SMJS

23 | I modify games in my free time.
Geode index staff & GD security specialist.

Discord: @smjs

[SMJS @SMJSGaming]

#GeometryDash Object-Collab v0.1.0-alpha.1 is finally out! This is an API to allow mods to make all kinds of custom objects & triggers while being able to work together. This should make gameplay mods extremely easy from now on!

[SMJS @SMJSGaming]

@ggfreeze_ Interesting, wasn't aware that Rob for once actually patched this stuff in a timely matter.

[SMJS @SMJSGaming]

Fun fact. While banks really struggle with the fact that AI seem to be managing peoples finances in irresponsible ways. @OpenAI system prompt in the meantime advices people to do so:

# Instructions

- Recommended plugins:
- Finances: Connect your financial accounts or credit report to understand where your money goes, find ways to save, plan debt repayment, review your investments, and understand your credit score. Follow stocks you care about with a watchlist. Only surface when connecting financial data or tracking stocks could help with the user’s request. DO NOT surface for general financial education.
- plugin_id: plugin_connector_693864f100e4819093e6ed9b651239f1
- not installed, last_suggested: never

[SMJS @SMJSGaming]

@microbrainzzz @RobTopGames I'm aware that it existed for a while, but since it was just discovered and irresponsibly disclosed it's currently an immediate danger

[SMJS @SMJSGaming]

#GeometryDash The recently announced 9.2 PHP CVE is actually viable on GD. My personal advice would be to avoid logging in on the server for a while as @RobTopGames hopefully updates PHP ASAP.

The vulnerability is to an extend blocked by Cloudflare but it's not foolproof. For this reason I would not trust endpoints like login for a while which may leak your credentials if the exploit is used on the backend of Geometry Dash.

[SMJS @SMJSGaming]

@blindtraveI @RobTopGames The safest would be avoiding online GD. But logging out would be pretty effective as well.

[SMJS @SMJSGaming]

@Mechabrandon It's not a data leak. This exploit can however tamper with internal files, possibly designing one to use the DB or steal credentials upon login.

[SMJS @SMJSGaming]

@nichietv Oh there are a bunch actually. Though some are partially because of bad code (like a DDOS attack vector from a while ago)

[SMJS @SMJSGaming]

For context. The PHP exploits allow someone to execute scripts on the backend of a server, essentially giving someone the ability to change whatever they want in there without showing any sign of tampering on the outside.

[SMJS @SMJSGaming]

@jotaleawastaken @RobTopGames Now that more info is known, GD is vulnerable as it requires sessions but one way interactions which means account management is an issue. I reported it to RobTop. For now Cloudflare sortof works as a very fragile wall to hold off these attacks.

[SMJS @SMJSGaming]

@jotaleawastaken @RobTopGames It is an exploit in sessions, a system rob doesn't use since he only uses it as a API when it comes to public interactions.

[SMJS @SMJSGaming]

@grok @biasku_jodohku Yknow, gotta give it to this AI, it's right on the mark there

[SMJS @SMJSGaming]

Sorry #GeometryDash, had to reject Geometry Dash 2.209 from the Geode index for vibecode😔

[IliasHDZ @ilias_hdz]

75 FPS to 800 FPS!!! My optimization mod now uses compute shader culling and look at the difference:

[SMJS @SMJSGaming]

@HAHAHUOEIHEWI @wyvy64 @EDM115 I mean on the discord we have quite literally announced everywhere that we're working on v6 for 2.209?... No one ever said we won't update stuff. The only form of protest coming from Geode is that we're looking into how to appropriately credit the devs that never got credited.

[SMJS @SMJSGaming]

This is a new class so no, also the code example you showed is weird due to the last 2 lines, but the unschedule followed by a reschedule in this case isn't per se 100% nonsense vs what the new code I showed does.

In this case based on bVar4 it might keep the code scheduled and then just escape early. I think that the line after is a ASM to pseudocode artifact if anything.

[SMJS @SMJSGaming]

@HAHAHUOEIHEWI @EDM115 To be fair it was meant to be a joke. I just also believe based on indicators that it's vibecoded.

[SMJS @SMJSGaming]

@PurpleShader Considering one of the base classes for most new layers is almost definitely 100% AI, I'd say we're leaning more to vibecode than AI assistance

[SMJS @SMJSGaming]

A few examples of some of the weird artifacts which makes me believe that this isn't written by robtop.
- At random times unscheduling and rescheduling updates in the same frame (this does quite literally nothing).
- Random std::map usages everywhere which is a class rob has avoided as if it were a new strain of covid 19.
- Terminology I'd expect from a corporation, not a developer who never in 13 years used a single technical term in his code.

[SMJS @SMJSGaming]

This code isn't something he'd write. This is mostly derived from it using utilities he has actively refused to use for years and technical terms in the symbols which is a known fact that RobTop doesn't know these himself.

Besides that it has a bunch of weird artifacts which no human would write. Just something which doesn't actually know how Cocos works.

[SMJS @SMJSGaming]

@HAHAHUOEIHEWI @Aliveness200 @cartxter Considering that every scroll layer currently leaks memory... I think the AI really stepped up the game of horrific code...