general

[lavish compass]

You do, you have the commit

[cursive whale]

o hey

[void void]

We want 1.8 Support back

[harsh oasis]

2b2t

[viscid remnant]

Should use sponge instead!!!

[void void]

We need 1.8 Support

[vapid sapphire]

1.8 is so broken and vulnerable

[twin lagoon]

no

[mighty storm]

But 1.9+ pvp is so much better

In every way

[lavish compass]

@twin lagoon

[robust walrus]

pls

[cursive whale]

2b is going to have a field day with this one

[reef rapids]

Can you share what versions are affected by this exploit?

[vagrant marlin]

what is the "We"? seems like you are quite alone

[mental meadow]

!warn @void void Annoying about outdated versions

[thorny flicker]

:raised_hands: Warned ! strich#5805 (Annoying about outdated versions) [1 total infraction] -- aurora#4484.

[slate wasp]

hello are you high

[robust walrus]

not another 1.8 debate...

[vernal moth]

Don't ping

[void void]

yeah lol

[worn ember]

General going bonkers

[reef rapids]

sorry

[vagrant marlin]

practically all of them

[vernal moth]

Basically everything just update

[harsh oasis]

no it's not, i enjoyed when natural selection would take its course by giving gamer kids carpol tunnel before 15

[tropic flame]

well i mean, the patch has only been released less than an hour ago so i bet no relevant servers have been even updated

[mighty storm]

Develop on spigot, test on paper

[humble stirrup]

It would be so appreciated if you give some details in a few weeks for learning purpose

[umbral parrot]

hi dad

[viscid remnant]

Idk about that. I like to just mindlessly click then use strategy and timing

[crimson haven]

We need more slow mode lol

[vivid basin]

Based on the severity of the exploit, doesn't it seem like it would be a good idea to backport to all versions?

[meager tusk]

Develop on paper, test on paper.

[ashen nacelle]

I applied the patch and am showing the version on the mc console. though looks like some things did not like the patch with some chunk issues.

[twin lagoon]

evan my beloved

[tropic flame]

I would learn to read the commit on PaperMC's GitHub if I were you

[twin lagoon]

where have you been

[humble stirrup]

I did

[mighty storm]

Sadly, until we get hangar

[viscid remnant]

Ah i see. Thanks for clarifying lol. My eyes just hurt from reading it LOL

[slate wasp]

3 words: great description

[mighty storm]

Why are we battling over worse pvp

[vagrant marlin]

chill out

[meager tusk]

You good bro?

[umbral parrot]

working and trying to solve my relationship issues

[tropic flame]

3 words: read the code

[cursive whale]

chill dog

[sleek ivy]

Does it describe the issue? Kinda interested for educational purposes

[sterile wadi]

Lol

[mighty storm]

That was 4

[meager tusk]

No, that's the point

[slate wasp]

java will make me blind its so bad

[hot hamlet]

3 words and 1 number :P

[robust walrus]

so what is a bad faith actor capable of doing using that exploit?

[slate wasp]

ok

[crimson haven]

Of they would do that and actually good 1.8 could finally rest

[vagrant marlin]

yet you code with javascript 💀

[fossil patio]

is this a good time to share more kitty pictures

[ashen nacelle]

datk themes ftw

[slate wasp]

no java code will make me blind (java bad)

[mighty storm]

We will not describe how to do an exploit wtf?

[robust walrus]

no, that wasnt the question

[slate wasp]

what is a backport

[viscid remnant]

I use Javascript more than java :( my teacher sucked at teaching java

[ashen nacelle]

i have github in dark easier to read

[meager tusk]

Something you won't be told about

[fossil patio]

1. go to paper server terminal
2. alt+f4
3. right click paper discord icon
4. leave server

[mighty storm]

Easiest way to crash your server: type 'stop' in the console

[cursive whale]

yeah that is hard

[tropic flame]

the only based opinion.

1.8 pvp is underdeveloped. 1.9 introduced great mechanics like the shield, attack speed, sweeping edge, and effect arrows.

[slate wasp]

best language ```bf
+[>+.<]

[vagrant marlin]

but... but i want to crash my own server i certainly wouldnt use it on other servers 🙄 i am trustworthy i would never do that

[whole prawn]

ok

[sleek ivy]

Well yeah makes sense but I could somewhat get the idea from the changes

[cursive whale]

why dont we have a 1.8pvp debate channel, isolate all the fighting to there

[smoky python]

That aint a crash

[marble musk]

As a novice Java developer fluent in several other languages, I can confirm Java bad (side effects may include blindness and rapid brain cell decay)

[viscid remnant]

Watch some kid think they can crash hypixel with it Lmao

[potent panther]

seems sus.....

[robust walrus]

my question was what harm could have been done... i have no interest in executing anything

[plucky sparrow]

god damn

[viscid remnant]

Its satire guys

[cloud moat]

Just wait till you see PHP

[mild rune]

welcome back dap

[marble musk]

lol

[mighty storm]

PHP isn't that bad

[ashen nacelle]

php is like spaghetti

[slate wasp]

blindness if it was a language

[mighty storm]

Try Python, horrible to read and write

[viscid remnant]

Read papers github and the releaseD CVE

[full rune]

i'm fluent in english, good language

[slate wasp]

second worst language to ever exist

[vapid sapphire]

apparently has to do with LDAP according to the commit; also long time no see

[void void]

Can someone explain what was the exploit?

[old bridge]

Yeah same, like could they crash the server? Could they just access all files? Could they.. like.. what possibilities were there and what are we now safe for by updating accordingly :)

[ashen nacelle]

I still code websites in PHP

[mental meadow]

See the pins in #paper-help

[tropic flame]

no released CVE as of yet though but you can also read Log4J's commits

[potent panther]

that's a lot

[viscid remnant]

Pythons kinda easy but ir wouldn't be something i'd use outside data science

[cloud moat]

A language relying on WHitespace can't be good

[viscid remnant]

Mhm. I assume they'll release it in 2-3 days

[potent panther]

server owners ip

[ashen nacelle]

what about writing in Ruby

[slate wasp]

top 2 worst languages

1. c#
2. python

[whole prawn]

because its been going on for years in literally any minecraft related server and 1.8 pvpers are stubborn

[void void]

So... an exploit that crashes server?

[ashen nacelle]

#4 VBscript

[tropic flame]

You are now safe from an attacker possibly running code in your server. That could allow them to do whatever you described. As to "how they do it", I have no idea nor the PaperMC team is interested in revealing in this instant.

[mighty storm]

What's so bad about see sharp? Glasses are very useful for eyesight

[slate wasp]

c# doesnt deserve to be called c# because it isnt c

[glass crag]

sorry but java is worse than c#

[lavish compass]

This is actually a fucking disaster

[slate wasp]

forced oop + microsoft + slow

[potent panther]

yeah really bad exploit

[cursive whale]

c sharp is a pain in the ass to learn

[viscid remnant]

I love how you think about the server owners ip only and not everyone elses lmao

[formal tundra]

Anyone know what this exploit does?

