13 ms·

PolyMC compromised by rogue developer having unabomber manifesto in steam bio

53 points by SuperSandro2000 4y ago

deleted 4y ago
[deleted]
SuperSandro2000 4y ago
See reddit [1] for the deleted Discord announcement. Currently their Discord Channel and a GitHub commit [2] are being spammed. [1]: https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/switch_off_of_polymc_asap/ https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... [2]: https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99b81b8bc90cb203aed3ee https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99...
- SuperSandro2000 4y ago
  Also their steam profile is very interesting in containing the first paragraph of the unabomber terrorist manfiesto. https://steamcommunity.com/id/LennyMcLennington/ https://steamcommunity.com/id/LennyMcLennington/ https://www.washingtonpost.com/wp-srv/national/longterm/unabomber/manifesto.text.htm https://www.washingtonpost.com/wp-srv/national/longterm/unab...
- nalllar 4y ago
  The owner whose account might be hacked or might just have decided to do this kicking out all the active devs from the github project at the same time is some important context to go with the issue. The other maintainers have already started a fork. https://github.com/PlaceholderMC/PlaceholderMC https://github.com/PlaceholderMC/PlaceholderMC
  - immibis 4y ago
    They signed something with their PGP key to prove their account was not hacked
  - jacooper 4y ago
    They might as well just move to MultiMC
    - nalllar 4y ago
      MultiMC has been historically hostile to distros packaging it, which is part of the reason PolyMC got popular.
wisnoskij 4y ago
- olliej 4y ago
  > The devs seemed very friendly and responsive, but are typical exclusionary Leftists that are not welcoming to people with different beliefs What are the beliefs being excluded?
  - wisnoskij 4y ago
    Presumably all beliefs not their own, they definitely dog-whistled that not that I can speak to that directly. But they were clearly exclusionary to different sexuality/biology.
    - etchalon 4y ago
      What sexualities do you believe they're excluding?
    - sjcoles 4y ago
      It's open source! Don't like it fork it! Simple as that. You're not forced to work with anyone you don't want to for any reason. This always feels like a self tell for people with a very authoritarian mindset. Just because someone like yourself would use conduct to exclude individuals from participating does not mean that others will.
      - wisnoskij 4y ago
        "You're not forced to work with anyone you don't want to for any reason." I think that is the point here. The developers had a disagreement, and now some of them and some community members, and a crowd of previous completely uninterested people are now sending death threats and spamming the forums and github. Some people do not seem to think that their is enough room in this world for disagreement and deciding to work separately.
aaron695 4y ago
bullwalk 4y ago
I don't get it. One of the developers deleted the 'code of conduct'? And then lots of other people left strange comments on the commit? What's the issue here? I'm not sure I understand the context.
- Macha 4y ago
  They also locked out all the other developers. So effectively this is a hostile takeover.
- lonjil 4y ago
  No, the person who owns the GitHub organization kicked out all other developers with zero notice and started talking about how he's purging the "leftoids" from the project and that all other contributors were "promoting radicalist leftist queer ideology".
  - bullwalk 4y ago
    Ah okay that all seems rather silly. Sounds like one dev decided to play a prank on the other devs.
    - IntelMiner 4y ago
      That's a pretty charitable interpretation of events so far
      - bullwalk 4y ago
        No idea really, I'd never heard of the project until it popped up here. But it looks like everyone in the commit comments is having fun posting photographs of cats to each other, which I suppose must be some "in joke" of the project. So I guess it's a funny prank they are doing, like an April Fool, but in mid-October.
        oneplane 4y ago
        You do realise that this is about a piece of software with auto-updating and remote server control capabilities? A community project where suddenly all power is transferred to one individual who can now push malware to everyone who has the software installed is hardly a joke.
cesarb 4y ago
For those who use PolyMC, the most pressing question at the moment would be "what should I do right now"; one of the discussions had a link to the following gist https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c33506fd7751 https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c3... which says that the two most important steps (before opening PolyMC, otherwise it could auto-update) would be to disable automatic updates, and change the metadata server to the one from the MultiMC project (from which PolyMC had forked). That gist also links to an issue on the flatpak package (<https://github.com/flathub/org.polymc.PolyMC/issues/35 https://github.com/flathub/org.polymc.PolyMC/issues/35>); if I understood the situation correctly, if you're using the flatpak package, they will do the metadata server change for you (and it probably never had automatic updates enabled, since updates should be through flatpak itself).
- lonjil 4y ago
  Should be noted that autoupdate was only ever available on macOS.
  - nalllar 4y ago
    Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions. They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
    - lonjil 4y ago
      Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.
      - nalllar 4y ago
        Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.
readsadhours 4y ago
A reminder to go to your microsoft account remove consent for PolyMC once you change clients. The link is probably one of these: https://microsoft.com/consent https://microsoft.com/consent, https://account.live.com/consent/manage https://account.live.com/consent/manage Various people (such as the creator of the PolyMC fork that is confusingly named PollyMC, notice the amount of 'l's) suggest to change the metadata server: https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41ec85bf41cfccfbc2ad6d1 https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41.... I would personally suggest to use this fork because it does not require access to your MS account, so even if it was compromised the risk would end up being limited in comparison. Side note: I find it sad to see how people took the chance to spread misinfo. Example 1: claim that the MultiMC (not PolyMC!) developer is an alt right person who hates trans and gay people https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/switch_off_of_polymc_asap/ https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... (they took that idea from https://twitter.com/13yodeerfox/status/1582106791327899648 https://twitter.com/13yodeerfox/status/1582106791327899648, which did not even mention anything about lgbt) Example 2: claim that the PolyMC developer received death threats: https://news.ycombinator.com/item?id=33240644 https://news.ycombinator.com/item?id=33240644, I have not seen any evidence for this claim in the repo nor in the reddit and twitter threads. It might have been in DMs but the developer hasn't said anything about it to my knowledge.

