Developer Update - 14 September 2023

[tupper]

Welcome to the Developer Update for 14 September 2023!

The featured world for this Dev Update is Beyond a bit - 想像のちょっと先へ by EstyOctober. Gather up your friends, grab the key, unlock the chest, and enjoy the ride.

If you’d like to catch up, you can read our previous Developer Update from 31 August.

Important Info / Announcements

Recent Unity News

If you weren’t aware, Unity recently announced some changes to its pricing and licensing structure. You’ve sent us a few questions asking about how these changes might impact VRChat.

To keep it very succinct: VRChat isn’t going anywhere, thanks due in part to our VRChat Plus supporters. Thank you!

Unity 2022 Open Beta

Our Open Beta is currently testing a version of VRChat running on Unity 2022! This is a change from our current version, which is on Unity 2019.

DO I HAVE TO REUPLOAD??!?!?

No.

No reuploads are required. All content from Live VRChat works in this build.

We’ve done a ton of work to ensure as much content works as possible. Our Closed Beta testers found a bunch of stuff and we’ve fixed most of it. But we’ve almost certainly missed more stuff, which we’ll need your help to find!

If you have content you’ve uploaded to VRChat that you want to make sure works fine after a Unity upgrade, test it NOW.

Submit a bug report if something’s broken. We are most interested in broken features, broken content, or unexpected differences between 2019 and 2022. We really appreciate well-made bug reports with reproduction steps and examples! Those are the most helpful and have the best chance of getting quick fixes.

It is A LOT easier to fix stuff now in Beta than it is to fix after we do a release. So please, please, check your content. We want to minimize the number of people who say “wtf my stuff is broken!! nobody told me this was happening!!!” on Live release day…

Submit all bugs you find to our Open Beta feedback board. We’ll sort it out.

We are not releasing a 2022 SDK yet. Don’t upgrade your projects yet!! Stay on 2019!

Open Beta will remain on Unity 2022 going forward. This will allow users to use and test Unity 2022 while playing VRChat normally, so you can easily find and then report bugs.

We’ll have builds for all normally supported Beta platforms, and we’ll maintain network compatibility with Live as usual.

Rough Roadmap

1. Unity 2022 VRChat is in Open Beta right now, and will stay on Unity 2022 even if future test builds need to go out.
2. At some point during the 2022 Open Beta, we’ll push a Beta 2022 SDK and provide migration steps. It should be fairly straightforward, especially with the Creator Companion handling it!
3. Eventually, once we’re OK with the state of Open Beta, we’ll push to Live.

VRCSDK 3.3.0 has been released!

VRCSDK 3.3.0 is now available! You can get it through the the Creator Companion, as usual.

Upgrading your existing projects is super easy. Click “Manage Project” in the VCC, then slap “Update” for each SDK package you have installed. The VCC will handle it for you!

This update includes an overhaul to the “Build” tab of the Control Panel:

• Fully rebuilt the SDK Builder panel with new UI and features
• Uploading Worlds and Avatars no longer requires entering Play Mode
• Updating the thumbnail no longer requires a full content rebuild and reupload
• You can now select any file to be uploaded as a thumbnail
• A standardized public API has been added for tool developers
• Content Manager now marks the currently selected world and allows quickly setting any uploaded world as current
• Countless bug fixes and improvements across Worlds and Avatars SDKs

Important note for Tool Developers

If you’re making tools that integrate with VRChat SDK, pay attention! This is an important release, as it makes quite substantial changes to the SDK internals.

We now provide public APIs for you to integrate with, and we highly recommend migrating your tools to utilize them if you were relying on reflection or similar techniques before.

You can read more about the Public SDK APIs here.

Spookality and New Years Eve Info

Nothing to share yet but if you’re interested in contributing to either Spookality or New Years Eve in VRChat, keep an eye out on our announcements. We’ll have more info soon.

Ongoing Development

Merging ClientSim and UdonSharp into the Worlds Package

UdonSharp and ClientSim are a testament to the creativity and intelligence of the VRChat Creator Community.

Both of these packages started life as completely community-driven projects! Merlin and CyanLaser saw a way to make VRChat World development easier, and donated their own time to build out the tools they envisioned. UdonSharp became a Curated package when Merlin joined VRChat, and ClientSim was created by CyanLaser at VRChat’s request to take the best of CyanEmu and trim it down to focus on SDK3.

These two packages are now so integral to World Development that we’re going to take one new step. We’re merging their codebases directly into the World SDK to make them available in every project moving forward, by default.

This will also make it much easier for us to develop World SDK features which require changes to ClientSim and UdonSharp in order to function fully, and easier for creators to keep these three packages properly synced.

We will keep the UdonSharp and ClientSim source repositories synchronized as closely as we can, and will still accept issues and PRs from them for now.

What Will I Need to Do?

Not much. We will release a 2.1.3 update to the Creator Companion, then release the new Worlds SDK version 3.4.0. You can then use the VCC to update your World projects to the new version (3.4.0) and your project will have the duplicate ClientSim and UdonSharp packages removed from its filesystem and VPM Manifest.

This will also work if you update your Worlds Package through the Package Resolver directly in the Unity project. The resolver will be updated at the same time.

If you create Unity Editor Tools for the Worlds SDK, you can move forward assuming that every user with SDK 3.40+ will have UdonSharp and ClientSim available. Note that if you use a Version Define which looks for the ClientSim or UdonSharp packages, those will no longer exist! You should use the Worlds package instead.

However, we checked over 100 popular Community Packages and found only one which did this, so it’s not likely to be an issue for you.

A Letter from the VRChat Security Team

Hello everyone! I wanted to take a moment to peel back the curtain some and provide a little more visibility into VRChat’s security.

Historically, we haven’t shared many details about our security projects or responses. This is for a variety of reasons, but it can be summed up as “if we tell you what we’re doing, it’s easier for bad guys to bypass it.” That said, I believe we could be sharing more!

As such, today, I am going share some info on avatar ripping and piracy, and what we’re doing about it.

If you’re unfamiliar, the term “avatar ripping” in VRChat context refers to the act of taking an avatar someone else is wearing, and converting the files used to display that avatar on your local device back into something that they can upload. We also refer to this as “avatar piracy”, as this problem is very similar to software or media piracy.

First, I want to acknowledge that we’ve seen the reports that you have filed. We see the pain, upset, and cost that ripping and piracy inflicts on the community. We see the difficulty this causes for our creators, and the confusion it creates for you. As community members ourselves, we have many team members who have been impacted by ripping. Piracy is an issue we have taken seriously for several years, but like many companies out there, we have struggled to fix it. To put plainly, it’s a very difficult problem to solve technically.

So, what are you doing about it?

We have a series of updates planned for this late fall that should significantly reduce future occurrences of avatar ripping and piracy. Sadly, I can’t share the technical specifics on this with you (see above re: bad guys). However, I want to reassure you that we are tackling this issue on multiple fronts. These updates will be a culmination of efforts that have been in development for some time.

In addition to technical solutions, we have previously and will continue to employ other methods with the same goal of making it harder to pirate content out of VRChat.

So my avatar will never be ripped again?

I want to tell you yes, but… I can’t. The truth is that there will always be extremely dedicated malicious people out there, and they will find a way to bypass protections we develop.

Our goal is to make the difficulty bar so high that malicious pirates don’t consider it worth their time to rip avatars. This makes it much easier to find those who still pirate content, and to respond to them on an individual basis. We think these updates should fit that bill.

Will we hear from security again?

I hope so! My general philosophy on security is that when we’re doing our job well, we’ll be in the shadows and you won’t even notice we’re here. However, there are still going to be times when it may be helpful or necessary to hear from us directly.

We want you to know we see your reports, and the VRChat team is here to help protect our community against those who would hurt it.

Sincerely,

StarChild
VRChat Security Team Lead

Impostors!

We’re still working on Impostors! The feature is not dead! just because we don’t talk about a thing or because we miss a release date doesn’t mean something is dead smh

We ran into some unexpected delays and hiccups, especially on the API side of things, and that’s about as much as we can share without going too far into the weeds. Needless to say, it’s still on the way.

In trade, here’s a few more imposter examples you can take a peek at!

New VRChat Home Profile View on the way!

We’ve been working on a new profile look for the VRChat Home! Take a look:

This new view is designed to make it easier for you to view the profiles of users in VRChat.

It also works well in mobile resolutions and aspect ratios:

Look for this to roll out soon!

Conclusion

That’s it for this Dev Update! Our next update is scheduled for September 28th, 2023. See you then!

[VoicesShiature]

@tupper

So my avatar will never be ripped again?

I want to tell you yes, but… I can’t. The truth is that there will always be extremely dedicated malicious people out there, and they will find a way to bypass protections we develop.

Our goal is to make the difficulty bar so high that malicious pirates don’t consider it worth their time to rip avatars. This makes it much easier to find those who still pirate content, and to respond to them on an individual basis. We think these updates should fit that bill.

make sense that’s a good point + always stupid toxic people always doing this bypass + (I hope your day your team VRChat is doing great best work )

[polyjitter]

That Static Portal update is actually very cool! I like the idea of instance hubs, too.