[slate wasp]

dont learn it

[old bridge]

Ah I see, thanks. Well obviously they don't share the details of the exploit. I really was just interested in the consequences. Sheeesh

[mighty storm]

Check paper help pins

[potent panther]

i do but its like of the most important ips

[ripe sphinx]

Exploit is potential RCE. Update.

[old bridge]

Thanks for your explanation!

[cursive whale]

too late, already lost half of my brain doing it

[viscid remnant]

It isnt.

[marble musk]

I heard someone say the exploit resembles an RCE... In Iaymans terms, very, very, very bad if true

[tropic flame]

Remote code execution. As to "how they do it", no one will disclose until a few weeks later when everyone has updated.

[full rune]

bad things

[potent panther]

youtubers

[hot hamlet]

What about un updated plugins?

[vapid sapphire]

chunk wiping exploit, server-crashing with simple text: i sleep
log4j exploit: real shit

[hot hamlet]

Cause geyser updated that

[vagrant marlin]

uh-oh

[magic river]

Plugins shouldn't be shipping their own log4j

[hot hamlet]

Plugins shouldnt be doing alot of things xd

[rugged cosmos]

hi! i just want to be sure, 1.8.8 are affected by the exploit or just 1.12+ ?

[vagrant marlin]

yet they do

[potent panther]

bruh minecraft java was made on

[void void]

1.8.8 game over

[simple tundra]

it sounds dull, but it is wayy more severe

[slate wasp]

im a cool kid btw

[vagrant marlin]

1.8.8 is affected

[potent panther]

so you prefer bedrock?

[tropic flame]

An RCE exploit is 10 times worse than a chunk wiping one, in my opinion. Someone could literally do whatever they want in your machine since they can run code in it. But go off I guess.

[vapid sapphire]

no i get it, it sounds fucking criitcal

[rugged cosmos]

okay thank you!

[vagrant marlin]

thus you should update

[potent panther]

idc if you prefer bedrock but paper is for java

[vapid sapphire]

wait, so hold on

[marble musk]

Who told you it wasn't already public? If one random person can find it anyone else can too

[sinful iron]

is there a CVE for the new RCE?

[sleek ivy]

weird how I can't find anything about this exploit

[mighty storm]

Not that we know of

[ashen nacelle]

according to /google
Here are the best Cross Platform App Development Languages:
Java.
JavaScript.
Kotlin.
Dart.
Objective-C.
Swift.
C#

[fickle warren]

what versions have this exploit?

[mighty storm]

Why does my discord freeze for like 3 seconds when I click a name?

[barren fractal]

specific versions?

[vapid sapphire]

if this affects servers including vanilla because of log4j, don't clients also include log4j?

[tropic flame]

Java actually has a much lower chance of things like buffer overflows (there are sanity checks in the JVM), which is what things like remote code execution exploits use to work. The thing is when these Java libraries use native code... Code written in C(++). Not very cool kid of you

[viscid remnant]

Every IPs you collect is information you shouldn't be leaking and something you should do your best to safeguard. I wouldn't consider the Owners/YouTubers ip more valuable then an average user. I recall tubbo leaking multiple ips when he streamed himself making servers which was disgusting

[mighty storm]

Why would we describe it? Just update

Or check paper help pins

[whole prawn]

yeah the app has started to do that recently

[fickle warren]

minecraft versions

[barren fractal]

Because it helps to identify how servers can fix it?

[mighty storm]

I keep accidentally calling people

[sleek ivy]

by updating

[mighty storm]

The fix is updating...

[viscid remnant]

Perks of being on mobile

[vagrant marlin]

the fix is to update

[tropic flame]

And what happens when you don't write code correctly? 🤔

Remember we are humans

[void void]

fix 1.3.2 Version

[fickle warren]

right

[mighty storm]

i haven't pinged him don't worry

[viscid remnant]

Should also consider user stupidity too :)

[ashen nacelle]

that is why whenever i post a screenshot of my terminal I censor out ip addresses that are visible in the screenshot before posting to discord.

[mental meadow]

apparently you do. Dont be a dick

[fossil patio]

[tropic flame]

also holy shit why not just crank up the slow mode to 6 hours if you're going to keep doing it I just want to reply to people

[mighty storm]

Yikes + ratio

[hot hamlet]

lmao

[viscid remnant]

Same. I hate it when others send logs but dont censor their players ip. You're just carelessly doxxing someone :/

[fickle warren]

theres nothing rude about that

[heady marlin]

Hm, what exploit the announcement is talking about? Where can I learn the details?

[hexed coral]

inconspicuous

[mental meadow]

See the pins in #paper-help

[livid plume]

on the other hand, it's not like the people who would be able to abuse this can't literally just understand what's happening? I fully support not releasing dangerous exploit info but yeah lmao

[barren fractal]

imagine giving player ips to spigot servers at all kekw

[mental meadow]

!kick @final granite Troll

[thorny flicker]

:raised_hands: Kicked UberSuperBoss#1184 (Troll) [1 total infraction] -- aurora#4484.

[whole prawn]

why do you have your real life name connected to your discord account through facebook

[fossil patio]

stfu nobody cares
theres nothing rude about that

all the trolls are out today

[viscid remnant]

Drop it.

[vagrant marlin]

ips barely tell anything nowadays in most countries though

[fickle warren]

don't tell me what to do

[fickle rain]

Why not? What are you gonna do? Fly over here?

[smoky python]

Curious, why doesn't paper have have an auto-updater? Could be handy for people not being in this Discord and don't update this often

[viscid remnant]

Try using your own IP and maxmind.com but yeah. Most you get is country and city

[fickle warren]

i would just like to know what versions this exploit is in

[limber knot]

auto updaters break shit

[mental meadow]

Because there can always be broken builds

[mental meadow]

the answer is: yes

[crimson haven]

All

[fickle warren]

ah okay

[vagrant marlin]

yes, it tells my contry. the city is wrong though

[tropic flame]

The way the internet is built unfortunately does not account for IPs being sensitive information. It just gets sent around as sort of an identifier when you're connecting to a remote service. It's how it is. I wouldn't make such a big deal about it, most of the time when you try to geolocate it you'll just get the location of an ISP tower and not the actual home of the user

[charred sleet]

hmmm

[somber leaf]

not epic exploit

[vagrant marlin]

why did you get kicked, james?

[old bridge]

So if I get it correctly, the problem is in every past paper version basically, but because these later versions use a higher version of Java chances are it still wouldn't work there.
However, obviously, it is still better to just update your paper (which I already did ofc)

[viscid remnant]

Mhm not the case for everyone. My friends ip gives his city. Combine it with knowing his other details you can do worse. You can also ddos too

[fickle warren]

so any versions starting from today fix it? including paper versions for 1.16 and below?

[potent panther]

who uses vpn for gaming?

[magic river]

I would assume it's in all versions until someone can say what log4j2 versions are vulnerable and you can cross-reference that with MC versions

[twin lagoon]

cya

[mossy vessel]

!ban 348418909029924874 Cheap troll, move on

[thorny flicker]

:raised_hands: Banned UberSuperBoss#1184 (Cheap troll, move on) [2 total infractions] -- NotMyFault#3732.

