PolyMC compromised by rogue developer having unabomber manifesto in steam bio
github.com
github.com
That gist also links to an issue on the flatpak package (<https://github.com/flathub/org.polymc.PolyMC/issues/35>); if I understood the situation correctly, if you're using the flatpak package, they will do the metadata server change for you (and it probably never had automatic updates enabled, since updates should be through flatpak itself).
They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.
Unless you're using flatpak, which has its own sandbox (though it's not perfect); and one very important piece of information (very important at least for Minecraft players), which is the Minecraft authentication tokens, is within the sandbox.
Speaking of authentication tokens: does anyone know whether it would be necessary to remove the PolyMc authentication entry from the Microsoft account, and/or re-authenticate with the Microsoft account once the new fork is released?
What's the issue here? I'm not sure I understand the context.
But it looks like everyone in the commit comments is having fun posting photographs of cats to each other, which I suppose must be some "in joke" of the project. So I guess it's a funny prank they are doing, like an April Fool, but in mid-October.
The first place contributor was the lead maintainer of MultiMC, the project which PolyMC is forked from, and has never been active in the PolyMC fork.
The fourth place contributor is a MultiMC contributor from 2016-2018 who has never been active in this fork.
The fifth place is the MultiMC founder who left in 2017 or so.
So the people he kicked out are the people actively working on the code.
Even just looking at the last year, he kicked out the top 9 contributors while personally being 10th
The guy who kicked them out was focused on pushing political views instead of actually working on code.
And as a bonus, the political view he's trying to push is alt-right edgelordism, which is a step on the modern pathway to actual nazism.
All of the people who contributed significantly have now moved over to https://github.com/PrismLauncher/PrismLauncher, which is a project that isn't going to start making rash decisions based on extremist views.
[1]: https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... [2]: https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99...
https://steamcommunity.com/id/LennyMcLennington/
https://www.washingtonpost.com/wp-srv/national/longterm/unab...
The other maintainers have already started a fork.
Various people (such as the creator of the PolyMC fork that is confusingly named PollyMC, notice the amount of 'l's) suggest to change the metadata server: https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41.... I would personally suggest to use this fork because it does not require access to your MS account, so even if it was compromised the risk would end up being limited in comparison.
Side note: I find it sad to see how people took the chance to spread misinfo.
Example 1: claim that the MultiMC (not PolyMC!) developer is an alt right person who hates trans and gay people https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... (they took that idea from https://twitter.com/13yodeerfox/status/1582106791327899648, which did not even mention anything about lgbt)
Example 2: claim that the PolyMC developer received death threats: https://news.ycombinator.com/item?id=33240644, I have not seen any evidence for this claim in the repo nor in the reddit and twitter threads. It might have been in DMs but the developer hasn't said anything about it to my knowledge.