Comment by yazzku | Hacker News Reader

Comment by yazzku | Hacker News Reader

'“Modified clients” are a large problem for VRChat in a variety of ways. Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues. Even seemingly non-malicious modifications complicate the support and development of VRChat, and make it impossible for VRChat creators to work within the expected, documented bounds of VRChat.

'In order to prevent that, we’ve implemented Easy Anti Cheat (EAC) into VRChat.'

All this stuff sounds like it should be enforced on the server side, not client side.

'EAC is the industry-leading anti-cheat service. It’s lightweight, effective, and privacy-focused. In short, for any game or platform looking to prevent malicious users from breaking the rules, it’s a powerful solution.'

EAC is the industry-leading DRM ass. It sometimes persists game installations and you need to go to greater lengths to purge the system of its trace. I don't know what 'privacy-focused' even means here.

Honestly this whole post smells of PR.

It's simple, have servers that enforce no-mod rule, and have servers that don't. Even back in cs1.6 there was the concept of VAC enabled and non-VAC enabled servers. Hackers could go in non-VAC servers and hack to their heart's contempt.

You can have official servers that are safe from "harassment", and let people have their own "non-secure" servers they do whatever they want in. It's not that complicated.

Have you played be chat? It actually is a real problem. Anyway, why not try to enforce security on both sides? EAC will literally fix 99% of the malicious issues…

Because it's throwing the baby out with the bathwater. Some of these mods were literally about making the game accessible to people who wouldn't be able to use it otherwise. There's no way they're going to keep up with all useful mods with their official client. Some of their concerns are valid, but at the very least they should provide an option to allow modded clients on your own private instance.

Unless they manage to make VRChat mainstream (which will likely erase a lot of its appeal to plenty of current users and will mean directly competing with Meta), this may be the beginning on its slow end.

>Some of these mods were literally about making the game accessible to people who wouldn't be able to use it otherwise.

How?

There are mods that fix significant performance problems, accessibility mods such as colorblindness improvements, etc.

And lazily screw over 1% of legitimate and interesting creativity by well meaning developers.

This is always a stupid call.

Open source the clients and do the hard work of server side controls to remove abusive behavior.

Imagine forcing everyone to use one proprietary web browser with DRM because webdevs could not be bothered to implement rate limiting and input validation.

I find that number optimistic. They’re still trusting a client that’s in malicious hands, and no anti-cheat will ameliorate that flaw.

You have succinctly described the #1 hard problem in multiplayer games. There is no solution, only things you can do to do better. A good recent example was Fall Guys being basically unplayable due to cheaters and had to up their game with an anti-cheat engine to make it playable again.

The issue is that because there is no perfect solution even if you have a pretty good all server side solution you’ll still improve by adding client side anti-cheat.

Anti-cheat systems are the compromise that allow games to be played on PCs instead of only locked down dedicated hardware.

I can't help but feel like Fall Guys was not the ideal example given just how comically vulnerable it was, it trusted the client for so much instead of running calculations server side you could just tell the server you're at the finish line and disqualify everyone else.

The crashers in public lobbies are real problems, but you should be aware that the vast majority of malicious behavior is not coming from modified clients. It's coming from avatars with specifically programmed shaders which causes others' clients to crash, or purposely malformed package files that cause the client to crash, or sound sources that cause the client to crash. All of those methods to maliciously crash other users are uploaded with VRchat's own SDK in Unity and requires zero 3rd party mods. On the flip side, there were mods specifically designed to prevent crashes by these malicious avatars that can no longer be used due to EAC (FinalIKSanitizer, TrueShaderAntiCrash, etc).

Reply on news.ycombinator.com