[crimson haven]

Only down to 1.16 not bellow

[twin lagoon]

[mild rune]

Michael you looking cute today

[fickle warren]

so its not an exploit below 1.16 or theres no patch below 1.16?

[vagrant marlin]

its an exploit on every version ever

[fickle warren]

geez

[formal turret]

most likely 1.8 -> current

[tropic flame]

they haven't used even close to pure Spigot code for a long time (legend says they forked Spigot 1.7 and just built their thing which does not resemble Bukkit at all anymore at this point). They are capable of fixing their state-of-the-art software by themselves, I'd say ¯_(ツ)_/¯

[cloud moat]

Just stop using legacy software

[crimson haven]

It is an exploit over all versions but there is no fix below 1.16 l. If you use verison bellow no one can help you

[livid plume]

if i remember correctly versions below 1.16 can use a java flag to patch this right? might be worth announcing for the people below?

[barren fractal]

they use forked bungee, nothing too special

[mossy vessel]

This is not up for debate

[simple tundra]

what isnt?

[ashen nacelle]

#politics

[fickle warren]

that is easier said than done

[fast arrow]

Bro, stop being such a troll

[mossy vessel]

Which has been deleted by now

[mighty storm]

rory would be very disappointed in most of yall

[mental meadow]

The next one discussing about pronouns gets instantly banned, easy

[viscid remnant]

Yeah. I do acknowledge its like that but sadly 70% of the time your ISP may be based in the same city you are in. I dont see it as a big deal but something that you should actually consider as data to protect as an owner/server manager

[simple tundra]

oh, that

[tropic flame]

bungee is just a proxy, not the actual Minecraft server. but yeah, I'd figure they also use a fork of bungee

[cloud moat]

Update your plugins and move on

[vagrant marlin]

is rory disappointed in me? i updated everything already 🥺

[fickle warren]

a lot of them are not updated

[tropic flame]

I guess if you're in a big city then that can be the case

[mental meadow]

Yes, see #announcements

[cloud moat]

Then find ones that are updated, for everything you try to do there are about 10 alternatives out there

[ashen nacelle]

https://tenor.com/view/anime-smug-face-smug-anime-girl-smug-smug-face-smug-smile-gif-23765538

[mild rune]

weebs

[simple tundra]

[fickle warren]

surprisingly not. theres very few or no alternatives anymore

[tropic flame]

weebs in, sorry

[mental meadow]

so close

[simple tundra]

[viscid remnant]

Peoples priorities are just weird lmao

[tropic flame]

I'd rather have weebs than homophobes

[mossy vessel]

I'm pro nouns, but verbs are cool too

[mild rune]

I like adjectives

[viscid remnant]

Nothing wrong with weebs. They're people

[cloud moat]

if you want you can send me a DM about it, I may be able to help you

[mighty storm]

nouns ❌
i prefer yesuns

[potent panther]

adverbs?

[cloud moat]

But fuck adjectives

[main hound]

hot

[fast arrow]

I think all words are cool, you can't single out nouns 😶 🧐

[viscid remnant]

I mean you could always just Modify your 1.8 jar

[tropic flame]

You say verbs are cool cuz they're easy as shit in English, try learning french

had 5 years of it, didn't help much

[hexed dragon]

Whenever an exploit fix announcement happens the chat is so much more active.

[golden gust]

!ban @clever mantle Creep elsewhere

[thorny flicker]

:raised_hands: Banned NicoNeko#6018 (Creep elsewhere) [1 total infraction] -- electronicboy#8869.

[ashen nacelle]

oof

[main hound]

another brother lost

[viscid remnant]

Rip

[mental meadow]

Y'all choose the worst time possibly to troll.

[fast arrow]

👌 😶 👍

[viscid remnant]

They really do

[ashen nacelle]

creeper alert!

[viscid remnant]

Awww man

[left swift]

oh man exciting day huh

[viscid remnant]

Yup i think the chats more calm now

[acoustic basin]

Where can I learn more about the exploit that was found recently

[tropic flame]

they heard it's a remote code execution exploit, they decided to remotely execute their trolling abilities

[mild rune]

hey nomana

[ashen nacelle]

https://tenor.com/view/troll-troll-doll-doll-hair-troll-hair-gif-5351489

[viscid remnant]

Fucks sake nvm

[crimson haven]

https://c.tenor.com/pzvDOo-MxEAAAAAM/obi-wan-oh-i-dont-think-so.gif

[viscid remnant]

I was a fool to think it was calming down thanos turning to dust

[ripe sphinx]

Wait a week, the nature of the exploit isn't being discussed at this time. Just update

[mighty storm]

and as usual, there's no eta >:)

[acoustic basin]

Okay 👍

[mild rune]

The CVE will pop up eventually on log4j's security page

[gleaming steeple]

Слава Украине!

[ashen nacelle]

how many bans are we up to today since this exploit was patched damn man

[mighty storm]

dependabot finna work overtime

[mental meadow]

Please stick to english in here

[mossy vessel]

The majority cuz people are cheap trolls smh

[viscid remnant]

Is that ur cat as ur pfp chew

[mighty storm]

rory?

[mossy vessel]

I suggest less complaining, more updating

[mild rune]

If people are gonna troll at least be a good one smh

[viscid remnant]

Ikr

[fickle warren]

troll how

[mighty storm]

so we can ban them quicker yea

[ashen nacelle]

like the troll doll above?

[worn ember]

waiting for the paper team to update faster

[viscid remnant]

Kekw

[mild rune]

I used to get trolls when I worked support and they'd always be so obvious I could ban them instantly

[vagrant marlin]

a good troll is something that people will laugh at, being annoying is not one of them

[mossy vessel]

Why do you have an emoji of yourself?

[viscid remnant]

if one of them is innocent and was just new

[mental meadow]

I'ma just ban everyone slightly annoying, should cover 90%

[worn ember]

90% of the server?

[left swift]

hi aurora

[viscid remnant]

95%*

[golden gust]

I vote DED yeetus first

[ashen nacelle]

thanos snapp in overcharge

[void void]

briefly what is this about an exploit dupe, force op, kickall, dump?

[mild rune]

I had someone come in with the name "Cock N Balls" and ask for me to send them some porn

[cloud moat]

Already updated all my Dockerfiles and pushed them into CI

[tropic flame]

guys, just fuck this exploit, remember when Need for Speed was a relevant racing game franchise? https://youtu.be/aA1FfmnC5zk

[worn ember]

you love me cat

[viscid remnant]

LOL.

[tropic flame]

now the cool kids play Forza or some shit like that

[void void]

Nah

[mild rune]

Had someone ask me to recommend them a server plan that could hold 300 million players

[vagrant marlin]

the cool kids play gmod for the ultimate car simulation

[viscid remnant]

I had someone claiming to be confused of their gender and wanted me to inspect their pants once. I just said that wasn't the support i gave-

[left swift]

gmod what is this 2016

[viscid wedge]

fucking PLEASE

[worn ember]

i can help them for 99$/h

[tropic flame]

GTA IV driving almost literal bars of soap

[cloud moat]

The only relevant Racing Game Franchise is Mario Cart

[viscid remnant]

Gmod is still being played on :)

[mild rune]

gmod is very much still kicking

S&ndbox looks cool tho

[tropic flame]

Sandndbox?

