and aren't damaged
#general
pulsar wigeon
orchid pelican
no we arent talking about the same ups
cosmic raft
I've never had something damaged by FedEx or UPS
ยฏ_(ใ)_/ยฏ
The worst experience I had was with DHL
orchid pelican
yall are to funny
cosmic raft
DHL came to my door, stuck the "pickup at our depot" notice on the door, and left. I was home, they didn't bother knocking.
Depot required 2 pieces of government-issues photo id, not just 1 like everyone else asks for
most people only have 1 piece
yup, like most people
void void
wat
cosmic raft
I have two now
void void
I have a passport, 2 ids, my birth certificate, and my ssn card
orchid pelican
like license and passport?
void void
am i the outlier, really
pulsar wigeon
birth cert and ssn aren't photo id
cosmic raft
I don't have a passport, birth certificates don't have your picture, and we don't have "ssn" cards
pulsar wigeon
driver's license and passport are
void void
oh didnt see photo
orchid pelican
I also have my license, ssn card, passwport, and birth cirtificate
pulsar wigeon
and yea, unless you travel, you prob don't have a passport
void void
i know but you expect me, a retard, to read
native thunder
The ssn card is a great
cosmic raft
1x Identity Card, 1x Services Card
native thunder
The stuff in the back changes through the ages
pulsar wigeon
"Lord Korea" is pretty strange too
native thunder
Needing 2 forms of photo ID is so weird
cosmic raft
tell that to DHL
native thunder
Who carries about that many
cosmic raft
I do now, the two I showed above together
1x Identity Card, 1x Services Card
lol
marble summit
Third Gender is Block Gender
void void
also sad that modlauncher has no license rn, i thought it'd gain enough traction to replace legacylauncher finally - but nah
would contribute n stuff
but hey it does not matter anymore anyway, i was mainly looking into this to replace legacylauncher in my Orion project
but hopefully Fabric support for spigot/paper gets more mature so i could finally archive my it :D
sturdy fulcrum
Anyone here have experience with mobile apps
sturdy fulcrum
Figured Iโd reach out to some of the best in my community with a possible opportunity
unreal quarry
?ask
unreal quarry
Ok.
unreal quarry
goes back to work with his Android dev knowledge
heavy rapids
wiz you like that ๐ฎ emoji don't you
heavy rapids
lmao
upper flicker
The ecosystem has improved
pulsar wigeon
i would assume so
upper flicker
And I imagine the android APIs can only have gotten better than they used to be
But itโs been a long time
earnest tapir
merry talon
no one in the right mind writes apps in java anymore
they use a framework like flutter or react native
cosmic raft
lots of people still write java apps, no reason not to
especially with java 9+
jlink and all
lapis sequoia
bby clip, does dtags work on 1.14 ๐ฎ
merry talon
yes there are reaons not to hence the frameworks existence
like not having to maintain 2 codebases
pulsar wigeon
kashike, i have a bunch of chicken thighs defrosting atm
idk what to do with them
also wow
fuck you too
cosmic raft
:D
sturdy fulcrum
Ask in the appropriate place @lapis sequoia
lapis sequoia
yes father ๐ญ
merry talon
I just assumed you meant java since this is a java community lol
cosmic raft
did you just assume? on my christian minecraft server?
wait until god hears about this
merry talon
we have knowledgeable people here? 
unreal quarry
A job offer? Eww. I thought you had a technical question that needed expert guidance.
sturdy fulcrum
๐๐
unreal quarry
Could have just started with that and prevented all the confusion
proud bay
gloomy sphinx
hey look its the placematapi guy
sturdy fulcrum
Stfu dude
sturdy fulcrum
Update your server and u get it automatically
gloomy sphinx
ill have you know my server has 2 dedicated players who are happy on 1.7.10
sturdy fulcrum
They are miserable on the inside
gloomy sphinx
they dont sleep on a couch
sturdy fulcrum
They donโt even pvp each other
heavy rapids
lmao what am i reading
gloomy sphinx
at least his is made in vietnam and not australia
sturdy fulcrum
And lose your /daddy
sturdy fulcrum
Sry
gloomy sphinx
hey ill program your wifes app. i am proficient in html, kotlin, and PHP
pulsar wigeon
needs more JPG TCC
i can almost make out the white text behind the purple artifacts
gloomy sphinx
dont blame me i just found it on yahoo
gloomy sphinx
woven otter
@unreal quarry good job on the moon generation and gravity
unreal quarry
Most of it was someone elses work. I just fork and modified
woven otter
that rocket should need more instructions though
unreal quarry
Yeah, I plan on removing the height restriction and adding a longer fuse time
tall hatch
limber knotBOT
after setting up firewall rules, how do i check test it for a possible admin login exploit?
what is the procedure?
void void
try connecting to your offline server sans bungee
limber knotBOT
sans?
wind mauve
Trying to fix fps on this laptop.. it's got a 4k screen. Any recommendations for resolutions to try?
merry talon
.wa sans
limber knotBOT
(DiscordBot) Definition: preposition | without - https://is.gd/IG8X9m
merry talon
fucking image
wind mauve
It's a surface book 2. i7-8650u 16gb ram and a gtx 1060. Like its not the best but not terrible either
merry talon
try running it at 1080?
wind mauve
Gonna try that next. 2k is definitely better so far
merry talon
should look no different for minecraft anyway
wind mauve
Yeah. Currently testing on r6 siege
wide hazel
mm, my chili tonight is turning out great so far
followed a comment on a recipe with modifications, added some more modifications of my own
if you don't add cocoa powder and cinnamon to your chili, you should think about doing so
heard that as a tip years ago, but never tried it until now
pulsar wigeon
does github not have one anymore?
bearded octo nemesis comes immediately to mind...
pulsar wigeon
slow down kashike
cosmic raft
slow down what
pulsar wigeon
2 letter project names ๐ฎ
unreal quarry
just look to your left. first thing you see is the name
pulsar wigeon
:^)
cosmic raft
https://www.intralinks.com/ma-project-name-generator used to have good names
doesn't anymore
PROJECT PCP is what it just generated
pulsar wigeon
do you want the name to be relevant to the project at all
pomf
kashike what did you do
cosmic raft
anything works, basically
pulsar wigeon
.-.
cosmic raft
what?
pulsar wigeon
you renamed your yarn fork pomf
pulsar wigeon
oh
cosmic raft
i did not :P
cosmic raft
yes
cosmic raft
project wizjany
ok wiz, which of these are good:
crow, raindrop, yoga, raven, flame, splash
cosmic raft
crow, raindrop, drizzle
pulsar wigeon
crow > drizzle > raindrop
cosmic raft
hmmmm
merry talon
cool, visa checkout vehemently rejects my attempts to paste info into fields
and they don't let me change my email address
easy way to pay my ass
cosmic raft
lmao
pulsar wigeon
kashike what are you making ๐
can't just ask me to help name and then not fill me in on the juicy deets :<
cosmic raft
yeah
pulsar wigeon
gl on the interview (โแดโโฟ)
cosmic raft
thanks :D
limber knotBOT
this guy has been going around fucking with big servers https://www.youtube.com/channel/UCr1EYQYUZsBLXG149KnqpOQ
i wonder what the exploit is, maybe infected jar?
pulsar wigeon
probably just found some admin account password
wide hazel
there's a few different ways
pulsar wigeon
you can download 10 million username/password combos in about 30 seconds with a google search
find one that matches a minecraft account
boom, you're in
pulsar wigeon
right
limber knotBOT
pretty sure mojang has a limit on brute forcing
brute forcing is retarded in 2019
pulsar wigeon
so would using different passwords on different accounts
instead of sharing your passwords
but you know, people aren't very security focused
most people*
wide hazel
more common ways include the whole "book command" thing that happened several times
infected jar, but less likely
improper bungee setup is the most common I've seen
100% most common way is improper firewall/bungee config
only thing 2FA+ wouldn't save you from is a bad/backdoored plugin since that could theoretically remove the plugin and restart the server
though that would be very difficult
cosmic raft
multiple usernames barty
wide hazel
yeah
too damned many
actually the entire reason 2FA+ exists is because the network I ran got pwned by a bad firewall rule
someone else opened a MC port and forgot to close it, didn't tell me they did
limber knotBOT
did it affect your sales?
wide hazel
dunno
I just did the technical stuff
network
so, bungee
ie. offline mode server
yep
logged in as one of the owners
thus, 2FA+ was born
we had backups at that point
completely restored the server and undid all damage in less than 10 mins
also half our mod team was on, including myself
so
that ended quickly
but yeah, the most common I've heard about was a bad firewall rule or bungee config exactly like that
which is why 2FA+ exists, why hasn't everyone downloaded this yet ๐
well
pulsar wigeon
because you keep shoving it down our throats
wide hazel
I mean
pulsar wigeon
๐ฎ
wide hazel
I wrote it, so yeah, but I don't make plugins that suck
cosmic raft
is there a performance difference between using an interface vs a concrete class? I seem to recall someone saying that simple field getters (Foo getFoo() { return this.foo }) get inlined or something
when accessed via the concrte class but not an interface, but can't find where I could have read that
cosmic raft
you know the answer wiz?
wide hazel
rip
wide hazel
my plugins force-quit after a max of 8 seconds
pulsar wigeon
and a default getter?
wide hazel
usually shuts down well before then though
pulsar wigeon
tbh i stopped paying attention to a lot of java internals right around java 8
so the internals of streams api and default interfaces are still a bit unknown to me
but hey, i became a full time c# dev in the meantime, so if you'd like to talk CLR/CIL to me, feel free
cosmic raft
no i mean
interface A { Foo getFoo(); }
final class B implements A { private final Foo foo; public Foo getFoo() { return this.foo; } }
void thing(final A a) { a.getFoo(); }
void thing(final B b) { b.getFoo(); }
I seem to remember someome linking something that says that passing B around has a performance increase because the getter is known to hit the field always
upper flicker
Pretty sure it depends on the inheritance
cosmic raft
i just can't remember where I saw that
wide hazel
could take a look at the bytecode for it
static badge
I don't see a reason for the jvm to choke
pulsar wigeon
bytecode isn't everything
static badge
yes they will use different calling instructions
pulsar wigeon
could look at the jitted assembly for it :^)
upper flicker
ie one single impl should get JITd but I have heard itโs slower if you have many impl
wide hazel
bytecode would be a good indicator, but yes the assembly would tell all
upper flicker
No idea Iโd thatโs still the case
static badge
that's correct z
pulsar wigeon
yea might be something like an invokevirtual vs invokestatic
static badge
it becomes a virtual function invoke vs a a direct one
pulsar wigeon
i don't remember this shit
wide hazel
I mean, at that point the term "micro optimization" doesn't even begin to cover it, so I'd have to ask "why?"
cosmic raft
so there is a very slight performance difference, then?
yes, just remembered reading this somewhere and have been trying to find it
a conversation somewhere else was mentioning something similar
and i wanted to link the article/etc
static badge
I haven't been able to test exactly the performance between a virtual function invoke and a direct one
the problem with the direct one is it gets inlined and removed
static badge
yes it turns out the JIT removing the code you're trying to benchmark is an issue
wide hazel
yeah ๐
static badge
there is a threshold though
wide hazel
"well, it's technically faster!"
pulsar wigeon
here kashike https://i.imgur.com/pGbdg89.png
it's invokeinterface vs invokevirtual
i was close :^)
static badge
it is a good patch
wide hazel
it's probably a good patch
static badge
get... is used literally everywhere
wide hazel
just never thought I'd see the day that patch was needed
upper flicker
Supposedly it has helped a lot on the tiny arm soc setups as well
static badge
ofc it did arm is god awful 
upper flicker
Have gotten some comments on that
wide hazel
god help us all.
upper flicker
Not that you can run 1.14 worth a shit on any of them anyway
Given how poorly it runs on x86
static badge
the only person I saw do it in here had watchdog timeout to like what 200+
acoustic basin
can someone help me disable the server max tick timeout thing? my server keeps crashing from it
paper #95 i think
I set max-tick-time to -1 in but it wont work
fallen oracle
Hey does anyone know where to find the gif of the kid falling asleep in class and he dreams he's falling and then he wakes up?
wide hazel
every time I look at the redstone changes for 1.14 I nope the fuck out :/
cosmic raft
set it to 2147483647
acoustic basin
ok
server.properys yes?
im in Intel(R) Core(TM)2 Duo CPU E8500 @ 3.16GHz
if that matters
cosmic raft
actually
set it to 0
i get this one confused with another, this one is 0 to disable
wide hazel
โข
static badge
egg's way of making a retarded meme
wide hazel
I try sometimes
acoustic basin
i tought -1 was to disabe eavrything
but i guss not
thanks
my server cant run without this amazing fork of spigot :D (it littrally wont load the chunsk without suffacating players in walls without it)
i have a suggestion btw, you should add a option to disable tnt from explodeing
wide hazel
plugin/Skript thing
void void
anyone know a plugin like you open a chest with key and you get random item?
for 1.14.2
stiff yarrow
that might be the plugin that I submitted a PR to update them to 1.14 
cold pollen
sand vale
cold pollen
Hello! I'll try my very hardest :)
brazen barn
This isn't paper related in the slightest but Idk where else to ask.
On some Discord servers there are images at the top of the channel list. How do you set that? I'm not seeing any image upload spots in Server Settings otherthan the icon spot.
cosmic raft
verified guild
cosmic raft
you're in a guild right now
guild is the real name for what the discord user interface calls a "server"
limber knotBOT
can someone explain to me how bungeecord admin exploit works?
lets say firewall rules are fucked, what does the exploiter do?
cosmic raft
simply logs in with an admin's name
limber knotBOT
if firewall rules are in place it stops at logging in?
cosmic raft
can't reach it to even try to login
limber knotBOT
connecting just like normal ''ip.address:25565'' ?
since its a bungee
should server be pingable if firewall is setup properly? (in minecraft client)
if bungeecord is setup properly, should the server return "If you wish to use IP forwarding, please enable it in your BungeeCord config as well!" when youre trying to connect directly?
or should it not even ping in minecraft client?
merry talon
if your firewall is configured properly, you should have no connectivity to the backend server
merry talon
private networking
wide hazel
@meager perch took me a bit, but finally got to fixing that issue
https://jenkins.egg82.me/job/egg82/job/AntiVPN/job/add%252Fcommand/
also slightly experimental command config thing
optional "run command for VPN user" thing
(works on my end, but you know how that goes, so let me know if it breaks)
fresh ermine
limber knotBOT
(DiscordBot) โ@Tesla (Tesla): Your next charging session is going to be SO ๐ MUCH ๐ FUN ๐ https://t.co/5YzSL36kCC (11 hours and 36 minutes ago)
heady spear
I like the bot because it posts the video a second time
so you get to watch it twice
very useful
wide hazel
just in case you missed it the first time
wait wait wait
why is there a game console in the front of the car, with the driver controlling it?
is it April 1st already?
