Minecraft servers have always been decentralised, but in 2022 Mojang attempted to roll out a chat reporting system. Without the ability to trust either the client or the server, this turned out to be very difficult to get right. Over the next 6 months, we were in a cycle of Mojang releasing an update, and me dropping a zero day. In all we dropped 7 exploits, and there were a couple more found by others.
This talk covers the context behind the system, how the exploits worked, how Mojang tried to patch them, the community response, and why the system is still broken today.