[viscid remnant]

Great game :) i remember in watching yters play TTT, murder mystery or some other games. Sandbox is just chill

[tropic flame]

yeah tho it looks awesome

[ashen nacelle]

https://tenor.com/view/thanos-infinity-gauntlet-snap-finger-snap-gif-12502580

[mild rune]

look don't question it

[viscid remnant]

Flashbanged ow

[snow iron]

Hello, where can I read more about this exploit, is there a article or thread thing anyone can refer me to

[mighty storm]

sans

[left swift]

it's fun if you get people to play, otherwise it's just dev tooling rn

[mighty storm]

no

#paper-help pins

[tropic flame]

since Source 2 actually supports infinite worlds they added that into s&box + procedurally generated terrain, which is fuckin cool, they could effectively remake Minecraft in Source 2

Source 1 was quite limited in that regard

[left swift]

my 3000 gmod hours in darkrp got me into s&box early access in 2 hours

[worn ember]

Source 1 is also like 20 years old

[tropic flame]

it worked fine for Half-Life 2 all the way up to CS:GO but, yeah

[mild rune]

I should request access

I've got a decent chunk of time in gmod

[left swift]

ya I want to see what your workshop token is

did you release any content for gmod workshop mja

[mild rune]

I released a few things iirc

[tropic flame]

tbf though, the fact that it still holds up even for a game as old as Half-Life 2 is amazing

of course that the CS:GO branch of the engine has much more patches over it, but Half-Life 2 still holds up imo

[left swift]

you might get a good token then

[vagrant marlin]

source 1 just casually loading up the entire world because thats all it knows to do

[mild rune]

Apparently not

[left swift]

[foggy silo]

Dang a new exploit?

[ashen nacelle]

damn Owen you late to the party

[cloud moat]

Just found the exploit, holy shit, thats a big one

[worn ember]

no, its an april fools joke

[tropic flame]

the maps are relatively small enough that one could do that i think, you are not actually rendering everything outside of what you see anyways

[formal turret]

thanks apache

[foggy silo]

I was at school!! 😠

[mighty storm]

Yeah I have gmod content
https://steamcommunity.com/sharedfiles/filedetails/?id=322560486

[left swift]

the best

[spare venture]

i miss gmod

[worn ember]

i love balls underwater

[foggy silo]

Studying for French…. 🥴

[vagrant marlin]

218 hours in plague inc 😳

[mild rune]

All my workshop content was for other games

[flat shale]

Hi, sorry, just read about the new exploit. I'm a server owner and I'm currently at work, so I can't exactly look up what it is. Can someone provide some info for me?

[mental meadow]

See the pins in #paper-help

[mighty storm]

I have no idea how, the game was closed, but clocked in a week of gameplay anyway, it's more like 3 hours

[foggy silo]

Just make sure to update asap

[mild rune]

based

[ashen nacelle]

that avatar for aurora looks familiar

[mighty storm]

All you need to do is update to the latest build!
😄

it's anime, very well known in japan

[tropic flame]

It allows an attacker to run code in your machine (they can do whatever they want at that point). As to how it's done, no one will disclose for the following weeks. See the pins in #paper-help for more, and update

[mild rune]

All the custom stuff I made for gmod was mostly for private servers

1588 hours on record

[main hound]

from log4j...

[flat shale]

I'm currently at work. I am trying to weigh having someone pull the plug for me and crash multiple servers or hope I'm fine for a few hours

[vivid basin]

I don't think it's remote code execution

[tropic flame]

if Log4J uses native libraries then it can potentially be a thing

run unsafe code and risk a buffer overflow

[flat shale]

Thank you, that probably means I should pull the plug

[robust oxide]

Is the exploit on legacy versions?

[mild rune]

yes

[left swift]

2676 hours, sheesh wasted 115 days in total playing gmod lmao

[main hound]

good I just created my own logger

[robust oxide]

1.8 and 1.12?

[main hound]

fuck log4j

[flat shale]

Ugh now I'm gonna have to restart an entire ark cluster as well

[mild rune]

what part of yes do you misunderstand?

[left swift]

I wish you could see how many hours you've logged on minecraft

[cloud moat]

Just surprised it isn't a picrew

[robust oxide]

is it just a paper exploit?

[flat shale]

Oh well, thanks for the help!

[sleek ivy]

I think I figured it out but 🤫

[mighty storm]

don't bait people

[mild rune]

I don't it'd be like easily over 25k

[wide chasm]

It's an exploit in the logging library, software that uses this library is affected

[left swift]

lol

[acoustic fractal]

Wait what is the exploit?

[tropic flame]

yeah just use java.util.logging

it's not a reason to just say fuck Log4J imo, things like this happen, you just have make sure you're running up-to-date software

[sleek ivy]

which is like most of the java ecosystem

[mental meadow]

See the pins in #paper-help

[left swift]

weren't you supposed to not say the exploit yet

[tropic flame]

we are not saying how it's performed, are we? 🤔

[ashen nacelle]

bunch of script kiddies here it would of been spilled sooner or later

[vivid basin]

Paper is open source, you can find out what it was based on the changes in the source. The difficult part is taking that knowledge of what it was and making it into a proof of concept

[mighty storm]

But why, why would you do that

[hollow igloo]

Can plugins also expose a server to this issue, or should it be sufficient to update Paper?

[vivid basin]

Theoretically yes

[tropic flame]

plugins that ship their own Log4J for whatever reason must also be updated

[mighty storm]

depends if they package their own log4j for some ungodly reason instead of using the server's logger

[hollow igloo]

alright, thanks

[left swift]

I like my plugins to be 100mb+

[tropic flame]

can't wait for the first Electron-based Minecraft server

lord please no

[main hound]

wtf

[ashen nacelle]

https://tenor.com/view/the-office-no-angry-steve-carell-michael-scott-gif-5606969

[main hound]

2022 just can get better

[fickle warren]

paper 1.16.5 760 is the patch right?

[plucky sparrow]

Isn’t there a nodejs Minecraft server already

[ashen nacelle]

Mineos is based on NodeJS

[void void]

I had so much fun using it why patch ):

[ashen nacelle]

its not a minecraft server in of it self but a server management and webui system

[plucky sparrow]

Shouldn’t be too hard to add a UI to it

[cloud moat]

From what I can see, that fix isn't backported yet

[ashen nacelle]

https://github.com/hexparrot/mineos-node

[left swift]

[ashen nacelle]

looks like chat has calmed down now

[tropic flame]

indeed

[rare tiger]

ey whats the exploit called 👀

[ripe sphinx]

just gave the word for my remote hands to pull the plug on my home server while I'm not at home 🙃

[tropic flame]

deez nuts

[left swift]

sugma

[rare tiger]

https://tenor.com/view/crying-emoji-dies-gif-21956120

[worn ember]

sigma

[void void]

Dont do it also give ip

[left swift]

sugma balls

[rare tiger]

but fr im just curious 👉 👈 or is it a security by obscurity type deal

[void void]

Is this exploit not like... one of the biggest ever for minecraft

[left swift]

#paper-help pins

cant wait to watch the Fitz video

[void void]

rce in a shit tone of 1.12+ servers

[ashen nacelle]

yes

[cloud moat]

Take a look at Responsible Disclosure

[ripe sphinx]

waterfall itself is vulnerable I believe, not 100% on that

[ashen nacelle]

look in #announcements

[ripe sphinx]

ah yes, lemme give my home IP out to a random person

[tropic flame]

How it's done is not disclosed, what it is is a possible remote code execution exploit.