deleted 4y ago

[deleted]

SuperSandro2000 4y ago

See reddit [1] for the deleted Discord announcement. Currently their Discord Channel and a GitHub commit [2] are being spammed. [1]: https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/switch_off_of_polymc_asap/ https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... [2]: https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99b81b8bc90cb203aed3ee https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99...

SuperSandro2000 4y ago
Also their steam profile is very interesting in containing the first paragraph of the unabomber terrorist manfiesto. https://steamcommunity.com/id/LennyMcLennington/ https://steamcommunity.com/id/LennyMcLennington/ https://www.washingtonpost.com/wp-srv/national/longterm/unabomber/manifesto.text.htm https://www.washingtonpost.com/wp-srv/national/longterm/unab...
nalllar 4y ago
The owner whose account might be hacked or might just have decided to do this kicking out all the active devs from the github project at the same time is some important context to go with the issue. The other maintainers have already started a fork. https://github.com/PlaceholderMC/PlaceholderMC https://github.com/PlaceholderMC/PlaceholderMC
- immibis 4y ago
  They signed something with their PGP key to prove their account was not hacked
- jacooper 4y ago
  They might as well just move to MultiMC
  - nalllar 4y ago
    MultiMC has been historically hostile to distros packaging it, which is part of the reason PolyMC got popular.

wisnoskij 4y ago

olliej 4y ago
> The devs seemed very friendly and responsive, but are typical exclusionary Leftists that are not welcoming to people with different beliefs What are the beliefs being excluded?
- wisnoskij 4y ago
  Presumably all beliefs not their own, they definitely dog-whistled that not that I can speak to that directly. But they were clearly exclusionary to different sexuality/biology.
  - etchalon 4y ago
    What sexualities do you believe they're excluding?
  - sjcoles 4y ago
    It's open source! Don't like it fork it! Simple as that. You're not forced to work with anyone you don't want to for any reason. This always feels like a self tell for people with a very authoritarian mindset. Just because someone like yourself would use conduct to exclude individuals from participating does not mean that others will.
    - wisnoskij 4y ago
      "You're not forced to work with anyone you don't want to for any reason." I think that is the point here. The developers had a disagreement, and now some of them and some community members, and a crowd of previous completely uninterested people are now sending death threats and spamming the forums and github. Some people do not seem to think that their is enough room in this world for disagreement and deciding to work separately.

