Ronald.phillips

[link] [75 comments]

CD Projekt Red hasn't revealed exactly when it will roll out the long-promised PlayStation 5 and Xbox Series X/S upgrades for Cyberpunk 2077 and The Witcher 3: Wild Hunt. However, it says it's still on track to release them by the end of the year. The studio listed "late 2021" as the timeframe for those upgrades in its financial report for the first half of the year.

The timeline still fits with the Cyberpunk 2077 roadmap that CDPR published in January. At the time, it said the PS5 and Xbox Series X/S upgrades would arrive in the second half of the year. The studio also said at WitcherCon in July that a free current-gen upgrade for those who own The Witcher 3 on PS4 and Xbox One will arrive this year too, along with free DLC — perhaps in time for season two of the Netflix's The Witcher series in December.

After the abysmal launch of Cyberpunk 2077, which by all accounts ran poorly on the base PS4 and Xbox One, CDPR has released several patches and hotfixes to improve stability and performance. The game was in such a bad state at the outset that Sony swiftly yoinked Cyberpunk 2077 from the PlayStation Store, and didn't allow the game back until six months later (albeit with a warning about performance on the base PS4).

The most recent Cyberpunk 2077 patch included the first batch of promised free downloadable content. However, this only amounted to cosmetic items and a new look for Johnny Silverhand, Keanu Reeves' character. There are still expansions to the game on the way, though.

Still, given the widespread spate of game delays we've seen over the last year or so, including a couple of delays to Cyberpunk 2077 itself, its encouraging that CDPR is still confident about releasing the current-gen upgrades for both games in the next few months.

Between around a third and 40 percent of CDPR's developers are currently working on Cyberpunk 2077 support and the current-gen upgrade, according to a chart in the financial report. It's hard to tell, since the chart doesn't include actual percentages. In any case, that's down from over half of the team as of the end of 2020 as the studio gradually shifts employees to other projects. One of those is the first expansion for Cyberpunk 2077, which doesn't currently have a release window.

CD Projekt Red

The following contains spoilers for episodes three and four of 'What If...?'

There’s a Twilight Zone episode I’m particularly fond of called “A World of His Own,” where a writer discovers that everything he speaks into his dictaphone comes true, and he can undo it by simply burning the tape. By the end, even narrator Rod Serling is shown to be a creation of this character’s imagination, making this one of the few TZ episodes where the fourth wall is firmly broken. It took an entire season for that classic program to feel comfortable enough to play around with its format and premise like that. However, we’re only on the fourth installment of What If…? and it’s employing similar tactics, though with a less comedic tone.

The first two episodes of What If…? revolved around a simple switch, trading one character for another and seeing how things play out as a result. Last week’s hinged on a minor change — Hope Pym joining SHIELD — that spiraled out with huge consequences. This week shows us a simple substitution again, putting Dr. Christine Palmer in the car with Stephen Strange and killing her off in the accident that in another timeline, destroyed the gifted surgeon’s hands instead.

Her death ends up being the catalyst for Strange studying the mystic arts, and the events shown here pretty much follow the same lines as they did in the film. It’s kind of unlikely, given that a motive to fix one’s injured hands is small peanuts compared to an attempt to undo death. But we still see Stephen training in Kamar-Taj, learning about the Eye of Agamotto and eventually fighting Dormammu. As far as the timeline is concerned, everything is pretty much the same.

Marvel Studios

Except Stephen, who can’t get Christine’s death out of his head. He ends up going back to the moment of the crash and trying to save his girlfriend’s life, only to fail again and again. Since her death was the catalyst for him to learn magic, he can’t use his powers to save her. She is a fixed point, an unchangeable event (something Doctor Who fans will be well acquainted with).

For the viewer, this raises a big question: If Christine’s death is really such a concrete event in the time stream, how did we end up with “our” Stephen Strange back over in the regular MCU timeline? Here, the episode inspired an intriguing possibility: that perhaps this Doctor Strange will succeed in changing the timeline so that Christine isn’t in the car and he destroys his hands, in fact making this episode a prequel to the 2016 film. That would have been a rather mind bending twist that certainly would have made this series more important, though still not essential, to the MCU.

Alas, it was not to be, with Strange descending further and further into his obsession to the point where even our narrator is concerned. And for the first time, a character becomes aware that they are being observed and actually calls the Watcher out. Like in the Twilight Zone episode, the sequence is intended as a demonstration of power, showing that Strange has reached the level of awareness to notice the fourth wall. But still his powers are limited; he’s not cognizant of the audience (though Uatu the Watcher is, having addressed us directly earlier in the episode) and his pleas for assistance ultimately go unheeded.

Marvel Studios

Compared with the first three episodes, this one ends on a dark note. That’s actually truer to the original comic series the show is based on where, freed from the constraints of long-term continuity, the writers could take the story in whatever direction they wanted. If they wanted to kill everyone they could and would, since the main timeline was to go unaffected and future issues of What If…? would just hit the reset button.

