Disabling of Crackshot

Please Note: The TotalFreedom Forum has now been put into a read-only mode. Total Freedom has now closed down and will not be returning in any way, shape or form. It has been a pleasure to lead this community and I wish you all the best for your futures.

    Plugin Name
    Crackshot
    Server Name
    Freedom-01
    Reason for disabling the plugin
    In recent days, players have discovered that they can fill another players chat using a booby-trap notification feature of the plugin. As time has passed the exploit has become more efficient as players have had time to use it. We're talking thousands of messages being sent to one persons chat per second, and a player mentioned he had found a way to hide his username from the chat notification. The feature was being used more frequently and to a higher degree so I decided to disable the plugin this evening.
    Justification for believing this plugin is the root cause
    It is a feature of the plugin.
    Date & Time of the plugin being disabled
    24/08/21 22:50 UTC

    Patrolling the Mojave almost makes you wish for a nuclear winter.

    Yeah... I was able to both activate the item anonymously, and use it to target players who haven't even used the item through editing nbt. We should probably remove that feature since I don't think anyone uses it anyways.

    Quote

    ↩  FromTimeToTime i've seen and tested this exploit today. it can send an upper limit of a few dozen messages per second, and that's if you're trying to spam yourself.

    few dozen a second lmao... multiple people have tested it, and it can easily go above 1000/s, spammable on anyone

    I've re-enabled the plugin for three reasons:

    • The claim to be able to hide your own username is unconfirmed and should be taken with a grain of salt
    • Administrators can effectively stop someone from spamming by using /rd ITEM_FRAME and can also track the use of item frames with CoreProtect
    • This is not an exploit, but still a violation of the Conduct Policy as a Section 3 offense as it's considered an extreme annoyance and thus can be something someone can be sanctioned for.

    image.png

    A brief explanation for why this happens

    Trinkets in Crackshot are supposed to create an explosion that destroys the item frame holding it when they are set off. However, because explosives are disabled, you can just endlessly spam players by pressing the pressure plate over and over again because the item frame is never destroyed.

    Why the feature shouldn't be disabled

    In the interest of providing a better user experience, I feel like we should refrain from disabling features unless:

    1. The feature poses a significant threat to server or client stability

    2. The feature isn't logged by CoreProtect

    As the issue does not fit the criteria, I believe this feature should not be disabled. Anyone who abuse this feature to deliberately annoy other players can be sanctioned under rule 3c of the conduct policy.

    image.png