I call BS
#general
golden gust
minor badge
(sorry kenny)
golden gust
I do not believe that proxi has friends
minor badge
:(
potent fossil
proxi has no friends
quick orchid
Yeah you obiuslly never played practice if you said that> i can punch my friend in mc 1.15.2
@minor badge
minor badge
WE're friends cat!!
potent fossil
but proxi has family
minor badge
i dont care nort
youre part of the problem if you dont wanna push the community forwards
minor badge
the more important your code is to the product, the larger part you are :)
minor badge
good night simple
potent fossil
what
minor badge
good night simple
quasi valley
we sneakily did https://github.com/LuminuNET/LumiPaper/blob/master/patches/server/0007-Old-combat-mechanics.patch and https://github.com/LuminuNET/BukkitOldCombatMechanics/tree/master/src/main/java/kernitus/plugin/OldCombatMechanics/module with 90% 1.8 users on a 1.15 server, and people didn't even notice it was 1.15 =^]
quasi valley
OCM absolutely sucks ngl, it's a shame it's so awfully popular
golden gust
tbqh, you can fix some of the aspects already
quasi valley
so I threw pretty much everything out into patches 10% of the size
golden gust
The real issue is stuff like the client behavioral state
e.g. you can tell the difference between the two clients just by jumping around
quasi valley
unpopular opinion; nobody will notice if you don't tell them it's 1.15
quick orchid
Oh Im not saying that we dont need to go forwars, but backwards there is a community that needs features from the old versions to exist, a pretty big very very comphetitive community, with a lot of youtubers and players
And people are not understanding anything about this community until they join it and enjoy from it and understand its mechanics
In the end people dont like change and its easy to just stick to latest versions as a developer
But I enjoy both worlds
Its annoying that old versions are unsupported when it comes to mappings, but I found stuff that are just more fun to code for 1.7.10 and 1.8.8
Then on 1.15.2
golden gust
the intent of the game is to have fun
haughty bear
You aren't gonna force a large part of the community to 1.15 just by saying "update lol"
golden gust
pvp is 100% more fast paced in those older versions
Which, is like, what works for them; At the end of the day, so long as they're not running in here crying for support, it's π€·ββοΈ
haughty bear
If they like 1.8, they're gonna stay on 1.8, and if your server updates to 1.15+ only, they're gonna move to another server with 1.8
minor badge
dont they all use mods like 5zig or whatever too tho? surely a mod could just,, revert the client changes
golden gust
Mojang was having a discussion about combat recently
I was dead when that was going on through
potent fossil
think im gonna sell my macbook for whatever i can get for it and by a nice system76
quick orchid
@golden gust I agree its a nice way to say it, and yeah they are not running here crying for it, they actually develop their own spigots and clients
quasi valley
they were just collecting feedback, no news were brought on
quasi valley
haughty bear
Yes.
heady spear
stop bullying people
quasi valley
let's bully city
heady spear
be nice and friendly and loving
haughty bear
Programmer trial by fire code review
heady spear
stop being a nerd
potent fossil
@heady spear kiss welcome home, honey how was your day at the office
heady spear
it's embarrassing for your soul
quasi valley
wow what happened to being loving city
heady spear
I love myself
heady spear
anyway
potent fossil
quasi valley
student life is when you write code for your arduino without your arduino working
so I actually had to make sure stuff worked on a theoretical level without powering it on every 2 seconds and had to send it to the instructor so he could test it for me 
potent fossil
guys
i want to fucking MURDER node-sass
thing needs rebuilt every 5 fucking seconds
potent fossil
drop in?
minor badge
no clue
potent fossil
.g sassc node-sass
limber knotBOT
(DiscordBot) https://sass-lang.com/libsass -- LibSass - Sass: "LibSass. Wrappers. SassC; Crystal; Go; Java; JavaScript; Lua .NET; Node; PerlΒ ..."
minor badge
i tried node-sass like a year ago and found it sucked ass so sassc was available and easy to use
quick inotifywatch + sassc loop in bash and it's worked epicly ever since
potent fossil
hmm
minor badge
cannot reproduce on a non-trash system .
woven otter
ewww a @potent fossil
quasi valley
ewww a duk
potent fossil
mfw i just designed a skeleton loader for some profile info
then realized hey
i should probably just preload this on fucking app startup
so
trashing that component
vestal jasper
ew
potent fossil
what
quasi valley
yeah ew
cosmic raft
spice finch
wide chasm
Only a couple people accepted the changes, probably should've waited for a bit more feedback /s
unreal rock
void void
no
wide chasm
This isn't the place to advertise your server.
latent valve
βΏ
void void
potent fossil
lol
unreal rock
@wide chasm sorry
unreal rock
@wide chasm im really sorry
latent valve
unreal rock
@wide chasm sorry i swear i wrote it by mistake sorry again
potent fossil
void void
oh my lord
void void
alright stop pinging
a lot of performance?
