Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
[flagged] PolyMC compromised by rogue developer having unabomber manifesto in steam bio (github.com/polymc)
53 points by SuperSandro2000 on Oct 17, 2022 | hide | past | favorite | 63 comments


For those who use PolyMC, the most pressing question at the moment would be "what should I do right now"; one of the discussions had a link to the following gist https://gist.github.com/Earthcomputer/dc65391f84a2c19ebac6c3... which says that the two most important steps (before opening PolyMC, otherwise it could auto-update) would be to disable automatic updates, and change the metadata server to the one from the MultiMC project (from which PolyMC had forked).

That gist also links to an issue on the flatpak package (<https://github.com/flathub/org.polymc.PolyMC/issues/35>); if I understood the situation correctly, if you're using the flatpak package, they will do the metadata server change for you (and it probably never had automatic updates enabled, since updates should be through flatpak itself).


Should be noted that autoupdate was only ever available on macOS.


Downloading of jar files based on information from polymc's meta server (meta.polymc.org) applies to all versions.

They aren't ran in a sandbox or anything, so whoever controls meta.polymc.org can run whatever they want on your machine.


Yes, and the person I replied to explained how to prevent that, but seemed unsure about auto-update capabilities of the launcher itself, so I provided that information.


Ah, my bad. Going to leave it as is because I doubt I'm the only one who's going to parse that wrong and it's good to make sure nobody incorrectly thinks they're secure.


All good, apologies for not being clear.


> They aren't ran in a sandbox or anything

Unless you're using flatpak, which has its own sandbox (though it's not perfect); and one very important piece of information (very important at least for Minecraft players), which is the Minecraft authentication tokens, is within the sandbox.

Speaking of authentication tokens: does anyone know whether it would be necessary to remove the PolyMc authentication entry from the Microsoft account, and/or re-authenticate with the Microsoft account once the new fork is released?


Replying to myself about the authentication tokens: on the PlaceholderMC discord channel, one of the former PolyMC developers mentioned that the Microsoft authentication stuff was not under control of the compromised/rogue developer. My interpretation of that is that the authentication tokens are safe (unless an auto-update or the code delivered through the meta server is used to exfiltrate them).


I don't get it. One of the developers deleted the 'code of conduct'? And then lots of other people left strange comments on the commit?

What's the issue here? I'm not sure I understand the context.


No, the person who owns the GitHub organization kicked out all other developers with zero notice and started talking about how he's purging the "leftoids" from the project and that all other contributors were "promoting radicalist leftist queer ideology".


Is kicking out people who want to focus on pushing political views instead of actually working on said code bad?


He kicked out the 2nd, 3rd, 6th, 7th, 8th, 9th, 10th, 11th, 12th and 13th largest contributors while himself being the 14th largest.

The first place contributor was the lead maintainer of MultiMC, the project which PolyMC is forked from, and has never been active in the PolyMC fork.

The fourth place contributor is a MultiMC contributor from 2016-2018 who has never been active in this fork.

The fifth place is the MultiMC founder who left in 2017 or so.

So the people he kicked out are the people actively working on the code.

Even just looking at the last year, he kicked out the top 9 contributors while personally being 10th


He kicked out 100% of people who actually contribute code, so I'm not sure what the heck you're talking about. To the contrary, the sole person left in the project is the one who was all political about it.


This is the complete opposite of what happened. Kenny barely contributed to the project and mostly just wanted to push his anti-trans political views. The other contributors are the ones who actually wrote the bulk of the code. The PolyMC project now has almost no developer talent left, because Kenny kicked everyone who doesn't agree with him.

All of the people who contributed significantly have now moved over to https://github.com/PrismLauncher/PrismLauncher, which is a project that isn't going to start making rash decisions based on extremist views.


They weren't focused on pushing political views instead of actually working on code.

The guy who kicked them out was focused on pushing political views instead of actually working on code.

And as a bonus, the political view he's trying to push is alt-right edgelordism, which is a step on the modern pathway to actual nazism.


Ah okay that all seems rather silly. Sounds like one dev decided to play a prank on the other devs.


That's a pretty charitable interpretation of events so far


No idea really, I'd never heard of the project until it popped up here.

But it looks like everyone in the commit comments is having fun posting photographs of cats to each other, which I suppose must be some "in joke" of the project. So I guess it's a funny prank they are doing, like an April Fool, but in mid-October.


You do realise that this is about a piece of software with auto-updating and remote server control capabilities? A community project where suddenly all power is transferred to one individual who can now push malware to everyone who has the software installed is hardly a joke.


[flagged]


It has nothing to do with how open the source is, but I presume you already know this and are just a trolling teenager.


An oddly rude response.


You should scroll back. And read the other linked comments in this thread


I guess you don't have the context of what the commit message means. "Leftoids" is a derogatory slang term for people who aren't politically right-wing, and deleting the CoC like this while kicking everyone else out and declaring that the project has been "reclaimed from the leftoids" reads less like a prank and more like someone wanted to kick political opponents off the project.


They also locked out all the other developers. So effectively this is a hostile takeover.


See reddit [1] for the deleted Discord announcement. Currently their Discord Channel and a GitHub commit [2] are being spammed.

[1]: https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... [2]: https://github.com/PolyMC/PolyMC/commit/ccf282593dcdbe189c99...


The owner whose account might be hacked or might just have decided to do this kicking out all the active devs from the github project at the same time is some important context to go with the issue.

The other maintainers have already started a fork.

https://github.com/PlaceholderMC/PlaceholderMC


They signed something with their PGP key to prove their account was not hacked


They might as well just move to MultiMC


MultiMC has been historically hostile to distros packaging it, which is part of the reason PolyMC got popular.


Also their steam profile is very interesting in containing the first paragraph of the unabomber terrorist manfiesto.

https://steamcommunity.com/id/LennyMcLennington/

https://www.washingtonpost.com/wp-srv/national/longterm/unab...


A reminder to go to your microsoft account remove consent for PolyMC once you change clients. The link is probably one of these: https://microsoft.com/consent, https://account.live.com/consent/manage

Various people (such as the creator of the PolyMC fork that is confusingly named PollyMC, notice the amount of 'l's) suggest to change the metadata server: https://github.com/fn2006/PollyMC/commit/121f6b2a4e05fa15b41.... I would personally suggest to use this fork because it does not require access to your MS account, so even if it was compromised the risk would end up being limited in comparison.

Side note: I find it sad to see how people took the chance to spread misinfo.

Example 1: claim that the MultiMC (not PolyMC!) developer is an alt right person who hates trans and gay people https://www.reddit.com/r/PolyMCLauncher/comments/y6k4x7/swit... (they took that idea from https://twitter.com/13yodeerfox/status/1582106791327899648, which did not even mention anything about lgbt)

Example 2: claim that the PolyMC developer received death threats: https://news.ycombinator.com/item?id=33240644, I have not seen any evidence for this claim in the repo nor in the reddit and twitter threads. It might have been in DMs but the developer hasn't said anything about it to my knowledge.


[flagged]


> The devs seemed very friendly and responsive, but are typical exclusionary Leftists that are not welcoming to people with different beliefs

What are the beliefs being excluded?


Presumably all beliefs not their own, they definitely dog-whistled that not that I can speak to that directly. But they were clearly exclusionary to different sexuality/biology.


This feels very "I made a transphobic comment and got removed"


I asked, what are examples of beliefs that are excluded by CoCs?

Most CoCs I've seen simply state a variation of "don't be an asshole", "don't act like some people aren't actually humans", etc - which seems reasonable to me: being an asshole drives away contributors, treating some people as subhuman has a similar effect.

I have yet to see a CoC that limits beliefs (e.g. "no christians", "no muslims", "no atheists"), nor politics (e.g. "no democrats", "no republicans", etc), nor any other group really - I have certainly never seen any CoC that excluded sexuality or biology, and I would love an example because I think that kind of discrimination is important to acknowledge and avoid.

I'm sure that you could find some smaller projects that do shit like the above, but by and large CoCs are generally boring "respect other people in the community" drivel.


You can read the CoC here: https://github.com/PolyMC/PolyMC/blob/aecd158d3c9fce7e42143c... Doesn't seem to exclude any normal behaviour.

Considering the torrent of transphobic posts related to this issue, this could be a hostile account takeover or maybe a transphobic developer. I associate the language used here with 4chan above all else, though some far-right groups use the same lingo.


The SQLite CoE[1] comes to mind. It is the one that gets closest to exclusionary[2], but even so it's still generally well-regarded on HN when it's discussed.[3][4].

