PSA: The Switch to UUIDs - Potential Plugin/Server Breakage

Discussion in 'Community News and Announcements' started by EvilSeph, Mar 30, 2014.

Thread Status:
Not open for further replies.
  1. Offline


    At the beginning of the year Mojang started dropping hints of their plan to switch from a name based accounts system to a universally unique identifier (UUID) based accounts system, ultimately moving towards allowing people to change their Minecraft name. With much of Minecraft currently relying on a name based accounts system (bans, whitelist, ops to name a few) along with plugins using names to keep track of players (permissions, ownership, protections), this change has a high potential to break both plugins and servers if server admins and developers are not prepared for it. At the time of writing, Mojang have said they're planning to enable name changing around the time Minecraft 1.8 is released and with Minecraft 1.8 slated to release in May, the window for preparations is quickly closing.

    What is a UUID?
    A Universally Unique IDentifier is a fairly long series of hexadecimal numbers commonly used in software to uniquely identify something. With Minecraft, Mojang is planning to use UUIDs to identify player accounts, with each Mojang account tied to a UUID. For example: Notch's account now has the UUID "069a79f4-44e9-4726-a5be-fca90e38aaf5".

    Potential Server Breakage
    Up until this switch to UUIDs, Minecraft has relied on names for many of its core systems (bans, the whitelist, ops, etc.) and plugins have used names for permissions and protections. Once Mojang allow players to change their names at will with Minecraft 1.8, these systems’ accuracy can no longer be relied on. For Minecraft, Mojang have said they'll be handling the transition of bans, whitelist, etc. for the most part, but most Bukkit plugins will need to be updated to use UUIDs to track players instead of names.

    To prepare servers for the switch to UUIDs, server admins should perform an audit on their plugins to determine which ones currently use names for player identification. It is recommended that server admins communicate with the developers of the plugins that they use to ensure that they're preparing for the switch to UUIDs. The types of plugins that will likely be affected include (but are not limited to): permissions, region protection, world protection, chest protection, ownership, teleportation, economy, chat, and ban management plugins.

    Basically, it comes down to this: neglecting to prepare for the switch to UUIDs is the equivalent of running your server in offline mode. With player names no longer being static, anyone could potentially pick up an Admin's username and take over your server or bypass your protections.

    Plugin Developer Considerations
    Yesterday (March 29th, 2014) we went live with our UUID migration plan (Bukkit commit, CraftBukkit commit), where I made the decision to make use of Java's deprecation system as a means to get the attention of our plugin developers and make sure they're aware of the problems this switch to UUIDs is going to cause. This deprecation sweep was intended as a companion to this article. Information on this switch to a UUID based system has been hard to come by, with the majority of it coming from tweets from Mojang. As a result, while we have somewhat devised a migration plan, it is purely based on guesswork and assumptions which could be far off the mark by the time the system goes live.

    Points for Developers to Consider:
    • Names will no longer be a unique identifier for a player
    • String based lookups still work, they've just been deprecated to raise awareness of the upcoming changes. Some of the deprecations will be removed in the future. See our Current Migration plan below for more information.
    • Any data stored about users should be updated to use UUIDs
    • Since Minecraft 1.7, a player's UUID can be acquired through Player.getUniqueId();
    • Server.getOfflinePlayer(UUID) is a blocking, inefficient temporary hack provided for you to prepare a migration plan of your own.
    • You need to use Mojang’s AccountsClient or evilmidget38's UUIDFetcher (recommended) to convert Name to UUID. We may or may not provide our own built-in solution for this.
    Our Current Migration Plan, for reference:
    Minecraft 1.7.5
    • Deprecate string based player lookups to raise developer awareness of the switch to UUIDs and the impact it would have
    • Add a temporary hack to allow for early support for name lookup by UUID, which is currently inefficient and blocking
      • This is provided for plugins to prepare a migration plan of their own and NOT for use in production.
    Minecraft 1.7.6+
    • UUID lookup will become the most efficient lookup method: check if UUID matches stored player data on disk
    • Name lookup will then become the least efficient lookup method
    Minecraft 1.8
    • UUID awareness deprecations will be removed as time for preparation has passed, if they haven't been removed already
    General Notes:
    • A Mojang account is required if you want to change your name
    • Names need to be unique; you can't change your name to one that is already in use
    • Name changing is free but will probably be limited in some way to prevent abuse
    • If you haven't migrated your account to a Mojang one, you should do so as soon as possible to secure your name
    • Name changing is slated to go live when the web service has been updated and around the time Minecraft 1.8 releases
    • Once you have changed your name, your previous name is now up for grabs. This is not a traditional local nickname system, it is a global claim-based system. It is unknown if there will be a grace period or any protection against name sniping.
  2. Offline



