Discussion in 'Bukkit News' started by EvilSeph, Apr 24, 2012.
Reading Comprehension. Use it.
Sure, you blame EvilSeph for doing his job, which is working on Minecraft. Those that work on CraftBukkit focus on hunting the problem in CraftBukkit. I thought it was obvious that he doesn't actively participate in the coding of CraftBukkit anymore and therefore doesn't count into the "available resources".
As programmers look over code making fixes they sometimes notice some other piece of code and decide to fix it along the way. I doubt he spent quite a lot of time making the changes to fix that particular problem, it was probably a one or two line change.
For example, when I first reported the CPU issues I did some analysis and found that the minecarts were chewing up resources. He might have glanced at that area first when he was investigating the CPU issues. And, happened to notice some code he could come back to and fiddle with to break the minecarts in fewer clicks.
Anyways, afforress I love spout and think it's great. Let's all just brush the chips off our shoulders and work together to make something really great IMO. Anyone devoting their time to advancing minecraft development in general deserves respect. We all love it and want to see it succeed.
Welcome Amaranth!It's nice to see an addition to the team.
Few things here:
User auth with minecraft.net happens before we even make an EntityPlayer object, let alone a CraftPlayer so there is no chance of impersonating another user by somehow tricking the cache.
The cache works by checking a player's name which they cannot change and a plugin cannot change without poking in to CraftBukkit code. Sure someone could exploit a plugin that does this but they're much more likely to find an issue with a plugin somewhere else that is more useful.
The cache is hopefully being removed anyway. It was only added to work around an issue which we believe we've identified and fixed and the cache is technically a memory leak since it never gets cleared.
As I warned, posts continuing to discuss the "force op exploit" in this topic have been removed. This is not the topic for that discussion.
We take potential security risks very seriously and will very happily take your comments, suggestions and other contributions in the topic discussing the matter here: http://goo.gl/gkKRS
Again, this topic is not the place for continuing that discussion; the linked topic above is where to go. I've now added a comment to all of the first page posts saying to not reply to them and directing users to that post as well. So please, stop with the force op comments here. Let's consolidate all the discussion to one place so that if there is a legitimate security concern we'll know where to find it.
Worth noting a lot of the claims being made regarding op stealing involve somehow exploiting the authentication stage. If I knew more about it I could elaborate here, but like I stated in the my post that was deleted I can't confirm or deny the existence of a real exploit yet. Suffice it to say, I'm always worried when I hear someone say, "never" or "no chance", or "impossible." IMO almost anything is possible, especially when it comes to anti-security. Thanks for addressing this, though.
The plugins being exploitable is a good point, and I did mention it in the my post that was deleted. I think that craftbukkit is more exploitable than native minecraft because it supports plugins. A chain is only as strong as it's weakest links. And, unfortunately, the bukkit team doesn't get to choose what plugins a server administrator installs, or make certain they're kept up to date with the latest fixes. This is always going to be a hole in the security for a foreseeable future, unless we had a plugin auto-update feature that can also detect and disable end-of-life plugins. It would be nice if it could also warn an admin of known security flaws in the plugins they have in the logs when they get loaded and there could be a bukkit.yml configuration property "prevent-plugin-security-flaws: true" that could be flipped by admins that could stop the server from starting if a known exploited plugin is attempting to load and jot something out to the log to let the admin know why his server did not start. And, a team could be formed to analyze each of the most popular plugins for quality and inform the developers if they find anything.
That's good news.
Thanks for honestly replying to me.
EDIT by Moderator: merged posts, please use the edit button instead of double posting.
His job is working on Minecraft which you admit...then why is he still on CraftBukkit? If he is just going to sit here and give updates to the community then hell anyone can do that. Wouldn't it be better to step down (and the rest of the Mojang team still on CraftBukkit's repo) and let a team take over that actually wants to work on CraftBukkit? Really really looks bad to have the majority of the team in-active...
As he said before, bleeding is perfectly capable so what is the issue with letting go?
Um for all of this programming is there any page with all the major changes in each version? Thanks for working so hard.
It's perfectly normal for big open source projects that the original creators keep control over the project and just delegate work. Two examples: Linux Kernel, "Wine" Project (at least some years ago, I don't know how it is today). In both cases the creators don't really work for the project anymore. I remember interviews with Linus in which he stated that his whole work is to approve patches that have already been approved by other staff members. So he just has to scan over them and decide if they fit his idea of how the project should evolve.
