Comment by leijurv | Hacker News Reader

Comment by leijurv | Hacker News Reader

Parent Full thread

Yes, so Minecraft is exactly that. Any "I have mined this block" further than 6 blocks away from the player is ignored. The problem is that on a laggy server, an honest client can end up sending this, if the server lags out for more than 6 blocks of walking your player forward. So, Paper added a patch to undo these disallowed mines, setting them back to what they were. But this happened at any radius, and could be used to lag the server by making it generate any region. Then they patched it again and made it only reply if it were in a loaded chunk. The mistake was that it replies if the coordinate is in a chunk loaded by any player, not just by your player. :) See https://news.ycombinator.com/item?id=29620852

Hey thanks for your reply. I get how the Paper patch allowed this new exploit, but Im still curious to why Paper never even had the range check. Even for lag compensation it shouldnt be more than a chunk or 2 range.

Im actually reminded to the latest log4j exploit (main reason i aint actually gonna run Minecraft for a while) and even the Heartbleed exploit a few years back.

Did yall assume the patch to Paper would just return if the chunk was player loaded, and they wouldn't add any other sane bounds checks?

If the story from the FitMC guy is true, yall guessed/hoped that patch would be what it was. Giving yall a new leak of information without actually fixing the problem because if it was loaded you could still get all the block info in that chunk.

Pretty awesome from where i'm sitting. \(ᵔᵕᵔ)/

Well, Paper is trying to fix the result of vanilla Minecraft's range check. Taking their perspective, they wanted to fix the issue where <6 blocks worked, but >6 blocks caused desync. So it is natural to reply in the "else" block with "no you can't break that". They just didn't think of adding yet another range check with a looser limit on top of that.

I wasn't around for when the patch was engineered into Paper, but from what I'm told, yes that was the idea. :)

Reply on news.ycombinator.com