general

[jolly gull]

Avocado oil > Olive oil

[golden gust]

eat the rabbit food?

[rustic valve]

Do you flip your pancakes with one hand, or two?

I have always meant to ask, but in my eight years of popping around, I never have 🤔

[foggy veldt]

Oh it’s for rabbits

[merry talon]

also what you should do to other kinds of leafs

notably spotted ones

[rustic valve]

Burn them

Then flip them around

And sprinkle with some spice

[void void]

https://github.com/notrhys/Log-4J-Exploit-Fix

[shadow light]

darn you... know i am going through CDC and FDA websites to find something

[void void]

patch

[foggy veldt]

Have never seen a spotted one they only appear semi annually

[golden gust]

as a brit

I don't get why we conquored the world for spices

Like, our bread is already spicy enough

[rustic valve]

Because spices can always get spicier

[coarse lily]

Olive oil is basically magic

[void void]

it does

its from very good developer it patches

[rustic valve]

If you crash the filter when the filter filters, does the filter filter the next thing to filter? 🤔

[long bronze]

contexto

[jolly gull]

If there were a physical war between Minecraft versions, what version would you attribute to what?

I'd attribute 1.8 to the Anglo-Saxons and 1.18 to the British

[long bronze]

que paso

[rustic valve]

My non-developer ass with my 20h awake and sick brain isn't able to come to those thoughts. That requires some basic level of knowledge and understanding.

tsk tsk

Expecting things from me

[jolly gull]

Existing requires a basic level of knowledge and understanding

[rustic valve]

Not really

You could be Broccolai

[shadow light]

1.2001 is the US

[rustic valve]

❤️

[jolly gull]

What is 1.2001

[stiff wadi]

1.12.2 maybe

[foggy silo]

Oh my gosh paper help has finally become peaceful?

[rustic valve]

Let's invade

[golden gust]

oh gee, thanks for letting me know

[grave axle]

lol yeah it was getting dumb in there earlier

[stiff wadi]

brigade!

[foggy veldt]

Wait until the next timezone wakes up

[rustic valve]

That's wrong. You also have to ding the bell

[shadow light]

@jolly gullit was a bad joke about the US

[foggy silo]

Oh no…. 🥴

[jolly gull]

ok

[foggy silo]

Thankfully I’ll be sleep!!

Cat… when do you sleep lol?

[void void]

Can this plugin fix a problem for client side of my players https://github.com/notrhys/Log-4J-Exploit-Fix likee noone can infect players on my server?

[jolly gull]

#paper-help

[rustic valve]

Don't know

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[rustic valve]

Should ask someone who can help

[lilac notch]

what will happen with versions 1.7 and 1.8

??

[jolly gull]

no

bad

[foggy silo]

Nothing

Because we don’t support them!!

[coarse lily]

For Paper? Nothing. Paper doesn't support old versions.

[foggy veldt]

Why don’t you guys just tell people if they use the exploit they’ll be banned

Old problems require old solutions

[void void]

Hi jheyson, can you send me link of jhdev discord in dm please

[jolly gull]

Paper > Spigot

[stiff wadi]

imagine being forced to go back to spigot because of an exploit 💀

[rustic valve]

God tier idea, you're managerial material my friend.

[shadow light]

@lost sailpaper pulls from spigot for base code

[golden gust]

We're not going to setup build pipelines for stupidly old versions just to push out a release

there is already mitigation instructions in #paper-help

[tropic flame]

Of course, people can do that themselves by forking Paper. Have fun, y'all 😄

or follow the instructions yeah

[zenith gust]

From what ive heard, those versions dont have this issue

[rustic valve]

My computer is saying it's hot. But I'm not running anything 🤔

Maybe it should understand it's winter.

[tropic flame]

the issue might go as far back as 1.6 which was when craftbukkit started using Log4J

confirmation still needed but yeah

[void void]

ban them after they've rootkitted your server with RCE 😎😎😎

[foggy veldt]

How do I patch exploit on spout

[tropic flame]

1 - RCE server
2 - get banned
3 - unban yourself because you did RCE prior
4 - server owner: ??????
5 - no further explanation

chad

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[tepid ridge]

I vote we create a botnet that uses the RCE to issue a patch for the RCE 😎

[void void]

weon arreglen ya eso, quiero jugar en holy weon por la xuxa arreglen la 1.7 y 1.8 par de weones

[foggy silo]

This is paper btw

[tropic flame]

Spout... have fun

[foggy silo]

English

[void void]

use the RCE to patch the RCE 🤩

[void void]

weon fix that now, I want to play in holy weon for xuxa fix 1.7 and 1.8 pair of weones

[warped thunder]

this should fix

[foggy silo]

What.

[void void]

wtf

[tropic flame]

i don't think your south american Spanish insults translate well into English, I'm sorry

[foggy silo]

Sorry we don’t support older versions

[foggy veldt]

Holy fuck I just checked spout repo zml is everywhere

[tepid ridge]

google translate says that is english, not sure I believe it though

[foggy silo]

Fr

[fast turret]

https://github.com/jacobtread/L4J-Vuln-Patch

[void void]

omnipresent zml

[rustic valve]

But also leave a function for itself to run, you know, in case 😉

[void void]

i want play holy

so

fix this please

asp

aspa

[rustic valve]

Why don't you fix it?

[foggy silo]

Please read pins in paper help

[tropic flame]

CVE-2017 was, obviously, filed in 2017, not 2021

it is not this issue

[fast turret]

its the same issue

its the same cve

the issue has been present since then

[shadow light]

FYI, I am on a chat with a buddy at MS. "Unofficially" there is little potential from them to "fix" the issue on their side as the "effected" versions of java are "not supported" in the current release. Disclaimer, he is not in that department and is getting his info second/third hand.

[tropic flame]

so a RCE has been present for 4 years?