I absolutely don't think "anyone can do" what EvilSeph does and did* for this project.
(* So the way of thanking him for what he did is to push him out of the project?)
From time to time I get sick from reading around here in forums.
I wonder whether it's the age or just todays society...
All changes are showed on the file info on dl.bukkit.org
Community like the one we have here is still demanding, thankless, 80% aged < 18.
I am really amazed by your patience.
h31ix, I will not agree with you on this matter. It is society and the internet is only making it worse, because in real life you can avoid such idiots, but here it's not possible.
can someone help me when i try to download the reccomended build it shows R1 instead of R4 ????
can someone explain what a multicore is?
Big green button.
Don't ask questions.
What exactly is the current recommended build?
I cannot find something with that number -- "R.10". I did find "R1.0". But that's the only 125 recommended release I saw, and apparently that's in unacceptable shape.
So which version of the bukkit server should I use? I'm currently using:
21688 [email protected] 1 michael staff 11101992 Apr 4 16:45 craftbukkit.jar
but I don't know how to tell anything more than that.
10:16:37 [INFO] This server is running CraftBukkit version git-Bukkit-1.2.5-R1.0-b2149jnks (MC: 1.2.5) (Implementing API version 1.2.5-R1.0)
So if this is the bad version, what's the current good version?
Keybounce - Use the beta build.
I feel like this is more or less an advertisement "We magically fixed every issue USING this wondering program, which we happen to give you a link to!"
Nowhere in the article do we say we fixed every issue, don't put words in my mouth. We did spend days using YourKit Java Profiler to investigate the issue, as it is a powerful profiler and debug tool and it did help us fix the performance issue people were seeing. I'm not seeing the problem here.
Well I try to, but I'm not good in english.
At the moment the server core is based on one main thread, which runs 20 times a secound and does one thing after an other. Such a thing can only run on one physical core and all others are unused.
As todays processors have multiple cores the performance can increase by using them simultaneously. This can be reached by put some program parts in an other thread or multiple threads, but it's not that easy like it sounds. As they run simultaneously you have to handle how they can interact with each other.
For example when data is changed you have to take care that the other parts don't read incomplete things like when x/z coordinates change and one thread reads it while the other has written x and only is about to write z.
So it is really a lot of extra work to make a program like this and there is much more bug potential.
And by the way...
Java xx options like parallelGCThreads have nothing to do with running the program itself on multiple threads. There's no way java can handle the program itself like this.
GC means garbage collector which is an extra part of java where previously used memory parts that are no longer used are detected and returned to the 'pool' of useable memory. (I write it that way so everybody can understand it, maybe.)
Parallel garbage collection only makes it faster to free memory ressources, nothing more and nothing less. (That's really not a big part of the whole.)
One question from me, noone mentioned it earlier I think, but this is an amazing built-in feature, that should be avilable from the very beggining - mob limits !
Is the value in percents or is it a number of max mobs per type ?
And if its percent, what will happen if I will make a setting > or < than 100 ?
Maybe we should do something like "if theres more than x players on server use limitA if theres less than use limitB" etc.
I would also suggest to add an option to limit certain entity type, for example chickens that are often abused in underground farms. Players are lagging server with this and I have to use a plugin, and as we now many plugins dont actually work as you expect them to etc etc. I think it should be in the bundle by default.
Great work!!! and i hope the new team member helps!!!!
thanks SO MUCH, from all of the Minecraft servers (Below me... and ALL OF THEM).
I completely agree with you. And, keep in mind the people who say negative things like that are the minority. Most of us are happy with the work the bukkit team does and the progress they've made. Some people just like to lash out.
I didn't even know the tool existed, so I'm glad you pointed it out.
Keep good work bukkit I will wait to the 1.2.5 R2 I am suffering to keep my server online with the R1
EDIT: Err... and the bug of the jungle biome? Animals, sprites spawning inside leaves! It's Minecraft bug right?
Please please please work on multi-core processing. I have 16 threads to use and they're not being.
How do i replae the old from the new? Just erase the old and place the new? would that crash my plugins??
in console names with colors and ranks are too long and too annoying to read them Can u fix that ? lpease
EDIT by Moderator: merged posts, please use the edit button instead of double posting.
That's due to the plugin you use for chat.
same as Zidane..
But how install i it?
Separate names with a comma.