aaron695 4y ago

bullwalk 4y ago

I don't get it. One of the developers deleted the 'code of conduct'? And then lots of other people left strange comments on the commit? What's the issue here? I'm not sure I understand the context.

Macha 4y ago
They also locked out all the other developers. So effectively this is a hostile takeover.
lonjil 4y ago
No, the person who owns the GitHub organization kicked out all other developers with zero notice and started talking about how he's purging the "leftoids" from the project and that all other contributors were "promoting radicalist leftist queer ideology".
- bullwalk 4y ago
  Ah okay that all seems rather silly. Sounds like one dev decided to play a prank on the other devs.
  - IntelMiner 4y ago
    That's a pretty charitable interpretation of events so far
    - bullwalk 4y ago
      No idea really, I'd never heard of the project until it popped up here. But it looks like everyone in the commit comments is having fun posting photographs of cats to each other, which I suppose must be some "in joke" of the project. So I guess it's a funny prank they are doing, like an April Fool, but in mid-October.
      - oneplane 4y ago
        You do realise that this is about a piece of software with auto-updating and remote server control capabilities? A community project where suddenly all power is transferred to one individual who can now push malware to everyone who has the software installed is hardly a joke.

cesarb 4y ago

For those who use PolyMC, the most pressing question at the moment would be "what should I do right now"; one of the discussions had a link to the following gist https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c33506fd7751 https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c3... which says that the two most important steps (before opening PolyMC, otherwise it could auto-update) would be to disable automatic updates, and change the metadata server to the one from the MultiMC project (from which PolyMC had forked). That gist also links to an issue on the flatpak package (<https://github.com/flathub/org.polymc.PolyMC/issues/35 https://github.com/flathub/org.polymc.PolyMC/issues/35>); if I understood the situation correctly, if you're using the flatpak package, they will do the metadata server change for you (and it probably never had automatic updates enabled, since updates should be through flatpak itself).

lonjil 4y ago
Should be noted that autoupdate was only ever available on macOS.
- nalllar 4y ago
  Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions. They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
  - lonjil 4y ago
    Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.
    - nalllar 4y ago
      Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.

readsadhours 4y ago

A reminder to go to your microsoft account remove consent for PolyMC once you change clients. The link is probably one of these: https://microsoft.com/consent https://microsoft.com/consent, https://account.live.com/consent/manage https://account.live.com/consent/manage Various people (such as the creator of the PolyMC fork that is confusingly named PollyMC, notice the amount of 'l's) suggest to change the metadata server: https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41ec85bf41cfccfbc2ad6d1 https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41.... I would personally suggest to use this fork because it does not require access to your MS account, so even if it was compromised the risk would end up being limited in comparison. Side note: I find it sad to see how people took the chance to spread misinfo. Example 1: claim that the MultiMC (not PolyMC!) developer is an alt right person who hates trans and gay people https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/switch_off_of_polymc_asap/ https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... (they took that idea from https://twitter.com/13yodeerfox/status/1582106791327899648 https://twitter.com/13yodeerfox/status/1582106791327899648, which did not even mention anything about lgbt) Example 2: claim that the PolyMC developer received death threats: https://news.ycombinator.com/item?id=33240644 https://news.ycombinator.com/item?id=33240644, I have not seen any evidence for this claim in the repo nor in the reddit and twitter threads. It might have been in DMs but the developer hasn't said anything about it to my knowledge.