Hacker News Reader

Comment by superb-owl | Hacker News Reader

I'm not a VRchat user. But it's sad they decided to ban modified clients. Giving the community a way to customize their experience is a great way to grow an ecosystem and learn about what your users want.

The problems they mention are all solvable without banning mods:

> Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues.

These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc.

> Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes

Keep a list of "blessed" open source clients that have a reputation, and allow people to report them. Chrome and Firefox extensions have solved this

> Additionally, all modified clients – even ones that aren’t malicious – are a burden for creators. We regularly speak to many that have spent hours (or days) debugging user issues, only to realize that the culprit is a modified client.

Provide better debugging info for your creators! They should know which client (or at least that a modified client) is being used.

> This pain extends to VRChat support too – any time we update, we get a massive amount of bug reports that end up just being broken modifications

Ditto. These tickets should be easy to auto-close if you force folks to include info about their client.

I understand all this requires time and effort, and simply restricting the client-side of things is a low-cost solution. But if there's already a vibrant community of mods out there, I think you have a responsibility (and a vested interest) in trying to preserve that.

View on HN

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc.

never seen that work in practice.

> They should know which client (or at least that a modified client) is being used.

That's the modified client's job, not the original client's job. if the modified client is intentionally trying to be hidden, then its not going to show itself. Which is the cause of the whole everything

> Extensions

https://docs.vrchat.com/docs/what-is-udon already exists

> But if there's already a vibrant community of mods out there

is there a vibrant community of mods? besides, they have actively told people to bugger off if they use a custom client for a while now, by the sounds of it (e.g. the two mods I could find, both said that you will likely get banned for using them)

> never seen that work in practice.

Except in every competitive online game that predates EAC. Rule #1 in networked games is "don't trust the client".

That’s an endless arm race. They are complaining how much time they wasted on mods

How is "don't trust the client" an arms race? But now we're moving past the simple empirical fact that for countless games it worked, and still works.

> They are complaining how much time they wasted on mods

You mean their complaint that they wasted time on bug reports coming from modded clients? And instead of using the obvious, dead simple solution of appending a client ID to the bug report to filter out modded clients, they prefer to use this as an excuse to add DRM?

Guild Wars had a similar issue of getting bug reports from clients due to hardware errors. Did they ban all PCs not built by an authorized OEM? No - they simply added a hardware health check to their game, and ignored bug reports by clients that failed it.

> How is "don't trust the client" an arms race?

Exactly. You write the game logic, you know what the client is and isn't allowed to do. Just ban/kick if the client tries to do something it isn't supposed to do.

The only thing stuff like EAC should be needed for is stopping people from delegating making their game logic legal inputs via an aimbot or some external script instead of their actual fingers, which doesn't seem relevant for VRChat.

Another reason for EAC would be a kind of cheat people built for a recent Battlefield game: a modded graphics driver that changed colors to make other players more visible. There's just no way to detect this server side.

That doesn't seem very relevant for VRChat, either.

>Just ban/kick if the client tries to do something it isn't supposed to do.

Of course couple this with a deep understanding of what your client actually can do. Oh, and keep track of updates you'll have a lot of banned users.

The "dead simple solution of appending a client ID" would completely fail if the modified client sent the Client ID of a supported client.

Correct. The problem is users not mentioning they have modified clients when reporting e.g. avatar rendering issues to individual modders. The users aren't being deceptive, they're just non-technical

Welcome to the fruits of a computing industry that hasn't focused on making computing more accessible cognitive load wise in decades.

Specs locked behind paywalls/licensewalls. Closed source API:s, lock in via cryptography... It all comes together to create just what large software platforms want, but what people like Engelbart were trying to avoid.

A technically ignorant/illeterate user populace.

Even if it is an arms race, adding anti-cheat software will not make the client trustable. The arms race, as you say, will continue.

Even Ring-0 anti-cheat software hasn’t kept Valorent cheat and abuse free.