[faint wing]

that's wrong

[tropic flame]

#paper-help message

[faint wing]

this is not CVE-2017-5645

[spare venture]

paper general

[tropic flame]

sorry but it is not the same issue

[waxen panther]

i don't think that's true

they'll bump log4j

[fast turret]

The exploit is literally the same exploit

[void void]

a friend of a friend of a friend of a friend

that doesn't seem true

[spare venture]

dude

[potent fossil]

inb4 buddy works in first level support

[spare venture]

have you been living under a rock

[tropic flame]

RCEs are not all the same and this one is literally not the same issue. there is no CVE for the current issue as of yet

[shadow light]

yes it does

[void void]

i dont want be hacked D:

help me please

[spare venture]

mojang literally backported fixes this year

[void void]

i dont want lost my accounts

pls

help

[tropic flame]

"source: Dinnerbone is my neighbor"

[spare venture]

they will fix it since it’s a security issue affecting their game lol

[void void]

a team like ms could probably replace log4j as a dependency pretty fast t

or just fix it lol

[potent fossil]

wish paper would just enable guild-wide 1 hour slow mode and call it a night

[fast turret]

its very deeply rooted

[spare venture]

yes it does

[tropic flame]

it's been way more peaceful than a few hours ago

[void void]

same

[warm anchor]

Let’s not share poc

[foggy silo]

^

[waxen panther]

rce is only present on old versions, crash still works on modern versions, afaik

so its still an issue lol

[spare venture]

well it also can leak IP addresses

[warm anchor]

I can read Chinese and the post is literally a step by step guide

[waxen panther]

@twin lagoon best michael

[foggy veldt]

Oh pinned should probably be updated then

[warm anchor]

…

[foggy veldt]

I thought it was just console spam so I was like no biggie

[twin lagoon]

BEST brocc

[foggy silo]

Cutest Michael!!

[twin lagoon]

[waxen panther]

[warm anchor]

Let’s spam paper chan

[foggy veldt]

Make paperchan do gwiyomi

[spare venture]

mods

[foggy silo]

Makes love paperchan!!

**mods

[merry talon]

if they have this in their FAQ

it's definitely MLM

[potent fossil]

props to MLMs for getting so many dumbfucks to work for them for literal slave wage but also fuck MLMs because I hate MLM people

[fast turret]

ill update it then

[potent fossil]

with a passion

[merry talon]

they think they're doing such a good thing

[potent fossil]

my brother's girlfriend is balls deep in Monat, the skincare/haircare MLM

god she's so annoying too

[twin lagoon]

pimple

[merry talon]

oof

[potent fossil]

I think she's dropped like 2 grand into it and made maybe 300 profit

but she's convinced it's a great job

[shadow light]

i could use a haircut

[waxen panther]

keep me informed

[foggy veldt]

My grandmother is super into Avon but I just let her do it, it gives her a hobby

[potent fossil]

"hello i work office 365 helpdesk first line support and i can definitively say that m$ will not be patching this issue"

[shadow light]

sorry, didn't notice i had the "reply" clicked

[waxen panther]

[shadow light]

my mom did that... "she was required to say "Avon Calling" when going to a door

[potent fossil]

my response to any and all MLMs

[warped thunder]

anyone know how to check minecraft logs

[waxen panther]

logs/ folder

[swift root]

You just read em ?

[warped thunder]

not on server

check my crash logs

im trying to fix my client on 1.12

[shadow light]

for people showing up, i just answer the door in my birthday suit.
for the ones who won't to call, I start yelling at what ever kid that isn't present about the "abuse they are reporting"

[potent fossil]

what

[restive storm]

well i get hacked if i was on a smp with just 2 people only for 10 minutes?

[waxen panther]

no

[shadow light]

nope

[restive storm]

aight

ty

cuz i was scared lmao

[waxen panther]

you're fine :)

[restive storm]

:)

[jaunty arrow]

So wait, what does this "explot" mean?

[restive storm]

idk

[jaunty arrow]

CAn someone explain it?

[waxen panther]

check pins in paper help

[jaunty arrow]

Like what happens?

[restive storm]

like he gets in your logs

[jaunty arrow]

ok

[frosty gorge]

which versions does the hack affect?

[restive storm]

hacks your minecarft account i think

[restive storm]

1.12 and up

[waxen panther]

also in paper help pins

[potent fossil]

please just go read the pins

[golden kestrel]

hands out coffee, tea, and hot chocolate to the papermc peeps
Y'all are awesome. Just saying. ❤️

[waxen panther]

can i have coffee

[twin lagoon]

apex monster

[waxen panther]

had a monster an hour ago

waking up at 10 will be interesting tomorrow

[shadow light]

not the "account"

[shadow light]

doesn't help unless we know how far away "10" is for you.

[void void]

Is it true that there is an exploit in mc?

[waxen panther]

amogus

[shadow light]

nope <-- lie

[waxen panther]

read #announcements and paper help pins

[restive storm]

oh

then?

[void void]

Oh thanks

[muted ice]

Paper la concha de tu madre

[waxen panther]

english ples

[muted ice]

Dejame entrar mis server :'c

[muted ice]

ñ

[void void]

ksa

dormiste

[muted ice]

Sal :c

[frosty gorge]

XD

la cagada

[void void]

yo no se ni que paso

[waxen panther]

paper becomes such an interesting cast of characters after an @ everyone

[warped thunder]

hacks ur pc

[twin lagoon]

<@&748618676189528155> paper general has become cancer again please fix it

[waxen panther]

give michael mod

[restive storm]

dam

[twin lagoon]

please

[waxen panther]

PLEASE

[restive storm]

i aint hoping on minecraft

[frosty gorge]

un scrip q si entras a un server que usen papermc de hackean toda la pc

[restive storm]

them

[twin lagoon]

[waxen panther]

he is a certified discord moderator

.

[coarse lily]

Michael for mod

[twin lagoon]

certified gamer

[swift root]

!kick 665455536140976129 appropriate English only please

[thorny flicker]

:raised_hands: Kicked chileanlagger#3434 (appropriate English only please) [1 total infraction] -- Larry#6086.