Whether the animated version will go the same way remains to be seen, but with the fourth episode an underlying sense of continuity has started to develop: The tentacled creature from "What If... Captain Carter Were the First Avenger?" makes a reappearance, and Uatu acknowledges to the audience the stories he’s already told, which at the bare minimum hints that these episodes are meant to be viewed in a specific order. What If…? may be a diversion, but there seems to be a destination on the horizon.

Today, Microsoft is releasing Windows Server 2022, making it generally available to customers around the world. Typically, Windows Server releases are somewhat aligned with consumer versions of Windows, but Windows Server 2022 is still more like Windows 10 than Windows 11. That’s probably because the use cases for Windows Server don’t really require the kind of UI refresh that Windows 11 is.

Instead, this release focuses on enhancing core features that are more important for servers. First, there are security improvements with what Microsoft calls “advanced multi-layered security”. There are two parts to this; first, there’s Secured-core Server, a type of device where Microsoft works with hardware partners to enable new hardware, firmware, and driver features to provide enhanced security.  Microsoft did something similar for business PCs, which it called Secured-core PCs, and this is taking that to servers.

Additionally, Windows Server 2022 improves the speed and security of network connections with HTTPS and TLS 1.3 enabled by default, and support for DNS-over-HTTPS is also available now. AES-256 encryption support is now available for the SMB protocol, too.

Windows Server 2022 also comes with some new Azure features, like Azure Arc, which enables cloud services for on-premises configurations. Plus, there’s support for SMB Compression and an updated Windows Admin Center with an improved server management experience. Microsoft also highlighted some Azure features released over the past year, such as Azure Automanage to automate best practices for the cloud, Azure Kubernetes Service with .NET support, and more.

This release of Windows Server adds support for 48TB of RAM as well as 2,048 logical cores across 64 CPU sockets, which should enable support for even more applications. Additionally, it includes improved application support for Windows containers, adds support for IPv6 and dual-stack networking, and more.

If you’re interested in Windows Server 2022, you can head here to try it out, and find the full list of new features here. To buy it, there are three pricing options available; Essentials is designed for specialty servers and is licensed per server, while Standard and Datacenter are licensed per core and meant for large-scale applications.

The post Windows Server 2022 is now available with new security features appeared first on xda-developers.

Renters frustrated by headlines about the hot housing market that make it seem like this is their last chance to buy property won’t exactly be comforted by reports that rent payments are currently exceeding average monthly mortgage payments. But comparing the costs of owning versus renting on a monthly basis isn’t…

Read more...

Vestron Video and Lionsgate Home Entertainment will bring to Blu-ray Francis Ford Coppola's Dementia 13 (1963), starring William Campbell, Luana Anders, Bart Patton, Mary Mitchel, and Patrick Magee. The release will be available for purchase on September 21.

Following his recent director's cuts for Apocalypse Now: The Final Cut and The Cotton Club Encore, Coppola went into his own private collection to restore his directorial debut from 1963. [Continued ...]

[link] [20 comments]

At this point we run into a couple of new monster types. Actually, you may have run into these earlier, depending on how far you strayed off the obvious path provided by the main quest. But here is where you unavoidably encounter them, so let’s talk about them now…

Telepath

This enemy is a big black blob that hovers overhead and mind-controls groups of humans. The dialog hints that this experience is agonizing and terrifying for the victims. If the telepath senses you, it will send these human puppets after you. The human victims will shuffle towards you, flailing their limbs like marionettes in the hands of a novice. If they get too close, their heads explode, dealing huge damage.

I’m not totally sure what causes the head explosion. I mean, it’s obvious the Telepath monster triggers it, but I don’t think that human brain matter is particularly combustible. The game hints that this explosion is extremely violent. The head basically vaporizes and turns the skull fragments into shrapnel. This doesn’t seem like a natural extension of the telepath’s ability to manipulate minds.

Later the cook (we’ll talk about him in the moment) refers to the puppets as having “black eggs behind their eyes”. Maybe he’s talking about neuromods? Typhon flesh is indeed an oily black color and you obtain neuromods by injecting these huge needles through your eye, presumably depositing the mod behind the eyeballs. So perhaps the telepath isn’t exploding your fleshy human think-meat. Maybe it’s causing the clusters of Typhon cells to explode.

If this is the case, then someone without neuromods would be immune. The telepath wouldn’t have any way to weaponize them, and maybe it wouldn’t even be able to control them in the first place. Maybe those neuromods are creating the vulnerability that gives the telepath a way to hijack your brain?

Man, this setting is filled with such interesting ideas. I have a hard time condemning Alex Yu for studying the Typhon, because *I* want to study the dang things.