The server is the only software not in “malicious” hands; it’s the only place anti-abuse checks are viable.

Pretty much all AC focused on protecting the client and game memory was already ring 0 before Valorant even came out.

Cheating was rampant in those games? Even nowadays the most liberal modding policy for multiplayer games is "modded copies cannot play with unmodded copies" to try and cordon of modded users from being able to scam/grief/etc the general player base.

Is there any online game that has permitted modded clients playing with unmodded clients and had it go well?

> Cheating was rampant in those games?

But what kind of cheats? Aimbotting and seeing through walls don't apply to VR chat. And no matter how modded your client was, you couldn't spam endless grenades in Counter Strike - the server knows how many grenades you have, and where you can throw them.

Aimbotting/wallhacks are relevant, as there are games within VRChat where those are relevant.

Due to starcraft 2's design, defogging hacks were plentiful.

Anyone who has played TF2 for a significant amount of time has run into hackers landing impossible shots, e.g. through walls

before EAC, there has been VAC (along with two separate community-ran anti-cheat services for source games), Battleye, Warden, etc. It seems universal amongst those involved, that client-side anti cheat helps way more than you expect.

Minecraft. World of Warcraft. FFXIV. Just to name 3 off the top of my head.

Does squeenix explicitly allow FFXIV mods now?

Ehhh. I'd say they tolerate it.

Their policy is basically "Don't Ask, Don't Tell". So as long as you aren't yelling at people about DPS meters or streaming with obvious mods, they'll leave you alone.

It's worth noting that WoW addons also backfired at certain points but for different reasons. Example being AVR that drew shapes over the 3d world marking boss mechanics, essentially trivializing them and leading to Blizzard locking out that API entirely from addons. It didn't affect other users, though gave a competitive advantage to some.

And there is a hell lot of complaints about cheaters on hypixel, no?

In a game this makes sense, cheaters ruin the competitive aspect of the gameplay. But here people are objecting because there's no competition. VRChat's claims are that modded clients result in security exploits for unsuspecting users and can cause instability for non-modded users. So the question arises, can VRChat plug these problems without resorting to anti-cheat? Was anti-cheat just the lazy option, or are there inherent aspects of the client which make it hard to plug these security exploits or the instability?

I’d also invite anyone interested in this space to look at both the rule for World of Warcraft addons and their evolution over time. Many actions are doubly rate limited. Not only can you not spam a single action, you can typically only call one rate limited API action per event handler. So you can make a button that can do one of three actions depending on state, but if a second fires it generates an error.

Until you get a Lua unlocker. Because those limits are enforced by the client, not the server.

I’m not arguing that there’s no rate limiting going on in the server, but some things such as not being able to call several api commands with only one hardware event are enforced client side because by definition the server has no idea about whether a hardware event happened.

Yes and no. The rate limiting can still be done server side. Reacting to events is simplest on the client, but if you were being a hard ass about it you could do something with correlationIDs. I think it depends on how much state history you want to retain on the server to map actions to outcomes.

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc.

> never seen that work in practice.

Isn't this solved by basically every game with a persistent economy? If e.g. Eve online or Runescape just trusted the client they would have fallen apart years ago (not mentioning WoW until the next para because its economy is less important/more isolated to each individual player than a lot of other mmos).

Afaik in World of Warcraft (and by extension probably a lot of other similar games) a bunch of important stuff is totally serverside - your current HP/Mana/Inventory, skill cooldowns, buffs etc. None of that is controlled by the client, and the best you could do by hacking it would be to get it to temporarily show information that was different from what everyone else sees, and couldn't affect any other players.

Movement in WoW (afaik) is a bit more of a hybrid thing - it's a mixture of the client immediately responding to player input, and the server only resetting player position/kicking people off the server if it determines that the player could not have performed that movement with their maximum speed.

With a lot of games this isn't actually that hard either - you just encode rules about what players can do (max movement speed, rate limit amount of chat messages per second, abilities that that player has access to etc) and kick people from the server if their client claims they're doing anything impossible.

