[dead]
EAC does not prevent this in any way, shape or form.
I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this.
The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does?
I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.
Many mods are used for malicious purposes. This doesn’t mean ‘ban mods,’ it means patch the holes bad mods exploit.
You know who has patched some of those holes you're talking about? Modders. There are mods that mitigate crasher avatars.
Most regular users don’t use or know about anti-crasher mods, and in any case the problems are inherent to the game’s design. Fixing those problems should be VRChat’s main goal.
The OP is about VRChat mods. I started talking about malicious mods and segued into bad stuff on VRChat in general, which I think is both relevant and interesting to HN users. If you don’t like it, I encourage you to help remove the bad stuff.
I’m completely uninitiated on VRC, but I do see some artists who have been offering VRC avatars and accessories through external services like booth.pm for couple years by now. Rips and thrown-together pirated models was a huge problem at least initially, and I would imagine would only be helped by mods.
Could this be that VRC is finally moving onto integrating avatar/editor marketplace and locking down on “illegal” avatars as part of that move?
- Change into the avatar.
- Ask the VRChat API (backend) for information on yourself (this requires no special permissions).
- Use the link contained in the response JSON to download the avatar to your computer (it's how the official client obtains it, too)
- Unpack it with literally any Unity asset pack extractor, of which there are several. The asset pack is not secured in any way.
Note how mods are conspicuously absent from all of these steps.
I'm an avatar maker myself, and at this point my stance is that I can't be responsible for people stealing assets from me that I'm not allowed to redistribute, but I'm open to directly giving anyone anything I'm allowed to redistribute, and to teach them how to implement, download or purchase everything else. It's a load off my mind.