I didn’t realize it on my first trip through the game, but you can save the people being controlled by a telepath. If you knock them out, they’ll go limp. I just assumed these people would just remain unconscious for the rest of the game and were doomed to die when/if you chose to blow up the station at the end. But no! When you come back later, their bodies will be gone. The game isn’t totally forthcoming on where they’re hiding out, but the game seems to suggest that they’re somewhere arbitrarily safe where you don’t need to worry about them and where you can’t talk to them because voice actors are expensive.

You’ll never see these people again,^[1] but if you take the ending path that allows people to escape Talos-1, these former puppets will be counted among the survivors.

Poltergeist

This is very obviously an attempt to make something spooky. And I guess it worked.

The poltergeist is invisible and attacks by flinging objects around the room. The sound design borrows heavily from common horror movie tropes. Lots of howling, dissonant echoes. It also “speaks” by using weird distorted snippets of chatter from the victims it’s absorbed.

One cool detail is that it’s territorial. Unlike the other foes, it won’t chase you. It’s usually content to patrol one or two rooms and it only bothers you if it catches you trespassing. This encourages either stealth^[2] or just running through to get the item you need. Running and hiding is more scare-inducing than combat, which helps keep Poltergeist encounters spooky.

My first few Poltergeist encounters were brilliant. But once I was familiar with their tricks, they stopped being so scary. They’re not physically tough, but they’re annoying to fight because you can’t see them. Once you’re used to their jumpscare noises, they’re more irritating than frightening.

Still, those first few encounters are really something. Particularly if you have no idea what you’re dealing with ahead of time.

And speaking of monsters, there’s a different sort of monster here in the crew quarters…

Guess Who’s Coming to Dinner?

A Telepath is terrorizing the dining hall. Once you deal with it, the cook calls you over. He’s locked himself in the kitchen, but he’s willing to let you in if you do him a favor. He wants you to go to his room and retrieve some culinary award from his personal belongings. It feels very much like a classic fantasy-style RPG quest, which is a little odd in this context.

Once you fetch his shiny thing, he lets you into the kitchen. Next he asks you to fix some equipment so he’ll have access to fresh drinking water. He plans to hide here in the kitchen until this disaster blows over, so he’s looking to make sure he’s got enough food and water to get through. There’s no way to tell him that his plan is a waste of time because you plan to blow the place up.

He says that if you fix the water, he’ll let you into the freezer. He says he’s stashed some of the Telepath’s victims in there,  and they might have some good stuff for you to loot.

Once you fix the water, he unlocks the freezer. You go inside, he locks the door behind you, gas pours in, and you die.^[3]

There’s a lot odd about this setup.

Killer Cook

It turns out that this cook is one of the test subject prisoners. He escaped, murdered the cook Will Mitchell, and then impersonated him. His real name is Luka Golubkin.

The game is sporting enough to give you several clues that he’s a fake:

1. His name is supposedly the very anglo-sounding “Will Mitchell”, but he’s got a thick slavic accent. We already know that a lot of the human test subjects (the “volunteers”) were from the Soviet Union, so his accent in this context ought to be a bit of a red flag.
2. If you go to Mitchel’s room, you can see a picture of the real cook. Luka Golubkin looks nothing like Will Mitchell.
3. In Will’s room you can find a recording of his voice, which is much younger-sounding and doesn’t have an accent.^[4]
4. Luka is wearing a red TranStar pressure suit, which doesn’t make sense for a cook. Given the generous size of the suit, Luka probably stole it from Morgan’s brother Alex.
5. Luka is initially confused by Morgan’s nametag. He doesn’t recognize this incredibly famous company executive, when Morgan ought to be very familiar to him. Morgan and Will have both been on the station for years, and I have to assume she’s been eating food. There’s no way she would be a stranger to the real Will Mitchell. I can understand why Morgan doesn’t remember the cook, but the cook should at least know her name.
6. If the player was reading the experiment data Psychotronics, then they probably read about test subject 37, a mentally disturbed individual that a Telepath monster refused to possess. Now they find the cook has been close to a Telepath for hours without being possessed. That’s not enough info to immediately prove that the cook is really subject 37, but it is something to make the player curious if they’ve been paying attention. (Although, that makes me wonder why the Telepaths don’t possess Morgan. I assumed her spacesuit protected her somehow, and Luka is wearing the same kind of suit. So I dunno if this counts as a clue or not.) EDIT: As many people pointed out in the comments, it doesn’t possess Morgan because you have the psychoscope. I KNEW this, at one point, but then I blanked out like a dimwit when I started thinking about this scene.
7. If the previous items make you suspicious you can go to a security station and have it locate Will Mitchell. The resulting map marker will appear in the freezer and not on the guy claiming to be Mitchell. It’s unlikely a player will try this, but if they do that should be a total giveaway that this guy is both lying and dangerous.