In competitive shooters it's a bit different - you don't want to let clients send you technically legitimate "I shoot in this direction" commands that come from an aimbot instead of a mouse, so a multifaceted approach is important here. But VRChat isn't a competitive shooter.

With turn based games it's really trivial, just have clients send you their decisions for each turn, run all the game logic server side and have the client be a dumb UX that plays the animations it's told to.

===================================================

Having an authoritative client and just trying to detect cheating on the server is very difficult/impossible - but that's because it's totally the wrong way to solve the problem in the first place.

You want to have the backend doing all the important logic, and have the client be as dumb as possible (or write a deterministic game engine and have the server replay the same inputs at the same time from the same state and boot people when the outcome doesn't match what they told you happened, but this requires engineering up front - it's not an easy thing to retrofit into an existing game).

===================================================

Edit: Realised WoW is a good example for mods too - the client is moddable, but there's a clearly defined API for what mods are allowed to see/do. It works pretty well.

Doing this the right way is not impossible, it's just probably more engineering effort than the devs of VRChat are willing to put in.

> Doing this the right way is not impossible, it's just probably more engineering effort than the devs of VRChat are willing to put in.

Those guys push major updates on friday evenings, introducing new bugs and causing clients to break right when the weekend parties are scheduled to happen. I doubt it's a matter of "willing" and more about competence.

> Isn't this solved by basically every game with a persistent economy? If e.g. Eve online or Runescape just trusted the client they would have fallen apart years ago (not mentioning WoW until the next para because its economy is less important/more isolated to each individual player than a lot of other mmos).

These is easy when a couple seconds latency is acceptable. In an action game, as opposed to an MMO, it isn't. 100ms is likely to lead to a very subpar experience.

Thus you end up doing stuff client side, even if you sync up with the server a couple times a second.

A couple of seconds latency is basically unplayable in any genre (except for turn based stuff I guess). When I used to play WoW latency was generally < 100ms.

You can paper over latency by immediately showing animations and stuff clientside, and rolling back if the server decides it didn't happen - most games do do this. But there's not a multiple second gap between e.g. you activating a spell in WoW and the outcome being registered by all players involved - that would be actually unplayable as you say. There's also sub second cast times combined with spells that interrupt/stun those other spells.

Nowadays there's not much difference between a lot of MMOs and what I assume you're referring to by action games - see New World[1], Black Desert, Tera, Elder Scrolls Online for a bunch of examples of games that have fast paced combat with small cooldowns and reticle aiming while also being full fat MMOs.

Besides, this thread is about VRChat, which is definitely not an action game.

[1] https://www.youtube.com/watch?v=a8JiJN8942o

> multifaceted approach is important here

Valve is pretty good at this, and they don't even use kernel level anti-tampering as a facet. Trust factor, VACnet (machine learning) and overwatch (community demo review) add up to a system that's pretty decent at not matching you with cheaters if you aren't one.

>never seen that work in practice.

Linden Labs did just that -- and almost every other better-practices VR thing -- and it worked just fine.

Linden Labs and their teething problems should be the bible for anyone starting a 'VR-experiences' style platform, but for some reason their past struggles have been widely ignored by the newer players in the field.

The problem is that if everyone with "metaverse" hype actually looked at Second Life[0], they'd realize that there's not really much to get hyped over. The final and most important lesson of Second Life was that most people do not want a 3D world chat room.

[0] Or ActiveWorlds, or the metric buttload of VRML chat services before that...

Yep. Some people do, they still have an audience, but it's not the revolution it was supposed to be.

It's also a great example of a hype cycle - it was going to be the future, it was going to be everything, corporates had offices in there, universities had campuses, there were virtual music events and art galleries, there were real-dollar millionaires made from virtual real-estate.

When the hype died down and the smoke cleared, there were still people wanting to use it, but not that many, and not in the way we were all told to expect, and the corporates realised they didn't need a bank branch or an SL office full of virtual meeting rooms in there after all. Neat sandbox with interesting ongoing uses, not the new centre of all our online lives.

