Access to private worlds
tracked
A
Aoneko_Bell［jp］
VRChat Version:2022.3.1
Description of the bug:
I am Japanese. This article uses Google Translate.
Third parties can now create worlds that have been made private by the creator.
This is a bug that makes it look like the author's work was easily stolen and should be fixed immediately.
meaning
1: When the creator creates an instance, the private world can be seen from that location
2: Third parties can set up new instances from that screen
Similarly, I was able to confirm that I could create an instance from the website.
Due to this phenomenon, the creator misunderstood that "the work was stolen!", causing trouble. Immediate fix required.
↓The world in this screenshot is a private world created by a friend named Mireha.
As a result of this procedure, Aoneko (me) can create an instance.
Log In
LoppyDaCutie
its only supposed to allow you to create private instances for private worlds even if someone has access to the world in any case
Deantwo
I don't see how my bug report was a duplicate of this bug report. Or are we not supposed to be able to make new instances of someone else's private world at all?
Interesting nonetheless. Would love to hear what the intended behavior is.
If we compare "private avatar" to "private world", they definitely seem to behave differently. Worlds were referred to as "unlisted" before, which seems to describe the current behavior better.
Personally I would love to see different levels of world privacy. Could have "private world" be literally for only the creator, and "unlisted world" as the current behavior.
Sayamame
Deantwo: Indeed, this seems to point to a slightly different issue.
This Canny points out that non-authors can create instances of private world, whereas the merged Canny points out that public instances of private world can be created, right?
Seems like it shouldn't be merged.
Phasedragon
Phasedragon
Sayamame: "public" instances of a private world aren't a bug anyway if you have to get to them through manipulating strings. Yeah, of course it'll work that way. But the part where you can create an instance at all is valid, and locking that down is a reasonable feature request, and so has been merged with other posts related to that.
Deantwo
Phasedragon: "aren't a bug anyway if you have to get to them through manipulating strings"
That sounds nonsensical. Of course it is a bug if you are able to do something you weren't supposed to be able to do. It should be easy for the website/client to check if the instance being created/joined is public and the world is private and then give an error message. But as I mentioned in the bug report itself, it is a very minor issue and not all that important since they aren't truly public anyway.
But as mentioned in my comment before, I would love to see multiple levels of world privacy. It would make a lot more sense to have a difference between "private worlds" and "unlisted worlds". Should I make a separate feature request for that? (Assuming a feature request doesn't already exist.)
Phasedragon
Merged in a post:
Public Instance (kinda) of Private World
Deantwo
- Create a world and uplaod it as private.
- Go to the webpage of the world. (https://vrchat.com/home/world/wrld_6e0dcd13-9827-4cc4-aa04-1ca43e9f1485)
- Click create instance, the type of instance doesn't matter. You will then be directed to the webpage for the specific instance. Don't enter the instance yet. (https://vrchat.com/home/launch?worldId=wrld_6e0dcd13-9827-4cc4-aa04-1ca43e9f1485&instanceId=55717~hidden(usr_2c4e17a6-2990-49da-9f50-3c6c1efa90ed)~region(us)~nonce(162a5594-b17e-45a9-ac0b-f4fd985e03e8))
- Now edit the URL of the webpage, removing the "~hidden"/"~private" and "~nonce" sections. Optionally, change the "instanceId=" to something witty like "BugReportTest". (https://vrchat.com/home/launch?worldId=wrld_6e0dcd13-9827-4cc4-aa04-1ca43e9f1485&instanceId=BugReportTest~region(us))
- Click "Launch World" or "Invite Me". You are now in a public instance of a private world. Kinda.
The world is not publicly listed, so the instance is not truly public. Only people with friends in the world/instance should be able to find it via "Social -> Friend Locations". The world creator can also see it existing, even if you aren't friends with them.
Milo 7807
This is a fairly well known issue that hasn't been fixed in years and has been used to make custom instances. However, the submitter of this report is hiding that he was maliciously abusing this to create public instances of my world that is currently private and additionally setting custom instance tags to send targeted messages toward me.
After being warned to stop for the first one he created before I report to VRChat, he proceeded to create an additional two instances. After learning that a report to VRChat was filed, he proceeded to file this bug report nearly 15 hours after being reported to VRChat to try and clear his name.
Edit: This user has also created another bug report of this exact same incident, proving they are making fraudulent bug reports. https://feedback.vrchat.com/bug-reports/p/author-of-world-can-join-my-friends-instance-and-kick-me-while-i-have-them-block
Deantwo
Milo 7807: Why would I mention a personal issue in a bug report? No need to bring the drama in here. Please stay civilized and constructive. Your comment doesn't add to the report, aside from saying that it is an old issue, that hasn't been fixed.
Your warning to me was given to me after I made the second instance (ID: NotBanned), which was named that because I wanted to let you know that your UdonScript was broken. And the third instance (ID: WhatNow) was supposed to be a Friends+ instance, but I guess I screwed something up when editing the URL, which then might mean my other bug report was made in error. Do you wanna try to reproduce that other bug report with me to make sure?
I made the bug report when I felt there was a reason to. Namely you starting to accuse me of hacking and whatever else. The only thing I have ever done against you EVER, is hangout in instances of your world while we have friends in common there, and making these public instances as a little protest against your weird decisions. Now this is the most we have communicated in like two years. You are free to ignore me again now, instead of actively seeking me out to kick me. Anyway, this discussion is better taken elsewhere, if it even has to continue.
LoppyDaCutie
Milo 7807: A bug report is still a bug report and you need to acknowledge that. vrchat doesnt have all the time in the world for you to harass this user at all by slandering them just say hey here is the bug there you go, and nothing more. from what your seeing below your talking about the same thing. and doing the same thing.
Campa
Merged in a post:
[1238] Can create new instance of other's private world from menu.
yuukixx
Situations where I or a friends are already in a private world and have access to the "World Details" panel.
I can create a new instance using the "New Instance" button.
Previously it was grayed out in private worlds.
Campa
tracked
100の人
The “Add To Playlist” buttons is not grayed out either, so this may be an unexpected behavior.
yuukixx
Similar post with Live version now.
I'm quoting what I commented over there
-
If the WorldID is known, Instance can be created from the Web or API even in private worlds.
But I'd like to ask for an explanation that with this update why "New Instance" button that were not available before can now be used.
I'd like to confirm whether if this change was intended.
If it's a spec, then I don't mind.
-
venn02_ヴェン
>Due to this phenomenon, the creator misunderstood that "the work was stolen!", causing trouble. Immediate fix required.
The creator of a world is indicated on the detailed world screen.
Even if someone other than the creator opens a new instance and uses the world, the creator of the world remains the same and only that person.
It is unlikely to be misunderstood.
V
Val_eins
I was spreading the word on Twitter, but if you can't accept other people's opinions, you shouldn't post them.
Load More
→