🐱 VRChat Security Update Throws the Metaverse Into Chaos

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.
CatParty

VRChat, one of the only virtual reality applications that comes close to implementing anything resembling futuristic visions of the “metaverse,” is in total chaos after the social VR company announced a security update will disable all user-made modifications.


On any given day in VRChat, it’s possible for Winnie the Pooh to interview a war veteran dressed as Anakin Skywalker in a surreal forest or to slip into a hellish nightmare world designed like Disney merchandise from the 1990s. The security update, users say, will make some of that creativity and functionality more difficult.

What this means in practice is that many of the tools that VRChat users rely on to create dynamic, interactive avatars, as well as add accessibility features that make VRChat usable to people with certain disabilities, will no longer work.
This update is part of VRChat’s implementation of “Easy Anti-Cheat” or EAC. EAC is a program commonly used in competitive multiplayer games to prevent the use of hacks and cheats. EAC would stop the bulk of VRChat’s mods even though these mods have nothing to do with “cheating” (it’s almost impossible to “cheat” in a game like this anyway).

The reaction from the VRChat user community has been swift and brutal. Users are review bombing the game on Steam, which now has a “mosty negative” score on the digital storefront. It was, until this update, rated mostly positive with more than 100,000 showring the app with praise. “I love the community and opportunities this game has provided to me, but this is just an awful move from the devs,” one recent review said.
The official VRChat Discord server is filled with too many complaints to keep up with. Unofficial VRChat modding and “erotic role playing” servers are preparing for ways to get around the new security features, or devistation of their communities. People with disabilities are begging VRChat to not implement the security update.

For example, one VRChat user on Twitter explained that the “VR-CC” mod, which adds closed captions to movies in VRChat, allows deaf users to virtually view movies with their friends. “They’ve [VRChat] done absolutely nothing to address serious accessibility gaps on their platform,” they said in a video where their fox avatar in VRChat explains the issue in captioned sign language.





“Accessibility is always a concern for our team, and we're constantly looking into ways to make VRChat more usable for everyone,” a VRChat spokesperson told Motherboard in an email. “One way that we've done this is by adding in OSC [open sound control] earlier this year. OSC has enabled our users to have an entirely new dimension of creativity, as well as the ability to build accessibility tools to fit their needs.” The spokesperson said that users have already used these tools to create text-to-speech and voice control functions.


“In case you’re angry and want to show that there is some info from the [VRChat Modding Group] Teams post: it prevents you from having unlimited avatar favorites. It prevents you from using anti-crash mods. It prevents you from using all other mod features you’ve come to enjoy. It prevents you from using safe, open-source mods that never made anyone’s experience worse,” a moderator of an erotic roleplay server said on Discord.





The moderator, like many other VRChat users today, also suggested canceling VRChat+, a $9.99 a month subscription service offered by VRChat that provides some enhanced features such as extra avatar slots. “And do not launch VRChat for at least a week to produce a visible player count drop,” the mod said. “Anti-community measures like these from a greedy corporation should be protested as loudly as possible.”


In the Discord server, some users are calling the game ableist, others are accusing VRChat of instituting a “police state,” and still others are saying that only furries and perverts will care about this change. Others call for solidarity: “Anime fuckers and furry fuckers, we need to band up together and put an end to this shit,” one user said. “Furries vs the world. Lets Go! Shit never changes!” another user said.

Users have also reported that they’ve been banned from VRChat’s official Discord after going there to voice their complaints.





So far, VRChat has only added Easy Anti-Cheat to a beta version of its popular social virtual reality app, and said the system will go on live servers in “the next few days.” It said it made the decision to make it harder for users to harass and attack others.


“Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information,” VRChat said in a blogpost about the change. “These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet.”

“‘Modified clients’ are a large problem for VRChat in a variety of ways,” VRChat said in a blog post about the change.

“Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues. Even seemingly non-malicious modifications complicate the support and development of VRChat, and make it impossible for VRChat creators to work within the expected, documented bounds of VRChat.”

“While I'm not able to go into detail on internal security practices, I can say that we've seen an increasing amount of hostile traffic coming from accounts that have been clearly hijacked,” the VRChat spokesperson said. “These users have no idea anything is wrong, right up until they suddenly receive a suspension and then reach out to our moderation team. These types of hijacked accounts typically behave in a similar sort of way, and often these ‘bots’ can be taken advantage of by certain malicious clients. Those clients can then use these accounts to harass people in a variety of ways.”

Additionally, the spokesperson said that VRChat sees mods that users otherwise believe are benign that “report back” to a “home Discord.”

“There, they share various bits of information: the mod user's name, what avatar they are wearing, what world they are in, and what other users are in their current world, just to name a few examples,” the spokesperson said. “This information can then be used to harass users and their friends, who have no idea that someone in their instance is using a modified client.”

“For years, we in the VRChat Modding Group have provided users with a curated selection of community submitted mods carefully checked by our Staff Team to ensure the safety of our users,” a moderator and staff member of the VRChat Modding Group Discord who goes by the name Hordini told Motherboard. “This includes everything from quality-of-life enhancements, to protection against negative exploits. The latter is especially important as history has shown in some cases it can take VRChat several months to resolve an issue that is actively being abused to bring harm to the community. With this change, open-source modifications will be next to impossible to provide, which may cause much of the community to explore closed-source modifications instead leaving them susceptible to potentially dangerous software.”