Despite these clues, I managed to blunder into his trap like an idiot anyway. In my defense, there’s a lot going on in the crew quarters section. I was learning a lot of names and following a lot of different plot threads. I’m not great with faces and names to begin with, and the constant stream of audiologs from dozens of people was overwhelming my ability to keep track of everyone. By the time I got around to cleaning out the crew cabins, I’d forgotten the details of who the cook was claiming to be and why I needed this cooking award.

I did notice the red pressure suit and I thought that was kind of odd, but I cynically blamed that on the designers re-using existing character models. “Oh look, they reused Alex’s body and they thought I wouldn’t notice.” I also thought it was weird that the cook wouldn’t know Morgan’s name, but I didn’t immediately jump to the conclusion, “Ah-ha! Imposter!” I just thought it was, you know… a little odd.

Yu Got Me

I love the idea of a “gotcha” moment like this, because it was properly telegraphed. During my first-time playthrough I got distracted and blindly followed the in-game waypoint marker, which means I blundered into this trap unaware. That’s cool! I deserved it. Falling for cutscene incompetence is outrage-inducing, but falling due to actual incompetence is actually kinda fun, if handled right. Conversely, if you see it coming and avoid it, then you can feel clever.

Sadly, there are a few oddities with this ambush that kinda took the fun out of it for me.

One is that it feels like this shouldn’t work. When Luka springs his trap, white mist comes down from the ceiling and Morgan collapses. I can’t tell if this is flooding the room with gas, or if it’s flash-freezing me. In either case, what kind of walk-in freezer has a button that allows you to suffocate / insta-freeze someone? It’s not like you can “hack” a freezer to be able to do this. Someone would need to specifically engineer this capability into the freezer. That would be impractical, expensive, and serve no purpose other than to create needless danger for kitchen staff.

Moreover, I’m wearing a spacesuit. It’s specifically designed to provide me with breathable air and keep me warm in the frigid 2.7 Kelvin of space. You can’t get much colder than that, so I don’t see how a walk-in freezer could pose an immediate threat to me. I guess maybe the game is saying that this hits me when I have the helmet open? But then, it takes several seconds for Morgan to fall over, and that seems like plenty of time to get the helmet closed. Also, you get this overlay of triangles on the HUD, which the game normally uses to indicate that your helmet is closed. But if my helmet is closed then how is this a threat to me? I should be able to hang around in here for hours.^[5]

But the worst thing for me is that this feels like a game over, when it isn’t. There’s a flash of pure red and a musical sting before the fade to white, which really felt like an insta-death damage spike. I associated that musical sting with death, so when I blundered into this trap I just assumed I’d died. So I opened the menu and loaded a save, not realizing that Morgan was knocked out and that I’d be able to wake up and continue playing in a few more seconds.

I’ve been through the game six times now, and I didn’t realize you could survive this ambush until I decided to read about this scenario on the wiki.

Also, what could a freezer POSSIBLY do to someone in a space suit that would knock them out and somehow NOT kill them? If it somehow overwhelmed me with such intense cold that I passed out, then I’m going to freeze to death before I wake up.

This is a great moment, but it’s somewhat ruined by the confusing presentation. It doesn’t make sense that he should be able to knock you out, and when he does it feels like a game over anyway.

Solving the Crime

The other problem with this scenario is that it breaks the unspoken rule of a silent protagonist: It’s fine that I can’t talk, as long as you never put me in a position where I NEED to.

It’s possible for an attentive player to realize the cook is sketchy. However, I don’t think they have enough information to justify pulling out a weapon and taking physical action against him. In this situation, the most reasonable course of action would be to draw a weapon and demand to know who he is and why he’s pretending to be Will Mitchell. The game has placed our silent protagonist in a situation where they need to be able to speak, and that’s a no-no.

It would be fine if Morgan was a literal mute or a robot without the ability to speak, but Morgan is presumably a functioning adult that knows how to communicate with other people using mouth noise.

I’m not even sure you could solve this with a dialog wheel. The whole point is to have players fall for this trap, and having pre-baked dialog options would ruin this. If the player sees “I know you’re not the real Chef Mitchell!” in their dialog options, then they’ll realize the truth even if they missed the clues. There’s no way to allow the player to respond in dialog without also ruining the secret for the unaware.

Also, I’d really like to know why Luka Golubkin asks Morgan to go to Will Mitchell’s room and fetch his gold medal. Why would Luka want a sentimental item like this? More importantly, this is what ultimately incriminates him. The cook’s quarters are where you discover^[6] that Luka’s face and voice don’t match with who he claims to be. Luka basically incriminates himself by asking you to get an item that is of no practical use to him.

One final oddity with this setup is that Luka offers you the opportunity to loot the people in the freezer. That’s a creepy thing to bargain with. “Hey, I’ve got a bunch of your dead colleagues in my freezer. If you help me out I’ll let you through their pockets!”

