Time Nick Message 02:59 Zeno` do c++11 threads work? 03:00 Zeno` /home/zeno/minetest/src/threading/thread.cpp:210:17: error: ‘m_thread_handle’ was not declared in this scope 03:00 Zeno` but... of course that's not declared if USE_CPP11_THREADS == 1 03:01 Zeno` so all code that uses m_thread_handle obviously doesn't compile 03:01 Zeno` hmm 03:09 Zeno` how did this end up in the code? 03:09 Zeno` it doesn't work! 03:09 * Zeno` looks at git history 03:22 Zeno` nvm, I just need sleep 03:22 Zeno` sfan5 fixed it a while ago 07:23 Zeno` I've +1 #4155 07:23 ShadowBot https://github.com/minetest/minetest/issues/4155 -- Implement player attribute backend by nerzhul 07:24 Zeno` The code looks good, my basic tests seem to confirm everything works and it's been tested on a live server 07:44 nrzkt merging #4155 in maximum 4 hours :) 07:44 ShadowBot https://github.com/minetest/minetest/issues/4155 -- Implement player attribute backend by nerzhul 07:48 sofar do it! 07:51 nore \o/ 07:59 nrzkt sofar, done as it was requested by the people :p 08:00 red-001 wow 4155 was merged??? 08:01 red-001 I though it will never happen 08:01 nrzkt it seems this devel branch is mor active :) 08:02 red-001 ohh it's a version without sqlite 08:02 red-001 still awesome 08:02 sofar so who's good with textures and stuff? 08:04 nrzkt red-001, it's a pure implementation using current tools 08:04 nrzkt but sqlite/pg version will come next month i think, i need to backport it 08:04 red-001 wow thats great 08:05 nrzkt i have a working version since 18 months on my server 08:05 red-001 seems like minetest dev is really active right now 08:05 nrzkt red-001, can you rebase our CSM PR ? 08:05 nrzkt need to go, see you 08:05 red-001 well not right now, I need to leave soon 09:19 nrzkt Zeno`: there are many code style problems :) 09:20 nrzkt but if you are okay with change, good point, just need to fix code style 09:20 Zeno` ? 09:20 Zeno` oh I didn't even look at style. That's for other people :) 09:22 Zeno` pity that something like I dunno... Astyle cannot be applied to diffs 09:22 Zeno` hehe 09:22 Zeno` diffs/patches 10:56 juhdanad nrkzt: sorry, I don't understand what you wrote there: https://github.com/minetest/minetest/pull/4421#discussion_r98165535 11:06 juhdanad Ah, now I see. 11:06 nrzkt you declare class Map; but there is no other Map * pointer usage in this diff for this file, i suspect this is a useless line 11:06 nrzkt or misplaced 11:07 juhdanad Yes, a rebase mistake. 11:27 juhdanad nrkzt: #4421 is done! 11:27 ShadowBot https://github.com/minetest/minetest/issues/4421 -- Expose getPointedThing() as Raycast by juhdanad 12:36 paramat moving to 0.5.0 next release is ok with me, mapgenwise we now have multiple mapgens and a new default mapgen, 0.4.0 was roughly the time of starting mgv6 12:39 VanessaE will anything major break by doing so? 12:48 paramat only the version number heh 12:48 VanessaE then it needs to stay 0.4.x 12:48 VanessaE 0.5.0 is reserved for something big that breaks stuff 12:49 VanessaE (I think it was originally for the idea of a major network code rewrite) 12:49 kaeza something big like CSM? 12:49 VanessaE CSM? 12:50 kaeza client-side modding 12:50 VanessaE oh 12:50 VanessaE well I don't expect that will break anything :) 12:51 paramat the light bug fixes by juhdanad bump mapblock serialisation 12:52 VanessaE not broken enough ;) 12:52 kaeza it won't break anything, but it will be big 12:53 kaeza at least MT never encouraged use of version numbers for identification, so don't think anything will be broken by putting a five in there :P 12:53 Zeno` Personally I would like to break things at this stage of the project 12:53 Zeno` Not breaking for breaking's sake, but because it seems like some things might need to be broken to progress 12:53 nrzkt currently CSM doesn't require any break 12:53 Zeno` nrzkt, correct 12:54 kaeza (that was the rumor about why there's no Windows 9, BTW :P) 12:54 Zeno` But even if it did I am not sure I'd object to it strongly 12:54 nrzkt but it will be a very big feature and a major version bump is logical 12:54 nrzkt we will try to make the CSM (aka #5088 merge) without breaking change, and it is atm, as it's a purely client side feature, which is a good start to preview API to modders 12:54 ShadowBot https://github.com/minetest/minetest/issues/5088 -- Client side scripting/modding by nerzhul 12:55 Zeno` looking at the code and the PRs I think that things might need to be broken to make things better in the future 12:55 Zeno` I know that it's a big deal, but just putting it off is not a (good) solution 12:55 nrzkt Zeno`: red-001 we should finish security to make #5088 mergeable asap to master 12:55 ShadowBot https://github.com/minetest/minetest/issues/5088 -- Client side scripting/modding by nerzhul 12:55 nrzkt Zeno`: which part of CSM would require a break ? 