general

[red panther]

To prevent RCE on clients, should I add -Dlog4j2.formatMsgNoLookups=true to my client launch options?

[left swift]

if you're using latest client no

[limber knot]

oh wow formatting is broken

[latent flint]

I've been writing software since 1997 and am baffled how that happens in 2021.

[limber knot]

https://osu.ppy.sh/ss/17344677/bc6e

i am angry

got all those 100s on shit easy parts

[left swift]

trash

[warm anchor]

only if you are using older non-vanilla client that's not being patched

[left swift]

only 99.4%

smh

old naomi gets 100%

[limber knot]

nah old naomi gets 96% because she can't aim it

[quick pasture]

what 😳

[mental meadow]

[potent panther]

if a server "hacked" me before the exploit was fixed and reset my pc the possible hack stops working?

and my antivirus could have helped?

[quick pasture]

hey i only meant it as a quick fix until mojang fixed the client

its deprecated now and i link to paper-help

[potent panther]

ik

[quick pasture]

but yeah it only filters chat packets to clients

other packets can be added if you want but im not doing it xd

it fixed now (by mojang)

[reef orchid]

hold up if you join a server which didn't update to a fixed version of the exploit from a client that has the fixed version are you still vulnerable? or the client is enough to be safe?

[potent panther]

i think the client is safe

but the server not

[quick pasture]

both the client and server were vulnerable, there was a moment last night where servers were updated but clients were not

[reef orchid]

no but let's say I join from an updated client to a server which didnt update

[potent panther]

vanilla made another vaccine

[reef orchid]

am i still vulnerable

[potent panther]

no

[quick pasture]

no you aren’t

the server is

[potent panther]

but the server is

[reef orchid]

oh ok just wanted to make sure

ohhh ok gotcha

[limber knot]

https://osu.ppy.sh/ss/17344707/b3ab

noooooo

@mild rune dammit

[mental meadow]

https://twitter.com/gcouprie/status/1469276948304216077 this tweet made my day lol

Geoffroy Couprie (@gcouprie)

So. I hope you all went and checked your java applications for the log4j vulnerability this morning, right?
If not:

• do it, it's a bad one https://t.co/93TXh8bMlV
• there are minecraft servers with a better security posture than your enterprise, and I am judging you for that

Twitter · Dec 10, 2021, 12:04 PM

[warm anchor]

Kneny the security expert at paper

[jolly charm]

smort

[magic river]

All these people surprised Apple uses Java for stuff

Apple used to ship a semi-custom Java with OS X you could use to write "native" apps

They were real big on Java, inherited it from NeXT

[chrome cosmos]

knenyy better

[magic river]

iirc they dropped it after Java 6

[spice ether]

Uwu it's been stuck on updating for couple min..

[left swift]

the update fix is a hoax made by mojang to keep them in power and control the price of gas

[potent panther]

how to check that the exploit is fixed on my client?

[left swift]

yeah java 6 riots were fake news

[plucky sparrow]

They apparently take a 10%

[limber knot]

hey dap

[plucky sparrow]

hey naom

[left swift]

billion dollar nude sharing industry and discord wants some of that pie

[charred sleet]

holy guac

[mental meadow]

Win 11 is nice

[hidden dust]

sry...

[plucky sparrow]

It is

Really had no issues with Windows 11 and it ran quite nicely

[remote pelican]

but I can't move my taskbar 😭

[limber knot]

https://naomi.s-ul.eu/Vdn0kIBE guess which score is better

[mental meadow]

i always had my taskbar down

ez

[remote pelican]

aurora king

[limber knot]

can't do that on unactivated windows

[plucky sparrow]

I used to put my taskbar on the top of the screen

So it would feel like macOS

[void void]

ok

[mental meadow]

naomi why do all skins have weirdass sounds

[limber knot]

because skins can put in custom sounds

mine keeps them mostly default iirc

i use the old -GN skin

[hidden dust]

what?

[spiral robin]

@mental meadow uwu

[plucky sparrow]

uwu

[spiral robin]

wtf aurora despises me

[mental meadow]

uwu!!!

I did not look at discord for a few minutes 😦

[worn ember]

wow

[plucky sparrow]

why are you still in this server

[worn ember]

ok

[marble lark]

do I just @ aurora and say uwu every time my depression relapses

seems pretty effective

[left swift]

ded quit

ded is a valuable member of this papermc 2.0 community

[tranquil valve]

what is this exploit thing going around

[wide chasm]

See pins in #paper-help

[tranquil valve]

okay

[ripe sphinx]

delet

[tranquil valve]

what exactly happened tho

[tranquil valve]

bruh what

this is so confusing

[ripe sphinx]

Remote code execution vulnerability

[wide chasm]

A vulnerability in log4j was found

[ripe sphinx]

Read #paper-help pins

[tranquil valve]

what does that do

[ripe sphinx]

malicious people can run arbitrary code on your server

[tranquil valve]

oh

[ripe sphinx]

In the industry that's called "really fucking bad"

[tranquil valve]

wait 1.17.1 is patched up

[rare tiger]

are people still asking about this days later? lol

[tranquil valve]

yep lol

[stiff wadi]

paper logo likes to jump around a lot

[tranquil valve]

i live in the caves

[ripe sphinx]

has only been like 12h...

[brave mountain]

What do you consider is the bests file systems for a Minecraft server?

[wide chasm]

Yes, 1.16, 1.17 and 1.18 have received patches

[tranquil valve]

great then!

[rare tiger]

well yes theoretically that's like absolute worst outcome

gl trying that on any big server

[ripe sphinx]

Well yeah any big server has patched it already

[rare tiger]

or on a server that uses java 17

[ripe sphinx]

Kevin was able to get RCE working on all server versions which includes those which require j17

[rare tiger]

oofies

i wonder how Hypixel patched it when their servers are stuck on 1.8

also imagine how long this exploit was sleeping quietly

we're lucky that the person who discovered it didn't hold out

[finite swift]

sometimes i just hate node.js

[rare tiger]

solution: don't use node

shit lang 😎 im so cool

[ripe sphinx]

It's a really easy patch. Paper just cannot be bothered to backport it further than 1.16.5, which I don't blame them for

[rare tiger]

I feel like, if the patch acts upon code that has been largely unchanged over the versions, that they could do this fairly easily

But they take the whole "old versions bad" thing very seriously

I get not maintaining them but this exploit is pretty huge

[golden gust]

Hypickle forked from spigot in 1.6

and, like, they literally have a full dev team maintaining this shit

[vernal moth]

They do use paper on some servers tho

[golden gust]

Do you really think a team as big as hypickle can't do a trivial l4j update?

[vernal moth]

But yeah, hypixel is the prime example on how you use old versions

With a giant dev team and fix all the issues yourself

[rare tiger]

hypickle :)

[foggy veldt]

Why are you using globalthis for a bot

[latent flint]

C# > * 😎

[foggy veldt]

🦜

[primal charm]

@coarse lily I'd love to discontinue distributing our theme in new jars once the new version of timings has been pushed
https://github.com/aikar/timings/pull/127

Been waiting almost 5 months now 😦

[warm anchor]

people still think hypickle uses 1.8 and download plugins from spigot regularly.

[rare tiger]

quick vent: i was recruited into the shady botting world for freelance programming work a long while ago and eventually got scammed out of a shit ton of money. i did however learn, to be incredibly weary of people overly reliant on node (specifically electron) or python

there's like thousands of people making their own shit electron bot apps that all do basically the same thing

[coarse lily]

Timings was made by Aikar and he hasn't been around to test it to give it the green light, is my guess.

