VRChat is littered with UX and network bugs, design flaws, extreme performance issues on the client-side (poor user experience with anything less than a $2000 GPU), and apparent technical debt. High-severity bugs don't get patched for weeks. Major updates often go out on Friday nights, causing much disruption for anyone who had plans there on those nights. Seriously, who even releases on a schedule like that?

Not to mention its a security nightmare given that by default your client will run arbitrary GPU shader code that is uploaded by other users. People can and do take advantage of that, even as a full-time hobby.

The third-party developer community that claims to combat said security issues, really misses the mark. Their approach is to attempt to centralize the governance of all third-party tools (which are badly needed because VRChat proper fails to protect its users or provide a decent UX). Then they demonize virtually anyone who doesn't get on board with their ultimatums. They even require all users of their third-party tools who want any kind of technical assistance to submit detailed log files to a bot that will sound an alarm if that user uses an "unapproved" program. The criteria for this is, to put it simply, to flag anything that wasn't created by someone named on their whitelist of developers. And if you want to see salivation, there's plenty of it there. It's a spectacle just seeing people jump on these users like dogs, quite rudely at times, for daring to download something that the gestapo didn't approve of. For a community that claims to be about creativity, they do a poor job of fostering it.

Anyone who wants to have an entrepreneurial spirit in the development of such tools better have some kind of copy-protection as the tools tend to only be implemented in the form of distributed binaries that tend to require no server, or a microservice at the most. Problem is, the same group mentioned above is requiring that developers on its whitelist implement process-wide hooks that will break the copy-protection but nothing else. All in the name of keeping the children safe, I shit you not, but what it's really about is control. A determined hacker can easily defeat this measure by distributing a forked version of the mod loader with their own tools. Here's the kicker: Apparently this was all the result of some kind of back-room deal between the developer cartel and VRChat's admins, the timing of which was conspicuously not long before their $80M Series D round.

Timeline of events

March 30: VRChat does a large ban wave of apparently as many mod creators as they can find, by cross-referencing social media and Github names of developers of third-party tools with their own database of users. VRChat demands to the developers to take down their Github repositories if they wish to be unbanned and to get connected back with their VR social life.

March 31: VRChat "admits a misstep". The accounts get unbanned, the developers may put their repositories back online, but now they "intend to start a dialogue" with said developers. https://web.archive.org/web/20210401015645/https://twitter.c... - In the meantime however, the developers are not distributing their software for the time being.

April 8: The list of whitelisted mods completes an overhaul, basically an audit, then distribution opens back up. Additionally on this date, the modding cartel says they won't be sharing any details with the public about the subject-matter of the discussions with the VRChat admins.

April 24: A rogue developer ragequits the community and pushes an update to their software that amounts to prankware. Letting no crisis go to waste, the modding cartel writes a 250 word announcement to signal boost this incident, even archiving the link to the commit so they can show you how much you are at risk if you don't only install what they say you can install.

June 16: MelonLoader 0.4.0 is released, and many of the tools on the whitelist are simultaneously released with 0.4.0. They also spill the news on this very day, that it is no longer backwards compatible with the previous version of the loader. So any developers who weren't colluding with the group were given no time to decide if it was a good idea to switch to 0.4.0. They weren't really given a real choice as the software became effectively unusable without adopting this version. Conspicuously absent from this announcement was the additional security measures I mentioned above, to prevent copy-protection. You'd think it would be a good opportunity to announce the supposed safety measures they implemented, but instead it seemed they were trying to avoid discussing that at first for whatever reason.

June 28 (just 12 days later): VRChat raises $80M Series D. A major focus of this fundraising round relates to the implementation of a creator economy.

A Machiavellian scheme to exert control under dubious pretenses is not the foundation of creativity. The above scheme did nothing substantial to mitigate the risks of piracy in the context of such a planned market. I'm not sure if a VC would have been wise to it though as it looks good enough on paper to someone who doesn't truly understand the ecosystem or the security factors involved.

This to me is solid evidence that VRChat as a company likely has a top-level strategy of putting lipstick on the pig rather than building a good product. Therefore, VRChat is a toxic, toxic, poison pill, and Facebook would be wise to take notice of this and instead compete with them head on. Otherwise it would be a missed opportunity to break the stockholm syndrome that is currently widespread in its future target audience.