great-lounge Friday 10 December 2021

123 messages12 people

  1. Duplex

    I've been pinged 10 times about this make it stoppp

  2. Gray

    Does this mean ANY server or can you still join your own server

  3. AzzyypaarasTeam

    Replying toDuplexI've been pinged 10 times about this make it stoppp

    It is good to see 10 different places have already pinged for it, this is a serious issue at hand

  4. Jack PapelTeam

    I like the makeup in your profile picture. Looks nice

  5. Gray

    I have a whitelisted server

  6. nailuj

    @gudenau was briefly a project lead

  7. AzzyypaarasTeam

    Replying toJack PapelI like the makeup in your profile picture. Looks nice

    idk, that is a lot of forehead

  8. AzzyypaarasTeam

    Replying tonailuj@gudenau was briefly a project lead

    Normal staff can't ping everyone

  9. nailuj

    Ah

  10. Jack PapelTeam

    Azzy bro what did you gain from saying that

  11. nailuj

    can I ping at everone

  12. AzzyypaarasTeam

    Replying toJack PapelAzzy bro what did you gain from saying that

    ¯\_(ツ)_/¯

  13. Jack PapelTeam

    Alright

  14. Duplex

    Replying toAzzyypaarasIt is good to see 10 different places have already pinged for it, this is a serious…

    Yeah it's crazy, Minecraft clients are epically at risk because they make heavy use of unsafe and cannot be sanboxed

  15. AzzyypaarasTeam

    Just noting what I see

  16. CodeRG712

    what server does that mean?

  17. AzzyypaarasTeam

    Replying toDuplexYeah it's crazy, Minecraft clients are epically at risk because they make heavy use of…

    Minecraft is a well coded game with no flaws whatsoever

  18. Jack PapelTeam

    Any Minecraft server. Big mojang mistake

  19. gudenau

    Technically any server you join can get you.

  20. Necro

    This is an interesting development

  21. nailuj

    Replying toDuplexYeah it's crazy, Minecraft clients are epically at risk because they make heavy use of…

    Heavy use of unsafe? This isn't rust. Java is always unsafe

  22. gudenau

    All versions basically.

  23. Jack PapelTeam

    All versions dating back to 1.12

  24. AzzyypaarasTeam

    Yeah, though if you are in a tiny server that is hosted by a friend you are probably not in very big trouble

  25. gudenau

    It isn't even a unsafe thing.

  26. Necro

    Can't wait for the YouTube video. 😛

  27. Jack PapelTeam

    Xisumavoid is frantically writing a script right now

  28. nailuj

    Dream music intensifies

  29. AzzyypaarasTeam

    Replying toNecroCan't wait for the YouTube video. 😛

    Minecraft is fucking DEAD?!?? hit that LIKE andSUBSCRIBE so that jeb can scratch his nuts and grow his board game collection

  31. gudenau

    He wouldn't have been caught cheating if he only used the mods for the last run a couple of times. :-)

  32. Duplex

    Replying tonailujHeavy use of unsafe? This isn't rust. Java is always unsafe

    you have no clue what your talking about :) first off java is actually memory safe, to an even higher degree than rust. second in this context "unsafe" refers to java's sun.misc.Unsafe class which allows for native (unsafe) memory access. however obtaining an instance of this class requires elevated permission with the Security Manager or reflection both of which can be disabled to secure a java environment

  33. gudenau

    Let that one sink in for a moment on why MC speedrunning is kinda stupid.

  34. Duplex

    yeah lol

  35. gudenau

    And there are about 10 different ways to bypass it.

  36. Duplex

    unsafe is set to be removed in like jdk 20 or something

  37. gudenau

    If your policy isn't perfect it doesn't matter.

  38. Duplex

    oracle's goal is to replace it

  39. gudenau

    Too much depends on it in the JDK.

  40. Duplex

    there are 2 unsafes

  41. gudenau

    Atomics and locks are two big ones.

  42. Duplex

    theUnsafe and theInternalUnsafe

  43. gudenau

    Poke a single byte with anything and you get access to the internal one.

  44. AzzyypaarasTeam

    The real reason unsafe is not getting removed is because every single library and framework on the planet would keel over and die if it did

  45. gudenau

    You just need to make a single byte in memory non-zero to access everything. :-)

  47. gudenau

    Many of them have started using reflection and invocation.

  48. Duplex

    Replying toAzzyypaarasThe real reason unsafe is not getting removed is because every single library and…

    it will be at some point oracle has been saying this for yearssss to prepare people

  49. gudenau

    I can't wait for the new foreign memory and invocation APIs.

  50. AzzyypaarasTeam

    Replying toDuplexit will be at some point oracle has been saying this for yearssss to prepare people

    All oracle do is eat hot chip and lie(edited)

  52. Duplex

    Replying tonailujThat was a joke smh

    LMAO sorry

  53. AzzyypaarasTeam

    I - wait I just looked at your bio, you are trans

  54. Duplex

    holy shit

  55. AzzyypaarasTeam

    huh

  56. Duplex

    huh?

  57. AzzyypaarasTeam

    That is not interesting in of itself

  58. techgo

    Where is the best place to find more information regarding the vulnerability in Minecraft?

  60. AzzyypaarasTeam

    If I had a penny for every trans woman I know that is deep into programming and likes the owl house I would - alright no this joke is stupid

  61. Duplex

    LMAO

  62. techgo

    Replying toDuplexhow technical?

    You can give me the technical resource.

  63. AzzyypaarasTeam

    But you are teh second trans woman I know that is a programmer, into the owl house, and rather based

  64. techgo

    I also want to know so I can follow the issue

  65. AzzyypaarasTeam

    Certainly a surprise to stumble into another one, but a pleasant one

  67. techgo

    So is this more of a Java vulnerability than a Minecraft one then?

  70. techgo

    And thank you for sharing the link

  71. Duplex

    it's a log4j one

  72. techgo

    Ohhh okay

  73. AzzyypaarasTeam

    Replying toDuplexI know of like at least 7 others

    t h e h i v e g r o w s

  74. gudenau

    I'm the kind of person that can make Java treat an object of type A as an object of type B without crashing the JVM. :-)

  75. nailuj

    Replying toDuplexit's a log4j one

    then why are they calling it a mc vulnerability in CVE

  76. AzzyypaarasTeam

    Replying togudenauI'm the kind of person that can make Java treat an object of type A as an object of type…

    Ok so does that mean you can hack facebook or no

  77. gudenau

    Everyone knows what Minecraft is no one knows that L4J is.

  80. nailuj

    CVE

  81. gudenau

    That's different.

  82. Duplex

    ^

  83. Gray

    I hope people cannot target my host

  84. techgo

    Replying togudenauEveryone knows what Minecraft is no one knows that L4J is.

    I am assuming L4J is a something that Minecraft is dependent on.

  85. Gray

    because that'd be bad

  86. Duplex

    when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.

  87. Jack PapelTeam

    @Azzyypaaras I think we've found your favorite exploit

  88. gudenau

    Haha.

  89. nailuj

    Replying togudenauThat's different.

    then whats the bug were talking about

  90. gudenau

    It's poor handling of expanding ${} that allows for things being logged to access resources that a logger should never even care about looking at.

  92. gudenau

    Feature creep the exploit.

  93. SollyTeam

    I'm honestly surprised that it wasn't mojang that caused the vulnerability tbh

  94. gudenau

    LWJGL3 has debugging stuff that allows you to find a good chunk of undefined behavior if you test things correctly, which they have started doing from what I understand.

  95. Carooosa

    They released something

  96. GalladeGuy

    👋

  97. AzzyypaarasTeam

    :balls: