By looking that you are here you most likely use Cardboard/Banner/some other weird bukkit + Fabric project (or just someone linked to it).
Don't do it, it will cause more harm/instabilities to your server than good. But let's start at the beginning.
Few definitions before we start:
- Bukkit - It means bukkit, spigot, paper and any forks of these,
- Cardboard - mod by IsaiahPatton that tries to port bukkit ecosystem to fabric.
- Banner - another mod trying to make plugins work with Fabric, similar to Cardboard.
- Fabric - a Minecraft modding platform, includes Fabric Loader and Fabric API, everything written in this gist also applies to Quilt.
- Mods - Mods designed for fabric and compatible platforms
- Plugins - Mods/plugins designed for bukkit/spigot/paper or their forks.
Mods being mods, they can modify game in substantial way. New blocks, items, mobs, etc. Possibilities are more or less endless as long as there is good enough programmer behind it. However, most mods still are kept compatible with each other, as they use tools designed for that (including Minecraft's internals, which allow for quite good compatibility) and having many gameplay mods is a norm.
Bukkit plugins on the other hand, while also normally compatible with each other, aren't really designed for custom blocks/items/etc. There are plugins that try to emulate mods with custom items/blocks/etc (for example Slimefun or ItemAdder), but they are mostly facade over vanilla items with some additional nbt. Because of that there are no issues most of the time (until other plugins don't try to use these items that is, as they see them as vanilla ones).
However, when you start mixing bukkit with fabric, bad things can easily happen. Fabric is close to Minecraft internal code (which has lots of nice and powerful stuff), while Bukkit is mostly an API which most of it's parts and design not being updated since 1.7. This means, you might need to make lots of conversions (with some not really possible without losing some functionality, for example messages in bukkit are just strings using legacy formatting, but mods use vanilla's more advanced json text for formatting). And if you start including things like non vanilla items, blocks and entities, it starts to break even more. Bukkit based server software is also known to break datapacks, which makes it even more likely to not work with mods (as a lot of them use and expend datapack funtionality).
Cardboards approach is more or less taking bukkit code and hitting it with a hammer until it starts to barely works. It uses lots of hacks, code overriding entire methods in Minecraft (breaks lots of mods mixing into them!) and breaking vanilla behaviour. It's also questionable license wise, as GPL isn't really compatible with Minecraft code (and for this reason spigot and others use workarounds to bypass it). Additionally, it needs to modify some plugin on runtime to make them work, which only shows how bukkit wasn't designed for that usage. This mod will never be in a state stable enough to work with more advanced plugins while also not causing other mods to break or straight up crash. Most of the time developers of incompatible mods and plugins won't support it anyway as these mixed environments were always hacky and problematic, so it's safer and stabler to just use fabric alternatives.
In similar way of cardboard, to support bukkit api and plugins using it, it needs to make a lot of invalive changes to make things work. Which will also break a lot of mods (and plugins). It also is known to modify/swap plugins to make them work, so it's not even doing it's job properly (see https://essentialsx.net/do-not-use-mohist.html)
This is more of my own opinion (through it's shared by many), that bukkit based plugins and servers should be thing of the past. Bukkit (or Spigot and Paper) never fully adapted to modern Minecraft, as their goal of forever backwards compatibility limited how they could evolve. Bukkit was originally created for early Minecraft Betas and it's api was kept mostly the same. It was extended with new functionality, but it never fully adapted to modern versions. Lack of nbt api's, lack of support for datapacks as parts of plugins (which both non-bukkit platforms have supported for long time), it limits what could be done with server mods. Nearly all plugins that do something more advanced, require usage of non-bukkit Vanilla classes, either via another library or own code (and a lot of reflections and jvm hacks). For bigger servers that want to extend gameplay in their own ways, it's more common to just fork Bukkit/Spigot/Paper instead and add things in same ways as modders do.
You should check out this list of server side fabric/quilt mods. There is lots of alternatives to pick, with even more being actively created!
If you are create mods or plugins you are also free to ask me about anything related, as I'm always happy to help people expand Fabirc/Quilt server side ecosystem :)
You should also checkout these server side communities:
- Fabric Server Side Development: https://discord.gg/atSzZ6zMHz
- Patbox's Discord: https://discord.gg/AbqPPppgrd
- Fabric/Quilt Server Tools: https://discord.gg/p56NJ6kp4u
Or modded ones in general:
- The Fabric Project: https://discord.gg/v6v4pMv
- The Quilt Community: https://discord.quiltmc.org/
@muriplz
Ah yes... the "truth".
You know, the EssentialsX Devs did a superb job providing actual sources in their PSA. They didn't tell lies here to make themself better. They don't need that at all.
Also, the Readme you linked is an absolute joke in various ways, especially these gems I want to cover myself.
Note that I'm not part of the EssentialsX team. I'm just someone who was around when the PSA happened.
If it is "proven", then why aren't there links to posts, commits, screenshots, etc that show this proof? If you truly want to debunk something you should provide undeniable proof of it being wrong.
They completely ignore the fact that the "plugin checker" doesn't give any clue that the downloaded jar is NOT the official one from EssentialsX themself. It just say you should update the jar.
Also, the mention of a "plugin blacklist" in said update message is bad too, as it gives the impression that EssentialsX is bad since it's on a blacklist...
This one is really stupid... It's not the dev's job to first discuss it with the Mohist devs. This was a security risk, because a jar would be downloaded from a different source while the message made it look like it was an official thing.
The EssentialsX Devs saw the potential risk here and decided to take action in the form of a PSA to spread awareness.
Also, the readme constantly mentions that they would never spread malware... No shit sherlock. Next you tell me they never will share the modified MC server directly...
This is an obvious thing to say and honestly... I don't believe them. The main issue here is, that OS != safety. I can share code that looks absolutely fine while the actual files I distribute have malware in them. Unless someone takes the time to decompile it and look for malware, they will never know about the potential risk.
Saying "I will never share malware" is nice, but it has the same effect as saying "I will never cut myself with this knife" while running around with it in your hand.
"If it looks like a monkey and speaks like a monkey..."
The download message was misleading and I explained many times why. So there is no surprise that the EssentialsX team saw it as a risk and made the PSA. From their side was this not lies, but what they saw and could find out at that time. It wasn't wrong at all.