what are you doing
applying some weird ass complex regex on every character?
do blocking dns query too
just to be sure
is it just me or is your safechat thing kinda overengineered
it is
kind totem
frank pilot
minor badge
damn right
quasi valley
yeah I don't think too often either
void void
yes it can
1.1 is perfectly valid ipv4 representation
and 0
used by cloudflare atm
1.1 -> 1.0.0.1
0 -> 0.0.0.0
both cloudflare dns
holy shit look i'm a hacker
xd
i'll be throwing malicious cloudflare propaganda on ur serbur
yeah how could a normal guy understand the internet protocol v4 lol
literally what i said
0 -> 0.0.0.0
scroll above
and now let's get to that good old question...
are you making that plugin for yourself, or for fun and for free & others to use?
worn ember
no place like localhost amirite
void void
true
void void
what would y'all suggest for doing cross-server msgs
considering that network would consist of more than 1 proxy (this plugin messaging is kinda ruled out)
was thinking about redis
& pub/sub
twin lagoon
redis
worn ember
minor badge
i'd do redis
void void
it's an external service lmao
of course you can
if you configure it correctly at least
worn ember
doesnt it run on the same machine?
worn ember
usually its a good idea to not allow remote connections
void void
mineplex did
left swift
Nah who needs firewalls
little dove
worn ember
ahaha
void void
this was quite long time ago however
nowadays on such large servers shit like this shouldn't happen, especially given the possibilities what you can use to run your servers ;)
docker, k8s, or even idk your home cooked namespacing to prevent servers/services binding to outside internetz
limber knotBOT
This is why the default configuration on cloud environments is that nothing is accessible to the internet
weary frigate
void void
I did worked already with kubernetes in the past and I agree with mini but normall you can just have a bare metal firewall running just allowing 443, 80 and 25565
limber knotBOT
Not via software config for what you're deploying, they don't control or care about that
They just dump you on a private subnet and firewall off any public IPs you have so they can't do anything by default
void void
k8s is nice
limber knotBOT
I feel like an ex-Mozilla person must have been involved in kubernetes
void void
why?
limber knotBOT
They are the first people I can find (and usually the only people) who do that kind of shorthand
i18n, l10n, k8s
cedar spade
e10s
void void
tnt
quasi valley
eeeeeeeeeees?
left swift
Do u say k-8-s or k-eights
quasi valley
you say kubernetes
vernal moth
I just say kube most of the time
left swift
Never
void void
cube
vernal moth
Exactly
waxen panther
cedar spade
itens
worn ember
keights
void void
just cube if i speak about kubernetes
cedar spade
leighteenn
void void
leighteeen the greeen
quasi valley
I think md is having a stroke
cedar spade
*itenn
left swift
A whole new world has been opened
void void
xd
cedar spade
shut up I'm not having a stroke you're having a stroke
left swift
A world no one wanted
quasi valley
no u?
left swift
Discord zoomer
void void
With k8s, it's harder to secure stuff
more or less yeah
limber knotBOT
Discord is selling all your data to China?
void void
k8s wraps everything away and is overwhelming at times
limber knotBOT
Of course, it's Google tech
left swift
China
void void
and it's bit sad how much k8s is cloud-first
and your own hardware is 2nd class citizen
limber knotBOT
Things from Google make a lot of assumptions about how your stack works, require a lot of complicated setup, and have a narrow window of usefulness unless you put a lot of effort in to them
void void
so your option is either k3s or endless agony
limber knotBOT
Because they build things for Google
void void
since i use nixos then i had to pick latter option
vernal moth
I use just docker swarm for my private stuff
limber knotBOT
nix makes git look user friendly
void void
strangled this to get k8s usable on my machine: With k8s, it's harder to secure stuff
sec
limber knotBOT
Really really cool idea, worst user interface I've ever seen
cedar spade
"why use zfs when you could use ntfs"
cedar spade
me or amaranth
limber knotBOT
People always talk about using btrfs or zfs for their OS for the snapshot support
So they can rollback bad upgrades and such
void void
i use that to do minecraft server snapshots
minor badge
@void void stinky
limber knotBOT
But with nix that's built in to the software, no fancy filesystem needed
void void
been bragging about it here for a while now, lol
limber knotBOT
I'm waiting for https://bcachefs.org/ before I move from ext4
void void
"i use zfs to back up my shit wbu plebs"
proxi
who smelt it
dealt it
but ye, mc backups
vestal jasper
Love when enemies are all nice until you kill them and they then spend the entire rest of the match shittalking you and everything you do
fallen oracle
That's some good compression.
limber knotBOT
Main thing missing from bcachefs is snapshots :D
Otherwise it does checksums, compression, encryption, RAID, etc
Soon(tm)
void void
i'd use btrfs but sanoid does not support it
thought btrfs would make shit a lot easier
because you can actually make snapshots inside container without needing to touch host directly at all
while with zfs you need to mount /dev/zfs etc
limber knotBOT
bcache is a part of the kernel already, used for setting up SSD caches in NAS systems and such
This project is basically taking that code, which is already mostly a filesystem and has all these features, and making it a standalone filesystem
cedar spade
"but what's wrong with ntfs"
void void
cringe slow windows fs
limber knotBOT
iirc NTFS itself, at least with all the latest bells and whistles, isn't terrible
But it's really complicated so open source drivers don't support all those things and the Windows IO subsystem is garbage so the only complete implementation of it is tied to the worst place to do IO
gleaming rivet
Can somebody recommend a offline invsee/enderchest viewer plugin.