1. https://sqlite.org/codeofethics.html

2. In that it assumes a Christian God. Rules: 1, 10, 21, 41, 42, 49, 50, 58, 60, 62, 70, 72.

3. https://news.ycombinator.com/item?id=18273530

4. https://news.ycombinator.com/item?id=18313131


Oh, woof that's quite the CoE :-O


I had not even read the CoC at that point. But it is somewhat similar in practise to the old Discord stuff. Hateful exclusionary Dog whistling mostly, nothing outright actionable, nothing you could take to court, but well understood what it means and how certain people will be treated under it.

The current rules under Lenny are ~dont be an asshole, dont cause drama, respect people.~ And yet people are lying about, brigading, spamming, and trying to destroy the project (and apparently harassing and sending threatening messages to Lenny) because he did not adopt a different CoC.


There is a big difference between "did not adopt a different CoC" and "removed all the other maintainers from the project and unilaterally deleted a CoC which had been around for a long time".

As far as I can tell, your message is itself misinformation.


If you look at the github history, it looks like people were literally griefing and deleting all of polymc. So it looks like he did not remove developers until after they threw a temper tantrum and started trying to destroy the project. What is a owner supposed to do when people you gave authority to start accepting PRs that delete all the content or replace the readme.md with trolly memes and harassment?

OR maybe some were removed before. All I know is clearly this targeted harassment campaign are not being forthright and truthful, otherwise the github history would not show what it shows.


This is just... not true? The README.md history[0] shows that it was last updated in august.

[0]: https://github.com/PolyMC/PolyMC/commits/develop/README.md


It is possible I dont understand how GH works. I apologies if I was wrong. I was talking about (https://github.com/PolyMC/PolyMC/pull/1243), which got 2 approvals. But it is possible I dont understand what approvals are, but to looks to me that people with authority on polymc to make changes approved of troll/destructive changes. But I am not an GH expert, maybe you dont need authority approve a PR that deleted the entire project and completly changes the readme?


Anyone on GitHub can give a grey checkmark approval. It's basically just a thumbs up. The green checkmark approvals are the ones given by people who at time of approving had project approval permission and only these green checkmark approvals have any mechanical effect.

Additionally, everyone who has ever contributed to the project gets a "Contributor" tag on their profile (current recognised contributors with permissions get a "Member" tag). You can see the trolling PR authors and approvers lack those.

So no, the trolls, including those giving the grey checkmark approvals, are not the former maintainers.


I see nothing like that in the Git commit history? What are you talking about?

Edit: it looks like some randos opened some PRs in the past couple hours. But that was after he already went rogue and kicked everyone?


I apologies if I just do not understand how the GH PR system works. I see approved/reviewed troll PRs. Maybe randoms can review/approve PRs? I assumed they had to be devs to approve PRs.


Can you link to which commit you're talking about? Have you verified it's not from a fork or a PR?


Hmm, maybe I just dont understand github. I have only ever done one PR. I see people approved (https://github.com/PolyMC/PolyMC/pull/1243) and took that to mean PolyMC devs approved it, but maybe the forker approved his own fork and that has nothing to do with polymc devs?


The original(?) one was not great as it contained exclusionary/discriminatory rules. See the "We will not act on complaints regarding" section https://web.archive.org/web/20160304034554/http://todogroup....

I am not aware of any modern CoC containing such section.


What was discriminatory in the "We will not act on complaints regarding" section?

* ‘Reverse’ -isms, including ‘reverse racism,’ ‘reverse sexism,’ and ‘cisphobia’

These aren't real things though - they're usually brought up in the context of methods to try and address underlying biases due to historical ("reverse" -racism, -sexism), or that I have never even heard of anyone claiming 'cisphobia' so I am unaware of when/how that would be claimed.

* Reasonable communication of boundaries...

Seems like there's nothing to discuss here at all - once a person says "stop talking to me" you can move on

* Refusal to explain or debate social justice concepts

No one owes anyone their time, this is all stuff that has been covered extensively, and is easily googleable.

* Communicating in a ‘tone’ you don’t find congenial

If anything this seems lax compared to many current CoCs that expect/require professional communication. This is "person X came across as angry/belittling/dismissive and it makes me upset" isn't something that they'll act on.

