Even if it is an arms race, adding anti-cheat software will not make the client trustable. The arms race, as you say, will continue.

Even Ring-0 anti-cheat software hasn’t kept Valorent cheat and abuse free.

The server is the only software not in “malicious” hands; it’s the only place anti-abuse checks are viable.

Pretty much all AC focused on protecting the client and game memory was already ring 0 before Valorant even came out.

How is "don't trust the client" an arms race? But now we're moving past the simple empirical fact that for countless games it worked, and still works.

> They are complaining how much time they wasted on mods

You mean their complaint that they wasted time on bug reports coming from modded clients? And instead of using the obvious, dead simple solution of appending a client ID to the bug report to filter out modded clients, they prefer to use this as an excuse to add DRM?

Guild Wars had a similar issue of getting bug reports from clients due to hardware errors. Did they ban all PCs not built by an authorized OEM? No - they simply added a hardware health check to their game, and ignored bug reports by clients that failed it.

> How is "don't trust the client" an arms race?

Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do.

The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.

Another reason for EAC would be a kind of cheat people built for a recent Battlefield game: a modded graphics driver that changed colors to make other players more visible. There's just no way to detect this server side.

That doesn't seem very relevant for VRChat, either.

>Just ban/kick if the client tries to do something it isn't supposed to do.

Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.

The "dead simple solution of appending a client ID" would completely fail if the modified client sent the Client ID of a supported client.

Correct. The problem is users not mentioning they have modified clients when reporting e.g. avatar rendering issues to individual modders. The users aren't being deceptive, they're just non-technical

Welcome to the fruits of a computing industry that hasn't focused on making computing more accessible cognitive load wise in decades.

Specs locked behind paywalls/licensewalls. Closed source API:s, lock in via cryptography... It all comes together to create just what large software platforms want, but what people like Engelbart were trying to avoid.

A technically ignorant/illeterate user populace.