Huh. The researchers seemed to gloss over the Cloudflare Pages URL, but it's actually pretty interesting. I haven't had a chance to look at it in depth yet, but it appears to use the search-ms: URL protocol to show an attacker controlled WebDAV server to serve the malware.
The server hosting the malicious files seems to be down now, but this post details a similar attack:
It also seems to be part of a phishing kit, or potentially generated with AI due to the presence of the following comment.
// Замени на свой URL
Which in English is:
// Replace with your URL
And various other descriptive comments like
// Полностью очищаем страницу (Completely clear the page)
// Создаём новый контейнер с индикатором загрузки (Creating a new container with a loading indicator)
// Через 3 секунды скрываем Cloudflare и запускаем загрузку (In 3 seconds, we hide Cloudflare and start the download.) [Though this was next to a 900ms timeout, so there's definitely been some tweaking]
They're the kind of comments that don't really make sense if the author is writing them themselves, but would if they're using something off the shelf, or asking some LLM to output code. The descriptive comments of what the code's doing definitely makes me lean towards the latter.
Tangentially related, I just recently found out that Lumberyard actually was spun out[1] into the open source Open 3D Engine[2] under the stewardship of the Linux Foundation. It's a nice surprise to see that Lumberyard didn't just die out, and is joining the ranks of open-source engines.
I'd call D&D more of a framework for collaborative storytelling that can absolutely be played as a game. The DM leads the adventure, the players decide how to respond to things. Everyone plays D&D a bit differently.
The most straightforward adventures that typically have a "win condition" are one shots/self-contained adventures from either WoTC or 3rd Party Publishers, like Curse of Strahd, Waterdeep: Dragon Heist, etc.
However, a lot of D&D groups I've played with might have characters die, but will rarely have a group "lose". However, because every group runs things a bit differently, a different group can drastically change how the game feels.
During the initial kerfuffle, a Unity employee did quote one of their lawyers saying the following[1]:
> Our terms of service provide that Unity may add or change fees at any time. We are providing more than three months advance notice of the Unity Runtime Fee before it goes into effect. Consent is not required for additional fees to take effect, and the only version of our terms is the most current version; you simply cannot choose to comply with a prior version. Further, our terms are governed by California law, notwithstanding the country of the customer.
The communication around this rollout was absolute rubbish. Even employees were trying to get clarity, and they were forced to figure it out and real time.
I know for me (as someone who would likely never have had to pay a dime under either pricing scheme) the crux of the issue was unilateral, retroactive changes to a license that was supposed to be tied to the software version, as well as the nebulous "we'll know what to charge you because of our proprietary data model, trust us" messaging that they first went with.
That, combined with the fact that there was no safeguard for the install fee to be capped at some percentage of gross revenue made it so clear that they were trying to get something out of their free to play market specifically, which seems to have been to force their F2P customers to use their Unity Ads service over Applovin or similar competitors since they gave credits towards the runtime fee if you vertically integrated with Unity.
Definitely use a battle-tested HTML sanitization library if possible. There's a million different pitfalls and footguns with XSS. See: Some of the insane XSS polyglots out there that can be used for testing.
However, if you're the creator of a Firefox/Chrome extension, and want to utilize the WebExtension support in Safari, your deployment workflow can no longer be platform agnostic.
I was thinking on that. You still need peripherals if you're using a Mac Mini, though that's no different than if you were using another desktop. Still though, if you don't use, or don't want to use a Mac as your daily driver, that's a dedicated machine just to build/publish an extension for a browser. IMO, there's a slightly stronger case for iOS apps, but requiring that for a browser extension is much harder to justify.
Synchronous communication typically means something that demands your attention as soon as something is sent. Asynchronous communication is something that typically handled whenever you're ready for it. To put it in programming terms, synchronous communication "blocks" until you deal with it, where as asynchronous doesn't require you to deal with it until you're ready to.
I mean, when a lawyer takes a case on contingency, they're essentially gambling their time on hopes of an outcome where their share (30-50% isn't uncommon, if I remember correctly) would make the time and effort spent on the case worth it. Against a company the size of Disney, with incentive to make the case as long and painful as possible to try and discourage other creators from trying to get what they're owed, it would likely take thousands of man hours, and tens of thousands of dollars out of pocket. Between discovery, filing fees, appeals, all for a victory that would result in (and I'm just completely guessing based on essentially no data) only hundreds of thousands of dollars. Lawsuits can very much end up being pyrrhic victories based on the costs incurred alone, not to mention the emotional toll that fighting a protracted legal battle can inflict upon a person.
Alright, since linking the entirety of title 17 isn't exactly easy to refer to as a source, the relevant part is 17 USC 203.^1
It's probably one of the more complex parts of copyright law. There's a few well-known cases of section 203 being used to claw back copyright decades down the line. (Note: I'm am very much not a lawyer)
In 1938, John Steinbeck granted Viking Press rights to publish 13 of his works, including Of Mice And Men, The Grapes of Wrath, and Tortilla Flats, as long as they were kept in print and for sale. In 2005, John Steinbeck's son and granddaughter served notice to Penguin Publishing, who were the interested party at the time, that they were terminating the agreement.^2
This section was originally designed to give artists who may have essentially (or even literally) given away their rights due to inequitable bargaining power a chance to recoup their property down the line with at least several years notice that they are planning on terminating the agreement.^3 In practice, however, it's kind of a mess, and to say that it would allow an artist or their heirs to terminate a grant to the public domain is dubious. It's something that would likely see its way to the supreme court should it ever come to pass.
I've included a couple other articles here just in the general interest of providing more info.^4^5
Down towards the bottom it seems like it's only presently available in the US, and they're simply using `.sm` as a clever domain name hack/gccTLD (e.g. .io domains, .ly domains, etc)
There are definitely some games that just don't translate as well to Tabletop Sim, but as far as shared tabletop experiences, TTS blows every other one I've tried out of the water on the widest variety of games. I use it for D&D, Wizards' Academy, and I own about half of the official DLC games.