I think COVID and GenZ growing up on the internet has changed the equation. Will the metaverse take over the world? Probably not. But now that knowledge work has gone remote, entire countries remain blocked to tourists, and people are coming down with flus they need to isolate for 10 days for, I think having a virtual sandbox to socialize in has more appeal.

Not being in Gen-Z, perhaps I don't get it.

But having seen virtual worlds come and go multiple times, I'm going to assume that it's another hype cycle until there's compelling evidence to the contrary.

Agreed.

You might as well not be a person if you live in a virtual world...necessities like money and basic human needs mean people outgrow their fantasy world, and their fantasy games. Moves like this cause fragmentation, such that there is no one virtual world.

As your userbase gradually dwindles to nothing...they grow up and have lives. Or don't, and are usually characterized by low paying jobs, poor health.

Ofc not every low paid worker is there by choice, and some are born disabled, but on average these games are a cause of their plight.

I think you missed the actual answer. There is a near future sci-fi book called Rainbows End written by a computer science professor 15 years ago (and that predicted a lot of stuff, like... cryptocurrency) that has an answer for this.

What will be the real "VR metaverse" for most consumers is the one that maps to reality. The AR metaverse. Being able to visit people in real life in real locations, virtually: augmented reality. Where the virtual reality part of that is a small extra side bit for the dedicated people.

I agree with this. I'm just saying in my opinion, with our current tech, VR and the Metaverse isn't something to be ignored. AR can definitely be bigger but it's important to remember that thousands of knowledge workers have begun their career never interacting with another person in a workplace.

While there used to always be soft pressure to structure your life in the real world, with work and school online, folks who otherwise would be pressured to interact offline might now find interaction online to be just as fulfilling. Or at least equally fulfilling for things like work while saving quality, offline time for friends.

But none of that looks like an excuse for VR to exist. That generation of remote first, they would be less interested in an hmd-based simulation of a meeting room, not more interested. They want a good camera, to be a better face on a screen, not better screens on their faces.

Of course and they are doing this, there's huge demand for nicer cameras, ring lights, backlights, etc for upcoming streamers and influencers. But this isn't a zero-sum game. It's not like we have to Zoom every hour of our work lives. Startups like Gather Town are predicated on finding a permanent, but not total, place in the future of remote work. If my company pays for a subscription to Minecraft For Work (TM) so that we can have remote tech talks or remote social events on it, then there's value, even if it's only used a couple hours per week by per team at a large company.

This is the exact same proposition that Second Life had, 15 years ago. Cross-continental teams can 'meet' in a shared virtual space and it'll be just like you're there! And after all the hype ... it just wasn't something that people did.

I know there are headsets now, maybe it will go differently. Maybe not.

And this will hopefully mean the end of Zuckerberg's expansion. It would be totally brilliant if this ended Meta.

Makes one think if remote work is going to find a home in those online worlds. The mechanics make sense and it gives a sense of togetherness.

The entire point of second Life is to have an infitely customizable character with user created clothing, etc. VRChat avatars are fully backed 3D models that require advanced modelling skills even for something as basic as changing the colour of a t-shirt.

I ve been inviting people to try SL (opensimulator, the open source version of SL) and most people actually like 3D worlds. Many people don't even know these things exist because their mainstream experience is mobile games and flat websites. But SL has a terrible user interface and experience and it's so complicated that it alienates those users. Even an advanced user would have a hard time figuring out all those legacy things and concepts, it's the Unix of VR worlds.

As for the metaverse, people need to realize that it's not for everyone . Maybe in 10-20 years or so

>The final and most important lesson of Second Life was that most people do not want a 3D world chat room.

Isn’t this is what most teenagers use Fortnite and Minecraft as.

On the internet “most people” are an imaginary statistic we toss around thinking it means anything.

Roblox and Minecraft both are good examples of Worlds where people meet up to socialize and play games.

