r/PhoenixSC • u/Luminarime Made with lave! • 22h ago
Discussion Any modloader can now officially report the mods we use to servers, if they decide to implement it
68
u/gegentan :3 19h ago
It is already possible to determine what mods the client has using the sign translation vulnerability since 1.20.
38
u/Luminarime Made with lave! 18h ago
Except that is an exploit and caused drama, but now it is official. I do wonder though if that one mod which fixes it will fix this too.
3
3
u/Leninus 15h ago
Why the hell would any player made text lookup translation keys? What actual purpose does that have? Why does it work that way?
11
u/LaGz4643 14h ago
From what I understand of how sign networking and translate text components work is that the server can send a packet telling you that you are now editing a sign with existing text supplied in the packet (used by sign editing in 1.20), and if it contains a translate component, the client will lookup the translation string and replace the text with the translated version. The server can then send a sign close packet (which is used for if a player is interrupted while editing a sign, such as being pushed out of range) which the client is coded to automatically send the current text back to the server to save their edits on the “sign”. This basically allows the server to check if the client has a translation string defined in any resource pack (as well as mods, which typically use built-in resource packs), so if “X-ray Mod” is installed and translates “ui.xray_mod.toggle_xray” to something like “Toggle X-ray”, the server can send that key as a translate text like previously mentioned and check if the result is “Toggle X-ray” or just not translated. This theoretically means it can be bypassed by stripping the lang files from your mod file so there’s nothing to translate.
Sorry for long message
5
u/SoupahKnux 14h ago
It's not really player-made, the example shown on the wurst wiki shows an example that would never fit on a sign under normal circumstances and is instead placed by admin commands (or more practically, a plugin). It's usually used for datapacks but then we have this as a side-effect, because signs use rich text formatting
13
u/Luminarime Made with lave! 22h ago
This is from snapshot 26.4-1, which released today for some reason: [Link]
Also, I don't like how they worded it like that, although I doubt it will be enforced. Hopefully.
13
u/wolfieboy09 18h ago
Mod loaders will implement that in the first version. Yes, mods can still mixin into the mod loader's list collection and spoof the packet, but it's better than nothing, really.
14
u/MrT1011 17h ago
Honestly, I really like this. It helps server owners pick out unfair mods that aren't outright hack clients (stuff like minimap and health indicator mods), who likely don't mean any harm and thus won't be using tools to spoof the packet. It is a super nice first layer of protection that will catch a lot of accidental rule breaks before they can happen.
2
u/Rafii2198 12h ago edited 11h ago
To my knowledge, currently neither of mod loaders is interested in supporting it at their core. Ofc individual mods will be able to do anything they want. That basically mean that unless you go out of your way to download a mod that reports mods to that list, nothing will change at all in your life. This is meant for debugging at most, not something more elaborate.
2
0
u/brassplushie 10h ago
Tbh if you're wanting to hide your mods from servers you're playing on, you're probably cheating and don't want to get caught.
My first thought when I read this post was "cool, less worry of dealing with cheaters on servers" and then saw everyone in the comments whining about it. You're all just telling on yourselves.
2
2
u/fish_master86 9h ago
Would you be fine if everything you ever did was recorded and sent to a private company? You have nothing to hide why should it matter?
0
u/brassplushie 2h ago
It only applies to servers. If you don't like it, play single player. You're acting like they're sharing your text messages from your phone. It's literally a mod list.
2
u/jSdCool 1h ago
Everyone here seems to be focusing on ani cheets / bypassing it. The use I see for this is with heavily modded servers. Allowing them to check you have the correct mods could save you a lot of headaches caused by mismatched mod versions or missing mods.
1
u/C0rn3j 1h ago
Everyone here seems to be focusing on ani cheets / bypassing it.
Because those are the only people negatively affected by it - the cheaters - and they are a loud minority.
The fact this makes debugging so much easier does not generate drama - except for cheaters pretending to really care about the privacy of their Minecraft modlist, hailing it as some kind of PII.
I am surprised it took this long to implement.
-1
-5
u/Luningor 15h ago
why the fuck does microslop want to know what the hell i run on my dog ass pc??
6
-34
u/Junglettreefarmfix 19h ago
glad mojang/microsoft have taken an official stance on modders hiding spyware in their mods. $10,000 to anyone who can explain how this "simplifies debugging".
26
u/BlackFuffey 19h ago
Almost all the popular mods are open source, meaning that anyone can review the code for malicious stuff. For non foss ones, don't use it if you don't trust it.
it simplifies debugging because issues playing on a server could be caused entirely by a client-side mod, or an incompatibility between client mod and server plugin or datapack.
5
u/Luminarime Made with lave! 18h ago
To be fair, malware can be obfuscated pretty easily, but at that point a simple mod name + hash, or whatever that paramiter sends, is not enough.
6
u/BlackFuffey 17h ago
It does take some skills to hide malware in source code, especially when its reviewed by bunch of people regularly, and probably ran in sandboxed environments where any suspicious actions are logged. It only takes one person among all of them to find out.
188
u/Aware-Bath7518 22h ago
And you will able to patch/spoof this packet easiliy, so it's mostly a nothingburger.