    It's already there in the dev build. However the offline player UUID stuff is blocking, so it should be used to migrate data, like on server start. It should not be used during the course of your plugin. This will invert in 1.7.6 and the OfflinePlayer String based methods will be the less efficient.
  3. Offline


    But, if nobody on my server changes his name, eveything will still work properly?
  4. Offline


    fromgate likes this.
  5. Offline


    Plugins will work. But there could be some issues. For example, old ban-plugin based on player names. Banned player can change it name and login to the server with new name .
  6. Then the "worst" thing to happen could be some past banned player or troll changing the name to a similar name of someone that is playing - for most cases players might notice, also because prefixes for ranks or colored names will make the difference bigger usually.

    However if you have a couple of tens of players who are more or less actively playing, or even hundreds, the probability of at least some people wanting to change their names will be pretty high, because you have parents setting up accounts and people just choosing silly account names - the ability to change those is quite tempting to use.

    You could use/get/program a uuid fetcher/catcher for your players, e.g. using the web service of Mojang, and have the combinations logged for uuid + name. For certain cases one could deny login then (taking over a name of a previously known player). I don't know if the players uuid returned by the Bukkit-API in 1.5.2 is REAL (queried from Mojang), my assumption is that below some past version it won't be, but there are others who can answer that technical question...
  7. Offline


    Is Mojang trying to kill us Bukkit Developers :_:
  8. If mojang had just gone with Account names and Display names instead of UUID then this would have been such a damn pain in the ass to fix

    I understand why UUID is better, but since player names used to be static, it is now a pain to fix it and using account names would have made it a lot easier while still allowing name changes
  9. Offline


    Btw, I've started documenting stuff about the UUID requests on the mojang api here.
    And I've suggested something that would allow faster/smaller requests here.
    Thought this might be interesting for some.
  10. Offline


    And So What Exactly Do Us Server Owners Have To Undergo? I'm Literally Laying Eggs Here Cause I Am Completely Anonymous To UUIDs Etc And Yet I Am Being Told That Ill Have To Undergo A Major Change, That Could Potentially/Will Break My Server; Mojang Are Just Advancing Minecraft Too Much, I Loved The Good Old Days Of 1.4 :'(
  11. Offline


    Right now you should be auditing your plugins. Find the ones that reference a player by the player name as well as plugins that store the player name in a database. Take note of these and watch the BukkitDev page to see if that plugin is ready to go when name changing is allowed by Mojang.
  12. Offline


    Ah thanks, it's good to know that i'm doing it right!
  13. Offline


    UUID's Should Be Custom........
  14. Offline


    Do I detect a hint of sarcasm?
  15. Offline


    Unfortunately, no.
  16. Offline


    Will one be able to change names at will, anytime, or is there some sort of lengthy (i.e. one week as opposed to one day) cooldown period involved? Or does nobody not know yet?

    Although not directly related to this controversy, I'd like to know how far the naming system could be abused to confuse server communities from establishing good/trustful relations with their clients. (For example, if I changed my name, then someone changed to my old name to trick others into thinking they're the admin when they're not.) Although purely speculative, I'm pretty sure Mojang will keep a log of name-changes on each UUID to make sure that changing your name to a used one (as opposed to one that hasn't been used in awhile) will be a harder process.
  17. Offline


    Fun predictions:
    • Someone will find a bug in the system and we'll have another one of those "omg people are logging in as the OP" weeks
    • Plugin developers are going to feel hurt and decide to quit pluginning, a la Wolverness commit, resulting in losing many good plugins *cough*DragonAntiPvpLeaver*cough*
    • I will cry when my long-time friends get on board with this and change their names because I don't like change
  18. Offline


    We don't know, yet, to your first question.