I once saw something like this, but I can't remember the name :/
void void
.g lishid openinv
limber knotBOT
(DiscordBot) https://github.com/lishid/OpenInv -- lishid/OpenInv: Open anyone's inventory as a chest,...: "About. OpenInv is a Bukkit plugin which allows users to open and edit anyone's inventory or ender chest - online or not! Features. OpenInv: Open..."
gleaming rivet
Sweet, ty!
unreal rock
Can someone come to my server
void void
no
unreal rock
why
worn ember
$50
worn ember
the tired programmers part is true
polar sonnet
Love getting fucking bruteforcced
void void
got rekt?
lol
that's what you get for using your favourite fast food name as a password
copper cairn
guys do you have any idea if the performance of 1.16 will be better for the servers?
potent fossil
just dont get rekt, easy
polar sonnet
Yeah I get that now
spice finch
brutforced ssh key 
potent fossil
should not be running a server under any circumstances with such careless attitude towards security
void void
why do people always have to learn it hard way
potent fossil
you're essentially saying fuck you to your players
polar sonnet
Its definately a learning experienc
potent fossil
i pity them
dense dock
lmao
void void
inb4 also uses plain old ftp
then leaked the root password over some public wifi or something
and then got rekt
polar sonnet
Whoever deleted the files is weird though
void void
if you use ftp then you also deserve getting rekt
waxen panther
polar sonnet
Not the folders themselves, but the data inside them
potent fossil
that means they ran a script :)
void void
no
potent fossil
no.
quasi valley
lmao
waxen panther
potent fossil
you got fucked. good job.
polar sonnet
I did indeed get fucked
potent fossil
void void
waxen panther
what are u gunna do
spice finch
who the fuck uses backups in 2020
polar sonnet
@quasi valley no shit
void void
potent fossil
"i just got FUCKED because i have no idea about security period whatsoever AT ALL"
polar sonnet
I cant even be mad just because of how retarted i was
waxen panther
polar sonnet
I will hax them
void void
with what
quasi valley
his tiny pp
void void
ping flood them?
waxen panther
boutta start knocking on doors in kenya π€
polar sonnet
My gaping butthole
I will shit in their mouths
Im hoping the backup I have is still sorta up to date
void void
gonna put the hacker into your ass
head first
ez
Hello there, I have a Minecraft Server (currently on Win10 Server), will performance improve by a large amount when going to use Ubuntu Server 20.04LTS?
polar sonnet
no
void void
.try
limber knotBOT
void void
pftw.
quasi valley
yes probably
void void
I used to run a server (1.14, first Paper build) with 20TPS on a AMD Athlon XII Dual Core
with 2 GB of ram
tip of the day is to follow good security practices
polar sonnet
need atleast 128gb now
void void
And now I am running windows with better hardware and performance sucks
listen what people say
polar sonnet
Your using windows thats why
void void
tip of the day is to follow good security practices
@void void i know
that wasn't for you though
That's literally the only reason why I have a Mac lol
but glad you know
polar sonnet
Install linux on it
void void
Because Windows is shit
no macOS works great
why I have a Mac
I'm lovin' it
mac does not protect you from getting viruses
polar sonnet
macOS is like a fancier linux
polar sonnet
SO just
waxen panther
I'm impressed
potent fossil
i love mac, but im going to sell mine soon
polar sonnet
I started it off dont worry
void void
macOS works great with my 50 EUR iPhone SE :)
quasi valley
it's because keepitfresh came back from holidays
waxen panther
void void
iPhone SE (2016) is great value rn
void void
$50 - $75 for pretty good hardware :P
waxen panther
Nokia Brick (1985) is great value rn
quasi valley
I'll take it if you give me 20β¬
waxen panther
$1-2 for pretty amazing buttons
polar sonnet
Ill give you atleast $2 for it dancing
waxen panther
u rite
polar sonnet
Typewriters are pretty good
waxen panther
Smoke Signals (unknown) are great value rn
void void
xiaomi gang , sorry
mega cringe botnet user
void void
you should shut up you got rekt
polar sonnet
shhhh
void void
by getting your root password bruted
tired heath
Hi, could anybody give me a tipp to understand my issue with GSON. Well I have on eplugin, what loads a previously stored json string (tojson) into an object (I store jumppads) like that. While the object model I use to export/import from/to json has a constructor with arguments (so when I create a new one, not related to Json, I can do it directly on "new" passing all it needs) β GSON imports this one without problems.
