VRChat uses a version of yt-dlp with secret modifications. This is allowed by the yt-dlp license, but it puts VRChat users at risk.

YouTube occasionally makes changes that break yt-dlp. Even if VRChat immediately updates to the latest release version as soon as it comes out, it's not good enough, and some users will try upgrading it themselves because watching videos is critical to them. Right now, some users are replacing VRChat's yt-dlp with an unofficial build of the regular yt-dlp made by a yt-dlp contributor.

If these modifications made by the VRChat team are truly important, at a minimum, the VRChat team needs to make VRChat yt-dlp visually distinct from the official yt-dlp. The icon, the filename, and the file properties should be different. The command line --version output being different would be nice, but probably most users don't check there. Changing the appearance of the file makes it obvious that it is not the official yt-dlp and replacing it with the latest official yt-dlp is not a direct upgrade. The easiest way to check currently is to compare file hashes, and the average user isn't going to do that.

Additionally, VRChat should publish the modifications being made so that it is possible to create an unofficial replacement which contains the same changes. Somebody, probably from the community, could create a build service that applies the same modifications to a copy of the source code for the regular yt-dlp and produces an exe file. To prevent people from running an unpatched version, it needs to be obviously incorrect to do so and there needs to be an easy way to do it correctly.

It would also be great if VRChat's logic for replacing yt-dlp was better. Even if the previous two actions are taken, it's possible a user will install a special, patched yt-dlp to fix a problem and then forget about it, leading to problems later when their yt-dlp is outdated and VRChat cannot replace it with a new version. If VRChat could somehow recognize that a file is a replacement for eg 2022.08.08 and not replace that file with 2022.08.08, users would not need to permanently prevent VRChat from replacing the file. Maybe VRChat could check a file property or something to see if the version matches the expected version. Maybe VRChat could name the file something like vrc-yt-dlp-2022.08.08-r0.exe and not replace it if it already exists.