I can go through and take a look/test but realistically it won't be for a while. With 1.18, holidays, etc.

[primal charm]

Yeah, I'd love for it to get merged so we don't have to continue distributing new jars with it in and so you all can't complain about a changed url in the jar 😄

[coarse lily]

But I'll put it on my todo list.

[primal charm]

Sounds good 😛

[twin lagoon]

@coarse lily 🥺

[coarse lily]

Morning!

[twin lagoon]

BEST paper moderator

better than larry

@warm anchor

[warm anchor]

yes I am the best moderator

hi michael

[foggy veldt]

Your pfp always remind me of the awoo girl

[undone rampart]

is 1.18.1 considered stable?

[foggy veldt]

https://youtu.be/eGslweDOihs

[finite swift]

because i think its easier to access some variables when they're global, like chalk, config, database client or discord client

but i think its more easier to not use node.js

[foggy veldt]

Just use dep injection, you aren’t writing for browser

[coarse lily]

Larry was up until a few hours ago working way harder than me, so he probably wins

[foggy veldt]

But anyways in case you decide to use node again you appear to use es modules (typescript?) in which case the import syntax would be import chalk from 'chalk';

[spare venture]

how does one choose ALL mode instead of LAG mode on mobile version of your timings?

buttons are not there

basically unusable on mobile :\

[primal charm]

Just pull down in the top box area and it'll let you scroll to the bottom where you can select the timeframe

[spare venture]

why is it hidden

my recommendation is making that more obvious

only way to find it is by accidentally swiping in the wrong spot right now

[primal charm]

There's only so much room on mobile unfortunately, It's (at least I'd say) an improvement on the existing mobile.

[finite swift]

I'm using javascript, i prefer to use typescript but i couldn't do some things with it so i tried using JS

[spare venture]

well yeah overall it’s going to be better but if you’re going for an overhaul you should do it right

not hiding half of the menu

[primal charm]

If you make something larger or take up more screen space you're going to have to hide something else

[spare venture]

i mean just use a hamburger three line thing and have it minimized by default and expands the entire menu when clicked?

[foggy veldt]

Well the fix should be the same assuming you have “type”: “module” in package json

[primal charm]

We had decided that splitting the page into two sections and allowing scrolling through both was the best implementation for it, It's on git if you feel a different way looks far better

[spare venture]

pretty standard mobile interface

i’d recommend doing that over hiding it

[finite swift]

i'll try it, thank you

[spare venture]

yes but it is not clear or even close to being obvious that those buttons are hidden there.

[plucky sparrow]

I must admit that it actually looks better than what we currently have

[spare venture]

an overhaul should improve in every aspect, not make it worse in some. this is a spot where there is room for improvement in my opinion

[half hawk]

is dev.bukkit.org down? im trying to update worldedit

[spare venture]

use their website, enginehub

[half hawk]

ok ty

[void void]

Correct. There is a log4j config you can use in the pins, but there won't be an update for unsupported legacy software

six year old unsupported legacy software*

[spare venture]

then update

then live with the exploit

ok

[plucky sparrow]

The config in the pins is non fuctional

[void void]

Oh, mb

Still, 1.8

[waxen panther]

ok

no one asked

[warm anchor]

ok we dont care.

[void void]

^ If you use legacy versions you should accept that you're on your own

[worn ember]

i will take a huge shit later

[finite swift]

where can i download it

i need it

[plucky sparrow]

can you post pics for proof?

[finite swift]

thank you

[waxen panther]

are we gunna let people advertise their 1.8 forks in paper now

wtf is this

[void void]

1.8

[plucky sparrow]

but but his fork has optimized tnt on 1.8!!!!!

[coarse lily]

!warn 280917820781494273 Don't post links to other forks please.

[thorny flicker]

:raised_hands: Warned JH3Y50N#3269 (Don't post links to other forks please.) [1 total infraction] -- ocelotpotpie#5943.

[coarse lily]

Nope.

[waxen panther]

dam a real papermc moderator

oh

[void void]

You don't

[golden gust]

1. We've already got somebody who's said that they're going to look into it

[plucky sparrow]

that’s so unfortunate

[waxen panther]

i am also sad with you electroniccat

[golden gust]

2. We don't want people advertising other services, etc

[plucky sparrow]

they probably care so much!

[golden gust]

We're an open source community

However, we do not want people linking others to random untrusted software

then leave

[void void]

1.8 users are very entertaining

[finite swift]

But the trusted software is unsupported

[waxen panther]

average 1.8 user

[foggy veldt]

What are you typing right now though

[golden gust]

Stop mentioning

[plucky sparrow]

you mentioned cat…

[golden gust]

Disable the stupid mention feature in replies

[coarse lily]

Don't ping in your reply. cat has "no ping" in their name.

[golden gust]

and the highliht thing is annoying especially given that I have sight issues

[brave mountain]

How do I disable mention in replies?

[foggy veldt]

Press the @

[plucky sparrow]

LMAOO

[foggy veldt]

That’s one way to solve it

[void void]

average 1.8 user moment

[plucky sparrow]

[golden gust]

Please do not advertise 3rd party jars

[blazing fern]

more for informational purposes than to advertise but ok

[coarse lily]

Press the @ or shift click when you reply.

[waxen panther]

pretty the @

[void void]

very pretty @

[finite swift]

what is timings

i never understood that

[coarse lily]

Wh00ps

[hearty basin]

Could anyone send me an invite to the Magma discord server? The links on their reddit and github dont work 😦

[foggy veldt]

The time it takes to do shit

[coarse lily]

Thanks Broccolai

[waxen panther]

papermc moderator is abusing me by purposefully misspelling my name to cause me emotional distress

[golden gust]

Brokoli fomin

[brave mountain]

@ like this?

[coarse lily]

I'm sorry sir it's a proper noun it's force of habit.

[waxen panther]

askers

[coarse lily]

No.

[brave mountain]

On mobile phone?

[magic river]

When you click reply a bar shows up with the message you're replying to and "@ON" on the right

[blazing fern]

imagine complaining about pings instead of just using DND/muting them in this channel

[magic river]

Click on that to turn it off

[brave mountain]

Oh

Nice explained

[foggy veldt]

Since when does dnd disable the highlighting

[coarse lily]

It's not unreasonable to ask someone to not ping you.

[golden gust]

ask for basic respect so I can read wtf you're saying

LITERALLY THE GHESTAPO!

[blazing fern]

you mean to not to, right?

[brave mountain]

I have to do it every reply

[magic river]

Yeah

Discord sucks 😄

[coarse lily]

Exactly, yes. :)

[void void]

If you're on desktop, you can shift click the reply button

[golden gust]

it caches for a while

[blazing fern]

🏓

[waxen panther]

You cant disable pings what are you even talking about rooray

[blazing fern]

is discord good

[void void]

They still highlight in yellow

[blazing fern]

why is it changing my emotes

[magic river]

Discord is terrible all the alternatives are just worse

Except if you simplify things and go back to IRC

[coarse lily]

Smoke signals are the future.

[foggy veldt]

I love discord 🥺

[void void]

let's just return to irc ^

[golden gust]

and, like, maybe I just come from a different time period, where I don't NEED people to reply to every single message because of basic context following

[void void]

keeps all the dumb kids out

[blazing fern]

¯_(ツ)_/¯

[waxen panther]

when we go back to smoke signals im gunna send cat yellow ones

[golden gust]

and the highlight is hard for me to read

[mental meadow]

https://papermc.io/community-guidelines see point 6.

[magic river]

Reply makes me use my mouse

[coarse lily]

Yeah when you're in IRC and shit is scrolling like crazy you just get used to it.

[mental meadow]

No need to discuss that

[plucky sparrow]

@naomi we are coming

[coarse lily]

We used to not even have avatars!

[golden gust]

and so I ask for basic respect that people disable it or just not use the stupid reply feature

[magic river]

I mostly only use it when I'm on my laptop since the touchpad is right there

[golden gust]

Like, you literally need to do fuck all!

[magic river]

On my desktop that means moving my hands though so fuck that, I'll just type 😛

[plucky sparrow]

Just use teams

[golden gust]

heck, am saving you 2 mice clicks!

[magic river]

Have you ever tried to input formatting text in Teams?

[plucky sparrow]

no thankfully I barely use teams

[magic river]

It's a fucking nightmare

[foggy veldt]

Anyways I’m glad this channel is back to shitposting / dumb posts

I felt weird having to be useful

[magic river]

It doesn't actually let you type markdown, it intercepts your markdown in the middle of putting it in and replaces it with their rich text WYSIWYG system

[plucky sparrow]

It’s a worth trade, you can at least create assignments

[magic river]

Like, if you type ``` it'll remove those marks and put in a monospace text box inside your normal text box that you have to type in

[plucky sparrow]

I’ve gotten used to disabling the @ when replying thanks to cat

[foggy veldt]

What if you press tab

[magic river]

Instead of like Discord where it leaves the formatting marks in but also does the formatting so you can see what it looks like

[mild rune]

I wish discord would just let you disable replies

Like it doesn't seem like a hard feature to add lmfao

[plucky sparrow]

I wish discord let you see who replied to one of your messages without pinging

[foggy veldt]

I think replies are useful when there are 4 conversations going on at once

[finite swift]

Many features discord didn't implemented yet and some they will never implement aren't hard to implement

[golden gust]

I just wish discord cared about disabled users rather than just trivial random shit which clearly nobody who is disabled actually looked it

[coarse lily]

They can be, sure.

But you can reply without pinging.

[golden gust]

Like their option to down down the UI literally starts blending shit like buttons into one another

[coarse lily]

It'd be nice to have a toggle but Discord is dumb.

[plucky sparrow]

Remember when they removed light mode and instantly regretted it

[latent flint]

[foggy veldt]

Yea or they should make replies no mention by default because the only time you will really need to mention is when replying to something from hours ago which is rare

[plucky sparrow]

I don’t mind having replies, just add a toggle to have them not ping automatically

[golden gust]

I just want the damned option to be able to say "hey, am a blind fuck, don't highlight this shit"

[mild rune]

I never have my replies ping because I hate the pings so I assume others do as well

[golden gust]

and ideally don'tmark it as unread as I generally don't give a shit...

[finite swift]

For me pings just help me see when someone reply me

[golden gust]

I mean, i decided to make my eyes worse and somehow got an eye infection

it seems to be slowly clearing up but, just, jesus fuck

[coarse lily]

cat stop dying thanks.

[left swift]

or

[foggy veldt]

/gamemode creative

[plucky sparrow]

maybe just let him die in peace

[left swift]

gratz ocelot

masochist

signed up for torture

[jolly charm]

why did i get kicked from the discord server

tf

[void void]

A dm from @thorny flicker will tell you why

[brave mountain]

I'm on a server that the admin keeps pinig @ everyone everyday, I had to disable notifications

[coarse lily]

"Don't send seizure-inducing gifs"

[jolly charm]

oh

did i send that?

[coarse lily]

Yes.

[jolly charm]

im sorry

[coarse lily]

That's why you got kicked.

[jolly charm]

lol

[left swift]

it was my brother on my phone that did it

[jolly charm]

i didnt know

[frail trail]

(hopefully I disabled ping this time.) The blending of buttons in UIs and that bullshit "flat" design of everything makes differentiating UI elements difficult anyway. It's form over function and it's annoying

I'd probably still use old Windows classic theme if I could without any bs attached.

[golden gust]

I do love that microsoft is taking off of KDE

Like

[coarse lily]

Haha

[golden gust]

their new notepad app has so much whitespace it's annoying

[plucky sparrow]

what has changed

[lavish crest]

I miss the Windows Aero Glass theme.

[wide chasm]

They added dark mode

[frank otter]

today I rebooted my server

[wide chasm]

And made some changes to the UI as a whole

[frank otter]

and guess what

it started up without me having to go down with my bootable usb

however I forgot the command to turn off the screen so that was fun

[frail trail]

holy moly I just discovered that notepad++ has dark mode now.

it's not amazing, but it's better than when I've been in a terminal or in vscode and need to open a text file and die

https://tenor.com/view/reaction-my-eyes-cant-unsee-burn-gif-7225082

[magic river]

GNOME was the one with excessive whitespace, not KDE 😛

Although I guess even KDE had more than, like, Windows 95

[frail trail]

I was never able to get into either DE. GNOME was too simple and KDE had too much noise, or weird way of doing things. I may try again later. I just keep trucking on with macOS and Win10 (and WSL)

[spare venture]

sublime text 3

[magic river]

I can't brain today

Right, GNOME I struggle with sometimes because they don't let you configure it much but KDE just feels weird and jank no matter how I theme or configure it

Plus I'm in general a fan of the GNOME style

[plucky sparrow]

Oh that’s neat

Wish they revamped wordpad now though

[hexed dragon]

https://thewincentral.com/official-android-gaming-on-windows-10-11-to-be-a-reality-soon-as-google-plan-to-bring-play-games-app-to-windows/

[floral horizon]

an ideia since optfine is not yet patched just add ```java
-Dlog4j2.formatMsgNoLookups=true

[magic river]

Windows is going to pass SafetyNet and have the full Google Play Services?

What a weird timeline

[frail trail]

inb4 the linux x^2 + y^2 = r^2 jerk crowd comes in and tells me how wrong I am after I tried it for years x)

[magic river]

I mean, I'm using GNOME right now 😛

And still have commit access to a GNOME project that I believe is still used as a part of the "GNOME Classic" suite of gnome-shell extensions and apps

[foggy veldt]

You’re wrong

[frail trail]

git gud use arch no balls

[magic river]

It was a part of the GNOME 2 default desktop

[frail trail]

GNOME 2 was by far my favorite years ago.

[magic river]

I'm also an Ubuntu Member and former Ubuntu developer 😛

(paid developer even)

So fuck arch 😄

[humble anchor]

is 1.8 nice?

[frail trail]

I don't consider myself a developer, given I'm still trying to learn. Ignore my github link. It's mostly garbage x)

[frail trail]

It's pre-1.9 combat changes so yes

[magic river]

Some day I'm going to be less lazy and switch to Fedora Silverblue though

[humble anchor]

@half hawk what?

