exploit.
You know who has patched some of those holes you're talking about? Modders. There are mods that mitigate crasher avatars.
Most regular users don’t use or know about anti-crasher mods, and in any case the problems are inherent to the game’s design. Fixing those problems should be VRChat’s main goal.
The OP is about VRChat mods. I started talking about malicious mods and segued into bad stuff on VRChat in general, which I think is both relevant and interesting to HN users. If you don’t like it, I encourage you to help remove the bad stuff.
I’m completely uninitiated on VRC, but I do see some artists who have been offering VRC avatars and accessories through external services like booth.pm for couple years by now. Rips and thrown-together pirated models was a huge problem at least initially, and I would imagine would only be helped by mods.
Could this be that VRC is finally moving onto integrating avatar/editor marketplace and locking down on “illegal” avatars as part of that move?
- Change into the avatar.
- Ask the VRChat API (backend) for information on yourself (this requires no special permissions).
- Use the link contained in the response JSON to download the avatar to your computer (it's how the official client obtains it, too)
- Unpack it with literally any Unity asset pack extractor, of which there are several. The asset pack is not secured in any way.
Note how mods are conspicuously absent from all of these steps.
I'm an avatar maker myself, and at this point my stance is that I can't be responsible for people stealing assets from me that I'm not allowed to redistribute, but I'm open to directly giving anyone anything I'm allowed to redistribute, and to teach them how to implement, download or purchase everything else. It's a load off my mind.
Linden Labs did just that -- and almost every other better-practices VR thing -- and it worked just fine.
Linden Labs and their teething problems should be the bible for anyone starting a 'VR-experiences' style platform, but for some reason their past struggles have been widely ignored by the newer players in the field.
[0] Or ActiveWorlds, or the metric buttload of VRML chat services before that...
It's also a great example of a hype cycle - it was going to be the future, it was going to be everything, corporates had offices in there, universities had campuses, there were virtual music events and art galleries, there were real-dollar millionaires made from virtual real-estate.
When the hype died down and the smoke cleared, there were still people wanting to use it, but not that many, and not in the way we were all told to expect, and the corporates realised they didn't need a bank branch or an SL office full of virtual meeting rooms in there after all. Neat sandbox with interesting ongoing uses, not the new centre of all our online lives.
What will be the real "VR metaverse" for most consumers is the one that maps to reality. The AR metaverse. Being able to visit people in real life in real locations, virtually: augmented reality. Where the virtual reality part of that is a small extra side bit for the dedicated people.
While there used to always be soft pressure to structure your life in the real world, with work and school online, folks who otherwise would be pressured to interact offline might now find interaction online to be just as fulfilling. Or at least equally fulfilling for things like work while saving quality, offline time for friends.
I know there are headsets now, maybe it will go differently. Maybe not.
But having seen virtual worlds come and go multiple times, I'm going to assume that it's another hype cycle until there's compelling evidence to the contrary.
You might as well not be a person if you live in a virtual world...necessities like money and basic human needs mean people outgrow their fantasy world, and their fantasy games. Moves like this cause fragmentation, such that there is no one virtual world.
As your userbase gradually dwindles to nothing...they grow up and have lives. Or don't, and are usually characterized by low paying jobs, poor health.
Ofc not every low paid worker is there by choice, and some are born disabled, but on average these games are a cause of their plight.
Every time I see news about the "Metaverse", I remember the articles Shamus Young (RIP) wrote about ActiveWorlds and the DotCom bubble crash:
https://www.shamusyoung.com/twentysidedtale/?p=35399
The metaverse doesn't seem quite that bad (Facebook's people seem to have an understanding of the medium they want to operate in), but the basic "we're going to make the user experience worse by replicating the limitations of the real world for the sake of realism" mentality is still there.
As for the metaverse, people need to realize that it's not for everyone . Maybe in 10-20 years or so
Isn’t this is what most teenagers use Fortnite and Minecraft as.
I'd say, Roblox is more sticky, as there's a built in friend list and chat/messages without being in game.
