_mb2v
The Facebook crowd would be just as bad in VR, probably, but VRChat is its own sort of hive of scum and villainy.
Most regular users don’t use or know about anti-crasher mods, and in any case the problems are inherent to the game’s design. Fixing those problems should be VRChat’s main goal.
The OP is about VRChat mods. I started talking about malicious mods and segued into bad stuff on VRChat in general, which I think is both relevant and interesting to HN users. If you don’t like it, I encourage you to help remove the bad stuff.
Many mods are used for malicious purposes. This doesn’t mean ‘ban mods,’ it means patch the holes bad mods exploit.
If you’re a kid, it can be scary and potentially dangerous. The game is advertised with cartoon characters and a child-friendly aesthetic, far from what you actually find in public worlds. It’s easy for bad actors to hone in on kids based on voice, then corner them and do bad things. I’ve spoken to kids who were approached and “flashed” by much older users with explicit, ejaculating sexual avatars. It’s unpleasant and disorienting. Not to mention adults who zero in on kids, drop a portal to show them a “cool world” and then get them one-on-one in essentially an unsupervised VoIP call. This platform is practically designed to trap and abuse kids.
And yes, kids technically aren’t allowed to play VRChat or even go online using the Quest per Terms of Service. Enforcement is impossible, not that anyone tries, so kids are everywhere.
——
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
——
To be clear, banning mods and enforcing EAC won’t fix these problems. Improving moderation and patching the holes exploited by malicious mods will fix the problem.
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
I’m curious why you so energetically promote a false, rosier view of the situation.
There is no NSFW tagging system, no content filtering for uploaded avatars, no effective means to permanently ban abusive users, and extremely lax in-game moderation. There are tons of sexualized, fully nude, and fully-functional avatars all over the place. Spend a couple hours in the main public worlds and you're almost guaranteed to see some. Remember, this game is absolutely full of children and pre-teens, and the kind of adults who choose to hang out around them. The game is free on the Meta Quest store with zero age restrictions.
Enlighten us!
In this case, an exploitable platform filled with children and near-zero moderation of sexualized content. As you know, VRChat doesn't even have an NSFW tagging system or option for users to filter such content out (without hiding all custom avatars, i.e. disabling VRChat's core functionality).
"Second Life Is Plagued by Security Flaws, Ex-Employee Says; A former infosec director at Linden Lab alleges the company mishandled user data and turned a blind eye to simulated sex acts involving children."
https://www.wired.com/story/second-life-plagued-security-fla...
This community is now deeply imbedded in VRChat, another platform full of unsupervised children and security flaws.
There's still cool stuff there and unique and positive interactions to be had, but it's a slog.
The most popular client mod is emmVRC:
Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client. There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API, as well as some clients which tie into DDoS services that will target specific users in-game if you manage to obtain their IP address via exploit or social engineering. These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions.
The game's moderation is essentially nonexistent. Anyone who does get banned for using mods, or sexually grooming underage users, or running around in nude avatars with giant ejaculating phalluses, or all of the above at the same time, can make a new account in a split second. They don't ban IPs, and only recently blocked most well-known VPN IP ranges.
I've got a folder full of OBS screen captures of ~a hundred inicidents like those just described. They don't tell you if reporting a user results in moderation, to "prevent bullying," but I can tell you that users I recorded months ago running modded clients and sexually grooming children (adult with NSFW avatar explaining earnestly why incest is OK to preteens) still log in daily. I stopped filing moderation tickets when I realized nothing was happening. It's an absolute shitshow, a media exposé waiting to happen. I haven't even mentioned the staff-curated default avatar worlds with Disney and Viacom copyrighted characters.
https://neos.com/#neos-credits
The selling point of Neos used to be that it allowed 10-point full-body tracking (as opposed to 6-point) while VRChat did not, but VRChat recently added that functionality.