[coarse lily]

Certified Michael

[twin lagoon]

thank you larry very cool

[foggy silo]

Thanks

[coarse lily]

Certified Larry

[foggy silo]

❤️

[void void]

y como se que servers usan papermc? xd

[waxen panther]

😐

[swift root]

@void void inglés por favor

[void void]

oh sorry

[swift root]

Thanks 👍

[twin lagoon]

god i love larry

[swift root]

Lookin hot there mike

Correct

Yes

[frosty gorge]

hycraft hypixel zone universo holy y un monton ams Xd

[foggy silo]

English…

[merry talon]

mike

lmao

[foggy silo]

Please

[restive storm]

HEH

what is thattt

[ripe sphinx]

java versions

[restive storm]

oh

[swift root]

@frosty gorge inglés por favor

[waxen panther]

among us versions

[ripe sphinx]

(or newer)

[void void]

Afecta todos los spigots no solo paper

No entres a ningún server

[waxen panther]

man

[frosty gorge]

sorry

[merry talon]

[swift root]

!kick 777643768266489906 use English please, I've asked already twice

[thorny flicker]

:raised_hands: Kicked Upioti#4878 (use English please, I've asked already twice) [1 total infraction] -- Larry#6086.

[swift root]

It's not rocket science.

[long bronze]

a

[fathom scroll]

is this real?

[merry talon]

not at all

[swift root]

Read the pins in #paper-help - they're real

[void void]

I like chocolate

[swift root]

Me too.

[worn ember]

coco gang

[foggy silo]

I hate chocolate.

[ripe sphinx]

Well shit, just got a report of someone successfully executing the RCE on a client (1.8 j8)
was using 3rd party launcher

[worn ember]

it hates you too

[foggy silo]

That’s ok

Mutual hate!

[swift root]

Old java! Das what happens

Gotta UPDATEEE

[foggy silo]

^^

This is just fun

[worn ember]

theres literally a post on spigot about it lol

like a couple hours ago

[ripe sphinx]

I kinda want to poke him for repro steps to see what all is vulnerable

[worn ember]

https://tenor.com/view/mushmush-mushmushfun-fun-cute-wowamazing-gif-24049395

[ripe sphinx]

like doesn't MC bundle j8 with up to 1.16?

[worn ember]

ye

[ripe sphinx]

🙃

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[fresh loom]

I did that

[foggy silo]

Very cool

[ripe sphinx]

please edit the last 9 characters out of your message

or a mod can delete, that works too

[foggy silo]

Thanks

[void void]

um ok

[swift root]

@void void don't share any information about the exploit

[void void]

ok

[waxen panther]

no

[ripe sphinx]

@swift root

[jaunty arrow]

what is this?

[ripe sphinx]

Delete that

[jaunty arrow]

is this being fixed

[waxen panther]

#announcements

[jaunty arrow]

oh

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[ripe sphinx]

already has, #announcements

[jaunty arrow]

sry

wait, so its all minecraft versions?

or are some safe?

[waxen panther]

read announcements

hi den !

[ancient bolt]

@low dagger #announcements

Do not DM me asking about it

hi

[swift root]

Hi DenWav

[coarse lily]

Hi DenWav

[ripe sphinx]

Hi DenWav

[ancient bolt]

bye

[viral hornet]

bye den

[polar yacht]

looks like Lunar client patched it

[foggy silo]

Hi camm!!!

[viral hornet]

Hello!!

[polar yacht]

yup lol

Anyways the best security is to use lunar client rn

[rotund portal]

no one cares about lunar

[polar yacht]

70k players used daily

[ripe sphinx]

it's easy to patch on vanilla, you don't need a client to patch it

[rotund portal]

only 1 of like 4 of there mod devs credits mods

[waxen panther]

what is this lunar client propaganda in here now

[ripe sphinx]

¯_(ツ)_/¯

[polar yacht]

lunar client > java

[jolly pollen]

csgo ?

[potent fossil]

https://tenor.com/view/endusers-customers-end-users-programmerhumor-gif-13872480

that is all

[foggy silo]

Welcome back simple

[potent fossil]

what is reliant

[waxen panther]

cheat client

[fallow dagger]

=0

[twin lagoon]

@waxen panther

[waxen panther]

@twin lagoon

i forgot about koribroccoli

this is huge

[twin lagoon]

[regal quarry]

Will PaperSpigot update fixing the exploit in versions 1.8.8?

[waxen panther]

no

[rotund portal]

lunar client is absolute trash, they do not credit the mods they take

[foggy silo]

Outdated!!!

[polar yacht]

free use idk mane

I didn't know survival minecraft nerds hated lunar then again I quit and recently came back

[rotund portal]

https://howoldisminecraft189.today

its the 6th birthday! /j bad that people are still on here

[barren breach]

"survival minecraft nerds" lol you're definitely better than everyone man

[waxen panther]

this guy gotta be a troll

lunar stans are somethin

[vestal jasper]

@cosmic raptor hi

[barren breach]

I use lunar because it's convenient but their lack of crediting as well as trying to overcredit themselves is silly

[foggy silo]

Hi Josh!!

[polar yacht]

???????

[regal quarry]

Well, I am not going to make a Practice or HCF server in a version 1.18 with the KB so ugly that it is brother.

[waxen panther]

didnt ask

[polar yacht]

So why do you dislike lunar?

[barren breach]

"but their lack of crediting as well as trying to overcredit themselves is silly"

read

[rotund portal]

you do realize static is not normal kb?

[barren breach]

with your eyes

I didn't realize these lunar nerds could not read

[potent fossil]

wow, the call out that 6 years = 2190 days made me feel extremely old

[regal quarry]

I mean a PvP with cooldown, I will not use a plugin that eliminates that cooldown since the PVP WILL REMAIN rare with that modification.

[potent fossil]

what the fuck

[vestal jasper]

oh ok my discord client just reloaded, nice

[twin lagoon]

@vestal jasper uwu

[viral hornet]

I hate when that randomly happens

[vestal jasper]

and everything I was typing is gone

...

