VRChat Modding and the Problem With Easy Anti-Cheat

For those who know me well, VRChat has pretty much been like a second home to me.

I’ve been on that platform since early 2020 and met many of my most incredible friends there. VRChat (VRC) is by no means perfect, and the app has definitely had its ups and downs before. However, despite the bugs, stability issues, and outages, it remained a platform that I was very fond of.

As with many games and apps, there is a massive and thriving modding community, that has continuously worked hard on delivering specific but cool addons to the VRC client. Those mods range in all sorts of categories. Everything from tweaks to the camera system, to general Quality-of-Life mods to make the experience a little more efficient, to essential accessibility mods that some people require even to be able to play the game at all.

The Complicated Relationship with Mods #

VRChat has repeatedly stated that they do not endorse modding of their software and that it is technically a ToS violation. Despite that, most players still use legitimate non-malicious mods, and most of the time, VRC seems to be okay with that (minus a few hiccups here and there). I understand VRC’s stance, as any modification to any software bears a safety and security risk to the end user, and endorsing those mods could lead to potential liability problems purely from a legal standpoint.

Discord screenshot from the 10th of January 2022, of a message from Tupper, the VRChat Community Manager, stating that modified clients are not allowed on VRChat, and that there's no such thing as approved modifications. The full message reads as following: (Quote) Hey everyone! As part of our continued commitment to improving safety and awareness, we just wanted to put out a reminder that modified clients of any kind are not allowed on VRChat, for any reason, and are prohibited by the Terms of Service. VRChat does not condone the use of, permit, approve of, or allow any client modifications. In other words, there is no such thing as an 'approved' modification. Using them will result in your account being banned! If you have further questions, please consult the faq channel on this server! (End of Quote)
VRChat's official stance on mods.

However, the truth is that most players understand the risk and are still willing to take that risk to enhance their experience. It has pretty much been an ‘under the table’ thing, where everyone is using mods but keeps it relatively hush-hush. So it hasn’t really been a problem at all.

That is, until recently, when VRChat decided to push their most controversial update yet.

Easy Anti-Cheat #

On the 25th of July, VRChat officially announced that they are implementing Easy Anti-Cheat (EAC), an anti-cheat software developed by Epic Games. This update is a massive problem for various reasons (which I’ll get to in a bit), and the community did not take this lightly at all.

Graph of recent Steam reviews for VRChat. Towards the end is a massive red spike, indicating a flood of recent negative reviews.
VRChat's recent reviews on Steam. Yikes.

VRChat claims that implementing EAC will solve the issue of malicious client users and modifications.

And they’re right… as in, it prevents every modification from running, effectively killing off all modding, including the many legitimate and helpful client mods that enhance the user experience for many people.

Malicious clients #

Of course, as with many things in the world, there will always be rotten eggs, including the modding scene, where some malicious mods are specifically designed to steal people’s avatars and ruin the experience for other players. There’s also the problem of malicious players “crashing” other players by using specially-crafted avatars that will make other players crash by overloading their CPUs or GPUs with crazy particle effects and other exploits within the Unity engine, which VRChat runs on.

However, VRC blocking client mods from running using anti-cheat software will not solve this issue, as you don’t even need a modded client to steal avatars or crash people! Avatars are usually ripped from the local cache, and files can be accessed through VRC’s own API. Banning malicious clients will make this a little tedious, but it will not solve the issue of avatar ripping and malicious behavior!

Punishing legitimate players #

It’s also a huge problem for those who play on Linux, as it is known that EAC does not work well on Linux at all. So even legitimate players who don’t even use client mods are having significant problems or can’t even play the game now because of EAC. There are also reports that EAC causes performance issues on many setups.

Another critical issue with EAC is the major roadblocks this will cause to people with disabilities who require client modifications for accessibility reasons. An example is VRC-CC, a client mod that adds closed captions to videos and movies inside of VRC, which is something that VRC currently lacks native support of.

The EAC update has broken this, now that modding is not possible. This update is inadvertently punishing deaf/HH people who need this mod to be able to watch videos and movies with their friends.

Absolutely none of these mods causes problems to players at all. These mods do not cause any problems on the network side of things. VRChat is not a competitive game. People are here to socialize, hang out with friends and have a good time, and if client-side mods help to enhance the experience, they should be allowed to do so!

A suggestion… #

Now, I need to state that I don’t hate VRChat or the devs. This is just speculation, but I believe they’re probably under pressure from their investors to push those updates. But what they’re doing is wrong, and I cannot support this at all. I’ve forgiven VRC a few times for some of their decisions, but this is too far.

However, I do understand some of their reasoning. Modded clients can be a security risk, especially as they’re not officially checked by the devs, and there are definitely bad mods out there. When you run a commercial piece of software like VRC, there are some legal considerations you have to take when it comes to supporting mods. There are some amazing unofficial groups, like the VRChat Modding Group, who develop and curate wholesome mods that are safe to run and open source, but in general, it’s still a bit of a wild west out there.

Now, here’s my suggestion of a potential solution to this. I doubt that VRC devs are reading this, but this is just my two cents.

My idea: Plugins for VRChat #

In my opinion, VRChat should have official mod support. In this context, let’s call them “plugins.” It sounds less scary… ;)

An official API/SDK should support client-side plugin development for VRChat. This also has the bonus of allowing VRC to at least have some control of what plugin developers have access to, further increasing security.

When a developer submits a plugin to VRChat, it will be checked by them to make sure there’s nothing malicious happening.

When it’s all good, the plugin will be published to a “plugin marketplace”. Think of something like the Steam Workshop, but for VRC plugins.

That way, players can tailor their personal experience without having to install complex or suspicious software and modify the client itself, and VRChat can be sure that nothing bad is running on their player’s clients. In my opinion, this is a win-win.

VRChat has stated that they want to implement the features many of those mods already had, but I don’t think that’s a good solution. There’s no way that VRChat can implement all the features that players request, without experiencing some major feature creep or bloat. Every person is different, and players have different needs and requirements.

In my opinion, this is the beauty of mods. Players can tailor their experience by picking little individual mods for their own needs, and I don’t see this as a possibility without mods, or at least some sort of “plugin” system, as I suggested.

Alternatives to VRChat #

If you’re interested in alternatives to VRChat, the best one at the moment is ChilloutVR (CVR), developed by Alpha Blend Interactive. After VRC pushed the EAC update to their main branch, there was such an enormous influx of new registrations at CVR that their servers crashed momentarily. It’s great to see that competitors are getting more attraction now, and hopefully, this will push VRC into improving their app and their scarred relationship with their community.

There’s also Neos VR, which is really cool! It’s more of a VR sandbox than a social platform, and the UI/UX is not very user-friendly. However, even though the community is small, they’re very passionate about the project and willing to help new players! Development has been stagnating a little bit due to some internal conflicts between the Neos devs and their cryptocurrency-shilling CEO. However, I do hope that this project will continue again soon.

My final take is that VRChat has made a massive mistake by including Easy Anti-Cheat in their game. The platform is lovely, but it is hard for many of us to support the hostile updates that create more problems than it solves.

Here’s hoping that the community, as well as the competition from other social VR platforms, will send a strong signal to VRChat, that they should embrace all content creators. Not just avatar- and world creators but also the unsung heroes of legitimate mod developers who just wanted to enhance the experience of a platform that they dearly loved.

To all the wholesome mod developers out there, we all salute you.

Tags: vr, vrchat, modding, anti cheat, drm, linux, accessibility, opinion

☕🪙 If you like this article, please consider buying me a coffee!