I'd say, Roblox is more sticky, as there's a built in friend list and chat/messages without being in game.

They use Fortnite and Minecraft as something to do while they chat in another client, usually Discord. Modern multiplayer games have largely reduced (or eliminated) communication with people you aren't already friends with.

No, not really. You're thinking of Discord.

Fortnite and Minecraft do have chat features in them, but those are features tacked-on as a last resort. In the case of Minecraft you don't even have voice chat. In the olden days of the Xbox 360's heyday[0], all we had were one-on-one voice channels or in-game chat, the latter of which would be an absolutely toxic nightmare of getting shouted and screamed at.

Furthermore, Fortnite and Minecraft are games whose camera and movement controls are optimized for the specific game mechanics they feature. If you want to create a generic 3D world, then you have to also create a generic set of controls to move and look around that world; and those controls are always going to be awkward and difficult to use.

Maybe you built a regular house, in which case Sims-style point-and-click-to-move and a fixed camera angle would be your best control option. Or maybe you built a racetrack with cars, which means you want WASD-steering with a car-locked third-person camera. Your FPS level wants first-person or over-the-shoulder third-person.

Second Life tried to do all of the above, so they gave you a default behind-the-head camera that vaguely works in open spaces, but you have to use Maya-style camera orbit controls to look at specific things. You can scroll to zoom to first person, but you can't use any of the builder controls in that view because of mouselook. And all of this was complicated enough that Linden Labs felt it was necessary to add "easy" movement and camera controls driven by UI buttons, but not to add click-to-move for third-person mode.

The thing is, when I look back at Second Life I can't really think of a way that it could have been done better. I can think of features that it's missing, but that wouldn't fix the clunkiness of the controls. Anything I could think of to fix camera movement would bias in the direction of a particular 'genre'; and making people switch between "FPS mode", "car mode", and "hanging out mode" would be a total pain.

This isn't even getting into the other problems these projects have, like the fact that 3D worlds are really expensive to build, or that the copyright maximalists will have a field day suing you over all the pirated content that your users will inevitably port in.

[0] As in, "blades dash" era 360

> Or ActiveWorlds

Every time I see news about the "Metaverse", I remember the articles Shamus Young (RIP) wrote about ActiveWorlds and the DotCom bubble crash:

https://www.shamusyoung.com/twentysidedtale/?p=35399

The metaverse doesn't seem quite that bad (Facebook's people seem to have an understanding of the medium they want to operate in), but the basic "we're going to make the user experience worse by replicating the limitations of the real world for the sake of realism" mentality is still there.

SecondLife, Fortnite, Roblox, etc (even VRC on PC) are what Matthew Ball refers to as "proto-Metaverses" as in 3D experiences locked inside 2D screens. But you can't compare those experiences to what is possible when you can see 3D in 3D either overlayed on top of reality or in a totally animated world space. It's Apples and Oranges -- yes they are both fruit; but you'd be very wrong indeed to think because one is good in a pie the other must be.

Personally, I hadn't thought of it this way (mostly dismissed the idea). I'm sure it's a much different experience and one would have to experience it to properly judge it. I think the difficulty with the other, more generic, platforms was that the question of "what is the point" came up, a lot. And when users got to define "the point", sometimes "the point" was pretty disturbing ... most of the time it was just boring.

My biggest concern is that I've yet to find a VR headset that I can use for more than about ten minutes before feeling nauseated from motion sickness. I'm told this is somewhat/mostly solved and I've used higher end gear but it's been the same result for me every time.

> My biggest concern is that I've yet to find a VR headset that I can use for more than about ten minutes before feeling nauseated from motion sickness.

Sometimes I see these issues being brought but and I always wonder if they are associated with experiencing applications that make your virtual body move artificially without actually moving in real life, instead of staying intact like in Beat Saber or jumping by teleportation like Half Life: Alyx allows?

It seems a popular mistake for VR newcomers is to get in—or be put in—a rollercoaster or drive a car where these kind of problems are very visibile.