    Your last idea sounds good. Hopefully they'll do something like that.
  19. Offline


    To counter name change abuse names should be bound to the account / UUID as long as the user decides to release the name.

    In fact:
    • Adding a new name should only be possible via account page on mojang account page.

    • There should be a limit on how often some might be able to rename himself to prevent flood attacks.

    • If the user has an active session renaming should also not be possible. Managing names should.

    • Limit the number of maximum renames per account to 10. Assuming that a name once used is bound to the account.

    • If this limit is reached the user has to release one of his used names. Making it available after 48 hours to others (or whatever the sync time is to give replication services and users enough time.)
    Limiting the maximum renames should prevent identity theft and also name blocking.

    Even if someone did not want to drop a name (accidently released a name from his account) he would still be able to claim his released name again.

    Since a name is flagged with the UUID this should be checked before he can re-claim his old name.
    JaguarJo likes this.
  20. Offline


    can someone confirm that two players will not be able to have the same name at the same time?
  21. Offline


    We hope to see more information from Mojang on how name changes will be handled. Those are really good suggestions, but we haven't been able to find specific information confirming those points.

    This is stated as such in the first post.
  22. Offline


    It has been announced by Mojang that you will not be able to change your name every 5 minutes. That doesn't narrow it down as to how often names can be changed, but it does tell you they are thinking about that.
  23. Offline


    What do you mean by this? Should I migrate my account on the website? Under profile?
  24. Offline



    There will probably be an onslaught of plugins released with this functionality, soon. But, as a request, I've finished developing a plugin that will disallow a player from joining your server if their username is different from what you have recorded.

    You should get this as soon as possible, so you can start registering usernames to UUIDs, now, before the update.
    Unique Again - Awaiting approval
    Source Code
    TreeDB and ElgarL like this.
  25. Offline


    Great idea, definitely a temporary fix but it gives server admins the means to keep their server secure while waiting on us plugin developers.
    FerusGrim likes this.
  26. Offline


    If only nicknames were made to register like playernames where any players with a custom nickname would just be handled by a built in feature as part of the minecraft/bukkit server ( as opposed to third party mods like essentials which just offer a limited cosmetic version) all this uuid nonsense from mojang moron studio would not have been required.
  27. Offline


    I've seen this posts like this a few times, and there's something about it that bothers me. The system that you guys are talking about IS a UUID system. In this case, however, the UUID would just be the "real username". Either way, we would have to make changes and updates to our plugins to match this new system.

    What this boils down to is the fact that you can't make everyone happy. Since Minecraft was created, people have been clamoring and critizing Mojang for not having a way to change usernames. So, Mojang does it, and in doing so, implements UUIDs, which are required for account security, so people can't just steal people's data on servers, by swapping to someone's discarded username.

    It's unfathomable to me how the public can so badly want something, and then turn on them as soon as the only viably safe way to do it is released. And it's not even like they're just randomly dropping this on us. We've had months to prepare!

    UUIDs are only scary because they're large, and scary. But, when it comes down to it, to a programmer it's no different than a unique "real username". And, to be honest, it's probably safer.

    So, no. I'm not denying that this imposes a bit of a problem for a large majority of plugins. And yes, it's a hassle. But it's a necessary one to deal with, in order to have a feature that the Minecraft community has unanimously wanted since it's inception. It's hardly Mojang's fault that nobody, while we were all clamoring for this feature, thought beyond their own desires at the potential security risks involved with such a feature.
    garbagemule and JaguarJo like this.
  28. Not right :) - nobody would be forced to change things, including all past versions of Minecraft - an extra display name, be it ~ 5 like with some other games, would not force people to updated, unless they want to support the fancy feature. Not that i am voting for it, but you can't use this as an argument. The real user name need not be named UUID but it could stay - admittedly neither way is perfect.

    That's correct :p.

    It's not the only safe way to do "it", at least it is highly disputable if we need that "it", there are alternatives for display names, which have been proven doable by online lobbies of award winning big-budget games. The people complaining now are not all the same people, bet on having server owners and plugin developers complaining most right now.