12:56 VanessaE I had no idea client-side modding was nearly ready 12:56 Zeno` nrzkt, none that I can say. I am speaking in general 12:56 kaeza it is a thing at least 12:56 nrzkt VanessaE: in fact i started the branch last week and red-001 participate actively 12:56 VanessaE (though looking at the PR description, still has some ways to go :) ) 12:57 Zeno` there is a strange thing about CSM 12:57 nrzkt the starting up is a very very little kernel, look at https://github.com/minetest/minetest/blob/client_side_modding/doc/client_lua_api.txt 12:57 Zeno` even though CSM has never been supported it has been in a way (e.g. mainmenu) 12:58 nrzkt mainmenu is a different lua stack as CSM 12:58 Zeno` nrzkt, I know. But the idea is the same 12:58 Zeno` CSM is something that I would love to see 12:59 nrzkt now i need to start teaching my student, will answer a little bit slow for ~30mins 12:59 nrzkt yeah Zeno` can you help us in one 5088 point ? especially security (on red-001 PR) 12:59 Zeno` I think SN is better qualified to comment on that than I am 13:00 Zeno` :) 13:01 Zeno` or even nore 13:01 nrzkt i think we should change the current I/O behaviour client side to use virtual namespaces 13:01 Zeno` I've never really even looked at those parts of the codebase 13:02 Zeno` I can review the code of course 13:02 nrzkt currently if i remember it stuck to one specific folder, but i think a godot like path could be interesting, for example mod:// for a local mod storage and shared:// for a mod shared storage, what do you think zeno ? 13:02 Zeno` but I would not like to make any kind of final decision 13:02 nrzkt Zeno`: yeah, maybe you can help us to port some interesting calls ? 13:02 Zeno` maybe, yes. I'll look at it 13:02 nrzkt for example Minimap handlers 13:03 nrzkt adding Lua calls to handle minimap (position, size, mode) 13:03 nrzkt it's a static feature atm it could be an interesting HUD modding, changing the form (round, square...) 13:03 nrzkt or core.register_on_punchnode 13:03 nrzkt i added interesting registers to PR for a good modding startup, for example purely client side on_dig sound 13:04 nrzkt we need to port map lua calls for local map, permitting to port easily ambiance mod purely client side 13:06 * Zeno` is sleepy 13:06 celeron55 read-only versions of the server apis are kind of a trivial design choice 13:06 nrzkt for a first preview could be nice, after a second PR adding more things, like server side mod channels as sofar suggested and used by World of Warcraft permitting same mod to discuss with other mod users without involving any server part except message routing 13:06 celeron55 and probably make sense 13:07 nrzkt celeron55: for map ? yes obbviously client should not modify local map, except for particles but it's not exactly map 13:07 nrzkt or maybe texture modding 13:07 nore hmmm, I think client *should* be allowed to modify local map 13:07 VanessaE so long as the server isn't forced to accept such changes. 13:07 nore but it's up to the modders to make something compatible with the server 13:07 Zeno` true 13:08 nore i.e. like is done currently with node placement prediction, which is purely local 13:08 nore and when the client receives map updates from the server, any client-side change is overwritten 13:09 nore I guess we eventually want to remove node placement prediction from the engine even and make it a client-side mod 13:10 Zeno` is that "safe"? 