* Criticizing racist, sexist, cissexist, or otherwise oppressive behavior or assumptions

e.g the CoC won't act on someone complaining that someone else criticized racist, sexist, cissexist, etc behaviour.

Again, I fail to see the "exclusionary/discriminatory" rules.

I see the bigger issue with this section is that it makes an explicit list of things that don't matter and will be ignored. This is tricky as it means they ignore things that I would say should not be ignored, and vice versa. It also kind of means any kind of assholery that comes up in future isn't explicitly covered, so what rule applies?, etc


What sexualities do you believe they're excluding?


It's open source! Don't like it fork it! Simple as that. You're not forced to work with anyone you don't want to for any reason.

This always feels like a self tell for people with a very authoritarian mindset.

Just because someone like yourself would use conduct to exclude individuals from participating does not mean that others will.


"You're not forced to work with anyone you don't want to for any reason."

I think that is the point here. The developers had a disagreement, and now some of them and some community members, and a crowd of previous completely uninterested people are now sending death threats and spamming the forums and github. Some people do not seem to think that their is enough room in this world for disagreement and deciding to work separately.


What kicked this off was... adding a bog standard code of conduct. The latest commit removes this, with the message being "reclaim polymc from the leftoids".

So this is a simply knee-jerk over-reaction.


Not adding a fairly standard CoC resulted in death threats and and people attempting to take down PolyMC and prevent people from using it and it from keeping up development.

Talk about an overreaction.


You’re absolutely right, no one should be subjected to that.

The people acting like that should be excluded.

However that isn’t what you originally said, which was that CoCs typically exclude people on the basis of beliefs or biology. What I have been trying to work out is who and what is being excluded, and by whom?

If you are going to make that claim, you have to be able to provide concrete examples, as it’s a fairly significant issue that needs to be addressed.


No, sorry. I never meant to say that, tho I guess I could argue that by their very nature CoCs are exclusionary, and the longer they are the most exclusionary they are being, at least in general, that is the entire point of them.

I was trying to explain what I saw in my experience in their discord community. I don't remember the rules, or any specific interactions, it was just a overall leftist dog-whistling aura of if you are not like us you don't belong here. I never encountered anyone who was not friendly and accommodating, so while the server made me feel uncomfortable I was and remain ostentatiously a member because of being a big fan of the software product which I have used extensively for about 7 months now.


An example of leftist dog whistle behaviour being..?

Here’s the thing, many projects have adopted CoCs over the last few years because in the absence of specific documents saying “don’t be racist, sexist, antisemitic, transphobic, homophobic, …” there were people doing just that, and then saying it wasn’t against the rules.

There a significant problem in which people have been trying to claim that racism, sexism, antisemitism, transphobia, homophobia, etc are a core part of their religion or political beliefs, and so must be allowed. These same groups make claims like giving gay or trans people the same rights as non-gay or non-trans people is somehow giving those people privileges.

The reason they make those claims is solely to do a very classic trick employed by white supremacists, which is to claim that by not allowing them to dehumanize others you are discriminating against them.

It’s a generally common refrain used by any group discriminating against any other group - from neonazis against Jews, Israelis vs Palestinians, to the jim Crow states against black people in the south. In all cases the group that wishes to discriminate claims that being denied the right to discriminate is itself discrimination.


To be clear, the code of conduct was added 8 months ago and removing it again was rejected 4 months ago, so it's not even a new development


Usually the beliefs being excluded are things like "white people are superior to all others", "there is no reason for the English language to have different words for sex and gender", or "it's acceptable to use terms for immutable characteristics as insults", etc.

And let's be honest - those ideas are excluded in the name of inclusivity. If you interpret "inclusivity" as meaning "accepts everything", you end up at a paradox quite quickly. It's the paradox of tolerance, yet again. And its cause is the same thing: misunderstanding the goals based on a naive reading of the name.

Inclusivity isn't about including absolutely everything. It's about maximizing the variety present. And doing that does have the cost of rejecting people who drive others away.


"maximizing the variety present." is new to me. Is this a common idea?


It's the idea underlying any kind of "diversity" effort. Nevermind that most of those get heavily corrupted into some form red tape box-checking or internal power struggle rapidly. People will be people, no matter what they say they're doing. But that's where it started.


Why’s it only popping up where there’s power to be had or money to be made? Why don’t we need to maximize the variety present in kindergarten teachers?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: