7 ms·

For those who use PolyMC, the most pressing question at the moment would be "what should I do right now"; one of the discussions had a link to the following gis

by cesarb 4y ago

For those who use PolyMC, the most pressing question at the moment would be "what should I do right now"; one of the discussions had a link to the following gist https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c33506fd7751 https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c3... which says that the two most important steps (before opening PolyMC, otherwise it could auto-update) would be to disable automatic updates, and change the metadata server to the one from the MultiMC project (from which PolyMC had forked). That gist also links to an issue on the flatpak package (<https://github.com/flathub/org.polymc.PolyMC/issues/35 https://github.com/flathub/org.polymc.PolyMC/issues/35>); if I understood the situation correctly, if you're using the flatpak package, they will do the metadata server change for you (and it probably never had automatic updates enabled, since updates should be through flatpak itself).

lonjil 4y ago
Should be noted that autoupdate was only ever available on macOS.
- nalllar 4y ago
  Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions. They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
  - lonjil 4y ago
    Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.
    - nalllar 4y ago
      Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.
      - lonjil 4y ago
        All good, apologies for not being clear.
  - cesarb 4y ago
    > They aren't ran in a sandbox or anything Unless you're using flatpak, which has its own sandbox (though it's not perfect); and one very important piece of information (very important at least for Minecraft players), which is the Minecraft authentication tokens, is within the sandbox. Speaking of authentication tokens: does anyone know whether it would be necessary to remove the PolyMc authentication entry from the Microsoft account, and/or re-authenticate with the Microsoft account once the new fork is released?
    - cesarb 4y ago
      Replying to myself about the authentication tokens: on the PlaceholderMC discord channel, one of the former PolyMC developers mentioned that the Microsoft authentication stuff was not under control of the compromised/rogue developer. My interpretation of that is that the authentication tokens are safe (unless an auto-update or the code delivered through the meta server is used to exfiltrate them).

by cesarb 4y ago

lonjil 4y ago

Should be noted that autoupdate was only ever available on macOS.

nalllar 4y ago
Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions. They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
- lonjil 4y ago
  Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.
  - nalllar 4y ago
    Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.
    - lonjil 4y ago
      All good, apologies for not being clear.
- cesarb 4y ago
  > They aren't ran in a sandbox or anything Unless you're using flatpak, which has its own sandbox (though it's not perfect); and one very important piece of information (very important at least for Minecraft players), which is the Minecraft authentication tokens, is within the sandbox. Speaking of authentication tokens: does anyone know whether it would be necessary to remove the PolyMc authentication entry from the Microsoft account, and/or re-authenticate with the Microsoft account once the new fork is released?
  - cesarb 4y ago
    Replying to myself about the authentication tokens: on the PlaceholderMC discord channel, one of the former PolyMC developers mentioned that the Microsoft authentication stuff was not under control of the compromised/rogue developer. My interpretation of that is that the authentication tokens are safe (unless an auto-update or the code delivered through the meta server is used to exfiltrate them).