pteraspidomorph

I started writing QBasic programs at 8! And boy, did I suck! I too owe it to a childhood friend.

Too bad I lost my childhood programs (along with everything else) when the Chernobyl Virus ( https://en.wikipedia.org/wiki/CIH_(computer_virus) ) messed up my hard drive and I tossed it (no backups of course).

It does depend on where you live. In southern europe red or orange clay roofing and a range of colors on traditional housing including yellow, pink, orange, etc. makes towns appear much more colorful. In parts of Portugal it's also traditional to paint a broad colorful bar along the bottom of whitewashed outer walls and around doors and windows; the color changes from place to place, and it can be black (I've seen that in the Azores) but also blue, green, scarlet, etc.

For the sake of understanding the problem, any avatar marked as public can, or at least could (I can't say I've looked into this problem recently) be obtained in the following manner (DON'T do this, as it's still both a violation of the TOS and copyright infringement):

- Change into the avatar.

- Ask the VRChat API (backend) for information on yourself (this requires no special permissions).

- Use the link contained in the response JSON to download the avatar to your computer (it's how the official client obtains it, too)

- Unpack it with literally any Unity asset pack extractor, of which there are several. The asset pack is not secured in any way.

Note how mods are conspicuously absent from all of these steps.

I'm an avatar maker myself, and at this point my stance is that I can't be responsible for people stealing assets from me that I'm not allowed to redistribute, but I'm open to directly giving anyone anything I'm allowed to redistribute, and to teach them how to implement, download or purchase everything else. It's a load off my mind.

Yeah, let me clarify my argument there. Open source, safe, well-known clients, mods or modding systems can easily be monitored for workarounds and flagged, and become unviable. Malicious actors with second intentions however can keep finding new exploits and releasing small, obscure, harmful software that has way less exposure because the vast majority of people are not interested in harming anyone, they just want their mods to do something minor like displaying screenshots in the loading screen or adding support for eye tracking. They will not seek these out. These will be sold (financial incentive) or used by people with too much time on their hands and an axe to grind.

I agree with your sentiment there for sure, but this is a submission about EAC. You have filled it with off-topic comments in a way that makes it seem you don't understand what the conversation is about. You made a very misleading statement when asked about the modding community that strongly implies it's mainly nefarious and exploitative, and that's what I replied to.

You know who has patched some of those holes you're talking about? Modders. There are mods that mitigate crasher avatars.

Glancing at the links you provided, I see some unfounded rumors and some (three?) references to the creation of avatars that overload users, causing them to crash (including one of the features in the bottom links). It's common knowledge that this is possible, and VRChat should probably do a better job of analyzing avatars at time of upload.

EAC does not prevent this in any way, shape or form.

I see what you mean now about abusing the API - they seem to be invite bombing or similar. This is not what DDoS means. If possible, this is definitely a rate limiting issue to be solved on the backend. EAC does not prevent this.

The client in your last link appears harmless at a glance, though maybe if I dug enough into it I'd find something unsavory. Did you look at what it does?

I don't think you have provided any evidence of harmful modding that will be affected by this patch yet. It's easy enough, on the other hand, to locate the github repositories for the hundreds of harmless mods that tens of thousands of community members use regularly, and which you don't seem to know about if you think these videos suffice to describe what mods are "mostly" used for.

You're the one who has to explain yourself.

> Other mods exist, mostly for nefarious purposes like crashing other users who're on Quest or the vanilla client.

"Mostly" has statistical implications. Where are you getting this statistic? Do you have any data to back what you're saying? Which are these mods, and what exactly do they do? Are you saying there's a rich ecossystem of software specifically designed to interfere with the experience of Quest users? How do you even know that?

> There's a whole mini black market of "hacks", i.e. client mods built on abusing the VRChat API

This statement makes no sense. What VRChat call their "API" is a backend for wrangling metadata. Access to this backend is available to all user accounts and generally not discouraged. There is a message in the HTTP headers inviting users to apply for a job there.

> as well as some clients which tie into DDoS services that will target specific users in-game > These malicious clients are generally advertised and sold via Discord links in users' profiles. PayPal or CashApp are used to facilitate the transactions.

So these are standalone applications that cost money? Is the money to pay for denial of service botnet time, or a one time cost? How do you even know? And I don't see how a criminal operation of this calibre will be stopped by EAC.

> if you manage to obtain their IP address via exploit or social engineering.

IP addresses are public data and denial of service attacks are a crime wholly independent from any platform. If you already have the user's IP address, anything to do with VRChat and mods seems redundant.