Fortnite and Minecraft do have chat features in them, but those are features tacked-on as a last resort. In the case of Minecraft you don't even have voice chat. In the olden days of the Xbox 360's heyday[0], all we had were one-on-one voice channels or in-game chat, the latter of which would be an absolutely toxic nightmare of getting shouted and screamed at.
Furthermore, Fortnite and Minecraft are games whose camera and movement controls are optimized for the specific game mechanics they feature. If you want to create a generic 3D world, then you have to also create a generic set of controls to move and look around that world; and those controls are always going to be awkward and difficult to use.
Maybe you built a regular house, in which case Sims-style point-and-click-to-move and a fixed camera angle would be your best control option. Or maybe you built a racetrack with cars, which means you want WASD-steering with a car-locked third-person camera. Your FPS level wants first-person or over-the-shoulder third-person.
Second Life tried to do all of the above, so they gave you a default behind-the-head camera that vaguely works in open spaces, but you have to use Maya-style camera orbit controls to look at specific things. You can scroll to zoom to first person, but you can't use any of the builder controls in that view because of mouselook. And all of this was complicated enough that Linden Labs felt it was necessary to add "easy" movement and camera controls driven by UI buttons, but not to add click-to-move for third-person mode.
The thing is, when I look back at Second Life I can't really think of a way that it could have been done better. I can think of features that it's missing, but that wouldn't fix the clunkiness of the controls. Anything I could think of to fix camera movement would bias in the direction of a particular 'genre'; and making people switch between "FPS mode", "car mode", and "hanging out mode" would be a total pain.
This isn't even getting into the other problems these projects have, like the fact that 3D worlds are really expensive to build, or that the copyright maximalists will have a field day suing you over all the pirated content that your users will inevitably port in.
[0] As in, "blades dash" era 360
My biggest concern is that I've yet to find a VR headset that I can use for more than about ten minutes before feeling nauseated from motion sickness. I'm told this is somewhat/mostly solved and I've used higher end gear but it's been the same result for me every time.
Sometimes I see these issues being brought but and I always wonder if they are associated with experiencing applications that make your virtual body move artificially without actually moving in real life, instead of staying intact like in Beat Saber or jumping by teleportation like Half Life: Alyx allows?
It seems a popular mistake for VR newcomers is to get in—or be put in—a rollercoaster or drive a car where these kind of problems are very visibile.
> never seen that work in practice.
Isn't this solved by basically every game with a persistent economy? If e.g. Eve online or Runescape just trusted the client they would have fallen apart years ago (not mentioning WoW until the next para because its economy is less important/more isolated to each individual player than a lot of other mmos).
Afaik in World of Warcraft (and by extension probably a lot of other similar games) a bunch of important stuff is totally serverside - your current HP/Mana/Inventory, skill cooldowns, buffs etc. None of that is controlled by the client, and the best you could do by hacking it would be to get it to temporarily show information that was different from what everyone else sees, and couldn't affect any other players.
Movement in WoW (afaik) is a bit more of a hybrid thing - it's a mixture of the client immediately responding to player input, and the server only resetting player position/kicking people off the server if it determines that the player could not have performed that movement with their maximum speed.
With a lot of games this isn't actually that hard either - you just encode rules about what players can do (max movement speed, rate limit amount of chat messages per second, abilities that that player has access to etc) and kick people from the server if their client claims they're doing anything impossible.
In competitive shooters it's a bit different - you don't want to let clients send you technically legitimate "I shoot in this direction" commands that come from an aimbot instead of a mouse, so a multifaceted approach is important here. But VRChat isn't a competitive shooter.
With turn based games it's really trivial, just have clients send you their decisions for each turn, run all the game logic server side and have the client be a dumb UX that plays the animations it's told to.
===================================================
Having an authoritative client and just trying to detect cheating on the server is very difficult/impossible - but that's because it's totally the wrong way to solve the problem in the first place.
You want to have the backend doing all the important logic, and have the client be as dumb as possible (or write a deterministic game engine and have the server replay the same inputs at the same time from the same state and boot people when the outcome doesn't match what they told you happened, but this requires engineering up front - it's not an easy thing to retrofit into an existing game).
===================================================
Edit: Realised WoW is a good example for mods too - the client is moddable, but there's a clearly defined API for what mods are allowed to see/do. It works pretty well.