Now, as it turns out you really do need something from one of the bodies. But it feels like Luka immediately senses that you’re the player character and thus he knows you’re going to be obsessively looting containers and bodies like a crazy person. I mean, he’s right, but this is usually the sort of thing that NPCs aren’t supposed to notice.

Danielle Sho

Incidentally, the whole reason we need to have to have this crazy misadventure here in the Crew Quarters is that the door to Deep Storage is locked, and that’s our real goal. For some reason, Danielle Sho locked the door to Deep Storage using her voice, meaning she’s the only person on the station that can get in. That’s an outrageous and absurd thing for her to have done. It actually reminds me of the Simpsons gag where Homer exits the power plant during a fire drill and pointlessly barricades the door behind him. Moreover, it’s not even clear why she did it. ^[7]

The place was already infested with Typhon, so it’s not like she did this in an attempt to keep them out. Moreover, part of her job was the safekeeping of all the drives in Deep Storage. By locking the doors, she not only locked herself out of her own office, but also ensured that nobody would be able to rescue any of the data that had been entrusted to her. If your job is to protect paintings in an art gallery, then the last thing you should do is lock the doors when a fire breaks out. Maybe the paintings can be saved and maybe they can’t, but there’s no reason to guarantee they’ll burn with the building!

It’s possible that this is deliberate on the part of the writer. The confusing thing about Ms. Sho is that she has sympathetic line delivery and a little side-story that humanizes her, but if you judge her solely on her actions in the game then you can actually make a pretty good case that she’s a petty, small-minded dimwit.

I bring this up because you actually get the chance to talk to her. She’s stuck outside the station, but you converse through the window^[8] and she gives you the last of the audio samples you need to open the door to Deep Storage.

My problem is that once again, we find ourselves in a situation where my silent protagonist needs to talk. Danielle does all the talking, but I have a dozen questions for her that I’m unable to ask. Why did you lock the door to Deep Storage? Why did you lock it with YOUR voice? Why are you deliberately suffocating outside the ship when you could easily come back inside and be as safe as any of the other dozen or so survivors? My suit seems to have an unlimited ability to recycle oxygen – why doesn’t yours? Why were you hanging out so close to the telepath that was controlling the pool? How did you avoid being mind-controlled? You asked me to kill the cook to avenge his murdering your estranged girlfriend, but why don’t YOU do it? If you’ve already resigned yourself to die, then why not try to make it worth something? Why did you seal yourself in Deep Storage and then escape using the data vault, when you could have just walked downstairs and gone through the door that was keyed to your voice?^[9] Also, you seem to be trapped between the outer hull and the inner hull – how did you get there and why?

I like silent protagonists, but only if the writer makes sure that their silence is never a hindrance to the player. Otherwise it turns into I Have No Mouth and I Must Nitpick.

Anyway.

We finally have samples of Sho’s voice, so now we can get around her inexplicable sabotage of the door to Deep Storage. But I have one last thing to nitpick before we leave the crew quarters behind. I’ll talk about that next time.

[link] [43 comments]

How do you build on a filmography that includes disaster movies like The Day After Tomorrow and Independence Day? If you’re Roland Emmerich, the answer is, quite simply, to drop the Moon on the planet. In the first trailer for his latest film, Moonfall, Earth’s natural satellite has decided to do humanity a solid favor and put it out of its misery by crashing into its anchor.

You might think its title says almost everything you need to know about Moonfall, but, sorry, the end of the world is only part of the story here. According to the film’s official synopsis, a “mysterious force” is what sets the Moon on its collision course with Earth. It’s up to a NASA executive, former astronaut and conspiracy theorist — played by Halle Berry, Patrick Wilson and John Bradley, respectively — to save the world. “These unlikely heroes will mount an impossible last-ditch mission into space, leaving behind everyone they love, only to find out that our Moon is not what we think it is,” the film’s official summary says.

I’ll say it now. I hope it’s not aliens that are behind everything. Either way, Moonfall looks like it will be a fun and trashy way to spend an hour or two forgetting about all the real problems haunting humans at the moment. The film will debut in theaters on February 4th, 2022. We can't wait.

Several weeks ago, Microsoft detected a 0-day remote code execution exploit being used to attack the SolarWinds Serv-U FTP software in limited and targeted attacks. The Microsoft Threat Intelligence Center (MSTIC) attributed the attack with high confidence to DEV-0322, a group operating out of China, based on observed victimology, tactics, and procedures. In this blog, we share technical information about the vulnerability, tracked as CVE-2021-35211, that we shared with SolarWinds, who promptly released security updates to fix the vulnerability and mitigate the attacks.

This analysis was conducted by the Microsoft Offensive Research & Security Engineering team, a focused group tasked with supporting teams like MSTIC with exploit development expertise. Our team’s remit is to make computing safer. We do this by leveraging our knowledge of attacker techniques and processes to build and improve protections in Windows and Azure through reverse engineering, attack creation and replication, vulnerability research, and intelligence sharing.

In early July, MSTIC provided our team with data that seemed to indicate exploit behavior against a newly-discovered vulnerability in the SolarWinds Serv-U FTP server’s SSH component. Although the intel contained useful indicators, it lacked the exploit in question, so our team set out to reconstruct the exploit, which required to first find and understand the new vulnerability in the Serv-U SSH-related code.

As we knew this was a remote, pre-auth vulnerability, we quickly constructed a fuzzer focused on the pre-auth portions of the SSH handshake and noticed that the service captured and passed all access violations without terminating the process. It immediately became evident that the Serv-U process would make stealthy, reliable exploitation attempts simple to accomplish. We concluded that the exploited vulnerability was caused by the way Serv-U initially created an OpenSSL AES128-CTR context. This, in turn, could allow the use of uninitialized data as a function pointer during the decryption of successive SSH messages. Therefore, an attacker could exploit this vulnerability by connecting to the open SSH port and sending a malformed pre-auth connection request. We also discovered that the attackers were likely using DLLs compiled without address space layout randomization (ASLR) loaded by the Serv-U process to facilitate exploitation.

We shared these findings, as well as the fuzzer we created, with SolarWinds through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR), and worked with them to fix the issue. This is an example of intelligence sharing and industry collaboration that result in comprehensive protection for the broader community through detection of attacks through products and fixing vulnerabilities through security updates.

Vulnerability in Serv-U’s implementation of SSH

Secure Shell (SSH) is a widely adopted protocol for secure communications over an untrusted network. The protocol behavior is defined in multiple requests for comment (RFCs), and existing implementations are available in open-source code; we primarily used RFC 4253, RFC 4252, and libssh as references for this analysis.

The implementation of SSH in Serv-U was found by enumerating references to the “SSH-“ string, which must be present in the first data sent to the server. The most likely instance of such code was the following:

Figure 1. Promising instance of “SSH-” string

Putting a breakpoint on the above code and attempting to connect to Serv-U with an SSH client confirmed our hypothesis and resulted in the breakpoint being hit with the following call stack:

Figure 2. The call stack resulting from a break point set on code in Figure 1.

At this point, we noticed that Serv-U.dll and RhinoNET.dll both have ASLR support disabled, making them prime locations for ROP gadgets, as any addresses within them will be constant across any server instances running on the internet for a given Serv-U version.

After reversing related code in the RhinoNET and Serv-U DLLs, we could track SSH messages’ paths as Serv-U processes them. To handle an incoming SSH connection, Serv-U.dll creates a CSUSSHSocket object, which is derived from the RhinoNET!CRhinoSocket class. The CSUSSHSocket object lifetime is the length of the TCP connection—it persists across possibly many individual TCP packets. The underlying CRhinoSocket provides a buffered interface to the socket such that a single TCP packet may contain any number of bytes. This implies a single packet may include any number of SSH messages (provided they fit in the maximum buffer size), as well as partial SSH messages. The CSUSSHSocket::ProcessRecvBuffer function is then responsible for parsing the SSH messages from the buffered socket data.

CSUSSHSocket::ProcessRecvBuffer begins by checking for the SSH version with ParseBanner. If ParseBanner successfully parses the SSH version from the banner, ProcessRecvBuffer then loops over ParseMessage, which obtains a pointer to the current message in the socket data and extracts the msg_id and length fields from the message (more on the ParseMessage function later).

Figure 3. Selection of code from CSUSSHSocket::ProcessRecvBuffer processing loop

The socket data being iterated over is conceptually an array of the pseudo-C structure ssh_msg_t, as seen below. The message data is contained within the payload buffer, the first byte of which is considered the msg_id:

ProcessRecvBuffer then dispatches handling of the message based on the msg_id. Some messages are handled directly from the message parsing loop, while others get passed to ssh_pkt_others, which posts the message to a queue for another thread to pick up and process.

Figure 4.Pre-auth reachable handlers in CSUSSHSocket::ProcessRecvBuffer

If the msg_id is deferred to the alternate thread, CSSHSession::OnSSHMessage processes it. This function mainly deals with messages that need to interact with Serv-U managed user profile data (e.g., authentication against per-user credentials) and UI updates. CSSHSession::OnSSHMessage turned out to be uninteresting in terms of vulnerability hunting as most message handlers within it require successful user authentication (initial telemetry indicated this was a pre-authentication vulnerability), and no vulnerabilities were found in the remaining handlers.

When initially running fuzzers against Serv-U with a debugger attached, it was evident that the application was catching exceptions which would normally crash a process (such as access violations), logging the error, modifying state just enough to avoid termination of the process, and then continuing as if there had been no problem. This behavior improves uptime of the file server application but also results in possible memory corruption lingering around in the process and building up over time. As an attacker, this grants opportunities like brute-forcing addresses of code or data with dynamic addresses.