13:10 nore Zeno`: why wouldn't it be? 13:10 Zeno` not really sure, which is why I'm asking 13:11 nore I mean, we're already doing it with node placement prediction 13:11 Zeno` true 13:11 nore so it shouldn't be a problem to allow mods to do it as well 13:12 Zeno` without seeing how it works I think I agree 13:32 nrzkt nore map prediction is not a very good idea, we risk desync problems 13:32 nrzkt and it's not a performance gain server side 13:33 nore nrzkt: well, desync problems are modder responsibility 13:33 nrzkt nore: map desync problem ? absolutely not 13:34 nore and while it's not a performance gain, it will allow the client to feel more responsive 13:34 nrzkt and map loading client side is due to other things server side, like the big map lock 13:34 nore nrzkt: well, the server will send the block again if it changed 13:34 nore if this is not the same as what the client had, then we overwrite it 13:34 nrzkt no 13:35 nore why? 13:35 nrzkt it's not good, as the client needs to send its mapblocsk to ensure they are correct, and server should compare and... it's a performance killer 13:35 nore no, the client never sends its mapblocks 13:35 nrzkt only texture modifications shloud be added, not terrain block changes or prediction, it's not the problem in our map loading 13:35 nore what I said was that if ever the server sends the block again and the client hasn't the same, well, the server is right 13:36 nore and if map sync wasn't correct then some mod was responsible 13:36 nrzkt then what do you want to predict if server always send the mapblock? 13:36 nore what I mean is something like node placement prediction 13:37 nrzkt and how server know the mapblock isn't good to send it to client if client doesn't sent it ? 13:37 nrzkt we already have that 13:37 nore the client already makes changes to its local map to predict the placement of a node 13:37 nrzkt node & dig prediction 13:37 nore except that we'd like to have it moddable and improved 13:37 nore it would be easy if client mods can modify local map 13:37 nrzkt why mod node placement ? for a client side world edit ? 13:37 nore and it would work the same as client prediction 13:38 nrzkt i would see a client side map paint like in MC with world edit, terraforming using paintbrush client side 13:38 nore well, look at nodes that have non-trivial on_place functions, such as an on_place = minetest.rotate, or nodes such as beds 13:38 nrzkt it's 13:39 nore if you place a bed, it places a second node (ok, not anymore, now it's meshes) 13:39 nore but anyway, things like that aren't predicted by the node placement prediction code 13:39 nrzkt for the node rotation it's a little bit more compliacated, but a local mod can override that to predict the correct rotation 13:39 nrzkt if it's you want 13:39 nore if it was moddable, it would be easy to predict the placement of such nodes 13:39 nore yes, that's it 13:39 nrzkt okay i understand 13:39 nore so, we give access to the local map to mods 13:40 nrzkt nore: for starting we need RO access to map 13:40 nrzkt especially to know what node is under player and points at 13:40 nore but they have *absolutely no idea* of what will happen to changes they make, because they could be overwritten any time 13:40 nore ^ of course 13:41 Zeno` I agree with nore 13:41 nrzkt nore: have you get time to help us working on 5088 ? especially for the map getters ? 13:41 Zeno` there are some problems I can foresee but I don't think they're impossible to overcome 13:43 nore nrzkt: I will see if I can find some time to work on it, but I'm not sure to be able to do that for now 13:46 nrzkt no problem, take your time, 0.4.15 was released 1 month ago we have some time to work on it 13:46 paramat #1531 are devs ok with me making bush leaves leafdecay? 13:46 ShadowBot https://github.com/minetest/minetest/issues/1531 -- Be Able to Load Mods Without Restart 13:46 paramat game#1531 13:46 ShadowBot https://github.com/minetest/minetest_game/issues/1531 -- Bush leaves don't decay when removing the stem 14:16 nrzkt kilbith hm 14:16 nrzkt ooops 15:26 octacian Do I have to do anything special to modify tab_mods.lua in mainmenu? I've tried doing several things, but in the end, when I do ./bin/minetest, nothing had changed 15:56 rubenwardy octacian, it's just a normal lua file 15:56 octacian rubenwardy: problem was, I had forgotten to specify DRUN_IN_PLACE 15:56 rubenwardy maybe you're editing in the wrong place? It may be running from /usr/local/share/minetest 15:57 octacian I had to reinstall everything after HDD failure, and again, had forgotten to do DRUN_IN_PLACE 16:37 sofar Re: node placement prediction discussion - 16:37 sofar I agree we should allow mods to modify the node placement prediction 16:38 sofar but that's not the same as allowing the client to modify the map 16:38 sofar it's one thing to tell the client "I predict node X goes there now" 16:38 sofar since we know the server will be updating it soon 16:38 sofar it's another thing to allow a mod to just put a node somewhere 16:39 paramat #5115 any comments? 16:39 ShadowBot https://github.com/minetest/minetest/issues/5115 -- Plantlike: Fix visual_scale being applied squared by paramat 16:41 nore ^ that's exactly what I meant by giving map access to the client: it's the mod responsibility to only modify things that will soon be updated by the server 16:42 sofar but node placement prediction is a specific event 16:42 sofar we can pass that on to client side mods 16:42 sofar allowing node placement at any time in the client doesn't have any valid use as far as I can think of 16:43 nore yes, probably 16:43 sofar (besides, a good node placement prediction client side callback is really needed and possible) 16:43 sofar on_node_placement(pos, node, placer, pointed_thing) 16:43 sofar on_node_dig(pos, node, digger, pointed_thing) 16:43 sofar those are all callbacks we should have client side 16:44 sofar even allowing `pos` to be modified 16:44 sofar or returning some complex return value 16:44 sofar but if that is implemented well, I don't think you ever need set_node() 16:45 paramat thanks 17:06 paramat i'll merge 5115 later tonight if no objections 17:27 nrzkt sofar: it was exactly what i said, but maybe i should talk to nore in french as we are two frenchies :D 17:27 nrzkt thanks sofar for making clarifications. 17:36 red-001 #5115 17:36 ShadowBot https://github.com/minetest/minetest/issues/5115 -- Plantlike: Fix visual_scale being applied squared by paramat 17:48 paramat game#1532 sorry i didn't do this when i added bushes 17:48 ShadowBot https://github.com/minetest/minetest_game/issues/1532 -- Bushes: Add leafdecay to bush leaves by paramat 17:49 sofar I'm not sure we should 17:50 sofar It's not like it's hard to clean up 17:51 paramat i don't feel strongly about it 17:52 paramat i was watching a lets play where they assumed there would be leafdecay, dug the stems for wood and left the leaves 18:22 crazyR can anyone tell me if any paticular port needs to be available in order for a server to update the serverlist? ethicrush is not showing 18:33 sfan5 crazyR: http port 80 (tcp) outgoing, nothing unusual 18:34 crazyR just pinged it from the server and its reaching fine.. Is there any other reason why it wouldnt list a server? 19:00 red-001 nrzkt, rebased #5100 19:00 ShadowBot https://github.com/minetest/minetest/issues/5100 -- [CSM] Improve security by red-001 19:01 red-001 looks like mods are only able to access files in the /clientmods directory 19:05 tenplus1 hi folks, it seems latest daily build doesnt put dug items into inventory 19:05 tenplus1 do we have problems ?? 19:06 paramat creative mode? 19:06 tenplus1 nope, normal... creative is off 19:06 tenplus1 tried picking up sand and other nodes and nothing goes into inventory at all 19:06 tenplus1 only today's build... yesterdays was ok 19:06 tenplus1 no mods running 19:08 paramat https://github.com/minetest/minetest_game/commit/bee5b316a86abba55ddb3bf97eab3cb9fb5803b5 ? 19:09 paramat "-- Don't pick up if the item is already in the inventory" 19:09 tenplus1 for creative... but... creative isnt on/active 19:09 paramat that's all i can think of 19:09 tenplus1 can only be, it interfers with items being added... 19:09 paramat yeah, but maybe a bug is triggering that 19:11 paramat you could test by using the creative mod from before that commit 19:11 tenplus1 testing 19:12 tenplus1 yup, that's the problem... 19:12 thatgraemeguy oh I just noticed this 19:12 tenplus1 it messes with pickup 19:14 paramat bug confirmed 19:14 paramat when creative is off 19:14 tenplus1 *phew* thx dude 19:15 paramat rubenwardy! 19:15 paramat can you post an issue? 19:15 tenplus1 kk 19:17 tenplus1 https://github.com/minetest/minetest_game/issues/1533 19:18 paramat thanks 19:49 rubenwardy pushing small fix in 5 mins... https://github.com/rubenwardy/minetest_game/commit/b06368adf2c5e5d00fa2e34fb914e6bc67dc82cf 19:49 rubenwardy paramat ^ 19:49 rubenwardy misread the code 19:50 paramat looking 19:50 tenplus1 sweet, I was just about to add a pull also :PPP 19:50 paramat well anyway +1 19:50 tenplus1 :pPpP 19:50 rubenwardy ok, merging now... 19:50 paramat i'm assuming you know what you're doing 19:51 tenplus1 works fine :P 19:51 tenplus1 thanks ruben 19:57 tenplus1 the original handle_node_drops was inside of the IF check for creative... why was it ever put outside ? 19:57 paramat i was wondering that 19:58 tenplus1 I see the point if 'creative' priv was re-added and players could use it for that... 19:58 paramat i don't understand the original pull at all 20:00 paramat handle node drops seems to call itself 20:01 tenplus1 will that affect performance ? 