I assume it's a metaphor or something
native thunder
I think it's real
wide hazel
can't be, that would be beyond stupid
native thunder
It'd be a tesla thing to do. Make a racing game for you to play while charging
native thunder
What'd be even funnier is playing a racing game while it auto drives
wide hazel
(if you can't afford a $250 game console what are you doing with a Tesla?)
also, that's like watching a movie on your phone as you're charging it
sure, it'll charge, but I mean
wide hazel
isn't the point of playing a game inside the Tesla precisely because you're sitting there, presumably in some parking garage, bored?
I just dunno why you'd waste time and charge on a game is all
(at least charge on the Tesla)
fresh ermine
wdym "charge on a game"
wide hazel
as in, power
eh, I don't get it
just buy a Switch if it happens that often
play real Mario Kart
enjoy other games
don't risk accidentally throwing the car in reverse as you're playing
wide hazel
it probably does
but you gonna bet your life, someone else's life, or the car on that?
wide hazel
cars in general are insanely dangerous
fresh ermine
teslas are insanely safer compared to normal cars
wide hazel
"it's the least-sugary candy I could buy!"
fresh ermine
its pretty dumb to downplay just how much safer roads would be with teslas lol
they are smart cars
the most dangerous things about a car is the human controlling it
stiff yarrow
automated driving in general has the potential to drastically reduce the dangers of driving if it were heavily adopted I think
wide hazel
I play games on my PC and drive in my car. I don't play games in my car, and I don't drive on my PC
tool, meet job
fresh ermine
automated driving will not only help that but pretty sure theres studies that it would reduce traffic a shit ton also
because that is also caused by human error
wide hazel
the most dangerous thing about cars is the person driving it, and apparently playing games in it while behind the steering wheel, controlling the vehicle
wide hazel
who knows
fresh ermine
uhh them, because its designed that way?
wide hazel
all I see in the ad is someone controlling a game with the steering wheel of a street-legal vehicle
wide hazel
safety-precautions or not, I'm not a fan
just because something's safer doesn't mean you can use it like an idiot
fresh ermine
also its not like they also have a perfect test crash rating or anything
fresh ermine
thats completely downplaying the significance of how safe a tesla is
cars wouldnt be so dangerous if humans aren't behind the wheel controlling it
wide hazel
self-driving cars are great because the computer is generally a far superior driver to a human
but
still a car
fresh ermine
its not like any other choice is viable lmao
wide hazel
they could.. Not add a game into the car?
entirely do-able
they already did it, in fact
fresh ermine
they already had entertainment options actually
only accessible in park mode but yknow
"dangerous"
native thunder
What a thing to be outraged by
wide hazel
not a fan of those either
fresh ermine
literally like any other car with a screen
were you in a rage when those car dvd players showed up
wide hazel
I'm not "outraged" - just concerned. I stated my reasoning
native thunder
Actually those are pretty dangerous
native thunder
Distracted drivers are super dangerous
fresh ermine
those were only able to be used in park mode also
iirc
at least in my last vehicle that had it
native thunder
Not talking about teslas. Cars in general
wide hazel
not a fan of anything that has potential to seriously distract a driver
car radio? Fine, just don't screw with it too much while driving
TV? lolno.
I'm fairly certain this whole "game in the parked car" thing is fine, but I'm still concerned because it's still a car and there's a distracted person behind the wheel
that's a safety-net removed
fresh ermine
in a car that can't move
wide hazel
hopefully can't move*
fresh ermine
what do you mean, literally go to any article
it clearly states
it only works in park mode
fresh ermine
tesla vehicles already have a shit ton of precursors for humans to not be distracted, included weighted steering wheels
to sense if a person is actually touching it
fresh ermine
they are literally most likely one of the safest cars someone could get?? of course it has safety nets, its a smart car. you are acting like this one thing is showing they don't but you aren't even accepting the fact that it only works in park mode lmao
limber knotBOT
(DiscordBot) Why Tesla's Model X Was The First SUV To Receive A Perfect Crash Test Rating - length 3m 3s - 94,433 likes, 8,368 dislikes (91.9%) - 10,905,917 views - Business Insider on 2019.01.18
fresh ermine
they not only have computer built safety features
its completely built up to be safe
wide hazel
yes, I hope that the game only ever works in a parked mode, and that parked mode doesn't fail
but why risk it?