This squashing of access violations assists with exploitation, but for fuzzing, we filtered out “uninteresting” exceptions generated by read/write access violations and let the fuzzer run until hitting a fault wherein RIP had been corrupted. This quickly resulted in the following crashing context:

Figure 5. WinDbg showing crashing context from fuzzer-generated SSH messages

As seen above, CRYPTO_ctr128_encrypt in libeay32.dll (part of OpenSSL) attempted to call an invalid address. The version of OpenSSL used is 1.0.2u, so we obtained the sources to peruse. The following shows the relevant OpenSSL function:

Meanwhile, the following shows the structure that is passed:

The crashing function was reached from the OpenSSL API boundary via the following path: EVP_EncryptUpdate -> evp_EncryptDecryptUpdate -> aes_ctr_cipher -> CRYPTO_ctr128_encrypt.

Looking further up the call stack, it is evident that Serv-U calls EVP_EncryptUpdate from CSUSSHSocket::ParseMessage, as seen below:

Figure 6. Location of call into OpenSSL, wherein attacker-controlled function pointer may be invoked

At this point, we manually minimized the TCP packet buffer produced by the fuzzer until only the SSH messages required to trigger the crash remained. In notation like that used in the RFCs, the required SSH messages were:

Note that the following description references “encrypt” functions being called when the crashing code path is clearly attempting to decrypt a buffer. This is not an error: Serv-U uses the encrypt OpenSSL API and, while not optimal for code clarity, it is behaviorally correct since Advanced Encryption Standard (AES) is operating in counter (CTR) mode.

After taking a Time Travel Debugging trace and debugging through the message processing sequence, we found that the root cause of the issue was that Serv-U initially creates the OpenSSL AES128-CTR context with code like the following:

Calling EVP_EncryptInit_ex with NULL key and/or IV is valid, and Serv-U does so in this case because the context is created while handling the KEXINIT message, which is before key material is ready. However, AES key expansion is not performed until the key is set, and the data in the ctx->cipher_data structure remains uninitialized until the key expansion is performed. We can (correctly) surmise that our sequence of messages to hit the crash has caused enc_algo_client_to_server->decrypt to be called before the key material is initialized. The Serv-U KEXINIT handler creates objects for all parameters given in the message. However, the corresponding objects currently active for the connection are not replaced with the newly created ones until the following NEWKEYS message is processed. The client always completes the key exchange process In a normal SSH connection before issuing a NEWKEYS message. Serv-U processed NEWKEYS (thus setting the m_bCipherActive flag and replacing the cipher objects) no matter the connection state or key exchange. From this, we can see that the last message type in our fuzzed sequence does not matter—there only needs to be some data remaining to be processed in the socket buffer to trigger decryption after the partially initialized AES CTR cipher object has been activated.

Exploitation

As the vulnerability allows loading RIP from uninitialized memory and as there are some modules without ASLR in the process, exploitation is not so complicated: we can find a way to control the content of the uninitialized cipher_data structure, point the cipher_data->block function pointer at some initial ROP gadget, and start a ROP chain. Because of the exception handler causing any fault to be ignored, we do not necessarily need to attain reliable code execution upon the first packet. It is possible to retry exploitation until code execution is successful, however this will leave traces in log files and as such it may be worthwhile to invest more effort into a different technique which would avoid logging.The first step is to find the size of the cipher_data allocation, as the most direct avenue to prefill the buffer is to spray allocations of the target allocation size and free them before attempting to reclaim the address as cipher_data. ctx->cipher_data is allocated and assigned in EVP_CipherInit_ex with the following line:

With a debugger, we can see the ctx_size in our case is 0x108, and that this allocator winds up calling ucrtbase!_malloc_base. From previous reversing, we know that both CRhinoSocket and CSUSSHSocket levels of packet parsing call operator new[] to allocate space to hold the packets we send. Luckily, that also winds up in ucrtbase!_malloc_base, using the same heap. Therefore, prefilling the target allocation is as simple as sending a properly sized TCP packet or SSH message and then closing the connection to ensure it is freed. Using this path to spray does not trigger other allocations of the same size, so we don’t have to worry about polluting the heap.

Another important value to pull out of the debugger/disassembly is offsetof(EVP_AES_KEY, block), as that offset in the sprayed data needs to be set to the initial ROP gadget. This value is 0xf8. Conveniently, most of the rest of the EVP_AES_KEY structure can be used for the ROP chain contents itself, and a pointer to the base of this structure exists in registers rbx, r8, and r10 at the time of the controlled function pointer call.

