Peon

Peon 1.4.21

Server owners: this is the one to run. It replaces 1.4.20 and everything before it.

The sentinel: throwaway accounts never get in

The night after 1.4.20, six hundred throwaway accounts joined an offline-mode server, one of them dropped 155,000 primed TNT into a single chunk, and the server ran out of memory while saving it. Counting connections was not enough; the server now asks who is knocking, in three steps, cheapest first.

• The username must exist at Mojang. Checked off the network thread; the first knock gets "checking your username, come back in a moment" (the Peon disconnect screen retries by itself), the answer is cached, the second knock goes through or is refused. Known names are kept across restarts. If Mojang is down or rate-limits us, players are let in rather than locked out. Names that need no check go in pseudosSansMojang in config/1000eyes.json.
• No action in 90 seconds, no slot. A player who has not swung, placed, used or touched anything since joining is sent back. Bots never click.
• Operator commands are reserved (op, summon, give, execute, fill, gamemode, tp, kill and the rest) to the console and to the names listed in pseudosAdmin, whatever ops.json says. The dragons in the sky and the TNT came from a throwaway account that had been made operator.

Rate limits from 1.4.20 stay (three attempts per address per minute, eight connections per second overall). The "come back in a moment" refusal does not count against them.