I'm not sure exactly when it switched over but Ripper store has begun distributing #VRChat avatar assets. R.s has historically been a scare tactic, but now that they've enabled downloads that changes things.

Fun fact: R.s uses Cloudflare! Have fun: https://www.cloudflare.com/abuse/form 

(1/8)

I'm not looking to incite panic, and you'll find out why you shouldn't panic in a moment, but I believe it's important for you all to know what bad actors are capable of if you intend to create or commission a custom VRChat avatar.

What does this mean for avatar ripping in VRChat? Not a whole lot, actually. It's still very easy to do without being nearly as visible as R.s. Stay in invite worlds with people you trust and/or use a recoloured avatar base in public or friends+ worlds.

I'm still of the opinion that there's a VRC mod floating around that puts avatar IDs onto R.s silently. I'm not nearly deep enough into the modding scene to know if it's true or what mods exist outside of the very public discord and Ruby.

But I wouldn't trust mods at all.

Fighting back is as easy as introducing swift, harsh consequences for being so disrespectful to someone as to steal their art. Put them on blast, completely exclude them from your communities. Anywhere you see them, tell everyone what they've done and may do to others.

If nobody WANTS to use a ripped avatar for fear of losing access to their social communities, it becomes far less of a problem. Furries already do this for art thieves, and this is just another form of art theft.

Hold each other accountable, art theft is serious business.

Of course, ultimately this boils down to the VRChat API being used in a way that wasn't planned for. The blame for that falls on their development team, and it's worth pressuring them on this if avatar security is a priority for you.

However, 100% safety is never possible

What can YOU do to help? Admittedly not a lot. R.s DOES use Cloudflare, whose abuse form is located at https://www.cloudflare.com/abuse/form , but they're primarily a passthrough/caching service; they just send the abuse report through to the host and/or site owner.

Maybe it's enough.