Switch, $250
fresh ermine
same distraction
wide hazel
better than hands on a steering wheel
wide hazel
yeah, I'd also hope that someone doesn't play their switch while driving
same hope, really
fresh ermine
id also hope if someone notices that their car can move while playing a game in their parked tesla theyd stop playing
wide hazel
still the same hope
fresh ermine
your solution isn't any better then lol
wide hazel
just dunno why anyone would risk otherwise is all
fresh ermine
because charging your tesla is boring and was obviously something that needs attention too
wide hazel
not really a solution to a problem that.. Does this problem actually exist?
people bored while parked, charging?
fresh ermine
yes the problem of being bored at a charging station is completely exists
fresh ermine
sitting on your phone for a while gets boring too, plus if youre in a place with no service
ยฏ_(ใ)_/ยฏ
fresh ermine
why spend money on a switch when you have a few fun games and things like netflix and hulu in your car
wide hazel
part of me is confused as to why they thought it was necessary
wide hazel
"yes, let's remove a possible safety net because ยฏ_(ใ)_/ยฏ"
eh
sure
fuck it
it's probably fine
probably.
wide hazel
I wouldn't bet on people not being dumb
fresh ermine
good thing teslas literally have measures to stop idiots from being idiots
wide hazel
you'll always lose that bet
fresh ermine
computers can always overpower people
wide hazel
then they just invent better idiots, really
"that's the problem with idiot-proof stuff. Just invents better idiots."
not an exact quote
but goddamn does that ring true everywhere I look
limber knotBOT
ok I just found the single most inappropriate amazon search result
pack it up boys this is it
wide hazel
yeeeeeeeeeeeeeeeeeesssssssssssssssssssss?
limber knotBOT
I was looking at dice cups
a "realistic" mouth fleshlight complete with a detailed throat showed up
for some reason this product's name is "sex dice masturbator cup"
hoyl shit this amazon seller is the best
neck massager - it's a device for ball torture, what in the absolute fuck
I should probably report this to amazon
wide hazel
hahaha
limber knotBOT
I can't link the product but the name is sufficient, here's the full name under which it's listed
actually you know what I probably can't say all of these words either
Massagers for neck and back male egg squeeze scro*** clamp ball crusher bondage scrotch torture chastity poison for men toys enjoy love shirt
that's one name for one product
this is maybe the stupidest way of doing SEO
limber knotBOT
man amazon has some weird shit
wide hazel
I'm like 80% sure you've just introduced some 12-year-old kid to the wonders of the internet
wide hazel
enjoy, 12-year-old kid. Enjoy.
limber knotBOT
the best amazon products
if it makes you feel any better they probably won't find the product
it's not in the US store and I just reported it so it'll probably be down in a few minutes
wide hazel
I'm also pretty sure 10-year-olds these days know Google exists
aaaand now I'm on a list.
static badge
ur face is a list
limber knotBOT
hm there's not a wealth of dice cups in the DE amazon
static badge
those effects are awful
wide hazel
think I see your uncle up there
limber knotBOT
it's not fair that the US amazon consistently has cooler shit for much cheaper
this is really stupid but I might just import it from the US
spiral bane
cosmic raft
my face smells nice
limber knotBOT
are you tempted to eat it?
cosmic raft
no
limber knotBOT
can't smell that nice then
vestal jasper
exfoliation I read that as exploitation at first
fallen oracle
What's up people
limber knotBOT
hello
I am a Chinese, I want to add Chinese comments to waterfall.yml.
Where is the explanation for this document?
carmine tundra
limber knotBOT
can someone help me with this error i got
cosmic raft
is what
limber knotBOT
Mfw we found a bufferoverlow + remote code execution that affects all modern websphere versions
It's exploitable by entering stuff into our site search ๐
acoustic pilot
no u didn't, ur 2 dum
limber knotBOT
But it affects all our websites and applications
cosmic raft
you referring to CVE-2019-4279?
limber knotBOT
MiniDigger: ^
Ye, my boss just found that
\o/
So it's patched after all, strange
I thought we were on latest
NOPE
Not my problem ๐คทโโ๏ธ
My applications run on spring ๐
And we are migrating our main website to my application, it's going to prod in 2 months ๐คทโโ๏ธ
nice \o/
I like how the guys that found the cve PRd an exploit into metasploit, lol
worn ember
Delete the server
thorn summit
limber knotBOT
oh I wish I could delete the server
also, turns out its not CVE-2019-4279
its way simple
its an overflow in the jsessionid
and something todo with how clustering works
so more like CVE-2008-5457
worn ember
๐ค
vague nebula
limber knotBOT
sadly I am not directly involved with any of that
heavy rapids
oof gitlab api doesn't support setting up push mirrors
finite wave
Were is nossr
Where*
@stiff yarrow What the hell is up with anime and โpervertsโ it seems all the boys end up running into naked girls that falls for the boy immediately?
It seems weird
Like, i wanted to see some of these shows when i had nothing else to do, but apparently they are all about molesting women?
Like, what is this
What even
Also seems like everything is about super big breasts
void void
Is there a software to view the diff between two project folders easily ?
golden gust
Yes, just search for any of the dozen diff tools for your OS
golden gust
limber knotBOT
(DiscordBot) Anri Kumaki - Hello Goodbye & Hello - length 5m 6s - 8,280 likes, 56 dislikes (99.3%) - 743,292 views - Viแปt Huแปณnh on 2011.12.09
void void
@golden gust Found WinMerge
@cosmic raft โค
@golden gust if I have a copy of a whole git project with all the branches, how can I reimport all the branches to a new github project ?