Doing this the right way is not impossible, it's just probably more engineering effort than the devs of VRChat are willing to put in.
Those guys push major updates on friday evenings, introducing new bugs and causing clients to break right when the weekend parties are scheduled to happen. I doubt it's a matter of "willing" and more about competence.
Valve is pretty good at this, and they don't even use kernel level anti-tampering as a facet. Trust factor, VACnet (machine learning) and overwatch (community demo review) add up to a system that's pretty decent at not matching you with cheaters if you aren't one.
These is easy when a couple seconds latency is acceptable. In an action game, as opposed to an MMO, it isn't. 100ms is likely to lead to a very subpar experience.
Thus you end up doing stuff client side, even if you sync up with the server a couple times a second.
You can paper over latency by immediately showing animations and stuff clientside, and rolling back if the server decides it didn't happen - most games do do this. But there's not a multiple second gap between e.g. you activating a spell in WoW and the outcome being registered by all players involved - that would be actually unplayable as you say. There's also sub second cast times combined with spells that interrupt/stun those other spells.
Nowadays there's not much difference between a lot of MMOs and what I assume you're referring to by action games - see New World[1], Black Desert, Tera, Elder Scrolls Online for a bunch of examples of games that have fast paced combat with small cooldowns and reticle aiming while also being full fat MMOs.
Besides, this thread is about VRChat, which is definitely not an action game.
There are many mods, authors, and tens of thousands of hours of work put in by game devs.
It's disrespectful to be commenting about a subject you don't have experience with. It's only muddying the waters.
it often doesn't work out even if you do ban modified clients. there's an impressive array of hacked clients for many games out there.
Except in every competitive online game that predates EAC. Rule #1 in networked games is "don't trust the client".
I’m not arguing that there’s no rate limiting going on in the server, but some things such as not being able to call several api commands with only one hardware event are enforced client side because by definition the server has no idea about whether a hardware event happened.
Even Ring-0 anti-cheat software hasn’t kept Valorent cheat and abuse free.
The server is the only software not in “malicious” hands; it’s the only place anti-abuse checks are viable.
> They are complaining how much time they wasted on mods
You mean their complaint that they wasted time on bug reports coming from modded clients? And instead of using the obvious, dead simple solution of appending a client ID to the bug report to filter out modded clients, they prefer to use this as an excuse to add DRM?
Guild Wars had a similar issue of getting bug reports from clients due to hardware errors. Did they ban all PCs not built by an authorized OEM? No - they simply added a hardware health check to their game, and ignored bug reports by clients that failed it.
Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do.
The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.
Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.
Specs locked behind paywalls/licensewalls. Closed source API:s, lock in via cryptography... It all comes together to create just what large software platforms want, but what people like Engelbart were trying to avoid.
A technically ignorant/illeterate user populace.
Is there any online game that has permitted modded clients playing with unmodded clients and had it go well?
Their policy is basically "Don't Ask, Don't Tell". So as long as you aren't yelling at people about DPS meters or streaming with obvious mods, they'll leave you alone.
But what kind of cheats? Aimbotting and seeing through walls don't apply to VR chat. And no matter how modded your client was, you couldn't spam endless grenades in Counter Strike - the server knows how many grenades you have, and where you can throw them.
Due to starcraft 2's design, defogging hacks were plentiful.
Anyone who has played TF2 for a significant amount of time has run into hackers landing impossible shots, e.g. through walls
before EAC, there has been VAC (along with two separate community-ran anti-cheat services for source games), Battleye, Warden, etc. It seems universal amongst those involved, that client-side anti cheat helps way more than you expect.
never seen that work in practice.
> They should know which client (or at least that a modified client) is being used.
That's the modified client's job, not the original client's job. if the modified client is intentionally trying to be hidden, then its not going to show itself. Which is the cause of the whole everything
> Extensions
https://docs.vrchat.com/docs/what-is-udon already exists
> But if there's already a vibrant community of mods out there
is there a vibrant community of mods? besides, they have actively told people to bugger off if they use a custom client for a while now, by the sounds of it (e.g. the two mods I could find, both said that you will likely get banned for using them)