No one will admit it, because of the company's insane attitude towards modding and the heavy handed bans that result from it, plus a policy of preventing actual discussion about said bans, but yes, that is very much the case.

> telemetry

I believe they do collect a ton of data on how the user interacts with instances already.

> it’s still experimental buggy stuff

Kind of. They did have several years to build up a community and find a content creation pipeline that kind of works for a lot of people. And many millions of VC.

You're right, though, ideally the "metaverse" should run on open source software.

Unofficial malicious clients will still work, only the safe open source ones won't. Dodgy EAC bypasses seem to be easy to find, and will likely put people who try to use them at real risk.

There is a vibrant community of mods. There are more than 30 thousand people in the modding group Discord. Compare to less than 70 thousand people online in the platform at time of writing - a sizeable minority of the community uses (and a subset of them needs) mods. There are more than 200 safe working mods right now.

All these stories are worrying. Paypal used to always side with the customer (who is after all the one paying them) but it seems there has been a shift in policy.

> Do you expect Paypal to go to OVH, knock down their door and demand the money back?

Normally that's what Paypal is for. They're not going to burst through any doors but if a vendor wants to keep using their services they surely have a lot of leverage.

I'm wondering about this, too. In recent updates Windows seems to do a lot to force users into Edge under certain circumstances and use cases (and pester the user to switch to Edge entirely), in ways that at a glance appear to be incompatible with the summary of this regulation.

IE was replaced because it was a hole-riddled nonstandard mess, and Google used their position to shove Chrome into everyone's mindshare (something this regulation appears to forbid, incidentally). Chrome isn't nonstandard because Google are very careful to comply with standards - which is easy enough when they have many employees involved with designing them and tend to manipulate those committees in their favor, and even if they fail they can just release whatever they want and use the technology's widespread adoption to justify its eventual standardization. Also, as a modern browser, Chrome is patched frequently, so the security angle is also a nonstarter.

So, literally an attempt to discard net neutrality altogether (again).

I control a single fairly inactive subreddit with the name of my hometown (please don't go look for it!) I don't pay a lot of attention to it, but I'm around to perform whatever moderation is necessary.

A couple of years ago someone contacted me in private, suggesting I might want to hand over the subreddit to them so they can "improve it". Looking into the user, they were a powermod already controlling a dozen other subreddits. They posted aggressively to all of them, often the same thing to multiple of these subreddits. There was a whole bunch of crypto promotion. I said okay, I'm willing to hand over the reins to someone better, but anyone can submit to a subreddit; you might at the very least want to actually become an active participant in the community first so I can see if you're serious; I can even make you a moderator to begin with.

Their response (paraphrased)? "This requires too much time and dedication for me to do it experimentally, without any guarantees that afterwards I won't be kicked out. Have a good life."

I think there's a major difference in perspective between powermods and, you know, regular subreddit mods. To me, a subreddit belongs to its community - which means whoever shows up to engage with it. It's a convenient structure for organizing content submitted by people with a shared interest. My job as a moderator is to keep it clean of content that infringes platform rules and to enforce the will of the community in ways that the voting system isn't suited for. This can mean doing very little, if the subreddit is small. But a powermod like this one seems to require absolute control. Subreddits must be "theirs", their project, before they will engage, and they see it as their responsability to "grow it", to actually provide the content if necessary. They think a lot about karma and metrics and partnerships. They seem to me like control freaks who really, really need more hobbies (no offense, guy from back then).

I retain my lone subreddit to this date not because I am in any way well suited to do so, but to protect it from being nabbed by people like this. I'm always mildly worried the powers that be will think I'm squatting, but I'm an active redditor in general and I'm happy to keep an eye on contributions - which can be made by anyone. Maybe one day a community member will show up who is truly passionate about the town and suited to take my place and do more... css stuff with it.

Not right now, no. That would be terribly inconvenient.

Jokes aside, I'm aware of my own moral weakness in this regard. The religion I was raised in - and I'm still a spiritual person - holds that suicide is the gravest of sins, but I don't have that high an opinion of my own life and its potential. The closer I am to the situation, and the more urgent it is, the more tempted I am. So I try to stay aloof, for the sake of those who love me, and out of my own instinct of self-preservation, which is a powerful force in most human beings.

If your mind was exactly like mine, and you were close enough to the situation to make the decision to sacrifice someone else for a group of strangers - and being tied to the tracks is pretty damn close - you would likely be willing to sacrifice yourself. But remember, someone must have tied me to the tracks in the first place for my life to be in danger. As I said in previous comments, in most cases I am, though inaction or stalling, attempting to save the life of the single person in the tracks - the person in the same position. I will not kill to save others, and attempting to not kill myself to save others is consistent with this position.