Now in another plugin, I use the same tojson/fromjson logic and I also have a data model to store some locations along with some other data. This object also has an attribute conatining an arrayList of spawn point objects. But in this case, fromjson will fail and skip exactly the attribute/memeber containing the spawn poin ArrayList (rest gets imported), as long as the constructor of the export/import object does not offer on version without any arguments.
Since it works, I could live. But I would be nice to understand why it does not care about the constructor in one version while it does matter in another one π
polar sonnet
holy sht
potent fossil
you realize we will literally never let you live that down, ever
polar sonnet
....
void void
lul
waxen panther
polar sonnet
nothing else except /home was touched
Which is kinda weird?
Would have expected them to literally go on a rampage but
limber knotBOT
I mean you have to do a clean re-install anyways so Β―_(γ)_/Β―
potent fossil
Hi, could anybody give me a tipp to understand my issue with GSON. Well I have on eplugin, what loads a previously stored json string (tojson) into an object (I store jumppads) like that. While the object model I use to export/import from/to json has a constructor with arguments (so when I create a new one, not related to Json, I can do it directly on "new" passing all it needs) β GSON imports this one without problems.
Now in another plugin, I use the same tojson/fromjson logic and I also have a data model to store some locations along with some other data. This object also has an attribute conatining an arrayList ob spawn point objects. But in this case, fromjson will fail and skip exactly the attribute/memeber containing the spawn poin ArrayList (rest gets imported), as long as the constructor of the export/import object does not offer on version without any arguments.
Since it works, I could live. But I would be nice to understand why it does not care about the constructor in one version while it does matter in another one π
@tired heath so in other words
it "ignores" the constructor in one, but in the other which has "Location" references it "doesn't ignore" the constructor
tired heath
yeah looks like that
potent fossil
Location
it has a World reference
which has a Location reference
which...and so on...it's circular. think we went over this earlier today
it enters an infinite loop
the solution is a type adapter
tired heath
na the location thing got solved, I split it up into single values of floats and doubles, it will not use the location in the from/to json at all
tired heath
one mom.
polar sonnet
YoUr GoIng To StEaL mY cOdE
potent fossil
shut up Guy Who Got Fucked By A Kenyan
left swift
What did I miss holy shit
left swift
potent fossil
i really want Hello Games to fix controller support in NMS VR
tired heath
So baiscally this are the relevant code parts,
ArenaDataStorage contains a ArrayList of ArenaSpawnPoints
Export to Json works fine, when I than use load (from json) and ArenaDataStorage has a contructor with no arguments, it imports the Arraylist of ArenaSpawnPoints just fine, as soon as I do not provide a constructor without arguments, even when one what is assiging all values, it skips the Arraylist.
https://pastebin.com/ZDdyHsmC
potent fossil
the day that happens goodbye because ill have literally no life
that is, outside of NMS
tired heath
So it works, I just wanna understand why it makes a diffrence
polar sonnet
clicks ph ad
void void
ph ad
polar sonnet
no ban for me
quasi valley
mikro doesnt see them, he obv paid for premium
void void
those are mostly from b, 2nd b or ph itself
slim nymph
you def shouldnt be keeping that box, rebuild it
potent fossil
@tired heath so whats the loading code that works and whats the loading code that does not work
void void
smh
polar sonnet
@slim nymph ik
void void
no kenny they want cc :(
quasi valley
ooo
polar sonnet
Maybe someone on their can help me fix my machine
void void
wouldn't have my name there
polar sonnet
install teamviewer
tired heath
Basically removing
public ArenaDataStorage() {
}//end ArenaDataStorage
will always lead into skipping of the Arraylist, no matter how the other constructor veriations look like
polar sonnet
Duh
slim nymph
you dont fix a compromised machine.. you nuke it from orbit
quasi valley
thought the same lmao
slim nymph
you think they only touched one folder
polar sonnet
Ik they didnt touch just one
potent fossil
limitation of gson
slim nymph
but prob their fun secret waiting somewhere else
polar sonnet
It would be stuiped to not fully nuke it
potent fossil
its just how gson works
tired heath
So that question is not, why does it fail here, the question is, why does it work in my other plugin
got it ty
slim nymph
well are you sure they got in through ssh? got logs of that?
polar sonnet
As far as im aware yeah but ill rechecj
quasi valley
pw
polar sonnet
Im not sure how else they would have accessed it?
ftp?
They ran commands so Im assuming they did
slim nymph
then yes thats ssh
slim nymph
if there was no ssh logs, it was possible you had a backdoor plugin that let them run commands from within the java process
they prob wiped history
polar sonnet
There were seperate processes
(2 servers running_
Different plugins
So def wasnt a backdoored plug
quasi valley
why couldnt it? 
polar sonnet
If im comprehending this right
It would give them access to that 1 server correct?
