4 ms·

With Vanilla Minecraft, you have have a port open to the entire planet and have to trust that the built-in security will work. The more ports you want to open t

With Vanilla Minecraft, you have have a port open to the entire planet and have to trust that the built-in security will work. The more ports you want to open to friends, the more services you are relying on to have working security. With Tailscale, you just need to trust that Tailscale works, which seems like a much better bet given WireGuard's simple-and-auditable code plus the quality of Tailscale's dev team working on top of that.

squeaky-clean 5y ago
You can technically add a whitelist of usernames for your server, but (and maybe they've fixed this since) about 6 years ago my friends and I had our server ruined by a hacker who joined and converted our whole base to lava. When we asked how he joined despite the whitelist he said it was incredibly easy to circumvent. After chatting a bit more he eventually felt bad and placed about a hundred chests filled with diamond armor and weapons before leaving, but that doesn't really remove the sting of having your personalized base destroyed and killed the challenge for the game. We haven't played again since this year. At least now I know how to set up a cronjob to back up our world daily :P
- decremental 5y ago
  If you guys aren't modding and don't need the world to be running when no one is online then you might consider going with Minecraft Realms. It's like 10 bucks a month.
  - byhemechi 5y ago
    realms performance is woeful. lat time i tried it (around 6 months ago) it lagged with a whopping 6 players active.
  - squeaky-clean 5y ago
    I'm hosting it on a VPS I use for other things, so it's sort of "free" in this case. And we haven't had more than 10 concurrent players yet, but there's about 15 of us so it will probably happen one weekend eventually. I don't really mind administering it, but Realms is definitely a good choice for a lot of people.
- lostlogin 5y ago
  As someone who stumbled into the world of Minecraft as something to do with a child and their friends, I was surprised at how it all works. I might be doing it wrong but I found it pretty hard to get a server up, set up VPNs (including for remote players), modding, moderating etc. I’m sure a lot of parents would appreciate it being easier, with an in-app purchase of VPN, or similar access to safe, self hosted game play. However do I get a bit of a buzz seeing my child open console and get the process ID then go to terminal and kill the flakey Minecraft app when it crashes. Requested for server reboots and grumbles at server RAM allocation etc. Maybe it being hard is actually a win.
  - andylynch 5y ago
    Self-hosted is supported but for this use case it seems clear Realms are what they encourage parents to go for (and in fairness, a better option for most than managing self-hosting )
    - vorpalhex 5y ago
      Realms lack mod support, and mods are a big, big part of Minecraft.
- WayToDoor 5y ago
  Make sure you are running in online mode. If you aren't, yeah, it's very easy to spoof the username, by using any of the hacked clients in existence.
  - squeaky-clean 5y ago
    During that first server we were using a 3rd party minecraft hosting provider, so no way of knowing if that was the case. I'll double check my current server though, thanks. Edit dug it out of my old emails, it was actually actually much longer than 6 years ago! The host was Phoenixerve, seems they don't exist anymore.
- josephcsible 5y ago
  Did you have your server configured to allow pirated clients? Because that's the only case I can think of that would allow for such an easy bypass.
  - squeaky-clean 5y ago
    We were using a 3rd party MC server host (this was before Realms). So honestly no idea, but I hope they didn't! Edit dug it out of my old emails. The host was Phoenixerve, seems they don't exist anymore.
    - OkayPhysicist 5y ago
      I'm relatively confident that a whitelist bypass like that has been impossible since Minecraft 1.3. (2013 ish). The login handshake for an online-mode (authentication enabled) server involves a three way communication between the client, the server, and Mojang's auth server, which basically involves the client telling the server "hey, I'd like to join", then the server acknowledging, the client telling Mojang "hey, I'm attempting to connect to this particular server" here are my login credentials", then telling the server "hey, I go ask Mojang, I'm trying to connect", and then the server checking with Mojang that this given user is trying to connect to this particular server, then establishing an encrypted connection to the client.

squeaky-clean 5y ago

You can technically add a whitelist of usernames for your server, but (and maybe they've fixed this since) about 6 years ago my friends and I had our server ruined by a hacker who joined and converted our whole base to lava. When we asked how he joined despite the whitelist he said it was incredibly easy to circumvent. After chatting a bit more he eventually felt bad and placed about a hundred chests filled with diamond armor and weapons before leaving, but that doesn't really remove the sting of having your personalized base destroyed and killed the challenge for the game. We haven't played again since this year. At least now I know how to set up a cronjob to back up our world daily :P

decremental 5y ago
If you guys aren't modding and don't need the world to be running when no one is online then you might consider going with Minecraft Realms. It's like 10 bucks a month.
- byhemechi 5y ago
  realms performance is woeful. lat time i tried it (around 6 months ago) it lagged with a whopping 6 players active.
- squeaky-clean 5y ago
  I'm hosting it on a VPS I use for other things, so it's sort of "free" in this case. And we haven't had more than 10 concurrent players yet, but there's about 15 of us so it will probably happen one weekend eventually. I don't really mind administering it, but Realms is definitely a good choice for a lot of people.
lostlogin 5y ago
As someone who stumbled into the world of Minecraft as something to do with a child and their friends, I was surprised at how it all works. I might be doing it wrong but I found it pretty hard to get a server up, set up VPNs (including for remote players), modding, moderating etc. I’m sure a lot of parents would appreciate it being easier, with an in-app purchase of VPN, or similar access to safe, self hosted game play. However do I get a bit of a buzz seeing my child open console and get the process ID then go to terminal and kill the flakey Minecraft app when it crashes. Requested for server reboots and grumbles at server RAM allocation etc. Maybe it being hard is actually a win.
- andylynch 5y ago
  Self-hosted is supported but for this use case it seems clear Realms are what they encourage parents to go for (and in fairness, a better option for most than managing self-hosting )
  - vorpalhex 5y ago
    Realms lack mod support, and mods are a big, big part of Minecraft.
WayToDoor 5y ago
Make sure you are running in online mode. If you aren't, yeah, it's very easy to spoof the username, by using any of the hacked clients in existence.
- squeaky-clean 5y ago
  During that first server we were using a 3rd party minecraft hosting provider, so no way of knowing if that was the case. I'll double check my current server though, thanks. Edit dug it out of my old emails, it was actually actually much longer than 6 years ago! The host was Phoenixerve, seems they don't exist anymore.
josephcsible 5y ago
Did you have your server configured to allow pirated clients? Because that's the only case I can think of that would allow for such an easy bypass.
- squeaky-clean 5y ago
  We were using a 3rd party MC server host (this was before Realms). So honestly no idea, but I hope they didn't! Edit dug it out of my old emails. The host was Phoenixerve, seems they don't exist anymore.
  - OkayPhysicist 5y ago
    I'm relatively confident that a whitelist bypass like that has been impossible since Minecraft 1.3. (2013 ish). The login handshake for an online-mode (authentication enabled) server involves a three way communication between the client, the server, and Mojang's auth server, which basically involves the client telling the server "hey, I'd like to join", then the server acknowledging, the client telling Mojang "hey, I'm attempting to connect to this particular server" here are my login credentials", then telling the server "hey, I go ask Mojang, I'm trying to connect", and then the server checking with Mojang that this given user is trying to connect to this particular server, then establishing an encrypted connection to the client.