20:02 paramat register on place node now returns creative mode bool, doesn't seem to make sense 20:04 paramat rubenwardy shouldn't this code be inside the if statement as before? 20:07 paramat handle node drops should only be over-riden in creative mode? 20:08 paramat oh i see it's to enable per-player creative 20:09 tenplus1 adding that part just now paramat with a 'creative' privelage 20:13 paramat wish i'd reviewed this before merge 20:13 tenplus1 works, I've added 'creative' privelage that works on survival games (non creative) per player 20:13 paramat thing is, now on every node dig extra code is being run for this rarely used feature 20:14 tenplus1 true, unless 'creative' can be switched on/off during play 20:14 paramat i can't see any need for per-player creative 20:15 tenplus1 I already use it on Xanadu... for builders we trust 20:15 paramat ahh 20:16 tenplus1 whaddya think: http://pastebin.com/qWkaUzR5 20:16 tenplus1 it's the init.lua file 20:19 paramat hm it's not so bad now i understand it more 20:19 tenplus1 just have to display apppropriate inventory screen when privelage detected as well 20:19 tenplus1 if a normal player presses 'i' it shows crafting only, grant them 'creative' and I want it to show creative inv. 20:19 tenplus1 without the need to log out and in again 20:20 red-001 could someone link me to the test code for lua sandboxes? 20:20 rubenwardy tenplus1, you need to refresh sfinv when the priv is granted: https://github.com/rubenwardy/perplayer_gamemode/blob/master/init.lua#L20 20:21 paramat ah register on placenode returning true makes sense now 20:22 tenplus1 rubenwardy: wait, where in creative mod could I check and add that to be sure ? 20:23 rubenwardy you'd need this PR https://github.com/minetest/minetest/pull/4713 or a minetest.after 20:23 rubenwardy it's not very nice tbh 20:23 tenplus1 ahh... will wait for those.... until then it works after client reconnect :D 20:24 paramat ok i understand the PR now 20:24 paramat no strong objections 20:26 tenplus1 the only thing that bothers me is the constant checking of "creative_mode" bool... wont that affect performance on a server full of players 20:27 tenplus1 couldnt we simply read it into a value and check that instead ? since you still have to sign out and in to change to creative mode 20:29 paramat yes please cache the setting 20:30 paramat ^ rubenwardy 20:30 tenplus1 hows that look: http://pastebin.com/fDL8U57f 20:33 tenplus1 also puts less of a strain on handle_node_drops when checking 20:33 paramat .. since the setting is being 'got' on each node place and dig in normal game 20:34 tenplus1 will up that code to Xanadu tonight hopefully for testing 20:34 tenplus1 works ok singleplayer 20:35 paramat however you're now getting player privs each time 20:36 tenplus1 that's already cached and stores in a table 20:37 tenplus1 *stored 20:38 tenplus1 how about I do: if creative.mode or minetest.check_player_privs(name, {creative = true}) then return true end ; return false 20:40 paramat anyway i added an issue for a cache 20:41 tenplus1 checking 20:42 tenplus1 want me to add pull for what I have ? 20:49 tenplus1 paramat: https://github.com/minetest/minetest_game/pull/1535 20:51 paramat ok we'll consider the code 20:51 tenplus1 :p 20:53 Krock some code style issues but otherwise fine :) 20:54 tenplus1 ? really ? thought I used same style :P 21:33 red-001 #5100 ? 21:33 ShadowBot https://github.com/minetest/minetest/issues/5100 -- [CSM] Improve security by red-001 21:33 red-001 could someone review it? 21:42 est31 I'm quite confident that the proposed CSM model is insecure, and that RCE can be easily obtained 21:42 est31 that being said, its probably possible to RCE without CSM already 21:42 ssieb RCE? 21:42 est31 remote code execution 21:42 est31 e.g. right now it seems like the whitelist allows access to the filesystem 21:43 est31 this is horrible 21:43 est31 even IF you dare to write code that checks file paths to be correct or not, it should not be done 21:43 est31 what if a mod just writes junk to the disk? 21:43 est31 files filled with "HELLO HELLO HELLO" 21:44 est31 then the disk is full, in the worst case your system can't boot any more 21:44 est31 also, why is setlocale allowed 21:45 est31 builtin should not need it 21:45 est31 finally, the lua script env should run in a separate process and communicate with the main minetest process via IPC 21:46 est31 as its on the same computer, communication is fast enough to still allow CSM controlled controls, and similar 21:46 est31 but it allows a much better overview over what is controlled by client scripts and what isn't 21:46 est31 also, current voxel manips don't do bounds checking, you shouldn't expose them to CSM 21:48 est31 generally though, great to see people working on it 21:48 paramat thanks for input, what's the danger with voxelmanips? 