*proccess
slim nymph
only if containerized in an isolated context
polar sonnet
well fuck me
slim nymph
if they both runsame user w/o a container 1 server can run shell commands on anything it has access to
polar sonnet
I wouldnt even know what plugin it would b
slim nymph
but the fact you have stuffi n bash history is signs of login
unless they literally spawned a bash login prompt lol
polar sonnet
It couldnt have been a plugin
quasi valley
that's why you don't use closed source plugins
polar sonnet
Server was up for 1-2 months with no signs of that
So unless they play the long game
quasi valley
only on your server viper 
slim nymph
ok so bad actors now know to wait 3 months to compromise keepitfresh to make their backdoors considered safe
polar sonnet
^
limber knotBOT
logs in bash history
polar sonnet
I leave roughly once a week every 1-2 months so have fun
limber knotBOT
don't they know you can just prefix commands with a space to keep it out of the log? smh
polar sonnet
Im not sure why they were checking last though
But they got my ip now so thats dope
slim nymph
thats why
quasi valley
laughs in dynamic ip address
slim nymph
to see if you was on the system to detect them
waxen panther
slim nymph
also to potentially find other accounts to compromise
polar sonnet
If they didnt get in through the root pass
I have an account with just access to that directory
Is there a way to see what user executed the commands?
slim nymph
not if they wiped logs
if its in /home/user/.bash_history its that user
but tou can also just unset HISTORY_FILE or some var like that to erase writing history
polar sonnet
Well i can confirm it was a root pass then
slim nymph
those were in /root?
polar sonnet
IS that a normal user to have?
potent fossil
yes
polar sonnet
Alright nevermind
slim nymph
check /etc/passwd
did you use a shitty root pw or something? for one, dont use pw's...
slim nymph
if you do have pw access, make the pw 32+ chars of gibberish
upper flicker
nonsense, no one would ever guess my password ||hunter2||
wide chasm
Was expecting taco2.
slim nymph
how long is long to you, and did you reuse it?
wide chasm
15 isn't like super long
slim nymph
well whereever you had that password stored is likely compromised too
vestal jasper
Tacos > burritos
potent fossil
are we still certain that it wasnt a backdoored plugin??
polar sonnet
Yes
potent fossil
is ssh confirmed
slim nymph
wwell they logged into root
polar sonnet
Theres bash history
potent fossil
oh mkay
limber knotBOT
I mean it could fake the history, lol
slim nymph
then maybe your pw to your host dashboard w/ access to that pw is compromised
not to /root....
gotta be root to write to root
limber knotBOT
are you sure your server's aren't running as root? lol
polar sonnet
not going to talk about that one
slim nymph
...................
potent fossil
oh no
limber knotBOT
whelp
slim nymph
well, duh. a few shell commands and yes they can get root access fro map lugin
polar sonnet
@slim nymph Really? How does that work?
polar sonnet
This is a huge learning experience so Im trying to get better att his
pulsar wigeon
you realize progamming languages basically all have ways to run system commands right
slim nymph
you can literally spawn a 2nd ssh server w/o any security, add a user with full sudo, then login as that, all from a compromised plugin running on root
pulsar wigeon
the jvm isn't a sandbox
minor badge
the only place you should be running plugins as root is inside a container
even then, pls dont
polar sonnet
Ok then why wait 2 months though?
slim nymph
or theyve had it longer and accidently deleted the files revealing themselves
might be someone who knows you
have you been kidnapped and pw's tortured from you lately
spice finch
they wouldnt mine that much, VPS hasn't big efficiency
minor badge
cpu mining tho lol
slim nymph
smart ones sit on it
minor badge
ok
polar sonnet
Damn they sat on that for a whole ass 2 months
minor badge
still pretty lol
junior field
minor badge
hi ryan
slim nymph
you dont know what they were doing for months
polar sonnet
That is true
slim nymph
could of been using yo uas a proxy to do illegal things
polar sonnet
yikesss
slim nymph
US had iran nuclear reactors being physically sabotaged for years until they accidently got discovered
polar sonnet
I would have noticed a performance downgrade no?
vernal moth
Stuxnet <3
slim nymph
doubt it was brute force at 15 chars
polar sonnet
Im checking with reliablesite rn to see if my account was accessed
slim nymph
no copy of the pw on your local pc?
limber knotBOT
I mean, it could be a pretty widespread backdoor and they only just got to/found your machine Β―_(γ)_/Β―
slim nymph
though running servers as root was likely culprit, specially since they only touched your mc folders, shows the person is affiliated with mc
standard attacker would of just deleted entire folder
polar sonnet
Yeah but the history? THey had to have logged in no
slim nymph
does seem odd to only delete jars
polar sonnet
Especially for how they deleted files
slim nymph
yes, thye logged in, but a plugin could of let them
polar sonnet
this is what i came back to
slim nymph
you can reconfigure ssh, or start a new one
polar sonnet
no
slim nymph
oh they prob did wipe out the entire folder and the running process just wrote new files
minor badge
just disable passwords altogether
polar sonnet
but whats weird is the data inside the folders was delete
minor badge
so they just deleted everything they could? lol
slim nymph
as i just said, they prob deleted entire folder, and plugins recreated those folders because server was still running.