There is a vibrant community of mods. There are more than 30 thousand people in the modding group Discord. Compare to less than 70 thousand people online in the platform at time of writing - a sizeable minority of the community uses (and a subset of them needs) mods. There are more than 200 safe working mods right now.

Udon is not a modding API and was never intended to be one. It is purely a world-centric scripting system, which is great for building minigames inside VRchat, but not for extending the client's features on a global basis.

Udon isn't an extension.

There are many mods, authors, and tens of thousands of hours of work put in by game devs.

It's disrespectful to be commenting about a subject you don't have experience with. It's only muddying the waters.

> never seen that work in practice

it often doesn't work out even if you do ban modified clients. there's an impressive array of hacked clients for many games out there.

I'm gonna play devil's advocate here.

I pretty much agree with all your points, but what I see here is that VRChat developers or product people are choosing the solution that requires the least effort. They may have other features or fixes in their roadmap and decided to squash all the fixes into a single one: banning them.

If I were them, given the popularity of modified clients I'd try to turn that into a feature that sets them appart from other competitors, but I still think it's a rational choice to ban them given how much developer time costs.

If the true goal is to enable creators, why not let the creators choose whether to require EAC to connect.

It should not require much extra developer time at all to let both users and creators choose whether to join an EAC or non-EAC instance.

Excellent idea, and in theory others could create better alternatives for centralized moderation.

That's what I was going to say. The bullet points sound like a ton of work. And I'm sure the devs put considerable effort into exploring these points. There may have even been code in the repo to address these points.

EAC is about protecting game files. This is to protect cosmetic sales, nothing else.

You can already import any models you want (read: models you purchase from eg. gumroad) by uploading them through their unity sdk.

Here’s the problem: they trust the client. The client is in the hands of malicious actors. Anti-cheat - even ring-0 anti-cheat - does not make the client trustable. The client is still in malicious hands, and that trust will continue to be abused.

Their “simplest possible solution” has not solved the problem.

More than this, it sounds like a serious net negative to me.

Legit users who had modded their clients to have some perfectly fine features (such as performance enhancements) are SOL - they aren't gonna risk it just for features they've lost, they either gonna live with whatever's left or just abandon it entirely.

And those with malicious intent are gonna just work around the anticheat (because why not - what they're doing is most likely was some bannable offense already) and continue. Yes, there's some barrier but just the other day we had a thread where DMA hacks were mentioned (and PCIe cards for that are pretty cheap) - does EAC has anything against those tools?

Don’t let perfection be the enemy of good

We don’t put locks on our doors because they’re unbreakable but because they are the right compromise between cost and benefit

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc.

This is a crazy hard problem that is plaguing the majority of our mainstream social platforms. Looking at Twitter/Facebook/Reddit etc. moderation+harassment is mostly solved by brute force community management, and is extremely costly, with a human component that is hard to ignore (Facebook moderators are plain miserable and prone to stay mentally hurt even after leaving the job)

This is where Nintendo decided to bail out of the problem altogether by blocking personal interaction by default on their online platforms. If they don't have the resources to do it properly, limiting the attack surface feels like a sensible strategy.

>This is a crazy hard problem that is plaguing the majority of our mainstream social platforms.

...that rely on advertising.

It's comparatively easy to moderate communities if you're willing to permanently ban bad actors. Trouble is, that shrinks your audience, which reduces advertising revenue. Reporting accounts on Twitter, Facebook, Instagram, et al, is a multi-step process of making excuses for why your reported post won't actually negatively impact the malicious account.

As weird as it feels, this might actually be one of the very few cases where platforms are willing to throw users under the bus for better ad money...

Youtube demonetizing creators with too aggressive stances is an example of that, but we also had Reddit banning whole subreddits when their sheer existence had a nefarious effect on the platform's ability to negotiate ads.