[magic river]

With silverblue your OS is managed via snapshots and such and all your apps are docker containers or flatpaks

[half hawk]

hi what do you need

[humble anchor]

Im considering to use it for my serevr

[void void]

don't

[humble anchor]

why did u add 😐 to my question lol

[worn ember]

do it

[magic river]

And then they have a "dev toolbox" or whatever that is a persistent environment for working on stuff but that's also just a docker container so you can put whatever distro you want in there

So I can use Fedora but dev on Ubuntu

And never have to touch RPM, yum, or dnf

[foggy veldt]

If neofetch has one million downloads i am one of them 🙋🏻. if neofetch has ten downloads i am one of them. if neofetch has only one download that is me 🙋🏼🙋🏽🙋🏾. if neofetch has no downloads, that means i am no more on the earth 😢. if the world against neofetch, i am against the world ❌🌍☄️.

[twin lagoon]

they have a similar toolbox thing going for coreos

[golden gust]

gnome-flashback #2nd best gnome

[frail trail]

I want ZFS in the kernel, because it would be great for a root fs, I think. RIP the licensing conflicts--it'll never happen :/

[blazing fern]

for shits and giggles

[worn ember]

high iq chat again i see

[frail trail]

I barely know the surface of what ZFS can do and I absolutely love it for my home NAS build.

[magic river]

The silverblue one started out as just using that one then changing it a little then they rewrote it

[half hawk]

because most people have an attitude and/or personality that tells me they are expecting proper support. since you are planning to start an 1.8 server, i assume you are going to ask questions in this discord, but as paper developers have said many times, they are not going to put any effort in supporting a 7 year old version. this usually makes people act like a dick when they don't get support.

[blazing fern]

well i mean half of this chat is people complaining about pings

and 1.8 is genuinely aight

[magic river]

iirc the CoreOS one was just a 1000 line shell script or something, really barebones

[blazing fern]

how did you get from "i like 1.8" to "i like this version thats been long depreciated and have ignored several warnings about is depreciation to tell you that i want support for this version"

[humble anchor]

✨ stackoverflow

[frail trail]

marked duplicate, -11 downvotes
(to a post from 10 years ago and has no relevance)

[worn ember]

Marked as off-topic

[blazing fern]

marked as duplicate, -47 karma

[worn ember]

they just yeeted all my posts

i had a few with over 5000 views lol

[blazing fern]

paper backports an unsupported version and is surprised that people assume they're gonna backport other version

[frail trail]

I understand if someone posts "what does cout << "hello world" mean?" but I've seen actual questions that received abhorrent replies. Stackoverflow is useful as I've been learning C++ this year, but sometimes it's depressing. I don't post. I just Google and use it that way.

[foggy veldt]

I’ve never had to ask a question on stackoverflow because all my questions usually have already been asked

[golden gust]

It's more the fact that people refuse to read the various bits of info we've left around and start acting like we really must patch it because plz!!!

[blazing fern]

i mean it is a critical security vulnerability

[golden gust]

as I've said, it's not easy for us to push out a fix for those versions as all of the build pipelines are literally gone

Literally irrelevant

It being a security vuln does not change the fact that we don't have build pipelines setup for those versions

Nor does it change the fact that we'veliterally been warning people of this shit for years

[void void]

does the vanilla minecraft log4shell patch apply to all versions?

yes

[frail trail]

Like I feel sorry for the bastard that had to push an update out to fix terminal services security bug in Windows XP in 2019. XP dropped support in Apr 2014... I'm not a dev, but I understand.

[golden gust]

XP is still maintained in a sense

Just, only for corpro shills

chances are they just deemed this one was worthy enough to issue more as a general throw out

But, I mean, they've stillgot all the tooling there setup to be able to do that

[frail trail]

Understandable. When I was in undergrad, our quantitative analysis lab equipment still ran XP. Although I believe it was airgapped. No harm. No reason to upgrade equipment that has costs with multiple 0's.

[golden gust]

Yea, that's part of the joyous thing

[frail trail]

I still keep on an old XP machine around for when I write floppies for my vintage PCs when I play around sometimes.

[golden gust]

back in the early 2010's I had to shove XP onto my grandfathers work laptop to be able to service some PLCs and stuff

and the thin is that much of this gear is managing the power towards critical infra like hospitals, so, it's not easy to justify everything to replace

[frail trail]

Old machinery that costs $100k's or more. Old proprietary ISA card to interface with. XP was end of the line. Airgap and move on. shrug

[golden gust]

Because you wanna replace that PLC? Well, now you've gotta redo all the wiring looms because the form factors have changed in the 20 years since that system was installed, some requirements have changed and while you're there, you might as well look at replacing those 30 year old ACBs, etc, etc

[foggy veldt]

I was under the impression that people who were still on 1.8 were on 1.8 because they are using a ⚡️✨high performance async customized 100tps fork of paper that they purchased for $500. Can’t believe how many people there are who are just using paper 1.8 with 0 support

[golden gust]

and, at that point, now you've got an entire hospital wing out of action

[frail trail]

the NMR computer at my university was running Windows 7 when I left. albeit heavily modified with proprietary software. NMR isn't cheap. It's cool. Not cheap. Liquid helium and liquid nitrogen is also expensive. It's a continuous cost. if it ain't broke, don't fix it...

the execs holding the purse also aren't gonna budge x)

(btw NMR is exactly the same thing as MRI) it's called MRI because people are scared of the word "nuclear".

[frank otter]

what does nmr stand for?

[frail trail]

nuclear magnetic resonance

I still barely understand it. I was much better at fourier-transform infrared spectroscopy. I've decided to move into computer science from chemistry., once I start grad school.

[daring owl]

my mod said someone joined and started spamming tthis

[golden gust]

yes.

[daring owl]

i'm guessing its blocked by anti link ttho

[mental meadow]

no

[golden gust]

and please actually use the correct channel.

[daring owl]

i mean for clients

[tired mountain]

we're freeeee

[daring owl]

#869651180698099732 ?

[golden gust]

All the info we're able to give is already in the announcements, etc

No

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[golden gust]

Youre not reporting an exploit

[meager tusk]

poor cat

[daring owl]

kk

[golden gust]

Literally all of that shit is well known

We've literally patched it

tf would we need a report to say it exists.

[meager tusk]

Cat?

Do you want me to report that bug you announced?

[pastel reef]

How do I help my friend's Celeron Laptop run Minecraft?

[meager tusk]

I'll take your lack of response as a yes.

[tired mountain]

oh no

they did publish the exploit

[floral horizon]

of course they did

its an exploit

[frail trail]

mm yes shell expansion because someone didn't scrub inputs :3

[floral horizon]

why shouldn't they

[void void]

the funny thing is if people actually followed best practices (e.g. least privileges and service containerization) then even vulnerable servers would be at relatively low risk

[magic river]

I think they even stopped XP support for ATMs

[void void]

but what can you expect from people who want support for 7 year old game software

[void void]

rip guess i gotta switch my atm to windows 11 now

helikopter helikopter

[meager tusk]

You're gonna containerize a minecraft server?

Ballsy.

[frail trail]

The last officially supported date for NT 5 was Apr 9, 2019. Of course corps could ship $$ to msft for a little longer

[void void]

i will make docker and jvm wear a big shirt together so they have to get along

[magic river]

Once someone has arbitrary code execution you should assume they also have privilege escalation and likely a container escape too

[marble lark]

oh lol that a squid game pfp

[void void]

but that's a much higher skilled attack than copy paste rce payload lol

[magic river]

This is why clouds don't use containers to separate customers

[frail trail]

same concept as "assume all firearms are loaded and dangerous and never point them at anything you don't intend to destroy, injure, or kill". Assume the worst and take precaution.

