3 ms·

Should be noted that autoupdate was only ever available on macOS.

• nalllar 4y ago
  Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions. They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
  • lonjil 4y ago
    Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.
    • nalllar 4y ago
      Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.
      • lonjil 4y ago
        All good, apologies for not being clear.
  • cesarb 4y ago
    > They aren't ran in a sandbox or anything Unless you're using flatpak, which has its own sandbox (though it's not perfect); and one very important piece of information (very important at least for Minecraft players), which is the Minecraft authentication tokens, is within the sandbox. Speaking of authentication tokens: does anyone know whether it would be necessary to remove the PolyMc authentication entry from the Microsoft account, and/or re-authenticate with the Microsoft account once the new fork is released?
    • cesarb 4y ago
      Replying to myself about the authentication tokens: on the PlaceholderMC discord channel, one of the former PolyMC developers mentioned that the Microsoft authentication stuff was not under control of the compromised/rogue developer. My interpretation of that is that the authentication tokens are safe (unless an auto-update or the code delivered through the meta server is used to exfiltrate them).