21:48 est31 paramat, if I remember correctly, voxelmanips don't do bounds checking due to performance concerns. 21:49 est31 it may be okay if mod security is disabled, but if mod security is enabled or mods run on the client, then that's bad 21:49 est31 because you can read/write memory out of bounds, which can mean you can get arbitrary code execution 21:49 paramat getting the index for a position doesn't check bounds 21:50 est31 reading is bad as well, it can be combined with other bugs 21:50 paramat oh maybe i'm misunderstanding 'bounds' 21:51 est31 well idk, when you use a voxelmanip to set some node inside the manip's buffer, then you give x,y,z 21:51 est31 internally it calculates an offset via a calculation like x* xstride + y*ystride + z 21:51 est31 or somehow else 21:52 est31 then it uses that offset as index into some array of len s 21:52 est31 if the offset is smaller than 0, or bigger or equal to s, its out of bounds 21:52 paramat i see 21:53 est31 meaning, the code to "set" the node now sets some other memory location outside of the buffer, and that location can be even code, which gets executed 21:53 paramat indeed index calculation doesn't check bounds or out-of-volume 21:56 est31 generally though I think its good to have progress on CSM 21:57 est31 just don't make stuff part of the stable API that's supported forever which is insecure 22:19 red-001 the filesystem stuff can be removed at some point in the future and replaced with some sort of storage api, like that web browsers use 22:19 red-001 then you can easy add max file sizes 22:19 red-001 easily* 22:21 red-001 plus client sided lua doesn't have voxelmainpl 22:22 red-001 setlocal is set to nil as soon as builtin no-longer needs it 22:22 red-001 same with debug.get_info 22:23 est31 the security should not depend on builtin 22:23 est31 and filesystem stuff should be removed at the start already 22:23 est31 not even dofile should be allowed 22:24 red-001 so how do you recommand files are loaded then? 22:24 est31 the entire mod should be put into one big file, who reads it any way 22:24 red-001 thats really messy 22:24 red-001 plus it will break builtin 22:25 est31 mhh right 22:25 est31 why store the client mod on the disk 22:25 red-001 if everything is in one file sooner or latter you will have to use preprocessors to make it possible to even work on a mod 22:25 est31 should be held in ram any way 22:26 est31 ooor.... how are csm mods loaded 22:27 red-001 for now it's purely client sided 22:27 red-001 no transfer from server 22:27 est31 mhh I see 22:28 est31 well then obviously dofile is required 22:28 red-001 iirc something about testing everything before we allow the server to send code 22:28 est31 good idea 22:29 red-001 obviously this will need improvement once servers are allowed to send code to the client 22:30 red-001 I'm thinking of allowing a small amount of storage per mod, which a special api 22:30 red-001 maybe like 5mb 22:30 est31 or make it per server 22:31 red-001 thats a better idea 22:31 est31 otherwise servers make tons of mods 22:31 red-001 maybe make it 20 per server then 22:31 est31 sounds good 22:32 est31 well if you say that csm API is unstable then its sorta okay to first add it then remove it 22:33 red-001 call it can experimental feature or something like that 22:44 ssieb couldn't you load the mods from the disk restricted to a certain subtree, but not allow them to write? 22:49 est31 yes, but that code can have bugs 22:49 est31 (the code to check the fs) 22:52 red-001 well thankfully minetest isn't a big target for this sort of stuff but it's still good to take reasonable precautions 23:45 red-001 could someone remove the rebased need tag form #5100 ? 23:45 ShadowBot https://github.com/minetest/minetest/issues/5100 -- [CSM] Improve security by red-001 23:45 red-001 also #5078 needs more reviews 23:46 ShadowBot https://github.com/minetest/minetest/issues/5078 -- Remove guest nicknames by red-001