Avitar id tags the avitar in your server you store it in after we upload it to you… This new update you have told us about showing avitar id to anyone for blocking reasons … WILL mean its easier for the third party applications to rip avitars from your servers from my understanding of how i’ve been told how they work… never in my mind would i rip when i can make them myself of cause
Tupper what are you going to do about this I DONT want to uplaod any more content i’ve been working on into vrchat due to its insecurities? i’m very concurned your avatar “cache cloud” or what ever it is “server” is very un protected… asking.
From what it sounds like you will be able to hide a Specific Avatar, aka the Avatar ID. I don’t expect it to be shown though, you will probably just end up with a button that says something like Block This Avatar. Even then, the Avatar ID is still shown in the logs, so yeah, if people want to get the ID they can already find it.
This is very much “damned if you do, damned if you don’t.”
Obfuscating avatar IDs is “security through obscurity” which is bad practice. We have other methods on the way (that I cannot describe due to it being a security change) that should help make ripping harder.
The “hide avatar by ID” feature is a common request-- and in order for it to work, you have to be “aware” of the ID in question and store it in some way. We’re going to do it in a way that’s fairly obfuscated, but still possible for a user to see. There’s not really any other way to do it.
As a quick aside, many of the things you are likely thinking of to hide the avatar ID from a user but allow them to use it to hide the avatar by ID won’t work-- for the same reasons it wouldn’t work for hiding an avatar asset. There are more robust methods to hide the ID that I can personally think of, but they’d require a pretty hefty change to the way we serve assets, and we want to ship this feature soon.
It is very important to note that, as we’ve stated in lots of other places, ripping will never be completely preventable. We can make it harder, but we can’t prevent it.
If you have something valuable that you never, ever want anyone else to ever have on their hard drive, do not upload it to VRChat.
