ioenjoyers The way I've patched this is that Wurst no longer uses Minecraft's translation system at all. Instead, Wurst creates its own separate translation system, which is simply not connected to signs, anvils, or anything that servers can control. All of those exploits, whether they're using signs, anvils, or some other Minecraft feature that we don't know is vulnerable yet, will behave exactly as they do in vanilla and not reveal any Wurst strings, because there aren't any Wurst strings in that system to begin with.
What many other mods / hacked clients are doing instead is still using Minecraft's translation system and simply trying to filter out mod-related strings on the sign screen, anvil screen, etc. On the surface, this method sounds better, because "it also protects your other mods while Wurst only protects itself", but in practice this idea doesn't really work.
Filtering translation strings is brittle for two reasons:
The problematic translation strings still exist, you've just hidden them from this one surface that known to be exploitable. When they filtered strings on signs, servers started using anvils instead and all of those filtering-based patches became vulnerable again. How many other Minecraft features are currently hidden in plain sight that are vulnerable to the same exploit? No one knows, and the exact list changes with every new snapshot (generally getting longer instead of shorter).
The filtering itself can be detected, because servers can add their own translation strings via resource packs. If the server creates a string that sounds like a hacked client and it doesn't see that string in the exploit, they know you have a mod installed because that string wouldn't disappear in vanilla. Like the anvil case, this too has been exploited in the wild.
The only real way to "patch the sign translation exploit completely" and "protect all your mods at once" is for Mojang to actually patch out the exploit at the source. You can't both close the data leak and perfectly match vanilla behavior, unless you're Mojang. This is why I keep advocating for Mojang to patch this exploit. They are the only ones who can protect people's privacy without putting them at risk of getting banned.
What does VanillaSpoof have to do with all this? Basically nothing. VanillaSpoof changes your "client brand" packet from "fabric" back to "vanilla". This is unrelated to the sign translation exploit. Think of it like changing the user agent in your browser. There are a few servers out there that treat all Fabric mods as cheats and simply prevent you from joining unless your client brand says "vanilla". Unless you're playing on a server that does this, I recommend keeping VanillaSpoof turned off.
As for "Device fingerprinting via resource pack", that's patched in Wurst too, the same way ExploitPreventer does it.
As for "Local HTTP request via resource pack", Wurst doesn't run any local HTTP servers, so it cannot be detected this way. Similar to the sign translation exploit, you can use ExploitPreventer to close that data leak, it will improve your privacy, but you should be aware that this will make your client stand out as suspicious on servers that use this exploit, so you will be more likely to get banned, not less.
Moral of the story: We should all be yelling at Mojang more. These are not just bugs, but security vulnerabilities. They need to get CVEs assigned and trigger big red warnings whenever someone tries to use Minecraft, effectively forcing Mojang to patch them out immediately, the same way that Log4Shell did. Mod authors are doing what they can to protect you in the meantime, but we can only do so much. Anything that's too far away from what vanilla does will simply get you banned. Vanilla itself needs to change.