[foggy silo]

Pensive

[polar yacht]

still confused how a lack of creativity is a reasonw hy you shouldnt use lunar client

[cosmic raptor]

who dis

[polar yacht]

but go off

[foggy silo]

My phone is old so sometimes discord will just crash

[vestal jasper]

the person you submitted translations to :D

[cosmic raptor]

OH

yeah im still doing that, but then this exploit stuff came up lmao

[vestal jasper]

I have a question regarding one of them lol, 1s discord deleted what I was typing...

[cosmic raptor]

i will finish it lol

[vestal jasper]

The muteinfo one reads De naam van de speler om te muten. but that command doesn't mute players, would De naam van de speler. be appropriate?

[twin lagoon]

what's the original sentence

[vestal jasper]

It's having me approve some stuff and that's in the queue

The name of the player.

[jade yew]

hellooooo

[twin lagoon]

then yes de naam van de speler>

[vestal jasper]

ty

And yeah tyt, just clearing the queue now while I have it open

[cosmic raptor]

there is a few ones i had some issues with

[waxen panther]

god michael is so smart

so talented

[potent fossil]

so dutch

[polar yacht]

lunar client > java

[vestal jasper]

If there's anything you want re-worded lmk

[cosmic raptor]

Showing search results for query

[potent fossil]

okay we get it, you're a lunar client simp. but also, newsflash, no one cares so be quiet

thanks

[cosmic raptor]

i made it Zoekresultaten voor query weergeven but it doesnt feel 100% right

maybe michael can help lol

[vestal jasper]

"query" can be replaced with "input", user input

in meaning

[cosmic raptor]

input would also feel weird to translate imo

[vestal jasper]

/chelp <input, search query>

[potent fossil]

what the fuck a bolt just fell out of my chair

am i about to die

[edgy cargo]

Hello, can someone tell me if I am completely sure of my privacy and minecraft account?

[twin lagoon]

buy a herman miller

[twin lagoon]

you're fine

[potent fossil]

MICHAL I CANNOT AFFORD

[twin lagoon]

did i ask

[potent fossil]

fine, donate

[twin lagoon]

@waxen panther buy a herman miller ?

[waxen panther]

nah

i like my chair

[fossil patio]

michael

[cosmic raptor]

none of you can top my chair

[fossil patio]

[twin lagoon]

send more void pictures

[waxen panther]

TRUE

[foggy silo]

Hi Paul!!

[fossil patio]

i don't' have any new ones :((((

I will take new ones after tomorrow

[waxen panther]

we want void pics we want void pics

[twin lagoon]

get new ones

[waxen panther]

wtf

you hate us

[twin lagoon]

wtf

you hate us

[fossil patio]

well

i love you michael

[waxen panther]

WTF

ok .

[foggy silo]

Based

[fossil patio]

BroFrickenSucks

[twin lagoon]

where is my merch paul

[waxen panther]

BroFrickinFricks

ammirite

[fossil patio]

good question michael

i think i found it

[waxen panther]

my wumpus plushie has been dispatched

my friend and i are going to set it on fire and frame its burnt corpse

[twin lagoon]

[fossil patio]

@twin lagoon did void steal your merch?

[twin lagoon]

@storm vale where is my merch on god fr

[potent fossil]

ok i rebolted my chair

[cosmic raptor]

i had a bolt fell out my old chair

im still alive

[waxen panther]

i need to be rebolted

[fossil patio]

i fall out of my chair all the time tbh

[edgy cargo]

Is the hack to the pc or minecraft account real?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[fossil patio]

where's /broccoli

[waxen panther]

so true

posts large

[viral hornet]

/broccolai

[fossil patio]

[waxen panther]

should add the broccolai stop bot here

bug-less bot

[vestal jasper]

how tf do I submit translations

[cosmic raptor]

ask glare, i made him add dutch so i could do it

[waxen panther]

ok

[waxen panther]

perfect

[edgy cargo]

Is the hack to the pc or minecraft account real???

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[vestal jasper]

ah figured it out

[gentle nest]

A lot of people in my country prefer 1.8 cause of the cheaper hosting
If our server could hold like 150 ppl in 1.8, now we can barely hold 50 with a stable tps

[waxen panther]

ok

[twin lagoon]

ok

[vestal jasper]

ok

[twin lagoon]

paper does not care about your socio economic status

[vestal jasper]

uwu

[twin lagoon]

uwu

[foggy silo]

uwu

[languid karma]

🥳

this servers favorite mc version

[cosmic raptor]

https://tenor.com/view/monkey-calculate-silly-count-calculating-the-fucks-i-dont-give-gif-15710300

[foggy silo]

😳

[summer marlin]

what is the effect of the current exploit?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[languid karma]

yea i am not logging on for a while just to be safe

[slender blade]

Why dude

Whar happened

[languid karma]

r u being sarcastic?

[slender blade]

I had exams

I was inactive for a while

[languid karma]

new zeroday mc exploit

[ripe sphinx]

.

[potent fossil]

which is already mf fixed

christ

[slender blade]

What is it

Duh

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[slender blade]

What was it's effects

[potent fossil]

please. for the love of god

read the pins

[slender blade]

Which 1?

[waxen panther]

😐

[slender blade]

Which channel i mean

[waxen panther]

it literally says in the message

[potent fossil]

[slender blade]

Ok

[serene bolt]

#gifs-and-memes

[potent fossil]

best pure

[autumn bobcat]

sorry

[storm vale]

lol

[waxen panther]

and where is mine ?

this merch that i totally know a lot about

[merry talon]

wait what is this exploit

and how do i fix it on my 1.7.10 server

[raw dock]

update to the new patch update

[magic river]

[raw dock]

398 i believe

[rare umbra]

hola señores

jijija

[raw dock]

how does the exploit work?

ty

[nimble basalt]

does paper 1.16.5 have the fix inside?

