Opinions on Nullcord
I currently use Velocity (ctd to be exact) and won’t be changing proxies.
With that out of the way, a couple of years ago I met a guy who liked clowning on Nullcord, never explained why (I didn’t ask either tbh).
Also was a Flamecord fan tho.
So, what are your opinions on Nullcord as a product? Compared to similar bungee proxies.
I found some people that recommend it and puzzled me because of that first impression from the guy I mentioned.
So I got curious about what are the real opinions on it.
43 Replies
I know the owner, pretty good detections, good software overall if you care about antibot, optimization does suck a bit more then xCord's though so i would maybe lean to xCord if i were to stay on bungee (Velocity + limbofilter still on top tho)
Flamecord is a joke in terms of antibot, and everything overall, for example it has an issue where it wont read proxyproto properly and will drop the ips from your proxy provider, i pointed it out to the owner and said it wasnt possible to fix and ignored (Which isnt true as basically any other antibot proxy has compatibility with proxyprotocol)
I also heard the nullcord dev is very attentive when it comes to reporting issues, overall it gave me a good impression now that I revisited their store
But tbh, I didn't like and still don't like the captcha part, but that probably can be easily disabled in the config, so I don't think it's someting for me to criticize
Overall I also saw a solid product there, I'd probably try it at least if I were to use bungee
It can be disabled, he is from the cracked latin-american community so bots are a big problem, he has a very advanced captcha which will probably not be bypassed anytime soon, because xCord's can be bypassed by some advanced tools
I'm also lat american actually 😅
This is probably not related to nullcord anymore, but interestingly enough, in our community bots are still a problem even for non-cracked servers, in small servers mcstorm could crash the server and lag everyone inside even if the bots couldn't actually join (this was from the year were I met that guy).
At that point is more a ddos rather than a bot attack, but the hosting provider at the time refused to help because it wasn't a bot attack for them.
The reason I don't like captchas is because, last year I run like 4-5 experimental (1month) servers in which I've been using an antibot (because of the reason above) and players that couldn't immediately join just left.
And I know those were real players because later some of them came to ask on discord why they couldn't join and showed the screenshot with the very clear message "We're authorizing your connection, you can now join again to enter the server" :marketplace: ("join again" in gold and bold)
Ah, yeah but those types of bots are more like DDoS attacks, for those you would hire a protection service instead of trying to get an antibot to handle them, though xCord has a better chance in that case.
Hosting providers cannot stop them as they are real "legitimate" traffic, you need someone specialized in minecraft, or a cluster or antibot proxies with 10gbps networking (Expensive)
People will be dumb, you can disable the captcha tho
Yh, only issue is that those services are paid monthly, I wouldn't plan on using those until I hold at least a medium-sized longterm server
I usually take that tradeoff of just disabling that first join protection (captcha in case of nullcord, first time kick in case of my antibot), a bit less protected but at least players don't leave. Probably doesn't matter that much if the server is online-mode tho
Well yeah, they have monthly recurring costs, just the same as if you wanted to take the attacks in your own.
If server is online mode you can safely disable captchas and just keep on the more lower-network checks for bots
Still id recommend a nice cpu and at least a 10Gbit/s uplink because otherwise those bots will take you down
and also host somewhere that has good layer4 protection
The antibot I use has both layer7 and layer4 protection, requires a vps to run tho
I have somewhat planned the type of architecture I'm gonna use, but definitely will use the best available once in production
No antibot can provide layer4 protection, that is something you need big servers with beefy uplinks to do
If you have a 1gbps uplink and get a 10gbps attack, theres nothing software can do
Maybe I just forgot the order of the layers
But that antibot blocks using iptables
Antibots advertise "layer4" protection
which is nothing more then using iptables for some stuff
yh
that thing
iptables is not performant so a 500k-1m packet/s attack will kill a 5600X
And it cannot dissapear traffic, so if the attack is bigger then your uplink, it will also kill the server
Yh, but by the time the server needs that level of protection, it'll probably be big enough to justify a purchase of one of the anti ddos services
It's temporarily, until it grows enough (if it grows enough)
Hmm not entirely true
its mostly luck
sending Layer4 ddos attacks is not complicated or expensive
if you get someone mad at you they can take you down
And unless you host somewhere with a decent level of protection even free programs can do so
Hmm, will have to plan for that then
I assume you will host on miami?
I had considered that level of attacks are a bit more rare, so I just shrug that into the "accept risk" part of the matrix
Not rare at all, in fact Layer7 is usually more rare, at least the actually powerful ones... specially more now that mcstorm died
All it takes is "free booter" search on google for some kid to gather enough power to take down any famous non-protected hosting (RS, Vultr, Hetzner, etc)
And for the famous protected ones (OVH, Cosmic, etc) they can do so with a $15-25/m one
Nope, I think my hosting provider was in ashburn iirc
I don't plan on supporting lat players tho, the server will just be on english
Ah thats a good choice
miami is kinda fucked network wise
Whos the hosting provider?
enviro
EnviroMC
Incredible performance, a low price tag and Carbon neutrality
?
yup
gimme a sec
They use "bonsai hosting ltd" as a server provider
no clue who they are
Just confirmed, it's indeed in ashburn
but they have GSL as an upstream
Which should be enough to stop the free booter kids
depends on their specific mitigation settings but it may actually require a $30-50/m program to take down
so dont worry about it for now
So into the accept risk goes again
One thing less to worry about
Yeah
When you become big enough to get taken down you surely have enough to hire a specialized service
Surprisingly, script kiddies dont actually have money so $50/m for them is quite a lot
Yh, I'm also planning on having this as a hobby so I don't need to get an actual income from the network, I plan to reinvest everything back into the network and put whatever could be missing from my pocket, at long as it isn't that expensive
ButI really need to save on monthly costs for the first months at least
Yup, I'm somewhat aware of that
I think mcstorm had a cheaper plan tho, fortunately was taken down from public internet, but it's probably still lingering somewhere
Probably not accessible to most skids at that point
Not really, i think only kickall keeps it as a private tool, only really goes for big servers
Yeah Layer7 attacks shouldnt be an issue with xcord/velocity
They would need like at least 100k C/s to cause any damage and frankly no script kiddie has enough proxies/servers to do that
Biggest bot attack we've seen this year was less than 200k C/S
Wild
The attacks I got were even smaller than that
I would assume, as we are not a server but a provider lol
Interesting enough, it happened only the first time. After I got the antibot I didn't get any :marketplace:
Yh, probably
So like across a ton of servers from all sizes and communities the biggest attack didnt surpass 200k
Most people will get bored instantly after seeing xCord/etc
not worth their time
specially if they had a cheap mcstorm plan
Probably related, I haven't stopped using the antibot since
Even if those are experimental servers to me, the people playing there still like to play uninterrupted
I take it back a customer just got hit with 300k+ C/s
bot attack alone is 7gbps worth of traffic lol
Me when not velocity 💤
Thats their parent company
I use velocity
How much time it lasted?
Hours ig
But like intermitent