Closed VidTu closed 4 months ago
virus steal account
@The-Fireplace, it should be ready for the first release candidate. Can you give me the access to the CI (GH actions) and security (security policy, etc) settings?
@VidTu Done. I went ahead and enabled Dependabot security scanning while I was at it, feel free to adjust as needed.
Thank you. I think I'll do some more testing and will release first release candidate on Modrinth, CurseForge after the weekend. Maybe I'll also set up something like mc-publish as it's recommended by Fabric in the future to automate publishing. (especially during the release candidate phase so it won't screw everything up if it won't release on one platform due to wrong config or something like that)
@The-Fireplace feel free to review and merge (squashing preferred). After that I'll probably push first "9.0.0-alpha.1" version to Modrinth/CF. (Unless you'll have complaints)
oops, duel-booting into linux broke system clock and windows didn't sync time for some reason. these 3 commits were added just now, not 3 hours ago.
What's new:
Required: (before merging)
Config screen and ModMenu integration. (Config system is ready)(✅ Config system and screen are both ready)Config and accounts migration from IAS8.(✅ Done)Support account reordering. (like in IAS8)(✅ Done)Ensure that current encryption system is stable and secure to be "baked".(✅ Probably and it should be not too hard to change if we need)To consider:
Is the current hardware key generation system unique enough? (Can use OSHI reflectively as it's provided by Mojang sometimes)(✅ Pretty secure now, uses old Java property and env retrievers and when available uses OSHI to retrieve baseboard, BIOS, disks, graphics cards for hardware key)Is the current hardware/password key AES/PBKDF2 encryption secure enough?(✅ PBKDF2/Sha512Hmac uses 500_000 iterations, it's stronger than recommended by OWASP; AES/GCM uses 256 bits, 16-byte IV; the only weakness is either choice or implementation details, can use ChaCha-Poly, not sure about support)Forge/NeoForge port? (With Architectury Loom)(✅ Done)Native Quilt port? (Shouldn't be too hard)(✅ Done)Backport to some MC versions with Java 17? (1.18.2, 1.19.2, 1.19.4, 1.20.1, 1.20.2?)(❌ Probably after releasing Release Candidates)Using "state" query in MS auth to increase security? (If it will increase security)(✅ Using now)Informative error messages for common login errors?(✅ Some errors related to crypting, internet connection and common issues from wiki.vg now have fancy messages with additional help info)Username in the titlebar?(✅ Done)Displaying (and copying?) account UUID somewhere? (tooltip?)(✅ Done, in tooltip and copying with CTRL+C for name or CTRL+SHIFT+C for UUID)Text color configuration?(❌ Not planned for now, color picker will be either really big in code, using tinyfd, which may not be supported for all MC versions, or plain text fields which is inconvenient)More convenient button configuration? (e.g. drag-and-drop)(❌ Not planned for now, button automatically moves if it'll overlap with another button, that's enough for simple users, advanced users could use advanced config especially with new helper tooltips)CI (GitHub Actions), dependabot, renovate? (For various dependencies and things such as Fabric API, Loom, Gradle)(⚠️ Sort of, requires enabling later)Security policy, secret scanning, private vulnerability reporting?(⚠️ Sort of, requires enabling later)Gradle upload plugins? (Minotaur, CurseGradle)(❌ They don't work with Architectury Loom, will try GH actions task later)Add "security concerns" and "common issues" pages? (also add them into ModMenu and probably account selector or config UI)(✅ Done)Add alternate authentication method used, e.g. in MultiMC and Prism Launcher.(✅ Done)Add remote (GitHub) endpoint that will disable the (current version of the) mod, if say a security vulnerability is found.(✅ Done)Clear clipboard on MS auth end/success/fail/cancel if it contains something that looks like an auth link. (Sharing auth link shouldn't be a security problem anyway)(✅ Done)Resolves #84. Resolves #92. (By adding descriptive error messages) Resolves #98. (10 ports will be used, they're added manually in the Microsoft Entra, so I'm lazy to do more; Alternate authentication method was also added) Resolves #104. (By also copying the link into the clipboard) Resolves #106. (By adding descriptive error messages) Resolves #113. (By adding descriptive error messages) Resolves #115. (By adding descriptive error messages) Resolves #124. (By using new skin renderer) Resolves #130. (By rewriting UI)
Will close #120. (Deprecated) Will close #128. (Deprecated)