World Persistence and Game Integrity
DarkSwordsman
Recently, the creator of the VR Poker world was banned by VRChat for technically breaking the creator guidelines. They implemented a preemptive moderation system, due to the prevalence of hackers/cheater/client users abusing game mechanics/giving themselves in-game currency.
Given the recent emergence of worlds that use the World Persistence feature (in this case, persisting user currency across instances), I believe that this brings unique challenges related to gameplay integrity.
I am not sure what the solution is, however, I wanted to open this canny to start a discussion around the topic and to track that this is a problem that is now happening.
A couple ideas off the top of my head:
- Update the Creator Guidelines to include a wider scope of what is or is not allowed in terms of cross-instance moderation
- Create new Udon APIs/systems that allow for complex moderation/reports that can be automatically handled/generated by the world itself
Log In
-CMC-
I was told the following story today. Paraphrased:
“Around 2018-2019 a bug in the Photon deserialiser was found and sent as a report to VRC. This lead to a permanent ban for the user. The person who found the bug took the ban personally and published the exploits, causing havoc in public instances for years.
I understand why the terms are there, and frankly they should be enforced, yes. There are better ways of mitigating this kind of activity, both geo-blocking and dynamic analysis. The problem is that has been touted – over confidently – by certain VRC team members that because EAC has been added, there are no more exploits. But a motivated individual can still circumvent these measures.
The team likes to pretend that the issue doesn't exist, so no-one should account or mitigate a possibility of it.”
Given what I've learned about in the brief time I've spent learning about cybersecurity, you have to mitigate and close exploits as soon as they're found, or at least keeping active tabs on it while securing and sectioning off the rest of your assets. As VRChat continues to make milestones in CCU and more lucrative collaborations, it becomes a bigger target for intrusion and disruption to that userbase. You must meet the task on a technical, managerial, and operational level.
Not only that, but you must also give real agency and more powerful moderation tools to your world creators, so they shouldn’t need to take such drastic measures. Stop punishing your biggest and brightest in the community in heavy handed ways that only causes problems for you later on. Be smarter and learn from your mistakes, less you be doomed to repeat them.
Legoman99573
-CMC- False. I still see client usage, but in this instance it's malicious users only who could care less what happens because they are on their 50th or 100th alt account.
Toys0125
Legoman99573 they mentioned people can still circumvent. So what's false?
Pineǃ
T&S absolutely did not 'just do their jobs' - ignored the fact that hackers were reported for ruining the gameplay for everyone else, but when those same hackers reported the world for having moderation against them, T&S swiftly acted to ban the world creator. Terrible display of integrity. If you want to protect your own TOS without creators having to implement their own moderation system, maybe actually respond appropriately to the tickets regarding the hackers ruining the experience for the majority of players on your platform?
Disappointed with the VRC team today and they should be with themselves too. Failed at doing the job they're getting paid to do spectacularly.
ElfMom
Pineǃ lmao, They've always been ban first, ask later.
Uzer Tekton
VRChat Inc failing to catch actual cheaters, but punishing the world author from having to protect their game/IP from actual cheaters BECAUSE of VRChat's failure? Anyone with a brain can see this is simply wrong.
This is VRChat's failure as a platform. This is anti-creator. This only confirms VRChat is totally unsuitable for making any serious game content.
Ban the cheaters, not the creators!
VRChat Inc. needs to seriously treat VRChat like a game, and not a chat room with VR tacked on. This is a failure.
WubTheCaptain
VR Poker's world author Nex1942 has formerly reported this issue with persistence: https://feedback.vrchat.com/persistence/p/exploit-multi-client-persistence-data-rollback-overwrite
DarkSwordsman
WubTheCaptain this doesn't seem to be necessarily the same problem (this canny is about moderation and hackers, that one is about a specific bug), but it definitely does fall under the same umbrella of general game integrity issues with world persistence.
Adeon Writer
My thinking is that the ToS for Udon-powered world moderation as currently written was well-suited before worlds could have persistence, but now that worlds can be powered by persistence, it is time to re-evaluate the ToS and create rules that account for cheaters able to misbehave in one instance and carry that result with them into new instances where the ToS does not currently allow creators to do anything about it.
Dalken Starbyne
Adeon Writer I think bare minimum, these abuses of the persistence system to everyone else's detriment certainly need to be made readily and handily reportable to the VRChat moderation team. If world creators can easily see these abuses happening but cannot be allowed to respond to it directly, then they need to be able to forward the pattern of behavior to someone else who can do something about it and swiftly.
And if that cannot be managed by the VRChat moderation team at scale, then perhaps that is itself another indicator of the weaknesses in the current system.
Adeon Writer
Dalken Starbyne I don't think VRChat's T&S team can handle or understand all the individual little made up rules and codes of conduct that a game may have, understanding if they are legitimately broken or not, and banning VRChat accounts wholesale for violating any one of them.
Perhaps then, a world creator could create world-specific report categories to be sent to the T&S team?
And those categories populated into VRChat's own reporting system
Dalken Starbyne
Adeon Writer If VRChat thinks their T&S team is up to that. Still sounds like that would probably wind up being quite a lot of volume, if you ask me
DarkSwordsman
Adeon Writer this is kind of what I'm hoping for.
World creators can create automated systems that check for abuses/out of bounds behavior. This could create reports, which get filed under that user.
Then if there are legitimate user reports, there is a paper trail of suspicious behavior which would more easily convict the person of wrongdoing.
I don't think people should necessarily be moderated because of automatic world reports, but it can definitely add to a file and be used as evidence.
DarkSwordsman
Linking over to this one, tracked by VRChat with over 1,000 votes, asking for moderation tools for world creators:
Tau of the sun
I think that people that are creators should have control over their worlds, simple as that. Worlds have been ruined in the public sense because of the lack of systems in place to stop the worst of the worst. If VRC cannot stop the crashers wrecking things, you should let world creators filter for them. VRC does not have the resources to protect their platform, This is why I quit moderation, Zero interaction with world owners and simply "hoping" they will patch the exploits will make you pull your hair out.
SherbDrgn
If they had a ban list or something that is like one of THE rules, you cannot punish someone for something they did in another instance. As far as I am aware the what is allowed in cross instance moderation is NOTHING. That has been a long standing rule like since forever
DarkSwordsman
SherbDrgn Absolutely. This is asking for VRChat to consider solutions that allow world creators
some more control
over the integrity of world systems, now that world persistence is more common.It's not reasonable to expect world creators to not restrict functionality for users that abuse systems, especially when modded clients can mess with persistence data for other users.
This is an unprecedented moderation situation we have now and we need modern solutions to deal with it.
DarkSwordsman
To copy from this reddit post to help emphasize the severity of this problem:
> Over the past several weeks, a specific Chinese client modding community began targeting public instances of VR Poker. They repeatedly crashed lobbies (regardless of your shield level), corrupted tables mid-hand, wiped players’ chip counts, and rendered public rooms completely unplayable. Some even streamed themselves configuring and deploying the modified clients, effectively demonstrating how to replicate the attacks. (I have links to the VODs but will not share them publicly). In response, Nex implemented a world-level ban list to prevent the specific accounts that were publicly streaming the mods from re-entering the world.
Colt_45
When hacking groups start targeting a world and their communities, choosing to instantly ban the world creator and removing all of their worlds with no warning whatsoever is probably not going to be the best approach.
Load More
→