When the choice comes down to more active users but lower prices offered, vs less users and better ad prices, platform tend to go for the latter I think (4/5/8 chan being exceptions)

> Provide better debugging info for your creators! They should know which client (or at least that a modified client) is being used.

> Ditto. These tickets should be easy to auto-close if you force folks to include info about their client.

As a (former) modder, though not for VRChat, I can definitely empathize with this. Code quality with mods is a freaking wild west where modularization isn't really a thing and everyone monkey-patches everything. Supporting your mod/content amidst other mods is in the gray area where the etiquette expects content creators to support their stuff even though there's no "warranty" on the label, so you get significant variance in how demanding players are or how accommodating content creators are.

That said, I don't think anti-cheat is the answer here. Officially supporting mods and driving modified clients down a predictable path where you'll know when and how a client is modded seems like a better approach. Modders benefit from having real infrastructure to work with, and as the game dev you can ask players to turn off mods for troubleshooting.

Yeah, I really don't get it here.

For competitive games, I can see the argument and demand for anti-cheat.

Here, though? Any actual problem it would solve is better addressed either server side or on the counterparty clients. It seems backwards to require full control of all client software rather than filtering out spam on the receiving and/or intermediary ends.

Modified clients were already banned; this is a technical measure to enforce that policy.

It’s a long list of excuses and they know it. It’s harder to monetize third party clients just admit it.

I find that very naive. Moderating online communities is famously difficult and unavoidably expensive. This is well documented going back to MUDs on dialup BBS systems.

> These kinds of issues should be solved on the backend. Rate limiting, pattern matching, etc.

Isn't VRchat... Spoken? It's kinda hard to rate limit and pattern match speech. Text is one thing but it's going to take some compute power to do what you're asking.

> Malicious modified clients

hehe there's a spiderman knuckles that spams webbing and it fills the entire room and you can't see anything it's funny.

That's hilarious /s

Who else is just depressed as fuck to realize that our VR experiences are likely going to be hamstrung by things like EAC, and there's probably little that we'll be able to do about it. This is not the metaverse future that I had envisioned. I guess they think I need to be protected from a "Snow Crash".

As a frequent VRChat user: the problem is entirely sloppy API design, poor to nonexistent moderation, a security team detached from reality (the team lead posts often in the VRChat Discord, or used to), and the fundamental problem of running a no-stakes social game where getting banned and losing your account is no obstacle to further bad behavior. Getting banned from WoW means you lose your time investment in level 60 and raid gear; getting banned from VRChat means you make a new dummy email and log right back in. Any VR game with real time investment doesn't have this problem.

it isn’t clear to me how you could have expected anything but this…

there are far too many hacks, too little moderation, and too little community pushback on bad actors. this will _always_ happen if the communities themselves don’t figure out a way to chase the trash out.

it doesn’t matter if it’s a social network, it doesn’t matter if it’s a game, it doesn’t matter if it’s a forum. if it relies on money, then either the community will make trash unwelcome or the company will, and of course the company will do what’s the most convenient for them.

we talk a lot about we want companies to keep things open for communities to run, then when companies try a hands off approach the communities sit by and do nothing while malicious actors take over lol.

then, strangely, the communities who did nothing to address actual real problems act all shocked.

Good points. There are solutions. A more transparent and community-oriented governance model would help.

Don't be, you're being a Doomer. For every negative experience, there can be positive ones. Check out Mozilla Hubs [1]. It's FOSS and runs in browser. The metaverse doesn't have to be negative. That said, VRChat's problems have everything to do with the abuse that mods entail rather than any inherent "Snow Crash"-iness to the situation. It's the age-old fight between bad actors and anti-tampering mechanisms.

[1]: https://hubs.mozilla.com/

Interesting, never heard of that. I'm testing it and the lack of mouse movement inversion, both x and y, drives me crazy. Did I miss it or they haven't implemented it yet?

Huh do you mean via headset or just using mouse and keyboard? It works fine for me.

Using mouse and keyboard, but I later found that I could adapt to it.

Reply on news.ycombinator.com