[golden gust]

#paper-help pins

[atomic hatch]

wait, this exploit can run commands on client side?

[void geyser]

yep! cool isnt it?

[atomic hatch]

oh shit

okay, and how can I prevent it?

[hearty canopy]

when a formatted string gets sent to a client or server log4j2 executes it creating rce

[hearty canopy]

add -Dlog4j2.formatMsgNoLookups=true to your startup flags

[atomic hatch]

but its is for 1.17+ is not?

[void geyser]

only way to prevent it on clientside is to add that JVM argument above yes

[hearty canopy]

1.7+

[magic river]

Some people have been saying that flag only works on 1.17+

[atomic hatch]

yes

[magic river]

Apparently Mojang didn't update log4j2 for a while

[hearty canopy]

oh well

[magic river]

So even though log4j2 had releases with that flag in 2017 Minecraft didn't use those versions

[hearty canopy]

just wait a few days ig spigot and paper have already updated

[upbeat kelp]

does this log4j2 bug affect clients

[void geyser]

clients AND servers

[upbeat kelp]

oh shiz

[hearty canopy]

oh no lol

dont use it

[void void]

lol you can look at the code

if you'd like?

or I can ss and show you.

[void geyser]

ah yes, a random person posting random jars.... that's a good way to get your stuff taken

[void void]

Or you could decompile it.

And find out that all the plugin does it check if a packet matches a pattern

    private static final Pattern EXPLOIT_PATTERN = Pattern.compile("\\$\\{jndi\\:*.*\\}");

    private PatternChecker() {}

    public static boolean isExploit(String message) {
        if (message == null) return false;
        return EXPLOIT_PATTERN.matcher(message).find();
    }

this is legit all it does.

[golden gust]

Please do not share random jars

[void void]

Alright.

[void geyser]

so shady

[hearty canopy]

yes clearly all it does

[void void]

LOL

Thats protocolib

[fleet matrix]

lol, im still use spigot 1.12.2

[hearty canopy]

mhm ok

[void void]

Bruh

LOL

[neon locust]

Que fue mano

Llego mcy

[polar yacht]

Lunar client already fixed the exploit

[neon locust]

Oe y mis panas de mcy 😭

@void void

[swift root]

@neon locust inglés por favor

[neon locust]

A ok

Sorry

[swift root]

Not a worry, just keep it English

[polar yacht]

Do we know of any mc server that was actually hit with this exploit? @swift root

[fast turret]

yes

[swift root]

Yea

[fast turret]

like all popular ones XD

mineplex, hypixel

[polar yacht]

Tot he point where players lost accs to their accounts etc

[swift root]

I'm not sure of the specifics. Also not exactly sure why the rumour is the exploit locks people out of accounts, because it doesn't necessarily do that

[viral hornet]

bruh

[spare venture]

lol

[swift root]

@lost sail are u ok

[golden gust]

It was me that removed it.

We don't want people sharing exploit info.

We don't care

We do not wanna have to vet every piece of info, please do not share it

bye

[swift root]

I didn't even delete it lol. Be nice

[golden gust]

!ban @lost sail Go elsewhere

[void geyser]

lmao rip

[thorny flicker]

:raised_hands: Banned ajvpot#9591 (Go elsewhere) [1 total infraction] -- electronicboy#8869.

[spice ether]

rip

[viral hornet]

hahahaha

[spare venture]

he had a way with words

[raw dock]

https://tenor.com/view/thanos-finger-snap-disappear-gif-13174976

[mint isle]

i was just playing hypixel skyblock now im scared that i will get hacked

[spare venture]

how did you get here

this isnt exactly hypixel help chat

[mint isle]

someone posted a link in a server im in, it had the link to this server and a little info about the chat bug

i need more information like do we need to click on the thing for it to hack us or can the just send it and hack us

[magic river]

Wasn't that one of the avo dudes?

[mint isle]

what

[upbeat kelp]

noyes

[magic river]

The banned guy

[merry talon]

yeah

that's where i knew him from too

[mint isle]

so like if we were to turn off chat will we be fine

[polar yacht]

mans got ratted

[mint isle]

im so confused and a bit worried

[swift root]

You should be fine unless you were playing on like 1.8 Minecraft client

Even then, you should still be fine lol

Pretty sure hypixel handled it in their end. Maybe

[magic river]

Every version before 1.17 runs with Java 1.8.0_51 on the official launcher 😄

[mint isle]

im playing on 1.8.9,

[merry talon]

oh boy

[magic river]

iirc they didn't update because of some bad interaction between newer JVMs, LWJGL, and the Intel driver

1.17 rewrote the renderer and dropped support for the iGPUs that were getting broken by that so they didn't matter anymore

Well, "rewrote"

[cosmic raptor]

@vestal jasper I've finished with the translations. Wouldn't hurt to let someone else fact read it tho 🙂

[mint isle]

ok i just need an answer to my question yes or no. Will i be fine if im playing on hypixel 1.8.9

[magic river]

hypixel probably filters it out but we aren't hypixel so... ¯_(ツ)_/¯

[mint isle]

ok

thanls

thanks

[merry talon]

why in the hell would you play on 1.8 when hypixel supports the latest version

[magic river]

It sounds like if you run a vanilla client it's patched already too, at least for some MC versions

[merry talon]

i don't get it

[viral hornet]

Restart & update your clients yo https://i.imgur.com/4xphmpR.png

[mint isle]

it is optimized more, more frames

[viscid wedge]

Avo as in Avolition?

[magic river]

Yeah

[viscid wedge]

Haven't heard that name in years

Which one was it?

[magic river]

Uh, he has the same name 😛

[mint isle]

also is the bug in optifine

[magic river]

optifine isn't a vanilla client so maybe

[vestal jasper]

tbh you and michael are the only two I know that could do so, I was just cross referencing with google translate earlier

but google's not very good with translating meaning, it just translates words

[cosmic raptor]

Yeah force Michael, good idea

[viscid wedge]

Oh. Here I was thinking Storm_Surge or Krysk made an appearance lmao.