Any word on a party system or something that will allow static portals to be used for worldhopping when with friends?

It’s the reason I never use them - if I see the portal, because this is a social game, I want my friends to come with me. Static portals can’t do that.

I REALLY feel like that’s a pretty big issue with them that’s more pressing than linking to specific instances. In fact, I think worldhopping and partying up with friends are all terrible experiences right now - really annoying to have to rope up all your friends and tell them you’re all leaving to somewhere else, and it has been for many, many years. There are like 10 features in the past 2 years i would have been okay with having postponed to have this made a nicer experience.

[Oracle]

You guys planning on updating the very dated visuals of portals? the weird sparkly bits around the portal are from the old UI look and the flipped image in the portals leaves a lot to be desired.

[tupper]

@VoicesShiature

I hope your day your team VRChat is doing great best work

we’re doing great, thank you!

@polyjitter

Any word on a party system or something that will allow static portals to be used for worldhopping when with friends?

That just sounds like static portals are broken. unsurprising, we haven’t really touched them in a while. people don’t seem to use them a ton from our data.

if you’ve got a bug with them please post to the canny!

@Oracle

ou guys planning on updating the very dated visuals of portals?

idk maybe one day, there’s lots of strong Opinions on how portals should look

[kitballard]

About Ripping: Good. Some better security is better than none.

[polyjitter]

@tupper

That just sounds like static portals are broken. unsurprising, we haven’t really touched them in a while. people don’t seem to use them a ton from our data.

Wait what? Are friends supposed to join the same instance as you when they walk through static portals with you? This has never worked for me in my two years of playing VRChat

[tupper]

@kitballard

About Ripping: Good. Some better security is better than none.

we’ve got better than none right now! but as it will always be, it isn’t enough. it’ll never be enough. just have to make it hard enough that it gets to “ugh, nevermind” territory to dissuade the jerks.

@polyjitter

Wait what? Are friends supposed to join the same instance as you when they walk through static portals with you? This has never worked for me in my two years of playing VRChat

ya, i think so. its probably just been broken for that long

[JustSleightly]

They’ve still worked properly for me. We’ve even had VKet world hopping parties this last Vket (July) where we all go into world portals together at the end of the map and still make it into the same instance.

[mackandelius]

@tupper

We have a series of updates planned for this late fall that should significantly reduce future occurrences of avatar ripping and piracy. Sadly, I can’t share the technical specifics on this with you (see above re: bad guys).

So sad that sharing technical solutions when it comes to security is a bad idea, they’d probably be interesting to learn about.

But the fact that it is being addressed in a developer update like this makes me hopeful for whatever mitigations has been figured out.

[Masterhound]

This is pretty cool, keep up the good work!

Also is there any plans to fixing the issues with group publics that cause them to make privated worlds publicly accessible? I feel like this is an issue that should be addressed.

[Vesturo]

@tupper

Using the portal marker, you can now define an entire worldID:instanceID combo to link to a specific instance, instead of just linking to a random instance of the world.

This is Awesome, makes it easier to Hardcode let’s say after party instances or things like that

[Cascadian]

Glad to see a little work being done to help us tool makers, much appreciated! I 'd love to see more in the future as well

[awesomeplayer]

Got a ETA on Physbones/Contacts being used for worlds? Is that going to be a feature?

[splitscream]

Good to see VRC will be able to survive the brunt of the ongoing Unity crisis

[tupper]

Static portal segment’s been pulled because apparently it’s not gonna work quite that way. We’ll talk more about it later.

[tupper]

@Masterhound

Also is there any plans to fixing the issues with group publics that cause them to make privated worlds publicly accessible? I feel like this is an issue that should be addressed.

Yeah, sounds like a bug or unintentional behavior. Have a feedback link?

@awesomeplayer

Got a ETA on Physbones/Contacts being used for worlds? Is that going to be a feature?

No ETA, it’s in “eventually” state

[ZenithVal]

Know it’s always an uphill unending battle to fight ripping but it’s always nice to get updates. Thanks for keeping us in the loop.

Is the unity version 2022.3.5f1 pretty much solidified at this point?

[bunnytail]

What’s this “impostors” feature? I never seen it in any other dev blogs. Is this a new thing? And what is it for? There’s no context for those who missed it / aren’t in the loop.

[Masterhound]

Here’s a feedback link to the original post about the issue:

Canny