105 lines
4.4 KiB
Markdown
105 lines
4.4 KiB
Markdown
|
# Network & Telemetry Audit — racked.ru launcher (PrismLauncher fork)
|
||
|
|
|
||
|
|
**Date:** 2026-04-30
|
||
|
|
**Scope:** `source/` tree — what the launcher contacts over the network, and whether anything phones home.
|
||
|
|
|
||
|
|
## Verdict: No telemetry, no analytics, no crash reporting.
|
||
|
|
|
||
|
|
Grep for `sentry|analytics|telemetry|tracking|google-analytics|mixpanel|amplitude|posthog|crashreport` across `*.cpp/*.h/CMakeLists` returns **zero hits**. (One false positive: a contributor's email `sentrycraft123@gmail.com` in copyright headers — unrelated to Sentry SDK.)
|
||
|
|
|
||
|
|
PrismLauncher upstream has never shipped telemetry. This fork preserves that.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## News feed — does it pull from online?
|
||
|
|
|
||
|
|
**Yes.** It is an RSS feed download.
|
||
|
|
|
||
|
|
- Code: `source/launcher/news/NewsChecker.cpp` constructs a `NetJob` and downloads the feed configured at build time.
|
||
|
|
- Caller: `source/launcher/ui/MainWindow.cpp:279`
|
||
|
|
```cpp
|
||
|
|
m_newsChecker.reset(new NewsChecker(APPLICATION->network(), BuildConfig.NEWS_RSS_URL));
|
||
|
|
```
|
||
|
|
- URL is set in `source/CMakeLists.txt`:
|
||
|
|
```cmake
|
||
|
|
set(Launcher_NEWS_RSS_URL "https://prismlauncher.org/feed/feed.xml" ...)
|
||
|
|
set(Launcher_NEWS_OPEN_URL "https://prismlauncher.org/news" ...)
|
||
|
|
```
|
||
|
|
- Trigger: fires on launcher startup (constructor of MainWindow).
|
||
|
|
|
||
|
|
**Implication for racked.ru fork:**
|
||
|
|
- Currently still hitting `prismlauncher.org` for news. If you want zero outbound to upstream, override at CMake configure time:
|
||
|
|
```bash
|
||
|
|
-DLauncher_NEWS_RSS_URL=https://racked.ru/feed.xml \
|
||
|
|
-DLauncher_NEWS_OPEN_URL=https://racked.ru/news
|
||
|
|
```
|
||
|
|
Or set both to empty string to disable. (Empty URL → `NetJob` fails silently.)
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## All network endpoints in source
|
||
|
|
|
||
|
|
Grouped by purpose. None are telemetry.
|
||
|
|
|
||
|
|
### Auth / account (Microsoft / Mojang) — required to play
|
||
|
|
- `https://login.microsoftonline.com/consumers/oauth2/v2.0/{authorize,devicecode,token}`
|
||
|
|
- `https://login.live.com/login.srf`
|
||
|
|
- `http://auth.xboxlive.com`
|
||
|
|
- `https://api.minecraftservices.com/...` (profile, skins, capes, entitlements, MSA migration)
|
||
|
|
- `https://account.microsoft.com/family/`
|
||
|
|
- `https://help.minecraft.net/...`
|
||
|
|
|
||
|
|
### Game assets
|
||
|
|
- `https://libraries.minecraft.net/`
|
||
|
|
|
||
|
|
### Mod platforms (user-driven)
|
||
|
|
- `https://api.modrinth.com/v2`, `https://modrinth.com/mod/`, `https://docs.modrinth.com/...`
|
||
|
|
- `https://api.curseforge.com/v1`, `https://docs.curseforge.com/`
|
||
|
|
- `https://api.atlauncher.com/v1/`, `http://api.technicpack.net/modpack/`
|
||
|
|
- `https://api.feed-the-beast.com/v1/modpacks/public`, `https://dist.creeper.host/FTB2/`
|
||
|
|
|
||
|
|
### Pastebins (user-driven, log upload)
|
||
|
|
- `https://api.mclo.gs`, `https://api.paste.gg/v1/pastes`, `https://hst.sh`, `https://0x0.st`
|
||
|
|
- `https://api.imgur.com/3/`, `https://imgur.com/a/`
|
||
|
|
|
||
|
|
### Updater / news / help (Prism)
|
||
|
|
- `https://api.github.com/repos/...` — version checks
|
||
|
|
- `https://prismlauncher.org/feed/feed.xml` — news RSS (see above)
|
||
|
|
- `https://prismlauncher.org/news` — "More news" button
|
||
|
|
- Help URL template in CMake: `https://prismlauncher.org/wiki/help-pages/%1`
|
||
|
|
- Bug tracker: `https://github.com/Diegiwg/PrismLauncher-Cracked/issues` ← **upstream-fork URL, points at the original "Cracked" project**
|
||
|
|
- Translations: `https://hosted.weblate.org/projects/prismlauncher/launcher/`
|
||
|
|
- Matrix/Discord/Subreddit: all `prismlauncher.org` redirects
|
||
|
|
|
||
|
|
### Documentation links (opened in browser only when user clicks)
|
||
|
|
- `minecraft.wiki`, `fabricmc.net/wiki`, `docs.microsoft.com`, etc.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Risk summary
|
||
|
|
|
||
|
|
| Vector | Risk | Mitigation |
|
||
|
|
|---|---|---|
|
||
|
|
| Telemetry | None | n/a |
|
||
|
|
| Crash reporting | None | n/a |
|
||
|
|
| News RSS leaks IP to prismlauncher.org on startup | Low (single GET, no UA fingerprint beyond `Launcher_UserAgent` = `PrismLauncher/<version>`) | Override `Launcher_NEWS_RSS_URL` to racked.ru or empty |
|
||
|
|
| Update check via api.github.com | Low (anonymous, rate-limited) | Override `BUG_TRACKER_URL` and consider disabling updater path |
|
||
|
|
| User-Agent identifies fork by name + version | Low | Override `Launcher_UserAgent` if anonymity desired |
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Recommended CMake overrides for racked.ru build
|
||
|
|
|
||
|
|
```cmake
|
||
|
|
-DLauncher_NEWS_RSS_URL=https://racked.ru/feed.xml
|
||
|
|
-DLauncher_NEWS_OPEN_URL=https://racked.ru/news
|
||
|
|
-DLauncher_HELP_URL=https://racked.ru/help/%1
|
||
|
|
-DLauncher_BUG_TRACKER_URL=https://racked.ru/bugs
|
||
|
|
-DLauncher_MATRIX_URL=https://racked.ru/matrix
|
||
|
|
-DLauncher_DISCORD_URL=https://racked.ru/discord
|
||
|
|
-DLauncher_SUBREDDIT_URL=https://racked.ru
|
||
|
|
-DLauncher_TRANSLATIONS_URL=https://racked.ru/translate
|
||
|
|
```
|
||
|
|
|
||
|
|
Or set them blank to disable the menu items entirely.
|