[void void]

docker escapes and linux privilege escalation are much more difficult to do

[magic river]

Instead they use custom VMs that don't fully emulate a legacy PC so they can start up in like 250ms and tooling to use them as if they were containers

[void void]

ideally you would do that but as far as setup and maintainability are concerned, custom virtualization software might be out of the question for most mc servers

containerization and least privileges with a relatively hardened linux system would be the ideal balance between security and devops simplicity for an mc server imo

[still turtle]

They will announce when a stable build for 1.18 is ready correct?

[magic river]

https://firecracker-microvm.github.io/

[mental meadow]

yes

[still turtle]

Tnx

[frail trail]

I always think this way--if someone wants in, they will get in. It's just how much time and effort they want to put into targeting an individual.

[golden gust]

containers have been busted before

[pastel reef]

You can also just check on https://papermc.io/downloads there it will say if the builds are still experimental.

[void void]

i love this solely because it's primarily written in rust

[golden gust]

they'll be busted again

[void void]

im not saying that containers are foolproof at all lol

[golden gust]

just because it's hard to do or there is no active exploit well in the known doesn'tmean that it'snot all that unheard of

[magic river]

Firecracker takes your standard docker (runC, whatever) container and bolts on a custom kernel and such below it to run it in a VM

With less than a second boot times and less than 5MB RAM overhead

[frail trail]

relevant

[void void]

oh what the hell that's amazing

[golden gust]

Okay, but

[marble lark]

lmfao

[magic river]

So you just build your normal containers then you run them with firecracker and they're actually VMs

[golden gust]

does it have a virtual floppy driver?

Cos, I really love virtual floppies

[void void]

for ingesting my mission critical virtual floppies ofc

[marble lark]

that's not the only thing that's floppy

runs

[magic river]

IT HAPPENS TO EVERYONE

[magic river]

This, along with a streamlined kernel loading process enables a < 125 ms startup time and a < 5 MiB memory footprint. The Firecracker process also provides a RESTful control API, handles resource rate limiting for microVMs, and provides a microVM metadata service to enable the sharing of configuration data between the host and guest.

[meager tusk]

What's the catch?

[frail trail]

honestly the us govt probably would've been better off leaving the nuclear system on ancient IBM mainframes.

[void void]

obscurity security 😎

[magic river]

If you want to do like bind mounts or something I don't think those work so your container needs to be really isolated

[peak ginkgo]

gnome is awesome

• gnome user

[meager tusk]

Pretty sure that anyone with half a brain would keep nuclear armaments away from the internet.

[magic river]

So if your container isn't stateless I don't think it works

[meager tusk]

Or any computer-based interface, for that matter.

[frail trail]

the old farts that are still kicking and can write the software for those things probably make bank

[void void]

assuming the us government has any cognitive ability

(it doesnt)

[meager tusk]

In war?

[frail trail]

did someone say OIL?

[magic river]

So I wouldn't use this for dev since I have it mount my project directory in to the container to do incremental hot reload builds and such

[void void]

the FBIs no fly list was found sitting on a public-facing server a few months ago

[magic river]

And if you wanted to use it for a DB or something you'd need some NAS to store the DB on

But maybe those things do work, just slower, not 100% on that

They didn't work when the project started

[frail trail]

the old farts in congress wanting backdoors in commonly used software as if their number one arch-nemesis (Russia) won't find it and exploit it

or anyone for that matter.

[golden gust]

.merica

[limber knot]

https://www.youtube.com/watch?v=h3jcmFNxRzQ

[marble lark]

been goin downhill

[magic river]

But they advertise it as being able to install containerd-firecracker and then just use it with your docker or systemd-nspawn CLI tools just like it was standard container systems

I should try this on my laptop, see if it works for my dev environment

[frail trail]

LMAO that video

[faint crystal]

americans*

[marble lark]

see told ya the earth is flat

[magic river]

Like, KVM/qemu has infrastructure to let you access directories on the host but I don't know if firecracker implements that bit

[void void]

fact!

[marble lark]

?

[magic river]

inotify probably doesn't work on those shares though so nodemon would still break

[frail trail]

I use bind mounts in proxmox for my zfs datasets.. although that's lxc rather than a VM

[magic river]

Their list of features mentions block devices (virtual HDD) but no file sharing so that's probably a no-go

Firecracker actually uses the same cgroups tech that containers use too, it basically runs your VM inside a container and then your VM is hosting a container that got converted into a full OS

yo dawg

[red timber]

kvm/qemu directory sharing infrastructure is pretty much p9 network filesystem, or new virtio-fs nowadays

p9 is s l o w

[magic river]

Right, virtio-fs is what I was thinking of

I wonder if WSL2 will ever switch to virtio-fs and implement that in Windows instead of 9p

[red timber]

doubt

[magic river]

hmm, Kata Containers is built on Firecracker and is the project virtio-fs is made for

So maybe firecracker on its own can't do it but Kata Containers can

[pastel reef]

Why will my framerate refuse to exceed 60 even with vsync disabled?

My limit is set to 95

[red timber]

your gpu driver probably enforces that

[pastel reef]

It only startet just now

[magic river]

If you're on linux turning off vsync is actually kind of a PITA

[ashen nacelle]

disable vsync in the gpu driver control panel

[magic river]

Otherwise if you're on Windows check the nvidia control panel or whatever

[pastel reef]

I'm on Windows 10

[magic river]

Cute, virtio-fs is basically just FUSE but the daemon runs on the host instead of in userspace

So the protocol for the hypercalls or whatever you call them is just FUSE

[pastel reef]

I'm using a laptop :I

[red timber]

sounds like overhead

ngl

[magic river]

Sounds cheaper than 9p

[red timber]

possibly, if it's implemented well

[magic river]

FUSE can use DAX and supports inotify

[red timber]

ah yea

[magic river]

So it works like a real filesystem instead of a network share

File contents can be mapped into a memory window on the host, allowing the guest to directly access data from the host page cache.

[red timber]

yep yep

[magic river]

This also avoids the problem everyone runs in to with WSL2 where the duplicate page cache in the guest bloats your memory usage

They had to patch the kernel to periodically flush the page cache or something otherwise WSL2 just slowly grew to use all of your RAM

[meager tusk]

wait

why is Proxi not here

:(

I was gonna ping her and say best proxi.

[red timber]

LOL

"ship now fix later" type beat

[ashen nacelle]

looks like jroy has escaped the abyss

[magic river]

Oh and since it's just FUSE you can use WinFsp to get it on Windows already

[coarse lily]

What?

[magic river]

(that's for Windows guests)

[ashen nacelle]

running joke from earlier in the chat regarding basnishing and summoning jroy with certain topics.

[coarse lily]

Ah.

[waxen panther]

jroy is the running joke

aside the running part

he cant do that

[magic river]

Ah, Kata Containers supports multiple VMs, Firecracker doesn't support virtio-fs but cloud-hypervisor does

That's the Intel version of Firecracker, more or less

[static badge]

@waxen panther

@waxen panther

@waxen panther

@waxen panther

[magic river]

I don't think it was a fork though, just their version of the same idea

[waxen panther]

May I help you Spottedleaf?

[coarse lily]

Please do not ping random members thank you.

[red timber]

the fuck is this feature?

[static badge]

@coarse lily

[coarse lily]

Time out.

[warm anchor]

shhhhh

timeout

[cunning raft]

he fell victim of moderation

[coarse lily]

Please do not ping non-random members thank you.

[cunning raft]

so sad

[static badge]

@coarse lily

[warm anchor]

@static badge

[quasi valley]

It's not random, it was very specific

[waxen panther]

another day of being abused but tyrant papermc moderators

[ashen nacelle]

broccolai fell victim again

[red timber]

intel had clear vms or something

[ashen nacelle]

they evn torment uyou with your own role

[red timber]

that evolved into kata

[magic river]

Oh, it is based on firecracker, kind of. Firecracker was actually based on Google's VM for running Android apps and standard Linux on Chromebooks

[red timber]

afaik

[ashen nacelle]

Vegtebal Overlord

[red timber]

clear containers, sorry

[magic river]

They turned the shared bits between crosvm, firecracker, and cloud-hypervisor into separate rust crates

[frail trail]

I’m assuming it’s okay to ping if already engaged in conversation?

[frail trail]

I’m trying to ensure that I disable the ping option, now that I’m aware of it

[magic river]

clear containers was a patch of qemu, the kernel, and a custom UEFI for qemu iirc

[red timber]

yep

[magic river]

Now they just tossed qemu and have a new VM

[red timber]

i digged those patches one day

[red timber]

what

[ashen nacelle]

Damn fresh isntall of windows is bluescreening hastn gotten to OOBE yet.

[pastel reef]

Where do I disable vsync for my gpu? I can't find anything?

[magic river]

I try not to ping people who I'm sure will be able to follow the conversation (staff and regulars and such) but still use the reply so other people know I'm not talking to them

[ashen nacelle]

there has yo be a piece fo failing hardware

[frail trail]

Memtest86

[magic river]

(left the ping on on purpose there)

I usually don't use replies at all in here, only for answering questions in #paper-help or #paper-dev

[frail trail]

Ah okie. Thank you.

[magic river]

Check temps and fans in UEFI?

[ashen nacelle]

running through Lenovo UEFI Diagnostics

[magic river]

It's either going to be bad RAM or a dead fan

[ashen nacelle]

I am getting Bad system config info BSOD

[magic river]

Or terrible thermal paste that has degraded in to nothing and you need to redo your heatsink mount

[ashen nacelle]

this is a laptop

[frail trail]

If you have another machine and a spare usb flash drive, go get a copy of memtest86 and let it run.

[ashen nacelle]

less than a year old

[magic river]

Ah, laptops are more likely to have been abused and have something else wrong

[frail trail]

DIMMs or soldered?

[ashen nacelle]

DIMMS

I am in computer repair

[magic river]

Sounds like a Thinkpad so either 2 SO-DIMMS or 1 and 1 soldered

[ashen nacelle]

so I am currently diagnosing it

it is a thinkpad

its gort 2 SO-DIMMS

[magic river]

The P ones (iirc) have one soldered on and an open slot for upgrade

[frail trail]

Ah then you should be aware of anything I’d start with. I tend to start with memtest86 if I get random BSOD. Bluescreenview to see what the dump shows when possible

[magic river]

Whatever the thin ones are

Wait, it's the S

T490S for example

[red timber]

use memtest86+ or something

[mental meadow]

made a meme

[red timber]

but wen update to 1.12.2

[frail trail]

Also the rookie: make sure you didn’t accidentally change SATA to emulate IDE rather than native AHCI 😅

[ashen nacelle]

#gifs-and-memes

[waxen panther]

TRUE

https://tenor.com/view/drake-clapping-clapping-drake-high-quality-hq-gif-23598042

[magic river]

https://xkcd.com/243/

xkcd: Appropriate Term

I know a lot of people hate these, but I prefer them to touchpads.

[limber knot]

(DiscordBot) xkcd: Appropriate Term (2 April 2007)

[mental meadow]

thanks, had no idea how this discord worked

[ashen nacelle]

dio I sense sarcasm

[red timber]

lol >nipple mouse

worst thing ever invented in this universe

[magic river]

That's usually what I call it

[frail trail]

I should sell my modded T430

[red timber]

yep same

[magic river]

I can see how if you practiced with it you could get really good and never want to use anything else

I like multitouch and gestures too much though

[pastel reef]

Can someone please help me with this, it's driving me of the walls.

[faint crystal]

you mean the best invention since 3000 BC?

[red timber]

i like my macbook's huge trackpad

[ashen nacelle]

I have a feeling it is eaither a faulty RAM or failing HDD

[red timber]

that's why you should try memtest86+

[ashen nacelle]

I have my own tools I use.

I have a USB with over 100+ diagnostic tools and OS's on it

[pastel reef]

Every time my Minecraft framerate goes below 60, my actual screen framerate goes down to like 10 for a moment.

[frail trail]

ah great. then no need of assistance

[ashen nacelle]

once I get the system fixed and fully functionall it is going to be sold

[pastel reef]

And sometimes it spontaneously decides, YEET let's go from 60 to 30.

[quiet mesa]

why... i hate the index _C

[red timber]

sounds like thermal throttling

[ashen nacelle]

agreed

[frail trail]

hwinfo64

[pastel reef]

My fans are silent at the moment.

Nevermind, the issue went away by itself.

[red timber]

while playing a game?

[pastel reef]

And it's back again

[frosty gull]

Wait so is 1.18 officialy out or just a pre build

[magic river]

Time to copy your patch somewhere, reset your branch to master, copy the patch back in, and rebuildPatches 😄

There is probably a better way to do that but bleh

[pastel reef]

Goes to 90fps for like 5 seconds then back to 55

[frail trail]

Well, it depends on what the graphics processor is processing.

[ashen nacelle]

140F (60C) is normal for air cool while under load. if liquid coold there may be an issue and same if you are getting that when idle

[frail trail]

I believe Intel begins to throttle at 90C?

[ashen nacelle]

yeah

[magic river]

Their limit is 100C still, right?

[frail trail]

Or at least drop to base clock

[magic river]

And AMD is 110C?

[quaint rover]

@frail trail depends on what intel you are using. In MacOS afaik its more than 90C...

[frail trail]

100-105 depending on architecture I believe. That's absolute max limit.

[ashen nacelle]

AMD lower if you have "cool and quiet" enabled around (70C)

[frail trail]

I believe my 2017 MBA begins to throttle at 95C. So yes I think so

[quaint rover]

I mean, the joke about cooking dinner with macbook isn't that much of a joke ... right ?

[frail trail]

M1 is a totally different beast. Intel Macs on the other hand... yes. unless you disable hyperthreading

Although the Intel iMacs (at least the 2017 27" I was using) took quite a bit to get up to 100C. It didn't throttle though. It would just drop to base clock

[quaint rover]

Btw, can I talk about non-mc related dev stuff here? Or there is a better channel for that?

[frail trail]

It's unfortunate that I ended up sending the M1 Mac mini back, because they apparently have issues with some external displays. I was getting strange, dark vertical lines across all my screens over HDMI. I can't afford to try buying new screens. Other computers don't have this issue on my displays. :/

[quaint rover]

ik that feeling bro. Still can't properly use my Samsung G7/etc ( not M1, but still it won't be better with m1 )

[void void]

hola hablo ingles

[ashen nacelle]

ENGLISH!

[void void]

ok what´s up

[frail trail]

It says "hello, I speak English" I believe

[void void]

yes

[red timber]

could be just dead hdmi cable

[frail trail]

I had read a couple of posts on macrumors forums that also had the same issue, and I made a post too. There's also a formal thread of "compatible monitors" that work with the M1 mini. Uh no... ALL monitors should just work with it. HDMI is a standard. If both the computer and the monitor (and their firmwares) follow said standard, and you don't have a shoddy cable, then it works.
The Apple fanboys adamantly refuse to believe the problem is with the computer and keep trying to buy monitors until they get one that works. (sans a few who get downvoted)

[frail trail]

Oh, I wish it were only that simple.

[red timber]

though i'd not be surprised that apple did some poopooo

[ashen nacelle]

its Fucking Apple they suck

they want everything propietary

[quaint rover]

It could be that your screen is hdmi 2.1, and m1 is too ( afaik ), or 2.0

And the cable doesn't support 2.0/2.1

[frail trail]

My screens are too old for that. lol

[quaint rover]

Have same issue with my 2.1 HDMI tv 😦

Then its just apple being apple lol.

[frail trail]

As if Apple is the only company doing that. 🙄

[quaint rover]

(not same, but similar - I have just random pixels turning to weird colours)

[frail trail]

My 2017 Intel MBA doesn't have any issues. But it's considerably underpowered for more than web browsing, document work, and SSH. Which is what I use it for. I didn't buy it new anyway x)

[ashen nacelle]

"A freaking landmine deals with pressure better than apple, and would kill fewer people."

[frail trail]

I do wish Apple would acknowledge issues more appropriately... "A very small number of users...." <insert louis rossmann rant here>

releases 2019 MacBook Pro..... immediately adds it to the butterfly keyboard recall bulletin page

https://tenor.com/view/mindblown-excuse-me-what-me-dr-phil-gif-14053511

[ashen nacelle]

"Awww. You think they're a threat. Show's about to start. Careful though, The first three rows are a splaaaash zooone" Maniacal Laughter

[quiet mesa]

yeah in the past i remake all like spigot patchs.. but lynx give me a tutorial for avoid this xd
almost are only the index... if not then broken git again try things XD

the first time when try https://github.com/Doc94/Paper/blob/master/CONTRIBUTING.md#rebasing-prs i broke the branch because in step 2 to 3 not explain (or i dont know how to read english) the index :C

[magic river]

Wow Yogscast are doing a poker tournament and Lewis is making all his decisions via wheel spin

[void void]

Definitely the easiest way

[magic river]

He has a wheel with like fold, raise, all-in, etc (some real goofy stuff too) and he spins it every time to decide what to do

[ashen nacelle]

Gonna be gusty

[twin lagoon]

    Number of packets received by the client.

is the rx value in the F3 screen per second?

can't find information on this

[worthy geode]

pretty sure it is, yes

[ashen nacelle]

Very Funny
https://www.youtube.com/watch?v=SAc7L5sLaG0&t=530s

[worthy geode]

for some reason I read that as "SQL most quotable lines" and was very confused

[void void]

thoughts on native bedrock servers?

do you think there is a market for decent bedrock servers?

i m ean there are more bedrock than java players

[ashen nacelle]

bedrock sucks

[void void]

meh

its an inferior game but there are more bedrock than java players

and bedrock is the only option on many platforms

[ashen nacelle]

part 2
https://www.youtube.com/watch?v=WP1oJPxuI1o

[limber knot]

uwu

[ashen nacelle]

hello there naomi

[potent magnet]

what cpu would be good for some servers? was thinking of setting up my own machine

[ashen nacelle]

wow middle of december 57F outside and i am turning on the AC

Xeon processor is a good one

https://www.intel.com/content/www/us/en/products/details/processors/xeon.html

[potent magnet]

what about one of the 12th gen intel cpus?

[ashen nacelle]

if you plan on doign any gaming with it i woudl avoid the 12th gen due to DRM issues

[potent magnet]

na I meant a computer just for servers and some general web hosting

[void void]

@red halo pig owns

[golden gust]

seriously, there is very little sane reason to own your own box

hardware moves so fast that if you wanna stay on the latest hardware it's cheaper to just rent a box and keep moving forward

[magic river]

I wish SAO Abridged was still a thing

(it might be but they do like one episode a year at most so who knows)

[ripe sphinx]

Well the Log4J RCE just took a hilarious turn. Apparently something in Discord's search stack uses Log4J so search is currently disabled 🤣

[potent magnet]

lmao

[ashen nacelle]

yeah i wished it would continue it kinda dropped off mid way

[potent magnet]

I was wondering why it was disabled

[ashen nacelle]

https://tenor.com/view/disappointed-picard-face-palm-enterprise-star-trek-gif-15057652

[worn ember]

adam do you watch sao quotes all day or something

[ashen nacelle]

not all day but ive probably seen the entire sao abridged series 6x this year

[worn ember]

sounds like you need help

[ashen nacelle]

i do watch a ton of anime on cruchyroll and netflix though

finished Demon Slayer and now watching Are You Lost

I have also finished the entire SAO series.

[molten oyster]

who wants lunar cape?

i mean cloak

[worn ember]

watch dragons blood

[void void]

@rich cove how long have you been doing cpp

[ashen nacelle]

actual exploit

[void void]

they can remotely execute any arbitrary code

read the stuff they sent

[ashen nacelle]

read #paper-help pins

[void void]

you should have everything you need

[ripe sphinx]

but yeah it's full RCE on both server and client

[molten oyster]

who wants free lunar client cloak

[void void]

since it's been exploited already, I wonder which server got the msft-insiders\™️ experience

[ashen nacelle]

only optifine can give capes so stop trying to scam

[molten oyster]

bruh no

lunar client can give capes

[void void]

I think it's against the eula

[molten oyster]

wdym?

do you know lunar client?

[worn ember]

it still falls under mojangs EULA lol

[twin lagoon]

why do you want to give people a cloak

[molten oyster]

i just have too many of them

so yea

[void void]

I want a free cape

[void void]

where is free cape

[molten oyster]

too bad

already got someone

[granite slate]

Hi guys, quick question. Does anyone know if it is possible, with gradle, redirect the output of the task "buildsNeeded" inside one single fat jar (Without using plugins like shadow)

[void void]

lol

[molten oyster]

wait a sec

[worthy geode]

yes, disabled because of the exploit

[worn ember]

is that a joke or is that serious

[worthy geode]

serious, they are using elasticsearch, which is affected

[worn ember]

kekw

[void void]

damn

I mean

it stays in your mind so

it's okay

have you ever tried making a minecraft server impl?

[ashen nacelle]

"Many, many services are vulnerable to this exploit. Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,"

btw the cve is released

[worthy geode]

discord search as well, thats why its currently not available

[ashen nacelle]

CVE-2021-44228

[frank otter]

ohh that's why they took it down

[void void]

automatic timer?

[molten oyster]

???

[molten oyster]

???

[worn ember]

https://youtu.be/Xqi9azBaTng this is so bad its good

[ashen nacelle]

The bug, now tracked as CVE-2021-44228 and dubbed Log4Shell or LogJam, is an unauthenticated RCE vulnerability allowing complete system takeover on systems with Log4j 2.0-beta9 up to 2.14.1.

[molten oyster]

oh

[void void]

what else have you made?

[silk sparrow]

lmao

imagine not having tens of alternatives 👍 that's one of ways the humanity will collapse miserably

[ashen nacelle]

After the first proof-of-concept exploit was published on GitHub yesterday, threat actors began scanning the Internet for systems vulnerable to this remotely exploitable security flaw that doesn't require authentication.

[void void]

what's vulnerable

anything that runs that log4j thing?