polar sonnet
Well not all of the data inside*
Certian data was saved like uuids from saved islands, et
minor badge
who cares what they did, just make sure it doesnt happen again lol
minor badge
obvious steps to avoid include avoiding blackspigot and avoiding shady spigotmc authors
left swift
Dont install plugins that you dont know what they are doing
slim nymph
he does need to know entry method though, incase the compromise iss actually outside the server, local pc, admin panel for dedi
polar sonnet
Either a plugin or a root pw comprise
slim nymph
or finding culprit plugin
minor badge
set up 2fa for admin panel, use key auth only, dont run as root, only trusted plugins; all issues fixed
left swift
Viper ur a furry now?
polar sonnet
@void void
no idea which plugin
All of the jars got deleted
Possibly
I had an offsite backup
That im HOPING i still have
junior field
hello am a bit late - do you know if they connected via SSH or not
vernal moth
Yes
junior field
yes- https://www.spigotmc.org/resources/spigot-anti-malware-detects-over-200-malicious-plugins.64982/
vernal moth
There is a spigot anti maleware plugin
Author is absolutely insane and checks every new spigot plugin
junior field
i was about to suggest using it to find any plugins that call shell commands
polar sonnet
@junior field ssh was accessed at one point yes
They left bash history
No that is not for sure
junior field
oh they didnt clean up?
polar sonnet
I need to know how they got it
junior field
check your /var/log/auth.log
junior field
thatll tell you if they bruteforced it since apparently they didnt clean up
also I assume youve changed your pwd since?
so they dont connect now while youre handling the incident?
junior field
(also you'll want to wipe everything after you eradicate the threat)
polar sonnet
@junior field fresh install ik
junior field
so in your auth.log
are you being bruteforced by a chinese botnet or
yeah unlikely
but
if a chinese botnet has had many months
polar sonnet
Can confirm was no bruteforce
junior field
no fail2ban
polar sonnet
Im actually the only one that has logged in
junior field
Β―_(γ)_/Β―
polar sonnet
Accepted password for root from only shows my ip
junior field
couldve gotten lucky - 15 chars isnt very many as it goes
chinese botnets are at it 24/7
polar sonnet
Oh shit
polar sonnet
My auth log only goes back to that 7th?
IS there a farther back log
Nevermind found out
junior field
auth.log.1?
@void void "its a strong password so its impossible to bruteforce" isnt good enough
polar sonnet
The ip i have
junior field
unless i can 100% see it wasnt a bruteforce, i wont rule it out
junior field
or uh
left swift
Yea enter your password on this website
junior field
post the password here
polar sonnet
junior field
considering you shoudlve already changed it long ago
polar sonnet
So I dont think it was bruteforced
junior field
big up lanman
tired heath
@polar sonnet for the ssh, did you deny root login, did you change the default port, did you enable a firewall and did you install failtoban.
If not, is highly recommended
polar sonnet
ofunny
Havent even got into the rebuilding stage yet
Is there way to see what ip assoicated to the user executed a command/
junior field
no
junior field
why do you care about whether its a vpn
polar sonnet
To see
junior field
what if it was the attackers on a vpn
@polar sonnet did they SSH into root
or a different account
olol
polar sonnet
I sent another zbk
in here
potent fossil
junior field
@polar sonnet are they your sysadmins IPs or no
waxen panther
this is still happening?
minor badge
hi stinkylai
waxen panther
left swift
junior field
did he die or
tired heath
I should'nt have implemented that strafe jump feature as first. Now I keep wasting at least 10 minutes after I test a new feature doing strafe jumps π
cedar spade
you should've changed your password 609 million years ago
polar sonnet
I can almost confirm it wasnt a plugin/bture
tired heath
Well may I play Columbo
tired heath
So you say only your plugins got deleted and it was not a plugin,
tired heath
would it
dusk drift
Good friend
tired heath
well is funny, little bit
polar sonnet
I have to have SOME confirmation before though
jagged egret
sometimes I crack myself up with my stupidity
i just googled "how to get first element of array" π
tired heath
Actually if I would have done it, I would inject some troll plugin into an other jar, but I guess deleting will also do it
true
polar sonnet
Its not a plugin
minor badge
networking with ur mUm was pretty good π
polar sonnet
It all points back to him
tired heath
well yeah we got that
jagged egret
claro
polar sonnet
What does set -o do?
Im not sure thta was a command left in bash history
Then it prints out a giant log
Why would they run that?
minor badge
check which options they set perhaps?
pulsar wigeon
as do lua, julia, R, lots of older things like fortran and cobol....
tired heath
@polar sonnet becasue it shows all options what got set on/off
waxen panther
cobol, gods language
waxen panther
pulsar wigeon
hey there's even a handy list https://en.wikipedia.org/wiki/Comparison_of_programming_languages_(array)#Array_system_cross-reference_list
jagged inlet
How do I find other developers sharing the same passion?
polar sonnet
grinder
waxen panther
Terry would've made better bible plugins
red imp
Guys there was changed something important in Paper that causing this? There wasn't this error before
java.lang.IllegalStateException: Asynchronous ChunkMapDistance::addTicket!
at org.spigotmc.AsyncCatcher.catchOp(AsyncCatcher.java:15) ~[patched_1.15.2.jar:git-Paper-345]
at net.minecraft.server.v1_15_R1.ChunkMapDistance.addTicket(ChunkMapDistance.java:158) ~[patched_1.15.2.jar:git-Paper-345]
at net.minecraft.server.v1_15_R1.ChunkMapDistance.addTicket(ChunkMapDistance.java:311) ~[patched_1.15.2.jar:git-Paper-345]
at net.minecraft.server.v1_15_R1.ChunkProviderServer.addTicket(ChunkProviderServer.java:958) ~[patched_1.15.2.jar:git-Paper-345]
at org.bukkit.craftbukkit.v1_15_R1.CraftWorld.getChunkAt(CraftWorld.java:402) ~[patched_1.15.2.jar:git-Paper-345]
at org.bukkit.craftbukkit.v1_15_R1.CraftWorld.getChunkAt(CraftWorld.java:410) ~[patched_1.15.2.jar:git-Paper-345]
at org.bukkit.craftbukkit.v1_15_R1.block.CraftBlock.getChunk(CraftBlock.java:128) ~[patched_1.15.2.jar:git-Paper-345]
at de.myzelyam.discofloor.BlockChangePacketMgr$1.run(BlockChangePacketMgr.java:64) ~[?:?]
at org.bukkit.craftbukkit.v1_15_R1.scheduler.CraftTask.run(CraftTask.java:99) ~[patched_1.15.2.jar:git-Paper-345]
at org.bukkit.craftbukkit.v1_15_R1.scheduler.CraftAsyncTask.run(CraftAsyncTask.java:54) ~[patched_1.15.2.jar:git-Paper-345]
at com.destroystokyo.paper.ServerSchedulerReportingWrapper.run(ServerSchedulerReportingWrapper.java:22) ~[patched_1.15.2.jar:git-Paper-345]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]
at java.lang.Thread.run(Thread.java:832) [?:?]```step 1: dont run stuff async when it's unsafe
step 2: no errors
step 3: profit
limber knotBOT
yeah, don't access the world async, lol
vernal moth
a yes, getting a chunk sync in an async task
101 world corruption π
thats why that async catcher is there
red imp
So when I disable this it could works?
async-chunks:
enable: true
threads: -1
or something?
red imp
It's old plugin, it was supported on 1.13 :/
minor badge
tell him he's still stupid then
tired heath
Le me guess, it fills up the floor with colored concrete and alters it to a given rhytm, but tries to do it async
vernal moth
it tries to get data async so it can send a packet
instead of actually modifing the world
if anybody cares enough to fix it, its open source
red imp
I didn't find another plugin on this... if it's not really difficult to fix, could someone try it please?
vernal moth
hes still active
try raising an issue if nobody in here feels like fixing it
its trivial
red imp
ok
tired heath
I'm just here to talk while doing coding breaks, sorry
vernal moth
would just need to remove the runnable and use getChunkIfLoaded
red imp
ok created issue, the first one there, lol π
golden gust
no
vernal moth
imagine you have a wysiwyg editor, but also allow input via markdown and potentially bbcode or even html
and you want to store that in a database
and display it on a website
what would you store?
limber knotBOT
that sounds eww
vernal moth
most wysiwyg editors prolly produce html
pulsar wigeon
sorta
limber knotBOT
ideally the editor would display whatever the user input after loading the content again, mini
polar sonnet
Essentialy I've traced it back to a guy i worked with that I though I could trust/literally runs a business
limber knotBOT
but if you allow mixing multiple stuff...
polar sonnet
His ip, his location(ik where he had lived before), etc
vernal moth
I mean, I could just force markdown
polar sonnet
vernal moth
found a wysiwyg that supports markdown
that seems easy, but requires ppl to know markdown
limber knotBOT
just use a switch to allow toggling between markdown and wysiwyg Β―_(γ)_/Β―
pulsar wigeon
i'd store it as whatever they wrote it as
then have it rendered separately
so that if they hit the edit button, they get back whatever they put in to begin with
vernal moth
so I would store the format somewhere, and then the content string?
