PolyMC Compromised
Kichura opened this issue · 10 comments
What happened?
PolyMC maintainer suddenly removed permissions from all it's contributors and deleted it's code of conduct.
These contributors thought that the maintainer's account was being taken over and quickly spread the news across Minecraft communities.
It was later confirmed that the account was not taken over and the change was intentional. Still, due to the abruptness of this action, who knows what might happen with it in the future again and as such, we no longer consider it safe.
As such, it will never be supported by Fabulously Optimized (and it never was) and instead we'll be considering to support it's fork, Prism Launcher, as soon as we consider it "sustainable".
What should I do?
Follow these instructions: https://fabulously-optimized.gitbook.io/modpack/readme/install-instructions#polymc
Has my Minecraft account been compromised?
No, your account is safe.
Is there a safe fork?
Yes, it's made by the same developers (except that lead developer of course):
https://prismlauncher.org/
https://github.com/PrismLauncher/PrismLauncher
I have more questions!
Ask in the fork's new Discord: https://discord.gg/hX4g537UNE
Or see the article: https://www.pcgamer.com/minecraft-launcher-project-spins-out-of-control-after-dev-hijacks-it-to-fight-leftist-queer-ideology/
OG PolyMC maintainer here, just a heads up. We are currently trying to get the organization back and have in the meantime opened a new organization. We hope GitHub and Discord will cooperate with us and help us get our stuff back. So far, the only risk of running PolyMC is the metadata server, so if you change that in the settings to something bogus, you are safe.
So far, the only risk of running PolyMC is the metadata server, so if you change that in the settings to something bogus, you are safe.
What about macOS auto-updater, AUR distribution, the website? I don't really think that is a safe solution.
Just don't update PolyMC or, like Kichura said, uninstall it until we give clearance. We might just rebrand entirely due to the damage done.
That's some damage.
If that was the only reason, why would he enable @everyone perms, change rank names, edit users' perms to view server's metadata..?
If that was the only reason, why would he enable
@everyoneperms, change rank names, edit users' perms to view server's metadata..?
Great question, for Lenny.
We don't know whether he is compromised or not and this isn't the place to discuss this either. All that's important is that we are working on either getting everything back or picking up the pieces and continue under a new name, domain, etc. Right now, the official mirror is at https://github.com/PlaceholderMC.
@cozyGalvinism Can you give more info about this security issue?
@cozyGalvinism Can you give more info about this security issue?
All information can be found on our Discord server.