The disabled community is also upset by the changes as many use mods that modify VRChat’s client to make it accessible. “I’m partially sighted and have a condition called nystagmus, which makes it hard for me to see moving objects” one user said on Twitter. “I cannot see peripherals, so VRChat’s Vanilla Hud is impossible to see, so I have mods that make the hud more centered. It’s a reason I also have mirror/camera mods so I can somewhat see what’s going on around me. Immersive touch also helps in these instances because I can feel my surroundings and see how close another player actually is …I’m honestly going to switch to some other platform if this does indeed go through as it will leave me unable to play.”
 
To sum it up: They're forcing the use of Easy Anti Cheat, no opt-out.

Easy Anti Cheat bans anyone using QoL mods or modified clients that provide features that have been on request lists/ VRChat's backlog for years. There's also suspicion it could be a way to force users to pay for the premium subscription service to access improved features.

Services like EAC are used by a good deal of games, most of them having a competitive focus - something not present in VRChat. It won't do much to fix character models deliberately designed to exploit bugs in the game, nor is there any option to opt-out of using it, unlike some other multiplayer videogames that give gamers a choice.
 
Yet another example of steps being taken to prevent bad actors, but with those measures being mostly ineffective, it almost exclusively punishes those who are acting in good faith instead.

I thought it was pretty funny, reading their announcement of how they had heard the massive pushback, but still decided "Nah, we're going through with this anyway. Get fucked." Maybe they signed a deal with Epic and had no option to back out of an EAC license without losing cash. Sure, they say that they'll be shifting all roadmaps and and development resources into adding in the necessary QoL and accessibility features these mods gave ASAP, but from my outsider perspective reading user's complaints, it doesn't look like they have a good history of delivering on feature promises.

Say, you know what would have been a better move than shooting yourself in the foot by obliterating most of your community good-will? Rolling out the EAC addition alongside a large update that integrated the most used mod features. Hell, even if your devs can't do it themselves, you wouldn't be the first studio that "uplifted" a modder's code into the base framework after hashing it out with them. Most modders would probably be pretty happy to have that happen, even if they aren't getting paid, just a big "thank you" from the developers.
 
To sum it up: They're forcing the use of Easy Anti Cheat, no opt-out.

Easy Anti Cheat bans anyone using QoL mods or modified clients that provide features that have been on request lists/ VRChat's backlog for years. There's also suspicion it could be a way to force users to pay for the premium subscription service to access improved features.

Services like EAC are used by a good deal of games, most of them having a competitive focus - something not present in VRChat. It won't do much to fix character models deliberately designed to exploit bugs in the game, nor is there any option to opt-out of using it, unlike some other multiplayer videogames that give gamers a choice.
It's also fucking garbage, Elden Ring on PC was released with EAC and it took hackers less than two weeks to bypass. I don't play VRChat but it will likely just fuck over regular players while doing nothing to stop malicious hackers.
 
They laughed at me when I said GMod was the superior social game. Who’s laughing now anime avatar users?
Gmod was always the undisputed king.
Miko gun office cs source.jpg
 
THIS is seriously what Zucc is reworking his company around? It's basically second life with worse graphics and a ton of functions missing.

this has to be some kind of money laundering operation seriously
 
THIS is seriously what Zucc is reworking his company around? It's basically second life with worse graphics and a ton of functions missing.

this has to be some kind of money laundering operation seriously
Basically what Zucc and a lot of corporate types want is a hyperrealistic Matrix where people go in and look like ideal versions of themselves and interact.

What an immersive VR world would be in reality is a bunch of people with Care Bear and Stormtrooper and anime avatars trolling, yelling "nigger", and having VR sex chat.

In other words, a total shitshow. Kinda like how the internet was supposed to be for enlightened discussion and is mostly used for trolling and porn.

This is a corporate attempt to take it back and get control and make it safe and boring. But the people have spoken, they want wacky zany chaos with pop culture avatars wearing penis hats.
 
THIS is seriously what Zucc is reworking his company around? It's basically second life with worse graphics and a ton of functions missing.

this has to be some kind of money laundering operation seriously
Actually this article/journalist seems to be conflating VR with the "Metaverse" and this isn't related to Zucc at all. VRchat is basically what metaverse aspires to be but it is already around and until now provided a lot of features Meta wasn't even close to rolling out.
 
It's also fucking garbage, Elden Ring on PC was released with EAC and it took hackers less than two weeks to bypass. I don't play VRChat but it will likely just fuck over regular players while doing nothing to stop malicious hackers.
EAC is like a door lock. If someone really, really wants to get into your house, they can still get in. But for the 99% of people whose maximum effort caps out at "turn knob, see if door opens", it does the job.

The best way to prevent "hackers" is to make it so your servers won't accept arbitrary data. No amount of anti-cheat software is going to protect you if your Made In India server will do whatever anyone tells it to without sanity checks. It's really not that difficult, but even the "good" companies don't bother these days because people have just come to expect shit servers.
 
Actually this article/journalist seems to be conflating VR with the "Metaverse" and this isn't related to Zucc at all. VRchat is basically what metaverse aspires to be but it is already around and until now provided a lot of features Meta wasn't even close to rolling out.
Well it's related in the sense that in casual user buy in and general interaction, building rooms and worlds, etc--VR Chat is what Meta wants and it was organically, creatively grown. Meta is top down, boring, controlled, safe, boring and palpable to advertisers.

VR Chat on the other hand, sees where Meta could go with ad revenue and mainstream success and wants to emulate that, by being safe and boring.

25 years ago, people thought walled gardens like AOL or cookie cutter copy paste geocities linked pages were the be all end all of the internet. Both Meta and VR Chat are probably as profoundly wrong.
 
Back