    Yes and no - we do depend slightly on Bukkit, also as long as we don't know how exactly and how reliable the UUId System will work, we can hardly start implementing anything. Another point is when to change, because plugins using uuids might be incompatible with before, so no use to be all that much prepared, except for
    "catch-it-all" technique, which may be unreasonable. So when is Minecraft ready, when is Bukkit ready, when are the plugins my plugins depend on are ready?

    Not, they are scary due to three three seasons:
    - Plugin developers have top change a lot (data/handling).
    - Plugin developers have to change ingame user interfaces to still work with UUID's, likely resulting in plugins doing things in different ways or more cross-plugin dependencies.
    - Transition phase is a bit uncertain, Bukkit has a plan, but can you link any statement on how lasting and how unique UUIDs are right now? From what point of time can we start changing data, without being side tracked by "oops collisions" and "oops multiple uuids". We need to know a little more about those itchy to formulate side conditions to do this right.

    Mojang could have used thinking :p, and i am sure they did. They have the modding community up right now, though it's somehow spread across mods - should be hard to ignore both server owners and plugin developers concerns. And how necessary it is depends on the chosen method of how to realize changing names.

    The UUID one probably is the most clean one in theory, but it's about the most dirty thing you can do concerning the transition from an already existing system, also potentially lethal :p.
  29. Offline


    I can not believe server owners are complaining about this. Are you going to be updating all of your plugins to work with UUIDs, writing converters, and spending hours of time? No you are not. You are going to be using someone else's plugins that they spent hours to make and develop, install them on your server, and claim it was the hardest thing you've ever done.

    Those who are saying anything bad towards Mojang about this need to leave. You are clearly ignorant or incapable of understanding what this system means. Minecraft is being rewritten so it can be more efficient of a game engine and can be easier for modders to use. Included in this rewrite is the change to UUIDs, and the ability to change your username.

    If you have ever played a Steam game: this is already implemented! Steam has a system implemented called SteamID which is conceptually exactly the same! So no, this is not some random stupid idea. This is a proven concept that is already being used in the largest AAA games.

    Let me explain the transition process to everyone so you can understand it:
    1. Make a converter. (Thank god Mojang already has a complete API that has existed for a few months for this very purpose!)
    2. Change username -> uuid in your plugin
    There isn't even a third step it is so simple.

    Please: stop complaining. This is not the worst thing I have ever seen at all out of Minecraft.
    Alshain01 and coldandtired like this.
  30. Offline


    How do we plan on handling this with buycraft?
    Perhaps onjoin function that checks the files and adjusts the player username to uid? I have no clue how mojang & bukkit & buycraft want to go about doing this XD
  31. Complaints-about-complaints?
    For many plugins it's actually not that simple this time: For which type of plugin/features does converting the data to UUIDs do the trick? What's the fallback measure in case transition doesn't go as smooth as some think it should? How to provide functionality for offline players, of course referenced in commands or on signs by something else than an untypable UUID? Can i replace my plugins by something that works at all? Will i have 2, 3, 4 different ways of referencing offline players without names nor UUIDs with just my plugins updated? Which of my plugins will be ready in time at all? Questions that need answers, not sure if 2 steps do the trick for the developer - sure you will find some for whom that might apply, but that's not where a discussion could possibly end.

    Since it's not sure how easy plugins will update, one could just install one more plugin and stay legacy until really sure. The plugin would record/fetch all past players UUID+name and prevent players from joining who took known players names. Of course it might be more complicated because you need plugins doing that for several of your data-saving plugins, so you probably need 2 to 10 of that kind :p, or you will have to drop some plugins, worst case including data - and that goes for all Minecraft versions, so there is no safe legacy thing here.

    Of course i am not convinced it's such a bad decision by Mojang, but it certainly is not comfortable. Server owners can do backups, install safety-net plugins and the like, if not wanting to trust all-beta/dev plugins with UUID-handling of uncertain "durability" - assume when the change comes both plugins and CraftBukkit might (just might) not be 100% bug-free - but the naming roulette will have started. So i think some people will need extra hours even if trying to use plugins that others write...
Thread Status:
Not open for further replies.

Share This Page