[cosmic raptor]

I'm sure I might have made some mistakes. I tried my best tho!

[willow robin]

You could use DeelL instead :P translations are a lot more accurate.

[golden gust]

https://tenor.com/bqHnw.gif

[quartz rivet]

Boop

[foggy silo]

Gn paper, I’m dead now.

[mint isle]

so do they have to paste the specific script to hack people

or can they mask it with text

[fossil patio]

https://twitter.com/slicedlime/status/1469150993527017483

slicedlime (@slicedlime)

A critical security issue has been found that affects Minecraft. If you have the game running, please shut down all running instances of the game and Launcher and restart - your Launcher will automatically download the fix.

Twitter · Dec 10, 2021, 3:44 AM

[quartz rivet]

Hi, Dead now. I'm dad.

[void void]

I added a check for that

[mint isle]

do I need to say something for them to hack me

im so confused

[void void]

no

They log on your server

they have TCP server setup

they send a message in chat

boom your server is backdoored and all clients on server are backdoored

[mint isle]

wow

so

on a website my friend found it says servers would be shut down while they fix the issue

[half hawk]

its already fixed, see #announcements

[warm anchor]

[mint isle]

is it fixed for optifine, vanilla, or versions before 1.17

[warm anchor]

we are not optifine

[half hawk]

its fixed for vanilla (only 1.12+) and paper (see #announcements)

[mint isle]

ok

[magic river]

The way mojang fixed it means it'll probably be fixed if you use optifine via MC launcher but no promises, I haven't tried it

Before vanilla was just accidentally hard/impossible to exploit (at least on Windows) but installing optifine broke that

[mint isle]

oh

is there a paper version for 1.8.9

[magic river]

No

[mint isle]

oh ok

[magic river]

See #paper-help pins

[royal crown]

Does anyone know of any spawn protection plugins that have updated to support 1.18

[magic river]

Ok

[warm anchor]

essentialsx-spawn

[royal crown]

Alr

[golden gust]

theres also mitigation for 1.8.8 if you actually go read the pins

[viscid wedge]

cat, #general is barely literate on a good day

you're expecting too much from end users

[inland latch]

a

[magic river]

The mitigation you gave for 1.8.8 is what Spigot did in their build and what Mojang did for the client 😄

So yeah, people have to manually edit a file but they're getting the same thing

And it's 1.8.8, being a PITA is a part of it at this point

(Pretty sure you already know that, just saying it so others can see)

[ivory light]

https://twitter.com/slicedlime/status/1469158122476478472

slicedlime (@slicedlime)

We've now released a third release candidate for Minecraft 1.18.1 to fix a critical security issue: https://t.co/06KXTzRJVv

Twitter · Dec 10, 2021, 4:12 AM

[half hawk]

neither, its a log4j bug

[magic river]

We got log4j2 via Mojang though

So it's their fault 😛

tinylog ftw

The CVE says log4j 2.0 had it

So.... like 2014?

[spice ether]

yikes

[magic river]

Nope, not saying that one 😄

[viscid wedge]

There's an embargo on discussion of that

Look elsewhere.

[potent fossil]

@void void

ugh

<@&748618676189528155>

Stop.

[serene bolt]

!warn @fringe void don't post exploits

[thorny flicker]

:raised_hands: Warned Febzey#1854 (don't post exploits) [1 total infraction] -- Puremin0rez#1337.

[static badge]

POGGERS

[potent fossil]

It's already public info, you're not some genius mastermind. We just don't talk about it here

congratulations

[ornate scarab]

is 1.16.5 patch build has released?

[magic river]

#paper-help pins

[potent fossil]

Dude

[swift root]

read the pins in paper-help

Further information is restricted for now

[magic river]

Why do we want to stop people from telling others how to exploit it? I wonder...

[potent fossil]

Because there are kids like you in here who want to use the exploit to cause chaos, so we don't talk about it here

[swift root]

No, and that's not really up for discussion

[serene bolt]

that's wonderful, this isn't the place to be curious about it

[golden gust]

Because we aim to follow several rules, e.g. discords ToS, the responsible disclosure policy, etc

[serene bolt]

for learning purposes

[half hawk]

i've seen many spanish speaking people in this discord today. is that normal? common?

[potent fossil]

Alright I'm going to go play AC. Have fun peeps

[raw dock]

as long as the server is running the fix, we shouldn't need to add the fix to our client startup arguments im assuming?

[swift root]

Not usually, but there was an everyone ping

[serene bolt]

we've had a broader range of community chatter today due to the issue at hand, I wouldn't say it's normal

[golden gust]

Please read the pin, ted

#paper-help

[half hawk]

ah well that makes sense. its cool to see people from all over the world

[mighty storm]

all joining together to break every possible rule and ignore every possible announcement channel, truly a sight to behold!

[potent fossil]

it's like update day but worse

[spare venture]

what version is your server on...?

[potent fossil]

read. the. pins. #paper-help

[spare venture]

1.17 isnt the latest version

[mighty storm]

update days we just have ETAs, tolerable, here we have people asking how to hack people's servers

[true canyon]

Then you'll never know

[potent fossil]

lmao i hate people

[true canyon]

Tragic

[mighty storm]

i mean, I appreciate the honestly, but yikes

[true canyon]

Defeated by reading a paragraph

FATALITY

[mighty storm]

our time is as important as yours, just read what we've already written

[true canyon]

Great effort was put into those words.

[raw dock]

thanks

[viscid wedge]

forgive me, but you are legitimately an idiot. update your jar.

[mighty storm]

pain

[serene bolt]

ok but the toxicity isn't needed either

[swift root]

@viscid wedge be nice :( people annoying you isn't a good reason to attack them

[potent fossil]

larry did you watch the new star trek

[swift root]

Oops sorry pure

[golden gust]

paper mods ganging up on poor user, more at 5!