I always only get one branch to push
should I switch and push each branch or there's a easy solution to this ?
golden gust
void void
woo
void void
worked, thanks
craggy trench
void void
hm
in Minecraft discord
there's Tree Puncher role
what's that for and how people get it?
apparently i have that role
for no apparent reason
void void
fair
limber knotBOT
@egg2, no but it looks related
we don't use weblogic
MiniDigger: where do you work?
top 5 german insurance
pulsar wigeon
time to start trying exploits on top german insurance sites ๐
limber knotBOT
we filtered it via our waf now
pulsar wigeon
tbh even if one didn't find yours, there's probably other issues out there
web security ๐ฎ smh
heavy rapids
Woo! Finally I've got a script to setup git repos from the command line.
heavy rapids
so I don't have to leave the CLI once I begin git init
pulsar wigeon
doesn't gitlab allow you to create a repo just by pushing
limber knotBOT
insurance
heavy rapids
I don't know
limber knotBOT
Explains why using websphere in <current_year>
graceful wyvern
github also has a hub cli which does that and some more
heavy rapids
there might be, but I also have the script automatically setup webhooks
so I'd need the script regardless
limber knotBOT
we are migrating all legacy stuff to jboss and all the stuff I maintain is on spring wizardfrag :D
pulsar wigeon
i use a private instance of gitlab and pretty sure i have a setting that just lets me push to a non-existant remote and it will create it
limber knotBOT
nice :D
Although I must admit I'm so pleased I don't use java in my day job :P
what do you do?
I use Elixir/Go
I created an app that interprets json and outputs html/css/js :D
For a UK online gambling company :P
Isn't that all apps lately? :P
and I was feeling bad for implementing gtm, lol
we hacked a json exporter into our legacy cms
that was fun
heavy rapids
mh, gitlab.com doesn't seem to have that setting
limber knotBOT
if its only in ee it was say so
pulsar wigeon
yea just wanted to clarify
heavy rapids
sweet
now I know that I need to take care when typing in remotes
otherwise I'll have 3 repos consisting of typo'd remotes
old drum
is it possible to set a spawnpoint where you go everytime you log on?
Like what plugin do i need?
fallen oracle
Probably a custom one
heavy rapids
@old drum kinda old
finite wave
Why though
fallen oracle
Man, I love linux so much. Switched to it full-time and I have no more internet issues or pc freezing.
strange bane
Were you using macOS before?
fallen oracle
No, W10.
strange bane
Hm, that doesn't sound like Windows.
strange bane
Hm, what do you mean by internet issues?
fallen oracle
The DNS was deeply fucked for some reason. http would quit working for a few seconds every few minutes.
PC itself would freeze for a few seconds, etc.
Multiple times an hour.
strange bane
Ah, not my issue. But I think my issue is ISP related not Windows-related.
strange bane
lol
wide hazel
it's in the Anti-Patterns Wiki page
wide chasm
Yes. I've actually had problems with that before. Two plugins using the same library, which make calls to Material, one has set api-version to 1.13, one hadn't, enjoy the show.
heavy rapids
oof
fallen oracle
That's why you relocate (:
wide hazel
who needs relocations when you have a child-first ClassLoader?
wide chasm
I did for one, the other one was just testing the library, so I didn't there. But I got a bug in my program and I wanted to debug with IJ, but it doesn't support relocations. "I'll just disable the relocation for now, debug it, and then put it back in". That was a terrible decision.
wide hazel
that's my anti-pattern solution this this anti-pattern
@wide chasm Child-first CL ๐
wide chasm
I just used Bukkit's classloader, I didn't change everything in ways that I suddenly used a different classloader.
Also, I don't think Bukkit likes it if you change the classloader. Tried it before, had to use a bunch of reflections additional constructors and whatnot before I got somewhat close to making it work.
wide hazel
use your own CL, don't replace Bukkit's
if you replace Bukkit's CL I and everyone else will murder you in your sleep
old drum
can you use bungeecord with ngrok?
wide chasm
stops sleeping
brazen barn
@twin lagoon probably best we continue down here
twin lagoon
i've been using linux and windows as a dualboot for 3 years now or so
so updates & system maintenance isn't really a thing i care about anymore
though i have reinstalled windows 2 weeks ago or so
brazen barn
Certainly you have forfeited your right to complain about instability then if you're not maintaining half of yoru system
twin lagoon
and now i keep windows updates on
i don't use windows a lot nowadays
only boot into it every 2 weeks or so
so there's barely any system maintenance to be done
brazen barn
I boot into it whenever I need to do work on D&D stuff as my art program isn't available on Linux and I'm not into Wine
so about once a week or so
Still make sure updates get done and old update files get purged.