I would be useless as a soldier!

To be clear, people who eat my cooking enjoy it. I'm a good cook (or so I'm told). It's the food snobs who weren't even there who get offended on principle!

But if you really need everything to taste like garlic I wouldn't mind you adding your own at all ;)

I did notice that. I'd pull the lever if I was the one on the tracks, since in that case I am not robbing someone else of their life through my decision - my life is my own to sacrifice. At that point it's best to save five.

Then again, a sizeable minority wouldn't sacrifice their life savings for lives either, which means this portion of the respondents does not think the lives of strangers have value at all, or at least that they are not in any case responsible for lives other than their own. Which is interesting!

Clearly not. The vast majority of people responding to this problem usually want to pull the lever, murdering an innocent who would otherwise have lived through the day - an utilitarian perspective that holds that by default it's best to maximize the amount of lives saved. It's difficult for those of us that would argue that every life is valuable, and that, not being god, the bystander does not have the right to make this call. The bystander did not place the runaway trolley there, nor are they responsible for the people who are tied to the tracks.

I would ask the person who is (in most of these scenarios) on the diverted tracks what they want me to do. They have the right to make this decision, since they are masters of their own life.

I hate garlic and remove it from every recipe, you should see how much hatred that has garnered me over the years.

Seems so. Knew the name sounded familiar.

Printers in general suck, but... Canon? Haven't had any headaches since I switched to them from HP. Then again, since it has been a few years, it's possible that they too went downhill since.

You can get very good body language through, but... it will cost you quite a bit in additional hardware (trackers and add-ons). The demand is clearly there and the supply is catching up (various competitors). I think competition will drive down the cost.

Audio is likewise a matter of cost. And manufacturers not cheaping out on components, I'm looking at you HTC (and the notoriously horrible Rift S too).

I'm looking forward to programmable smells based on a combination of basic smell cartridges. That's totally a thing people are working on.

Touch is a hell of a lot harder to solve. More could be done to provide good haptic feedback. Haptic vests and facial interfaces already exist (at additional cost, of course), but the problem is the more crap you have to add to your body the more inconvenient (and sweaty) VR gets. I believe providing better VR touch interfaces is key to the development of the technology.

And I really, really don't want to taste anything in VR!

It's true that I don't trust the permanence of online resources, usually with good reason. But I can also be a bit of a digital hoarder. My IRC logs, for instance, go all the way back to 1999. It's funny because in meatspace I'm extremely tidy and don't keep any garbage. I have a single wardrobe with shelves of computer parts (mostly cables, wires and screws) and a few old CDs.

I have nothing from before April 26, 1999, the date when the Chernobyl virus destroyed my hard drive and wiped out all of kid me's QBasic programs (what a loss for humankind). Kid me could not afford the storage space for backups, nor did he have the discipline anyway.

Good old InstallShield. At one point it was everywhere, and then... it wasn't.

I keep all the bundled installers I've ever had in a folder. Currently there are files there from 2009 onwards (older ones are archived somewhere). I didn't bother looking for the older ones, but running grep -a ether-rot-mutex quickly yielded a match containing the entire snippet! The culprit is the installer for Ulead (now Corel) PhotoImpact 12 and it has been there since 2010.

I had a problem with a similar effect some time ago but I run my own DNS (no Cloudflare). I accidentally clicked a button in my control panel to regenerate the zone keys, which means the published keys mismatched the new zone signature for a couple of days until I was able to get the registrar to update them and everything propagated (even when a registrar supports the .eu TLD they are usually severely lacking in automation). The control panel devs have since added a confirmation dialog!

It's because modern client-side frameworks like react or vue use javascript for routing, and in fact storing every character in a form as you type it is a basic design principle in such frameworks. If you are curious, you can install their respective dev tool extensions so you can tell at a glance which framework a website is using by checking which button lights up in the browser toolbar.

I like the uBlock Origin toggle myself, aka the "naughty website gets no javascript" button.

The single level/map of the Witness is rightly considered one of the best (if not the best) game levels ever designed, definitely nothing you can do on a website, but this isn't immediately evident--and for some people (myself included!) it can take quite a while to start perceiving what it has to offer (the game doesn't hold your hand at all). If you're interested in learning more, check out the videos below. They deal with distinct aspects of the game.

By opening these links YOU WILL BE IMMEDIATELY EXPOSED TO SERIOUS SPOILERS. Stop watching if you have decided you want to tackle the game in the future (but you can still repeat the process with the other video).

https://www.youtube.com/watch?v=j2OT3QdrHLU

https://youtu.be/HWKPOfSjV58?t=1287