From b1a1bf76b3e43db9c94bde83374f05acf261d596 Mon Sep 17 00:00:00 2001 From: Tim Date: Sun, 2 Aug 2026 11:38:46 -0400 Subject: [PATCH] Remove MythicalAC: it kicked a whitelisted player for opening a door The Phase check escalated a legitimate player from vl 13 to 25 during ordinary movement and disconnected them. Step had already been false-flagging an op just walking through terrain. Create contraptions, Waystones teleports and ~90ms latency to LON1 all produce the position desync these checks look for, so the false positives are structural here, not incidental. Nothing could be tuned. The mod ships no config file and generates none across restarts, so no threshold could be raised and no player exempted. Its jar is 60KB with 16 classes, it logs nothing server-side (alerts go only to ops chat, leaving no audit trail), every published build is tagged beta or alpha, and its package name com/serverguard does not match its own mod id. It also defended against a threat this server does not have. The whitelist is enforced, online-mode verifies every account against Mojang, and PvP is off, so there are no untrusted players and cheating harms nobody. What remains is the protection that actually works: PrismProtect block and chest logging with rollback, ProfanityGuard, disabled command blocks, spawn protection and forced gamemode. An alerting system that cries wolf is worse than none: it taught everyone to scroll past alerts, and then it removed a child from the game. Refs #8 --- docker-compose.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 55ee01c..d048762 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -52,18 +52,25 @@ services: # image, so we list the jars directly. To refresh after changing the pack: # read each file's downloads[0] from the pack's modrinth.index.json where # env.server != "unsupported", and join with commas. - MODS: "https://cdn.modrinth.com/data/LNytGWDc/versions/8amzvn9x/create-1.20.1-6.0.8.jar,https://cdn.modrinth.com/data/gu7yAYhd/versions/rx9gr1rz/cc-tweaked-1.20.1-forge-1.120.0.jar,https://cdn.modrinth.com/data/fXt291FO/versions/yxrimuPr/cccbridge-mc1.20.1-v1.7.1-forge.jar,https://cdn.modrinth.com/data/SOw6jD6x/versions/mIP0ApJY/AdvancedPeripherals-1.20.1-0.7.48r.jar,https://cdn.modrinth.com/data/R2OftAxM/versions/CsjS7EkP/FarmersDelight-1.20.1-1.3.2.jar,https://cdn.modrinth.com/data/WFwYiVoG/versions/Jo8EwiDR/letsdo-bakery-forge-1.1.15.jar,https://cdn.modrinth.com/data/1DWmBJVA/versions/2I4cH49O/letsdo-vinery-forge-1.4.41.jar,https://cdn.modrinth.com/data/wvMc8AJt/versions/eAALa47O/lightmanscurrency-1.20.1-2.3.0.5.jar,https://cdn.modrinth.com/data/LOpKHB2A/versions/sKoHLGbK/waystones-forge-1.20.1-14.1.20.jar,https://cdn.modrinth.com/data/SaCpeal4/versions/gBDsc134/comforts-forge-6.4.0%2B1.20.1.jar,https://cdn.modrinth.com/data/nU0bVIaL/versions/94dtOLgZ/Patchouli-1.20.1-85-FORGE.jar,https://cdn.modrinth.com/data/u6dRKJwZ/versions/vnxhddW4/jei-1.20.1-forge-15.20.0.133.jar,https://cdn.modrinth.com/data/lhGA9TYQ/versions/1MKTLiiG/architectury-9.2.14-forge.jar,https://cdn.modrinth.com/data/4XJZeZbM/versions/uEaTMht9/letsdo-API-forge-1.2.15-forge.jar,https://cdn.modrinth.com/data/MBAkmtvl/versions/8rz04Kha/balm-forge-1.20.1-7.3.38-all.jar,https://cdn.modrinth.com/data/umyGl7zF/versions/g5igndAv/kubejs-forge-2001.6.5-build.16.jar,https://cdn.modrinth.com/data/sk9knFPE/versions/maCpsT70/rhino-forge-2001.2.3-build.6.jar,https://cdn.modrinth.com/data/ordsPcFz/versions/Zsh14XeQ/kotlinforforge-4.12.0-all.jar,https://cdn.modrinth.com/data/zfbCkvdZ/versions/er56DwLJ/Kambrik-6.1.1%2B1.20.1-forge.jar,https://cdn.modrinth.com/data/BpwWFOVM/versions/EM7Su3PD/Bountiful-6.0.4%2B1.20.1-forge.jar,https://cdn.modrinth.com/data/oydE75bY/versions/bLT6TveT/mythicalac-forge-1.20.1-1.0.0.jar,https://cdn.modrinth.com/data/Vebnzrzj/versions/AudvOzqV/LuckPerms-Forge-5.4.102.jar,https://cdn.modrinth.com/data/w55UhnTf/versions/lkx1EGgV/Profanity%20Guard-forge-1.20.1-1.1.0.jar,https://cdn.modrinth.com/data/swbUV1cr/versions/kC7iYqja/bluemap-5.12-mc1.20-6-forge.jar,https://cdn.modrinth.com/data/FIpr9lji/versions/LcBh53eF/prismprotect-forge-1.3.2-mc1.20.1-1.20.4.jar,https://cdn.modrinth.com/data/rsBa8ErW/versions/l7p4hUk0/playtimestatistics-1.20.x-zh-CN-1.0.1.jar" + MODS: "https://cdn.modrinth.com/data/LNytGWDc/versions/8amzvn9x/create-1.20.1-6.0.8.jar,https://cdn.modrinth.com/data/gu7yAYhd/versions/rx9gr1rz/cc-tweaked-1.20.1-forge-1.120.0.jar,https://cdn.modrinth.com/data/fXt291FO/versions/yxrimuPr/cccbridge-mc1.20.1-v1.7.1-forge.jar,https://cdn.modrinth.com/data/SOw6jD6x/versions/mIP0ApJY/AdvancedPeripherals-1.20.1-0.7.48r.jar,https://cdn.modrinth.com/data/R2OftAxM/versions/CsjS7EkP/FarmersDelight-1.20.1-1.3.2.jar,https://cdn.modrinth.com/data/WFwYiVoG/versions/Jo8EwiDR/letsdo-bakery-forge-1.1.15.jar,https://cdn.modrinth.com/data/1DWmBJVA/versions/2I4cH49O/letsdo-vinery-forge-1.4.41.jar,https://cdn.modrinth.com/data/wvMc8AJt/versions/eAALa47O/lightmanscurrency-1.20.1-2.3.0.5.jar,https://cdn.modrinth.com/data/LOpKHB2A/versions/sKoHLGbK/waystones-forge-1.20.1-14.1.20.jar,https://cdn.modrinth.com/data/SaCpeal4/versions/gBDsc134/comforts-forge-6.4.0%2B1.20.1.jar,https://cdn.modrinth.com/data/nU0bVIaL/versions/94dtOLgZ/Patchouli-1.20.1-85-FORGE.jar,https://cdn.modrinth.com/data/u6dRKJwZ/versions/vnxhddW4/jei-1.20.1-forge-15.20.0.133.jar,https://cdn.modrinth.com/data/lhGA9TYQ/versions/1MKTLiiG/architectury-9.2.14-forge.jar,https://cdn.modrinth.com/data/4XJZeZbM/versions/uEaTMht9/letsdo-API-forge-1.2.15-forge.jar,https://cdn.modrinth.com/data/MBAkmtvl/versions/8rz04Kha/balm-forge-1.20.1-7.3.38-all.jar,https://cdn.modrinth.com/data/umyGl7zF/versions/g5igndAv/kubejs-forge-2001.6.5-build.16.jar,https://cdn.modrinth.com/data/sk9knFPE/versions/maCpsT70/rhino-forge-2001.2.3-build.6.jar,https://cdn.modrinth.com/data/ordsPcFz/versions/Zsh14XeQ/kotlinforforge-4.12.0-all.jar,https://cdn.modrinth.com/data/zfbCkvdZ/versions/er56DwLJ/Kambrik-6.1.1%2B1.20.1-forge.jar,https://cdn.modrinth.com/data/BpwWFOVM/versions/EM7Su3PD/Bountiful-6.0.4%2B1.20.1-forge.jar,https://cdn.modrinth.com/data/Vebnzrzj/versions/AudvOzqV/LuckPerms-Forge-5.4.102.jar,https://cdn.modrinth.com/data/w55UhnTf/versions/lkx1EGgV/Profanity%20Guard-forge-1.20.1-1.1.0.jar,https://cdn.modrinth.com/data/swbUV1cr/versions/kC7iYqja/bluemap-5.12-mc1.20-6-forge.jar,https://cdn.modrinth.com/data/FIpr9lji/versions/LcBh53eF/prismprotect-forge-1.3.2-mc1.20.1-1.20.4.jar,https://cdn.modrinth.com/data/rsBa8ErW/versions/l7p4hUk0/playtimestatistics-1.20.x-zh-CN-1.0.1.jar" # Questify (quests) was removed: it and PrismProtect both shade their own # copy of org.sqlite as plain classes under the same package name, which # Forge's module system refuses to load together ("Modules questory and # prismprotect export package org.sqlite to module profanity") - a hard # crash before any mod even loads, not fixable by config. Kept PrismProtect # since block/chest rollback logging is a safety feature. - # mythicalac (anticheat, server-only) is pinned by URL above, NOT listed in - # MODRINTH_PROJECTS below: every published version is tagged beta/alpha, and - # itzg's MODRINTH_PROJECTS only accepts "release" by default, so it failed - # every boot with "No candidate versions ... matched versionType=release" - # and crash-looped the container. Pinning the exact jar sidesteps that filter. + # mythicalac (anticheat) was REMOVED 2026-08-02. It kicked a whitelisted + # player for opening a door: the Phase check escalated vl 13 to 25 on + # ordinary movement, and Step false-flagged an op just walking. The mod + # ships no config file and never generates one, so no threshold could be + # raised and no player could be exempted; the only lever was uninstalling + # it. Its jar is 60KB with 16 classes, every published build is tagged + # beta/alpha (which is why it could never be fetched by project name), and + # it logs nothing server-side, so there was no audit trail to review. + # It also protected against a threat this server does not have: the + # whitelist is enforced and PvP is off, so there are no untrusted players. + # Do not re-add an anticheat without a config file, ops exemption, and + # server-side logging. See issue #8. # Server-only admin/safety mods, not in the player pack: # prismprotect = CoreProtect-style block/chest logging + rollback, # playtimestatistics = per-player playtime shown in the tab list.