Clean up missing registry paths/keys every month or so from installing/uninstalling things
twin lagoon
i don't care about windows enough to do that anymore
brazen barn
which reminds me I need to do a paccache today
twin lagoon
though i'm also having some issues with gnome here and there
maybe i'll switch back to macOS once I upgrade my PC
brazen barn
xfce is a nice de I used for a while. Switched to KDE when I decided I wanted more eye candy though
potent warren
brazen barn
you're literal first person I've ever heard talk highly of gnome
twin lagoon
it's not like i'm extremely satisfied with gnome either lmao
most people tend to hate it though
i just like gnome's design / applications
and they've been improving lately, memory leaks fixed, animation performance fixed etc
brazen barn
You could spin up your own custom de.
Take the elements of gnome you like, kick out and replace the poorly performing bits, customize here and there
brazen barn
Didn't I see the Arch logo on your taskbar?
twin lagoon
i do use arch
brazen barn
all the knowledge is there in the wiki for the taking
vestal jasper
Idk what server it's from
cedar spade
vestal jasper
Can just steal it
brazen barn
how?
vestal jasper
Save and upload to own server
brazen barn
yeh
native helm
Anyone good at decompiling plugins want to help me determine if 2 plugins I have are malicious?
They aren't the same plugin but they're obfuscated in the same way and are both on servers that appear to be sending ddos attacks
cedar spade
I'm doing
hexed iris
using obfuscated plugins is for me already a big no no. this means they are hiding something. 99% its bad
native helm
One of them still exists on Spigot's site, the other looks to have been removed at some point
hexed iris
let me have a look
native helm
The servers in question are creating a ton of sockets at once all directed at the same IP/Port, I think someone's trying to make a botnet out of minecraft servers lol
vestal jasper
I just turned off my computer but I'll hop back on to help check 
upper flicker
turns off Vicariousโs cat
vestal jasper
wat is this obfuscation
native helm
Yea..
I'm pretty sure I can see where they are doing what I suspect though
Someone should probably get these off of Spigot
native helm
The other one was called AutoItemReload
I can't find it online anymore, same obfuscation, much smaller plugin
austere ivy
Closed source, already a bad sign. There are some like CoreProtect and HeadDatabase and they have closed source so it's not an instant ruling but you gotta be more careful if it is closed source.
vestal jasper
closed source and obfuscated free plugin from an author with no previous resources
native helm
We've had 3 nodes at work taken offline by the DC for bad traffic, need to come up with a way to find and remove these things
golden gust
You're saying that you have two plugins of which one is likely being bad, and one of them that you're suspenting as being the issue has been removed from the site?
*suspecting
austere ivy
Let me open up the source and see what it's doing.
native helm
2 plugins, both obfuscated in the same way on 2 servers that are both sending bad traffic to the same IP/Port, only correlation between the 2
1 removed from Spigot, 1 still existing on Spigot
vestal jasper
mfw luyten hates the jar and jdgui fails every other class
native helm
I can DM both of them to whoever is interested, just want to get it taken down from Spigot mostly
unreal quarry
Solution: stop using obfuscated plugins
native helm
It's not me using them, I work for a host, clients are downloading these things
hexed iris
Uhhhh..
austere ivy
Opening the classes with IntelliJ and I'll see what pops up.
hexed iris
not everything is decompiled
but i found something intresting
Its encrypthing something in AES
golden gust
lulwut
austere ivy
Encryption? Obvious hacker stuff right there jail 'em boys /s /s
native helm
It doesn't always target the same IP/Port so it's being controlled by something
limber knotBOT
(DiscordBot) ใใช / ๅ้ณใใฏ - Omoi - length 3m 31s - 27,960 likes, 192 dislikes (99.3%) - 2,049,318 views - Omoi [Official] on 2017.07.08
austere ivy
vestal jasper
native helm
https://pastebin.com/raw/bJadctBc Came from a thread dump of the server running it, not sure if helpful?
austere ivy
excellent plugin design right there, blank class names
"So where's the error coming from"
"uhh I think it's 4 blank lines? wait no 3"
vestal jasper
ik you're baiting but it's obfuscation brian
austere ivy
Yeah I'm kidding it's sarcasm
static badge
that looks sketchy af
native helm
I don't plan to use it lol, I just want people to stop downloading it
I don't know who to contact to get it off Spigot
austere ivy
I just reported it.
golden gust
Use the report button
vestal jasper
below the plugin description there's a report button
austere ivy
For something so simple as a death plugin it's not worth using a closed source plugin.
vestal jasper
it being closed source doesn't mean much
hexed iris
I reported it as well
vestal jasper
the high level of obfuscation for a free and "simple" plugin is sus though
native helm
Yup, just found the AutoItemReload one on the 3rd node we had issues with, same obfuscation and weird encryption stuff
Guess it's been going around for a little while
native helm
All 3 of the ones I've found share the same class that contains the Socket creation and encryption stuff
austere ivy
I'm not paid enough to understand this. Just don't use the plugin lol.
Don't forget to subscribe and SMASH that report button.
potent warren
That obfuscation lol
native helm
I'll report any more that I find, now to get OVH to unblock our servers
peak dirge
mongodb doesn't have joins so it's fast
mongodb adds joins
proof mongodb is a meme
wide hazel
after reading through it multiple times, we've figured out what that says
"it's a left join."
heavy rapids
malicious ddos plugin
And that's why the only public plugins I use are WE/WG, Vault, protocollib. ._.
peak dirge
@heavy rapids My server is on the road to flat-out forking a bunch of public plugins. Already did it to ProtocolSupport.
So we can make its 1.12.2 performance not totally crap
peak dirge
Yeah, Shevchik's policy is to base on the latest version of Minecraft, but the horror stories of instability and performance issues in 1.13 and 1.14 have made us wary of moving past 1.12
1.12 is a good, stable release, just needs some TLC to make it really shine
peak dirge
So we wound up forking Paper to add performance enhancements and stuff
heavy rapids
I still fear the day I'll not be able to stall the update any longer
performance enhancements specifically related to your use-case?
peak dirge
some backported fixes, async lighting smuggled from Sponge, and EigenCraft redstone stuff smuggled from Paper 1.13
heavy rapids
ah, nice
the one thing I'll probably need to do is implement async pathfinding for my NPCs
right now they use a zombie with overridden goalSelector
but judging by all I've heard so far, pathfinding in 1.13/1.14 gets worse
peak dirge
we essentially run a bunch of small creative-like servers anyway, so we need it
heavy rapids
mh interesting
https://github.com/PaperMC/Paper/issues/2206
probably using side-channel attacks, e.g. timing? ๐ค as far as I'm aware there's no "newly generated" flag in the protocol
nvm
wide hazel
https://i.imgur.com/IUZ7Ts6.png
https://i.imgur.com/5RaLF2D.png
https://i.imgur.com/N9XEfym.png
https://www.youtube.com/watch?v=bmkY2yc1K7Q
limber knotBOT
(DiscordBot) ใใช / ๅ้ณใใฏ - Omoi - length 3m 31s - 27,963 likes, 192 dislikes (99.3%) - 2,049,611 views - Omoi [Official] on 2017.07.08
fallen oracle
@wide hazel What's that from?
wide hazel
the plugin
vestal jasper
the obf'd plugin brought up earlier
wide hazel
the malicious one linked earlier
pulsar wigeon
o boi some vocaloid
vestal jasper
I like how all of the booleans are just xor'd numbers
if (!bl) return false;
return true;```classic
heavy rapids
mh, what does the plugin do with the URL?
native helm
http://update4life.xyz:8080/ just returns ่ชๆฎบ which translates to suicide, nice
wide hazel
it creates a secure socket connection
so would be HTTPS somewhere
ZipInputStream -> CipherInputStream -> Socket
native helm
update4life.xyz:666 sends a ton of what seems like encrypted data to me
wide hazel
eyy
pulsar wigeon
lost needle
vestal jasper
Well since I need to stall me sleeping as long as possible
Slowly chipping away at the obfuscation
wide hazel
looks like it's not a zip file, but a jar file
it downloads the jar, opens it unsing zip, then loads the main class inside it and invokes the main method
jar/download is encrypted with AES
not HTTPS, but the download itself
void void
nice
native helm
I want to know why anyone would put this much effort into this sort of thing
vestal jasper
I'm starting to get some idea on how it works tho
The fuckery the obfuscator did that is
wide hazel
I jumped on the bandwagon of reporting the plugin
if anyone wants a copy for analysis, get it now
don't run it though
native helm
I have the other one that is even smaller of a plugin
wide hazel
other one?
pulsar wigeon
easy deaths?
wide hazel
yeah
native helm
EasyDeaths is one, AutoItemReload I found to be another that is no longer on Spigot
wide hazel
neat!
looks like they used to be legit
authors are different too
"EasyDeaths plugin by PinkNeonDino"
native helm
I'll DM you the other one if you want it
wide hazel
on plugin load
native helm
Can probably block these plugins by redirecting domain with hosts file then I guess?
native helm
Again, it's not me running them
native helm
Server host, trying to prevent clients from getting our servers flagged
pulsar wigeon
oh you're a host
native helm
Yea, had these things on 3 machines so far
pulsar wigeon
hosts file would require you to be ahead of the curve
you could in theory go the opposite way and have a whitelist-only firewall
might be annoying tho idk
and i mean
technically they could store their malicious jars on a reputable site
stuff like update checkers usually go to github or w/e
native helm
Yea, not sure why I thought Spigot had some sort of screening process for plugins
Guess that would be hard
vestal jasper
If you want access to 1.13 materials you need api-version set to 1.13 or 1.14
Having api-version set to 1.14 prevents it from being loaded on 1.13 servers
pulsar wigeon
it wouldn't be "hard"
dbo has it
it's just..more work than not
even a basic "does this look suspicious as fuck" screening would filter this out
like, this is automatic ๐ฎ
wide chasm
dbo โค
limber knotBOT
(DiscordBot) Marilyn Manson - The Beautiful People - length 3m 47s - 835,532 likes, 52,037 dislikes (94.1%) - 156,345,453 views - MarilynMansonVEVO on 2009.10.06
pulsar wigeon
did anyone find out what the jar it downloaded was