pulsar wigeon
i mean you can also store original input and rendered input separately
golden gust
Basically, I'd store the "raw" whatever the heck that thing uses
limber knotBOT
I personally would just store it in markdown and only have the wysiwyg part auto-format to markdown
golden gust
yea
pulsar wigeon
the important ux thing here is that if i write markdown, hit save, hit edit...i want to edit my markdown, not the rendered html
vernal moth
yeah
https://user-images.githubusercontent.com/18183560/76941970-4bdfc100-6940-11ea-9a60-94124237fa1e.gif
that editor supports wysiwyg without seeing the "code"
so I prolly just only use markdown
"advanced" users can write raw markdown
normals use wysiwyg only
markdown supports html anyways, right?
limber knotBOT
pretty sure most parsers do
vernal moth
ill just give that a try I guess
limber knotBOT
tbh the main issue with markdown is that it doesn't support colors by default, lol
golden gust
Yea, would probs need to go more towards things like bbcode for that
back in my days
vernal moth
do I want to support color tho?
limber knotBOT
bbcode is just simple-html xD
golden gust
Dude
tired heath
Did just read the original question, actually would need a editor that parses the view on runtime so the user sees the formated text, but will store it without converting markdown to html. So the logic showing it on the frontend has to parse the markdown again and prints html, what is not an issue since you always could cache the final output
so you will have html and markdown working in the same editor
golden gust
i can't even read it on my client lol
polar sonnet
fuckinn mintt
golden gust
polar sonnet
Hows everyones day going
golden gust
See, I just have a case of "k3s apparently killing the server"
hence, I kept having to reboot the darned thing
limber knotBOT
replaces zzzCat's stress pills with rat poison pellets.
vernal moth
wait, couldnt you use html to color?
polar sonnet
Can anyone link me a basic security guide for servers, so far I'vel earned
- disable passwords, use ssh keys
- containers?
- firewalling shit to protect bungee shit
pulsar wigeon
bbcode is not what markdown wanted to be
tired heath
css = color
vernal moth
tired heath
or inline style
pulsar wigeon
yall totally misunderstanding the markdown philosophy
vernal moth
ok, I call that good enough
pulsar wigeon
markdown is literally supposed to show semantics in plain text
golden gust
Well, yea, you could use HTML, but, er... raw html is generally... errr....
vernal moth
pulsar wigeon
using [] or <> tags to show semantics is completely opposite of markdown's goal
vernal moth
at least there is no xss π
polar sonnet
Can anyone link me a basic security guide for servers, so far I'vel earned
- disable passwords, use ssh keys
- containers?
- firewalling shit to protect bungee shit
@polar sonnet
pulsar wigeon
.g first 5 minutes on linux
limber knotBOT
(DiscordBot) https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers -- My First 5 Minutes On A Server; Or, Essential Security for...: "Mar 3, 2013 ... If you use your first 5 minutes on a server wisely, I believe you can do that. Any seasoned sysadmin can tell you that as you grow..."
polar sonnet
I guess I should edit to not trust people iether
Which is my entire downfall
Thought I could trust a repitable bussiness but nooo
pulsar wigeon
especially not zbk
marsh swallow
tired heath
Also you could use html attributes to strore any information you want, you can even use your own tags, standard html interpreter ignores them, while they are in dom and javascript can actually read the attributes, like data="" I mean there are plenty of possiblilities
vernal moth
ok am sold, the editor supports color https://i.imgur.com/Zv9ASKh.png
if you enable it
just creates spans
<span style="color:#4be536">me text and chooseΒ </span>
polar sonnet
Damn having shit like this happen just kills moativation
ember grove
tired heath
yeah most of them use span
polar sonnet
Good news im longer the guy who got fucked by a kenyan
vernal moth
everybody is on HIBP @polar sonnet
just make sure to never reuse passwords and you are fine
polar sonnet
hibp?
vernal moth
have i been powned
polar sonnet
Oh lmao
vernal moth
the site you screenshoted
polar sonnet
Im not even worried aobut that was just curious
Never reuse passwords
Im talking about my server and the motivation thing
vernal moth
oh
limber knotBOT
eww, hibp advertises 1Password
limber knotBOT
just use 2fa...
polar sonnet
it was one of my 3
was kinda just a throwaway
@still smelt the previous one was fixed
Wasnt technically my fault
tired heath
I actually have a pwned password and I did not change it cause I use it for shit content, who ever wastes hes time to get into one of these should enjoy
minor badge
i should change the password of that ancient steam account i constantly get emails about
limber knotBOT
mfw one of my emails was included in a dump from a site I don't even know/use?
polar sonnet
π
slim nymph
whats club penguin
minor badge
us kids liked to play with fake animals, aikar
polar sonnet
Or a plugin
fallen oracle
Wasn't it just one of the 3rd party servers?
They were serving it through Cloudflare
But the other main one I think is still up?
junior field
@polar sonnet but it was your fault
polar sonnet
Well yes but actually no
limber knotBOT
nice extensions π
junior field
for giving someone untrustworthy complete unrestricted access to your server
polar sonnet
It was a reputable business partner that I thought I could trust
That had multiple vouches/customers
junior field
is this a uh
slim nymph
mason?