[swift root]

Totally echoed u

[serene bolt]

:D

[swift root]

No but I will

Just watched new hawkeye

[potent fossil]

i havent yet either, im too exhausted and i feel like ill fall asleep

[true canyon]

Mod gang here

[viscid wedge]

C'mon, that was pretty tame. They were asking for it.

[potent fossil]

i just hope it's actually substantial story progress this time

[viscid wedge]

Yeah okay okay, lesson learned

[serene bolt]

I highly recommend never using "They were asking for it." as an excuse for anything

[potent fossil]

hey cat said more at 5 not more at right now

[true canyon]

It's 5 o'clock somewhere

[spare venture]

this is paper 2.0, soup

[potent fossil]

ill drink to that

https://www.youtube.com/watch?v=BPCjC543llU

[true canyon]

Actually would be funny if one of those odd half hour timezones was 5 right now.

[mighty storm]

I checked, sadly it is not

[spare venture]

there are half hour timezone shifts?

[swift root]

Yeah

[golden gust]

theres an even smaller one somewhere

[potent fossil]

i only know of em in australia

[spare venture]

my mind is blown

[mighty storm]

I see 8 am, 9am , 10am , 11 am, and 1am, and 2pm

[fallen oracle]

I'll drink to that too! Brb lemme grab a beer.

[true canyon]

Drat

[potent fossil]

grabs water

[viscid wedge]

Noted. It's not like I'd ever use it for anything serious.

But I'll keep that in mind

[potent fossil]

i need a vacation, can covid fuck off for a few months

would be nice

[viscid wedge]

Right? Haven't left town in two years.

[potent fossil]

i havent seen my fiance in nearly 3 years

[viscid wedge]

Oof. That's worse.

[potent fossil]

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[mighty storm]

aww :(

[potent fossil]

Sigh, a maven repo I used for an old project went byebye

[left swift]

papermc 3.0

[ornate scarab]

dang

[north heron]

where can i find paper for 1.16.5?

[potent fossil]

https://papermc.io/legacy

[golden gust]

see paper help pins

one on the site is outdated

[potent fossil]

oh nice

[magic river]

Legacy page gets updated manually, not via API, I think

Someone already PR'ed the change to the site but only like 2 people can deploy it

[potent fossil]

yea

[magic river]

Whenever you feel like you've really screwed up just remember you aren't this guy https://cybernews.com/security/microsoft-vancouver-leaking-website-credentials-via-overlooked-ds-store-file/

It's worse than the title suggests

They used that file to find other files in the server directory that were publicly accessible so long as you knew the path, some of those files were DB dumps

One of those DB dumps had wordpress account info in them and the passwords were hashed with MD5

It just keeps getting worse

Also this means at least one of the people who had access to directly upload files to the Microsoft Vancouver web server does so via macOS 😄

[ornate scarab]

today I watched CVS issues be like:

[fallen oracle]

Let's not share that here, thank you.

[magic river]

That was 1.8 with probably an ancient Java version too

[void void]

Can any mod dm me I need help

[magic river]

Yeah, they were using Java 6 or something

[polar yacht]

It was on a test server

Why did i get a warning lmao

[swift root]

What's up, you can say here unless you're certain it's a bad idea, in which case DM @upbeat falcon

[jade flax]

Because you were talking about exploits, of which we don't permit

[void void]

Is this
Velocity 3.1.1 #97 or higher: https://papermc.io/downloads#Velocity 1.18 version and safe and doesn't have a chance of losing your stuff/world

[jade flax]

yes

[void void]

So its the 100% safe one?

Cause I heard the worlds get destroyed?

[warm anchor]

???

[jade flax]

Velocity doesn't have anything to do with worlds

so not sure where you got that

[void void]

Oh in annoucments

[jade flax]

I would use #98

instead of 95

[warm anchor]

I've heard account got locked out and now world gets destroyed from RCE lol

[void void]

I need paper 1.18 that the world won't corrupt or anything

Or is that not out yet

[jade flax]

Paper 1.18 is still marked as experimental, backup your worlds before testing

[urban reef]

why does spigot require build tools

[jade flax]

because of the DMCA

[urban reef]

so why does paper not

and what dmca

[quick pasture]

paper ships the patches

[swift root]

That's years old drama

Very hard to summarize

[jade flax]

https://www.spigotmc.org/wiki/buildtools/#what-is-it

[swift root]

Basically it's legally necessary and paper goes around it

[magic river]

Paper ships a binary patch and a tool to download the vanilla server and apply the patch, Spigot ships a tool to decompile the vanilla server, apply source code patches, and recompile it

[potent fossil]

it is literally against discord tos to discuss it

fucks sake

[jade flax]

let's not post links that deliberately tell you how to do the exploit

[potent fossil]

dude you've tried like 4 times to share the info now

and you've been told to stop each time

[silver nexus]

lol

he has cute cat pfp

[urban reef]

paper way 1000000000000000000000x better

[magic river]

Well, yeah 😛

[void void]

Hey folks

[visual creek]

someone sent the message in chat, "not gunna post it here" and my client crashed, am i safe?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[void void]

Pretty new Java “player” here. I legit only play on iPhone bedrock but bought a 8gb server for paper and so far it’s been interesting

Anyone else have a geyser server?

[wary barn]

Does anyone know a way to prevent zombie pigman from spawning INSIDE an active nether portal?

Like a plugin or config file?

I swear they never did this before but according to forums online it's always been a thing

[warm anchor]

there is a config

or your world wasnt on hard difficulity before

[urban reef]

wait so paper is a fork of spigot and spigot is a fork of craftbukkit and craftbukkit is a fork of bukkit and bukkit was using minecraft code. so bukkit<craftbukkit<spigot<paper

[ripe sphinx]

Not quite

Bukkit's an API, CraftBukkit's an implementation

[wary barn]

This might be it... I thought it was on hard before but I guess not.

Which config file would I edit to adjust this?