[silk sparrow]

so all servers which didn't patch yet are vulnerable???

[void void]

yup

[silk sparrow]

stupid

there may be inactive servers

tens of thousands

only big ones are updated

[void void]

well you can be sure people will try to automate exploits

[worthy geode]

and tens of thousands of other applications, log4j is pretty popular

it is bad

[void void]

4j means 4 java right?

glad I don't use it

[silk sparrow]

thats really bad yes

[worthy geode]

yep.

[void void]

from wikipedia

[ashen nacelle]

The problem lies in Log4j, a ubiquitous, open source Apache logging framework that developers use to keep a record of activity within an application. Security responders are scrambling to patch the bug, which can be easily exploited to take control of vulnerable systems remotely. At the same time, hackers are actively scanning the internet for affected systems. Some have already developed tools that automatically attempt to exploit the bug, as well as worms that can spread independently from one vulnerable system to another under the right conditions.

[void void]

yup

[ashen nacelle]

pretty much

[void void]

not really if you don't have your ports opened no?

[faint crystal]

no

[ashen nacelle]

you should also have firewall rules in place to block port scanning

https://www.toolbox.com/tech/operating-systems/question/how-to-block-port-scanning-tools-and-log-them-with-iptables-051115/

[finite swift]

its fun how a logging framework can give hackers remote access to a server machine

[void void]

just block everything unless the production ready stuff

[void void]

java moment

[golden gust]

I down a can of monster when I want a good nights sleep

[void void]

average arch user

??

oh.. you mean to install

there's choco lol

[golden gust]

wat

you sound like you have 0 fucking clue of whatever the fuck you're talking about

Guess what!

[void void]

whomstdvent

[worn ember]

[golden gust]

Literally every linux desktop has a web browser too!

And, get this!

it can download shit!

Whodathunk!

[worn ember]

how many cans of redbull are on now cat

[void void]

uh... on most distros you mean

[finite swift]

but actually when i tried to download something on linux without sudo apt install, it didn't worked

[void void]

....

[golden gust]

I've literally yet to see a desktop distro come without a web browser

[finite swift]

note: i was using ubuntu 21.04

[void void]

I did an arch without anything

[worn ember]

MS-DOS

[void void]

broke two days later

[golden gust]

arch is not a desktop distro

[void void]

oh I didn't see the desktop part

among os maybe

[ashen nacelle]

arch does not have a desktop by default

you mustin isntall one along with a display manager

[void void]

yeye

[golden gust]

if that's a joke, don't quit your day job

[void void]

wolfyred senior dev

do you know you can download binaries on linux as well

[ashen nacelle]

only the dumb sheep think that linux cant do anything

[void void]

sudo doesn't make sense in nt

but there's something like it

[golden gust]

I mean, they tried to tell a "joke", with 0 context towards the fact that they where tryna tell a joke or even giving any form of clue towards what they're leading towards

[peak ginkgo]

https://community.chocolatey.org/packages/Sudo

[ashen nacelle]

sudo is safer than being logged in as root

but it is still up to user

[golden gust]

Like, you can literally download packages and many palces literally expect you to download the package rather than them offering a pretty repo

a joke in which you need to explain it because you dropped all context is just a shit joke

[twin lagoon]

doas >

[golden gust]

and speaking of shit jokes

hey michael

[ashen nacelle]

if user is incompetent and enters a comand he does not know what it does as sudo they can destroy their machine\

[void void]

tf..

[golden gust]

1. cmd is dead

[peak ginkgo]

everyone downloads files from the web

this is how the internet works

[ashen nacelle]

powershell does use wget now

[peak ginkgo]

if not the textbook definition of the internet

[void void]

curl?

[golden gust]

2. powershell literally aliases curl because windows users literally try to curl stuff

[void void]

that thing exists

[ashen nacelle]

i have scripts that download and instlal avast or malwarebytes without ever opening the web browser

[void void]

you okay wolfy?

it's okay if you're tired

[worn ember]

isnt that just an alias?

where else you gonna download from? the sewer?

[ashen cliff]

How you should actually run your MC server: https://posili.me/i/2021-12-10_22-42-25.png

[void void]

uh..

sounds unsafe

if that's admin

[ashen nacelle]

my avast install script

@echo off
mkdir C:\OEM
powershell -command wget https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build_RELEASE -outfile C:\OEM\avast_free_antivirus_setup_online.exe
start c:\OEM\avast_free_antivirus_setup_online.exe

[ashen cliff]

Admin? Nah. Trusted Installer bro.

[void void]

not by that much, people paste stuff in the terminal without knowing

??

[limber knot]

not using powershell in the first place

[void void]

does a string??

I'm lost man

need a can of monster now

on win yeah I think so

[ashen cliff]

Best "implementation" of the vulnerability I've seen is, to dump the client specs to a server.

[ashen nacelle]

the script I use for fixing corruption in Windows.

@echo off
echo This will scan your system for corruption and attempt to fix it.
net.exe session 1>NUL 2>NUL || goto :not_admin
goto :repair

:not_admin
echo ERROR: Please run as administrator.
echo  You need to start over and right-click on this file, 
echo  then select "Run as administrator" to be successfull.
set /p DUMMY=Press ENTER to exit...
exit /b 1

:repair
set /p DUMMY=Press ENTER to continue...
sfc /scannow
dism /online /cleanup-image /RestoreHealth
chkdsk
if ERRORLEVEL 1 goto :fullcheck
if ERRORLEVEL 2 goto :fullcheck
if ERRORLEVEL 3 goto :fullcheck
echo The drive is okay this time.
goto :end

:fullcheck
echo Errors Found. Running a full Disk check.
echo y|chkdsk /f /r
echo System reboot required.
echo Disk check will run on this reboot. This may take a few Hours to complete.
goto :end

:end
set /p DUMMY=Press ENTER to reboot...
echo System going down for reboot in 10 seconds. DO NOT CLOSE THIS WINDOW.
timeout /t 10 /nobreak > NUL
shutdown /r /t 00

[void void]

uh.. if cmd is dead you can reset your system

[golden gust]

and?

[void void]

powershell can run bats so

[golden gust]

Microsoft has literally deprecated it...

They can't get rid of it

[ashen nacelle]

dism wont work correctly in powershell

[golden gust]

but, they're tryna hide it as much as possible

[void void]

??

what does this mean?

[ashen nacelle]

you can see in my repair script if errors are found with chkdsk it launches chkdsk /f /r

[acoustic fractal]

if i join public servers with updated minecraft launcher, am i safe or no?

[void void]

yes but ..\folder then?

what does the space mean

use \ ?

[ashen nacelle]

cd is a command to change directory

for example cd C:\OEM

[void void]

I think everyone knows it here

there's a space

Paper 1.18

[ashen nacelle]

or you can do cd "C:\Users\You Documents\Minecraft Server\Paper 1.18"

[void void]

yeah okay

[ashen cliff]

Nah. We escape the spaces.

[void void]

then what's the point?

[void void]

don't

[ashen cliff]

Can't stop me.

[void void]

how do you escape if there's already \ used

[ashen cliff]

\\

[ashen nacelle]

I literally just had to instruct a customer over the phone on how to reset their modem

just now

[void void]

I'm lost

[ashen cliff]

https://posili.me/i/2021-12-10_22-55-55.png

🛌

[void void]

what are you guys talking about

[ashen nacelle]

command formatting

[void void]

yes but does this conversation has any topic??