This release fixes critical security vulnerabilities affecting both the client and server. We advise everyone to upgrade immediately.
Note that the attack vector for the critical vulnerabilities is installing malicious mods locally. They are not exploitable remotely (by clients joining malicious servers, or by malicious clients joining a server).
Indeed. It's essential that a security patch does nothing else, so that nobody has a reason not to upgrade. The only other two changes we included are two low-risk bug fixes.
By the way since it's been asked a few times: All previous Luanti versions are vulnerable. That includes 5.14.0, 5.13.0, 5.12.0, 5.11.0, 5.10.0, 5.9.1, ... To be safe you must upgrade or figure out how to apply the source code patches to your old version.
What about version 0.4.17.1? If this is vulnerable as well, will the bugfix be backported? (because some servers are still stuck on that ancient version)
What about version 0.4.17.1? If this is vulnerable as well, will the bugfix be backported? (because some servers are still stuck on that ancient version)
0.4.17.x is no longer supported, and there are many known security vulnerabilities in it even before this release (including a remote code execution)
We recommend that the server owners update to a supported version
(It's possible that some distros will backport fixes, and 0.4 users may wish to fork the engine to provide fixes. But it's not something for us to do)
Why do people even stay at old ahh versions, is they stupid?
5.0.0 was a bit of a rough release for some servers performance, plus it would take at least a couple of hours to fix some of the deprecations. Bouncy physics were broken too I think, plus other small things made some people think "it's just not the same game any more!" (it almost entirely is but... anyway). Totally not worth 8 years of extra development to switch to 5.15.2 right?
Why do people even stay at old ahh versions, is they stupid?
5.0.0 was a bit of a rough release for some servers performance, plus it would take at least a couple of hours to fix some of the deprecations. Bouncy physics were broken too I think, plus other small things made some people think "it's just not the same game any more!" (it almost entirely is but... anyway). Totally not worth 8 years of extra development to switch to 5.15.2 right?
Yeah it's a thing good I was late to Luanti, so I'm fine with it just the way it is.
Xanadu server was on 5.7 for the longest time and after taking some time to upgrade all the mods and fix any deprecations we finally landed on 5.15 which I must say is a lot smoother with many new features to play around with.
Xanadu server was on 5.7 for the longest time and after taking some time to upgrade all the mods and fix any deprecations we finally landed on 5.15 which I must say is a lot smoother with many new features to play around with.
plus other small things made some people think "it's just not the same game any more!"
Well, it's not Minetest anymore. :^)
For the first one: Yeah, the 5.15.0 graphical glitch was harsh, but at least that was corrected in 5.15.1 (This new update only patches a security vulnerability), but we have little idea what 5.16.0 will bring (& break).
Honestly, the application being called Luanti makes sense, as it uses LUA script files, and MineTest would've caused some confusion with Microsoft's Minecraft and potentially cause legal disputes.
Why do people even stay at old ahh versions, is they stupid?
For example, deprecation of games (for example, once after long time I play on my old worlds in 0.4.11 with files auth), deprecation of map generators...
Why do people even stay at old ahh versions, is they stupid?
For example, deprecation of games (for example, once after long time I play on my old worlds in 0.4.11 with files auth), deprecation of map generators...
Those are some plausible reasons. But as I said, there's multiple other reasons.