As in the pigman spawning and not the difficulty

[warm anchor]

enable-zombie-pigmen-portal-spawns: in spigot.yml

difficulity should be set to hard anyway in most cases

[pastel dragon]

idk where to say this but the download on the https://papermc.io/legacy for 1.16.5 is still 790 but not the updated version of 791
apparently its updated on github https://github.com/PaperMC/papermc.io/blob/81c85ed7e7bd6ef4d50f2138ac59ea9ac1c5510e/src/js/legacy.js#L9

[ripe sphinx]

Hard reload (ctrl+F5)

[mint isle]

i have another question about the chat bug in mc. can i tell if someone is attempting to do it like if i see some weird text in the chat should i leave or is it already too late

[serene bolt]

likely a combination of CDN cache and browser cache

you can pull it from the API for now if you need it but don't see it on the site

[half hawk]

electroniccat said that the legacy page is updated manually instead of from the api, it shouldnt be a cache thing. they havent updated because theres only two people who can deploy

[ripe sphinx]

If you see a exploit message in chat, and are vulnerable, it's already too late

[wary barn]

AWESOME. Thank you so much

[ripe sphinx]

Once it gets logged, the exploit is triggered

[magic river]

iirc you want 792, not 791, btw

But yeah, I don't think anyone has deployed the updated legacy page anyway

[cosmic raft]

just deployed; it has 791 listed

[half hawk]

792 is out rn https://papermc.io/api/v2/projects/paper/versions/1.16.5/builds/792 😄

[magic river]

I think the snapshot that got used for log4j2 in 791 had the relevant changes anyway but 792 changed to the 2.15 release so definitely does

[cosmic raft]

someone want to PR to the website? :p

[half hawk]

i wanna

[warm anchor]

Free pr!

[cosmic raft]

https://github.com/PaperMC/papermc.io/commit/81c85ed7e7bd6ef4d50f2138ac59ea9ac1c5510e

this, just for 792

[serene bolt]

https://github.com/PaperMC/papermc.io/pull/132

I guess glare beat us all 3 hours ago

[half hawk]

https://github.com/PaperMC/papermc.io/pull/133/files

[warm anchor]

Nice pic

[void void]

it's about to deal with some sh-

[cosmic raft]

deployed

[half hawk]

nice ty

[void void]

fastest pr merge ever

[serene bolt]

RIP glares PR

[warm anchor]

Just like mob vote

[void void]

Does paper spigot or bukkit decrease the explosive power or duped tnt

[cosmic raft]

Sorry @fallen oracle, didn't know you had a PR already

💃

[mint isle]

also im just making it 100% positive that i can ue 1.18 vanilla and i will be COMPLETELY fine

[serene bolt]

client? yes, if you've restarted your launcher / game

[mint isle]

yes

what about server

[serene bolt]

if you use paper, yes

[ripe sphinx]

Have you updated the server?

As long as you're up to date, you're fine

[void void]

Does paper spigot or bukkit decrease the explosive power or duped tnt

[fallen oracle]

Bruh

I put so much hard work into that website pr

[magic river]

vanilla 1.18 server is vulnerable

[serene bolt]

I know you did glare, you'll get 'em next time

[cosmic raft]

It's @serene bolt's fault

[serene bolt]

:(

[magic river]

Until 1.18.1 comes out, probably tomorrow

[cosmic raft]

also, whee, velocity's page displays properly now

https://papermc.io/downloads#Velocity

[serene bolt]

Promoted Builds

wow I want this for paper

[fallen oracle]

What about the promoted builds on all tabs?

@serene bolt There you go!

[coarse lily]

Promoted builds is nice.

[fallen oracle]

I'm a magician

[mint isle]

how do i tell if im up to date

[serene bolt]

but glare... you see, there are no promoted builds

[ripe sphinx]

/ver

[void void]

Run /version in game on in the console

[fallen oracle]

But the option is there

[serene bolt]

just like how we're on R0.1-SNAPSHOT forever right :P

[half hawk]

cylindrical fog hype hype hype

[mint isle]

i tried but it said unknown command

[void void]

If you're running it in the console, remove the slash

[mint isle]

ok

still didnt work

:\

[void void]

version in console worked for me

[mint isle]

Alright, here is the question with all of the specifics just in case that helps. Can I play minecraft on 1.18 on hypixel without paper or anything like that, without getting hacked

[void void]

Mojang has pushed a fix for 1.12+, so if you restart your game and launcher, yes

[mint isle]

define restart. does that mean i just x it out and open it again or do i need to quit it in task manager

[void void]

You should be able to get the update after just closing it using the x

[mint isle]

ok

will it show like any loading representing it fixing

[ripe sphinx]

I think the launcher will have a little loady bar

[mint isle]

ok

thanks for your help

i can play minecraft now worry free

[mint isle]

1 more thing. i forgot to specify i was talking about vanilla

am i still good?

[half hawk]

hi

[coarse lily]

Yes.

[mint isle]

ok and there was no loading bar

[ripe sphinx]

that was an I think

[mint isle]

oh

ok well thanks for all of your guy's help

i gtg now

[void void]

im confused on how this entire log4j thing even came to be

who thought “hmm yes today i will implement ways for logs to invoke a builder class”

[half hawk]

overengineering and enterprise stupidity

[void void]

ah yes..beans...

[mental meadow]

I feel like things have gotten progressively worse while i was sleeping

[limber knot]

me too aurora

[mental meadow]

https://c.tenor.com/-kZOB16tELEAAAAM/this-is-fine-fire.gif

[ripe sphinx]

I mean it got better for an hour, but then it got worse again

[mental meadow]

So what you're saying is "go back to sleep"got it

[viscid wedge]

consider general a quarantine zone until further notice

It's calmed down since the ping, but there's still a lotta useless messages

[limber knot]

like this one

[void void]

from an exploiters perspective this exploit isnt really all that interesting

takes a lot to exploit and the requirements match about 0.1% of the time

[ashen cliff]

Not really.

[void void]

Yes really

[outer patio]

What does “no-table” mean

[ashen cliff]

Just because it's difficult for you, it doesn't mean it's difficult for everyone.