[worn ember]

can send you a link in dm's 👀

[tropic flame]

may I take a look too, then? 👀

[formal turret]

lol

[worn ember]

0.5btc

[meager tusk]

lmfao

[tropic flame]

nice bait

[meager tusk]

table creation declarations

[left swift]

nft paper exploit

[rare tiger]

yes send me your rickroll 🙄

[ashen nacelle]

in other news Microsoft tempts software pirates with 50% discount on office.

[keen sable]

Wait what is the exploit

[foggy veldt]

So basically to do the exploit first you

[left swift]

exploit involves S.U.G.M.A system in java

[spare venture]

home depot sucks

[rare tiger]

lmao he actually delivered okay

[foggy veldt]

Anyways I predicted this but no one believed me #general message tomorrow’s winning 4 numbers are 7 4 5 1

[vagrant marlin]

you were behind this exploit, i know it

you invented it

[ashen nacelle]

One problem with auto-correct is that you always end up posting some thong you didn't Nintendo

[left swift]

you are so old

[vagrant marlin]

Yeah, sometimes i Nintendon't to type something

[left swift]

I feel like you could put that over a random scenic background like over a beach and post it on Facebook

that's probably where u got it from

[vagrant marlin]

dont forget the 3d joy emoji

[ashen nacelle]

its a text fomr a friend of mine

[vagrant marlin]

and red text

[left swift]

"funny teen quotes"

[worn ember]

put it in a logger

[foggy veldt]

Tell that 2b2t Minecraft keemstar guy to put me in a video

[left swift]

fitz videos make me mad

or fit

whatever the fuck that guys name is

[ashen nacelle]

maybe you shouldn't be infecting your computer with that crap.

[left swift]

alright this is totally not a pokipog moment I'm coming back in a few hours

[rare tiger]

||I WAS JOKING||

[left swift]

papermc is normie now and thsts cringe

[vagrant marlin]

oh, the bald guy with a beard, and a crave for some raycons and gfuel?

[meager tusk]

yeah now papermc is not fun

[vagrant marlin]

that guy, yes i know him

[foggy veldt]

He seems like he needs to touch grass but there obviously seems to be a market for no lifeing 2b2t so get that money ig

[worn ember]

why do you hate me?

[rare tiger]

> in Minecraft-tangent community
> mad that it's full of normies

[foggy veldt]

Because your rtp plugin didn’t find me the god spawn

[worn ember]

[rare tiger]

me when RTP plugins without fluid checks or with gigantic loops

[quick halo]

Minecraft YTers here rn recording chat for a quick-scroll montage later

[ashen nacelle]

"Meat Toboggan." Try gettin' THAT image out of your head. Gripping his entrails like the reins of Santa's sleigh, streaking through the fresh morning snow on a trail of bile and gore, as his eyes beg the same question as the horrified children in his wake: "Why...?" -- Kirito

[rare tiger]

me when the new RTP plugin teleports me outside of the world border 😐

[worn ember]

you been using the wrong plugin then

[foggy veldt]

Nyways I saw the ping and thought kyori and paper finally announced their merge. Wake me up when something happens

[mental meadow]

this will never not be fun
https://youtu.be/9PIcQ7VLGoA

[foggy silo]

lol

[ashen nacelle]

"I have others. How about... you look like Benjamin Button fucked an old catcher's mitt. Like four inches of face stretched over twelve inches of skull. Like a moldy jack-o-lantern that some frat guy barfed in and then crushed against his forehead because he was super drunk and thought it was a beer can and immediately regretted every single life choice he ever made!"

[quick halo]

Whenever I see the sirens I think of Patrick wee wooing.

[mental meadow]

that is absolutely the sound

[foggy silo]

https://tenor.com/view/wee-woo-patrick-star-spongebob-squarepants-panicking-freaking-out-gif-17867167

[rare tiger]

does it

• use NMS heightmaps to approximate Y value
• use optimized loop when that fails
• perform fluid checks
• have zone based on world border
• use same Random many times

[worn ember]

• No
• No
• If ur lucky
• Yes
• If u leave ur server on long enough

[rare tiger]

wait uhh

[wide chasm]

5 questions, 6 answers

[fossil patio]

not a video of all the dms and @s?

[worn ember]

thats how good it is

[wide chasm]

Take my money

[foggy veldt]

Sounds overcomplicated, close eyes and type random numbers into /tppos

[ashen nacelle]

my most favourite quote from SAO abridged is...

"You know something? I really hate people! They're selfish, ignorant, loud obnoxious pricks, with basically no redeeming qualities whatsoever. I mean really, look at all they've achieved! Genocide, global warming, reality TV, and just a never ending parade of failures and fuck ups! They are, without question, a complete write-off of a species, and how dare you make me care about them!"
--Kirito

[worn ember]

you know, math is hard

[rare tiger]

ill take your entire stock

[rare tiger]

thats better than 99.9% of RTP plugins

[mental meadow]

too many

is the answer

too many

[fossil patio]

[mild rune]

I used to have a screenshot of a server I used to run where I did like 5 announcements and each one the people filled up all the reaction slots

It was like 95% reactions

[plucky sparrow]

that dude with the Minecraft pfp is making me cringe really hard

[main hound]

those without a profile pic are the real deal

[plucky sparrow]

Indeed

@marble lark can confirm

[foggy veldt]

Do you just ban everyone who dms you or do you ignore them

[quick pasture]

[ashen nacelle]

pobably depends on the dm content and if the dm is nessicary

[mild rune]

I'm sure if someone DM'd aurora with some creepy shit they'd get banned

[plucky sparrow]

“hey my server is lagging can you tell me why”

[foggy veldt]

90% of those dms are probably something like “what’s the exploit”

Oh I meant after the announcement

[mild rune]

help my beta 1.3 server is lagging can you guys fix it?

[ashen nacelle]

think ive done that about 3000 time already ... jk

[left swift]

"is there exploit fix for 1.14.4"

[worn crest]

no fix for log4j for mc 1.6??? i wanna refund!

[plucky sparrow]

“is there exploit fix for bukkit 1.7.2?”

[ashen nacelle]

eewww 1.6 is so fare gone and old

[mild rune]

why you no fix hmod?????

[vapid sapphire]

Looks like a commit was pushed a few minutes ago for 1.16.5

[rocky flame]

probably been answered 100 times but what exactly is the issue can someone pin it

[ashen nacelle]

the exploit affects 1.12+

[mild rune]

#paper-help

[ripe sphinx]

#paper-help pins

[mild rune]

it's pinned there

[worn ember]

Are you oskar 👀

[foggy veldt]

I would hate to be someone like sponge because you are sort of expected to backport fixes to those versions because of forge lts cycles

[spiral robin]

https://tenor.com/oY33.gif

[worn ember]

[left swift]

o ma god

[limber knot]

today i remembered allan holdsworth existed

[left swift]

[worn ember]

sponge is a lot less version dependent tho

[ashen nacelle]

naomi graces us with her presence

[mild rune]

man I remember when CanaryMod was a thing for Minecraft

[left swift]

is oskar still banned here

[worn ember]

probably

[main hound]

no im the dev of autoplug

[limber knot]

ofc

[ashen nacelle]

ooh look aurora is back again

[worn ember]

who are we plugging?

[limber knot]

your mouth

and our ears

[plucky sparrow]

hmm

[ashen nacelle]

and your eyes

[main hound]

depends

[plucky sparrow]

Sounds fair naomi

[limber knot]

you cannot really plug eyes

[worn ember]

irc virgin

[plucky sparrow]

When are we doing it

[left swift]

tf is autoplug

[limber knot]

now, i'll grab the caulk

[left swift]

sounds like a sex toy

[bleak ridge]

Where is the Minecraft Bug tracker report for the exploit?

[frank otter]

who was oskar

[main hound]

yep

[worn ember]

its plug but automatic

[limber knot]

IT DOES HOLY SHIT

[main hound]

thats why its soo good

[bleak ridge]

So I can vote for the issue

[vernal moth]

Private

So you can't vote

[worn ember]

direct to pinging denwav lmao

[vernal moth]

Mojang was made aware as soon as we reproduced

[ashen nacelle]

https://tenor.com/view/lewd-trinity-seven-anime-sign-gif-7407062

[mild rune]

man naomi is almost unbanned

gonna be sad

[limber knot]

yeah soon

[worn ember]

if they ever unban you that is

[plucky sparrow]

I miss real naomi

[mild rune]

won't be able to call her a webhook anymore

[plucky sparrow]

This AI just doesn’t feel real

[mild rune]

😔

[left swift]

awe man it's been so peaceful and quiet since naomi was banned

[ashen nacelle]

what is the true naomi?

[plucky sparrow]

yea only this annoying bot

but other than that it’s been so peaceful

[limber knot]

thinking about just giving my sister €10 cuz i can't think of anything she'd want

[plucky sparrow]

so much less naiom

[limber knot]

1v1 me phantom forces dap.

[left swift]

wow such nice gift

[worn ember]

we're not having anyone over for christmas, so no presents to buy

[left swift]

10 fake dollars

[limber knot]

euro is more real than dollars

[left swift]

sorry that's too much politics

[twin lagoon]

more like new account

[limber knot]

no?

[mild rune]

Discord gonna take forever to unban you

[worn ember]

im still convinced mikel reported her

[ashen nacelle]

i was banned a year ago. for posting a picture of sayori.

[plucky sparrow]

Roblox?

[twin lagoon]

nop i only report through in app reporting

i don't have that feature in paper without mod permissions

[plucky sparrow]

Do I look like I fucking play Roblox

[left swift]

michael going to get naomi re-banned

[limber knot]

yes

[worn ember]

so it was a mod confirmed

[mild rune]

cat did it

[limber knot]

probably cat ye

[left swift]

Michael is a required discord snitch

[mild rune]

Michael got inside knowledge on how to snitch

[fossil patio]

i reported michael for never responding to me :(

[worn ember]

nami do you talk politics? if so its probably jroy

[foggy veldt]

Airplane svelte man :o

[ashen nacelle]

DONT YOU DARE SUMMON JROY

ive already sent him to the abyss

[limber knot]

i do not talk politics because politics suck

[worn ember]

no u

[fossil patio]

just svelte man now

airplane is a movie

[limber knot]

what's gonna be ur next project paul

[foggy veldt]

Oh yea I heard yatopia bought you guys out

[fossil patio]

lol, wtf

[limber knot]

SugarcaneMC*

[quick pasture]

lol

framing that

[fossil patio]

frank

[plucky sparrow]

gaze into the abyss

[limber knot]

abyss gazes back into you

[fossil patio]

doing some more open source stuff on funner projects, mostly just work lately though

[plucky sparrow]

no

[ashen nacelle]

https://tvtropes.org/pmwiki/pmwiki.php/Quotes/SwordArtOnlineAbridged

[worn ember]

didnt you have a rank here Paul?

[ashen nacelle]

those quotes are funny AF

[fossil patio]

i can post in the kitties channel, it's all i need

[worn ember]

[spare venture]

who is naomi and why were they banned

[void void]

whats the command to load it?

[foggy veldt]

This guy has been talking about sao for the past hour and I subconsciously tuned his messages out until I saw that big ass embed

[limber knot]

sao quotes

[plucky sparrow]

I’m feeling quite seris right now

Must be the abyss

[limber knot]

funny

no

[worn ember]

use something like chunky

[void void]

no i mean to render the map

whats the dynmap command

[worn ember]

idk bruh

[ashen nacelle]

Asuna: I'm sorry, did I freaking stutter? (glares at Sugou) I said, if you hurt him, you will experience pain and torment beyond anything you could possibly imagine. Your body will be torn apart piece by piece as you beg for a mercy that will never come. I will add your screams to MY GOSH-DARN SPOTIFY, AND I WILL SEE YOUR HEAD MOUNTED ON A FUDGING PIKE!

[worn ember]

google it

[mossy knoll]

See this is why you DON'T suppress @ everyone #announcements

[foggy veldt]

Probably something guessable like /dynmap render

[worn ember]

i just have at everyone enabled cuz i know it'll be carnage when it happens

Thats what i live for

[limber knot]

yes

you live for the nuking and reannexation of belgium to restore the duchy of brabant

[ashen nacelle]

Boss won't get off your back? Girlfriend won't stop nagging you? Did that fuckstick Tiffany sell you a bullshit dagger that broke almost immediately despite the fact that you spent half your goddamn Col on it? Have you considered... murder?

[foggy veldt]

I only suppress everyone pings when servers start getting annoying

[mossy knoll]

Do /dynmap help 😐

[limber knot]

reading hard, yes

[mossy knoll]

Yeah same but do not do it to import stuff like paper lol

[worn ember]

i just leave

[worn ember]

who?

[limber knot]

marco

[worn ember]

polo

[ashen nacelle]

polo

[worn ember]

nailed it

[limber knot]

anyway dap 1v1 me phantom forces when

[foggy veldt]

I leave if it’s an emoji server but sometimes servers like tph have little quirky everyone pings

[mental meadow]

We try to only ping for important stuff

[mossy knoll]

poblo

wait

[foggy veldt]

Well I left tph too

[worn ember]

i'm still in there lol

[mossy knoll]

Exactly and thank you otherwise you have people suppressing and they miss important things

[limber knot]

needed to nicely ask aurora to forward me the announcement lol

[worn ember]

thats what you get for being an irc pleb

[limber knot]

shut up ded

you're a belgian hoe

[mossy knoll]

Why does it say you are a bot? Are you on a bot client?

[limber knot]

i am an advanced AI

[foggy veldt]

How does irc bridge work is it only #general

[wide chasm]

"advanced"

[mild rune]

imagine not being able to read the announcements

[ashen nacelle]

https://tenor.com/view/its-getting-real-crap-is-getting-real-becoming-a-reality-its-getting-serious-ladies-night-gif-14179213

[mild rune]

The bridge has general and paper-help iirc

[ripe sphinx]

here, paper-dev|help, and I think waterfall stuff

[mild rune]

Yeah it's got waterfall-help/dev too

[limber knot]

this is why you befriend the mods and spam their telegram dms full with random jazzfunk albums and anime art

[mild rune]

what

[mossy knoll]

Ok are you a webhook because bots have profiles

[mild rune]

Naomi is an AI

[ashen nacelle]

https://tenor.com/view/japan-anime-kawaii-sugoi-gif-4761309

[mossy knoll]

Yes tottaly 100% I believe you

[mild rune]

good :)

[limber knot]

nah more like https://twitter.com/potg333/status/1468535098127818754?s=20

potg（ぴおてぐ） (@potg333)

実る

Retweets

4953

Likes

39765

Twitter · Dec 8, 2021, 10:57 AM

[mild rune]

that's pretty poggers art

[mossy knoll]

Fruit

[limber knot]

twitter artists on a different level

deviantart artists... too...

[mild rune]

facts

pixiv artist tho

[limber knot]

yes

[ashen nacelle]

i got a tournament in WARZONE at 7pm

[limber knot]

most of my pixiv stuff is touhou though

[spare venture]

oo that’s cool

[ashen nacelle]

touhou is good

[limber knot]

stan koish

[ashen nacelle]

https://www.youtube.com/watch?v=FtutLA63Cp8

[limber knot]

bad apple overrated

i prefer FELT - Goldrop

Halozy tho

[vapid sapphire]

There's a link on the API to a build of 791 for 1.16.5

[limber knot]

yes, and?

[void void]

whats the exploit thats so quickly needed patching?

[ripe sphinx]

#paper-help pins

[charred sleet]

something with log4j or something i though

[limber knot]

ye

[ripe sphinx]

Correct

[ashen nacelle]

bad apple is cool with the 8088 domination

[hollow spoke]

hello friends, anyone has an idea if this exploit impacts logback as well

[limber knot]

man i forgot how good this song was https://youtu.be/dMoszzW5YRc

[ashen nacelle]

https://www.youtube.com/watch?v=MWdG413nNkI

[limber knot]

tfvsjs >

i need to find more math rock albums

[solid night]

what was the major exploit?

[limber knot]

check pins in #paper-help

https://naomi.s-ul.eu/7W2wF3QW what the actual fuck is this kinda scam

[ashen nacelle]

https://trixter.oldskool.org/2014/06/19/8088-domination-post-mortem-part-1/

[limber knot]

like yeah the album is good but worth almost 900 usd?

[ashen nacelle]

thats scammy

[dusty flint]

what does the fix do?

dont understand the code of the hotfix lol

[ashen nacelle]

Killer Poke in modern PC's

MSi Laptops UEFI
Systemd mounts variables used by Unified Extensible Firmware Interface on Linux system's sysfs as writable by the root user of a system. As a result, it is possible for the root user of a system to completely brick a system with a non-conforming UEFI implementation (specifically some MSi laptops) by using the rm command to delete the /sys/firmware/efi/efivars/ directory, or recursively delete the root directory

[swift root]

Prevents the exploit, @dusty flint

[dusty flint]

is it remote code execution?

the exploit

[swift root]

Talking too much about how it works and what it does isn't a great idea

[golden gust]

I mean, that's literally an old af big

[ashen nacelle]

POKE 59458,62

[left swift]

big

[ashen nacelle]

he means bug

[golden gust]

up

ur mandem

[obsidian rose]

Iris Shader mod discord released an announcement on the exploit with full details.

[left swift]

cat goin crazy

[ashen nacelle]

after work imma go to my otaku cave.

[obsidian rose]

People need to update to the new paper and fabric apparently.

[left swift]

wow really

crazy

[foggy silo]

Well yea, it effects clients too.

[void void]

how?

[swift root]

Full???

[mild rune]

The same way it effects servers

[foggy silo]

It's a logging issue.

[pliant yoke]

Wonder how long it will take Mojang to update vanilla to patch it then

[mild rune]

1.18.1 will probably patch it

[foggy silo]

Looks like it

They posted the source

[magic river]

1.18.1 was supposed to release tomorrow so...

[foggy silo]

I can dm you it, but it's in chineese.

[swift root]

Mind dming me ?

Appreciate it

[obsidian rose]

Yea below their post they linked to a site detailing everything. Need a translate tho.

[quasi valley]

today*

[left swift]

why would they

[peak ginkgo]

This server is on fire lmao

[left swift]

its safe here dejay

[ashen nacelle]

DeJay late to the party

[left swift]

dont go to the help chats

[foggy silo]

For real x)

[left swift]

full of even more people who cant read

[magic river]

If that's the one I'm thinking of the PoC is only the vulnerable application, not the remote side that exploits it

Although it will teach you how to do at least part of the exploit so don't share it here

[obsidian rose]

Iris shader mod discord now has a channel to discuss it lol

[ashen nacelle]

OOF electroniccat
Using arch in a VM.
Bad Bad Bad NO NO NO NO.

[peak ginkgo]

i hate that this is supposed to be like a

"hey lets fix it silently and ask everyone to update"

now everyones like "no :)"

Iris and the Fabric Discords literally saying word for word what the exploit is

Noone can fix anything responsibly 🙄

[formal turret]

¯_(ツ)_/¯

[foggy silo]

Well just be smart and update ur stuff x)

[left swift]

fabric being responsible?

[void void]

i still dont know how its done lol

just know what it does

[ashen nacelle]

the idiots that refuse to update will be in a world of hurt.

[mild rune]

just update it for them with the exploit

[foggy silo]

Well of course they don't wanna say how

But, you can pretty easily find out.

[charred sleet]

how do i exploit

[limber knot]

not

[foggy silo]

😄

[limber knot]

already fixed

[ashen nacelle]

https://tenor.com/view/cyberpunk-hacker-gif-5648977

[foggy silo]

First

1. Wipe drive

[formal turret]

i mean the fix is posted publicly in a github commit... i'd imagine someone who wants to exploit it could figure out how to do it

[foggy silo]

@author: jeff

[obsidian rose]

Nothing can be kept secret in this age, everything is out on the web to be found. Eventually it would have been learned, they just skipped the searching part.

[foggy silo]

Well here is the thing

[left swift]

99% of the people who want to exploit it dont know how to use github

[worn ember]

good

[left swift]

and that's a fact

[foggy silo]

If you fix it quietly someone may notice

And abuse it

So the best way is to publicly announce it

[worn ember]

how can they abuse it if its fixed

[foggy silo]

older versions?

[worn ember]

no u

[foggy silo]

People won't know, won't update.

Sadly it creates alot of chaos,

(having to publicly announce it)

[limber knot]

literally an @ everyone

[void void]

This exploit does nothing compared to /mv delete /

[left swift]

people wont update even if the version they're using is deleting a random chunk every 5 minutes

[worn ember]

new minigame

[left swift]

leave them to the wolves

[worn ember]

yeet a region file every 5min

[limber knot]

should've added that to valk if offline mode was on

[void void]

The exploit won't work unless you use older than java8u191

Totally exaggerated exploit

[foggy silo]

Ehhh

Not entirely

It's still important because some people are very stubborn about updating

[worn ember]

didnt they use j8u152 or something in older versions

[formal turret]

i used it like 30 minutes ago in java 17 lol

[mild rune]

The exploit just can't do RCE on newer java versions, 100% can still spam your logs tho

[limber knot]

😩 i love yuragi

[formal turret]

fun times

[tropic flame]

pog

jk

[left swift]

rce deez nuts

[formal turret]

i need to not look in here again, very distracting

[left swift]

welcome back thonk

[formal turret]

chat's too entertaining

[plucky sparrow]

This sounds like a great idea

[left swift]

see you again in 50 minutes

[worn ember]

[plucky sparrow]

Might code it

[formal turret]

we'll see

[ashen nacelle]

other news Netflix imposes harsher restrictions on VPNs, Residential IP addresses

[tropic flame]

you just need to install FAWE, it does that for you already

[worn ember]

0.5btc for links to the exploit (for legal purposes this is a joke so jroy dun ban me)

[foggy silo]

🤑

[tropic flame]

to be fair though I've never actually had any issues with FAWE so I just said that for the sake of memes

I like FAWE

it solves a problem people have

[plucky sparrow]

this sounds like #politics

[worn ember]

.fawe

[limber knot]

https://cdn.discordapp.com/attachments/555469074080202765/682698598013468690/unknown.png

[left swift]

[peak ginkgo]

cannot believe i've never seen .fawe before today

[worn ember]

ur welcome

[left swift]

city left the discord again right

we can make fun of them for a few weeks

[worn ember]

the original was an svg i made lol

[swift root]

City leaves with the seasons

[tropic flame]

i don't want to say anything, since other dude got banned here for simply saying they arr'ed Visual Studio... but... the industry could just not impose geographical restrictions 🙄

[void void]

I really wonder why they hide the explanation of the exploit that doesn't work ... just to stimulate people's curiosity

[plucky sparrow]

This might actually be the reason air is more premium now, and not Naomi leaving

[peak ginkgo]

Bad people lurk this Discord for the smallest inkling of Paper fucking up purely to cause chaos

👍

[tropic flame]

no need for VPN if the show i want is available to me

[foggy silo]

^^^^

[left swift]

yeah like ded

[peak ginkgo]

So it's definitely better to just shut the hell up, even the people who know exactly how to do it

[left swift]

hes a terrible person

[peak ginkgo]

And everyone KNOWS somethings wrong but only the actually smart people will figure it out.

[ashen nacelle]

arr'ed?

[peak ginkgo]

Because most of those bad people are skids.

[tropic flame]

https://youtu.be/i8ju_10NkGY

[worn ember]

im not smart and i figured it out

[void void]

Sad Minecraft community reality

[foggy silo]

^^^^

[worn ember]

why do you care so much

[lapis marlin]

what all does this exploit do? it seems real bad

[ashen nacelle]

wait somone got banned because they pirated visual studio

[tropic flame]

of course what i meant is that they sang the Lazy Town song while they legally purchased a Visual Studio license

[lapis marlin]

I run purpur so I have to wait for the update but

[foggy silo]

#paper-help read pins

[worn ember]

quick someone hax him

[ashen nacelle]

https://tenor.com/view/hacked-hack-computerhack-virus-computerglitch-gif-14411709

[zealous cradle]

Does this exploit apply to versions below 1.16?

[left swift]

yes

[ashen nacelle]

1.12+

[swift root]

I'd say be careful with anything newer than 1.6/7

[void void]

I mean I think they didn't have to ping everyone if almost all the exploit does is console spam...

[spice crane]

wAIT

[swift root]

It can do worse on older stuff.

[spice crane]

bro

[worn ember]

code injection if i understand correctly

[void void]

But java 8u191-

[spice crane]

bruh

[potent magnet]

chunky worth using? on an smp on weak hardware

[left swift]

the exploit stabs your kids

[spice crane]

log4j has a Rat

ez

[swift root]

Yes

[worn ember]

basically

[lapis marlin]

yikes.

[spice crane]

the exploit allows people to remote access ur fucking computer

lmao

[limber knot]

no

[spice crane]

and some other

[lapis marlin]

lol no way

[spice crane]

injection shit

[potent magnet]

the task keeps taking longer and longer lol

[spice crane]

bro

[potent magnet]

how many chunks should I load

[spice crane]

its been patched on paper

i h o p e

[potent magnet]

oh I just realized I did way too many

[left swift]

bro!

[worn ember]

yeah

bro

[potent magnet]

if I cancel will it take what I've loaded now

[void void]

Only 1.18 tho right?

Or 1.8 and up?

[spice crane]

i think

idfk

[left swift]

bro aliens injecting ur java into paper with code rats bro!

[spice crane]

ur java into paper

what

[limber knot]

1.16.5, 1.17.1 and 1.18 have gotten the patch

[foggy silo]

They are talking gibberish

[worn ember]

https://tenor.com/9jB8.gif

[spice crane]

nah bro

the arch linux users injecting code into paper

:trole:

[limber knot]

there's no RAT

it's an RCE

[spice crane]

rat

log4j rat!!!

imagine ratting

[left swift]

ayo mods

[spice crane]

rce

[void void]

No

Not really

[tropic flame]

what

[ashen cliff]

🐀

[shrewd fjord]

Ok ..word is out amongst the boys https://www.reddit.com/r/minecraftclients/comments/rcriky/how_to_exploit_log4j/

[swift root]

1.16.5 and up

Oops didn't load chat

[void void]

Oh nice Alr thanks for letting me know

[swift root]

Totally overrode Naomi

[left swift]

yo larry

[swift root]

oy mana

[left swift]

that guy posted reddit

can u permban him

[tropic flame]

reddit

let me say this, it makes sense that Fabric discord is discussing the exploit since it's a server for modders, but this is on reddit now?

[swift root]

Reddit?? Who dares

[tropic flame]

someone just send a rickroll to them

[ashen cliff]

Or this:

They should get it.

[shrewd fjord]

I didn't post that ..I just found it btw and thats a post in a 'hackers' sub

[left swift]

damn that's a fat rat

[tropic flame]

i know

[ashen nacelle]

thats a fat rat

[tropic flame]

DAMN

thicc rat

[worn ember]

skids will use anything they can get their hands on

[ashen nacelle]

https://tenor.com/view/extra-thicc-extra-thicc-thick-extra-thick-gif-21812607

[worn ember]

even tho it wouldnt be useful for 99% of them cuz they cant even write code to inject

[quasi valley]

@static badge

[left swift]

kenny

shut up

[potent magnet]

how many chunks should I preload

[void void]

Do you know how to inject code into java

[worn ember]

5

[ashen cliff]

https://posili.me/i/2021-12-09_23-06-52.png