As a simple proof of concept, consider the following python code:

The above results in the following context in the debugger:

Figure 7. Machine context showing rcx, rdx, and rip controlled by attacker

Conclusion: Responsible disclosure and industry collaboration improves security for all

Our research shows that the Serv-U SSH server is subject to a pre-auth remote code execution vulnerability that can be easily and reliably exploited in the default configuration. An attacker can exploit this vulnerability by connecting to the open SSH port and sending a malformed pre-auth connection request. When successfully exploited, the vulnerability could then allow the attacker to install or run programs, such as in the case of the targeted attack we previously reported.

We shared our findings to SolarWinds through Coordinated Vulnerability Disclosure (CVD). We also shared the fuzzer we created. SolarWinds released an advisory and security patch, which we strongly encourage customers to apply. If you are not sure if your system is affected, open a support case in the SolarWinds Customer Portal.

In addition to sharing vulnerability details and fuzzing tooling with SolarWinds, we also recommended enabling ASLR compatibility for all binaries loaded in the Serv-U process. Enabling ASLR is a simple compile-time flag which is enabled by default and has been available since Windows Vista. ASLR is a critical security mitigation for services which are exposed to untrusted remote inputs, and requires that all binaries in the process are compatible in order to be effective at preventing attackers from using hardcoded addresses in their exploits, as was possible in Serv-U.

We would like to thank SolarWinds for their prompt response. This case further underscores the need for constant collaboration among software vendors, security researchers, and other players to ensure the safety and security of users’ computing experience.

 

Microsoft Offensive Research & Security Engineering team

 

The post A deep-dive into the SolarWinds Serv-U SSH vulnerability appeared first on Microsoft Security Blog.

Ransomware continues to proliferate for a simple reason—it’s profitable. And it’s profitable not just for the ransomware developers themselves—they’re just one part of the equation—but for a whole ecosystem of players who make up the ransomware economy. To understand the threats to small and medium-sized businesses (SMBs) and organizations today, it’s important to understand the scope and scale of what you’re up against.

Today, we’re digging into how the ransomware economy operates, including the broader ecosystem and the players involved, emerging threats to SMBs, and the overall financial footprint of ransomware worldwide.

Top Ransomware Syndicates in Operation Today

Cybercriminals have long been described as operating in “gangs.” The label conjures images of nefarious coders furiously tapping away at glowing workstations in a shadowy warehouse. But the work of the ransomware economy today is more likely to take place in a boardroom than a back alley. Cybercriminals have graduated from gangs to highly complex organized crime syndicates that operate ransomware brands as part of a sophisticated business model.

Operators of these syndicates are just as likely to be worrying about user experience and customer service as they are with building malicious code. A look at the branding on display on some syndicates’ leak sites makes the case plain that these groups are more than a collective of expert coders—they’re savvy businesspeople.

Ransomware operators are often synonymous with the software variant they brand, deploy, and sell. Many have rebranded over the years or splintered into affiliated organizations. Some of the top ransomware brands operating today, along with high profile attacks they have carried out, are shown in the infographic below:

The groups shown above do not constitute an exhaustive list. In June 2021, FBI Director Christopher Wray stated that the FBI was investigating 100 different ransomware variants and new ones pop up everyday. While some brands have existed for years (Ryuk, for example), the list is also likely obsolete as soon as it’s published. Ransomware brands bubble up, go bust, and reorganize, changing with the cybersecurity tides.

Chainalysis, a blockchain data platform, published their Ransomware 2021: Critical Mid-year Update that shows just how much brands fluctuate year to year and, they note, even month to month:

How Ransomware Syndicates Operate

Ransomware operators may appear to be single entities, but there is a complex ecosystem of suppliers and ancillary providers behind them that exchange services with each other on the dark web. The flowchart below illustrates all the players and how they interact:

Dark Web Service Providers

Cybercrime “gangs” could once be tracked down and caught like the David Levi Phishing Gang that was investigated and prosecuted in 2005. Today’s decentralized ecosystem, however, makes going after ransomware operators all the more difficult. These independent entities may never interact with each other outside of the dark web where they exchange services for cryptocurrency:

• • Botmasters: Create networks of infected computers and sell access to those compromised devices to threat actors.
  • Access Sellers: Take advantage of publicly disclosed vulnerabilities to infect servers before the vulnerabilities are remedied, then advertise and sell that access to threat actors.

• Operators: The entity that actually carries out the attack with access purchased from botmasters or access sellers and software purchased from developers or developed in-house. May employ a full staff, including customer service, IT support, marketing, etc. depending on how sophisticated the syndicate is.
• Developers: Write the ransomware software and sell it to threat actors for a cut of the ransom.
• Packer Developers: Add protection layers to the software, making it harder to detect.
• Analysts: Evaluate the victim’s financial health to advise on ransom amounts that they’re most likely to pay.
• Affiliates: Purchase ransomware as a service from operators/developers who get a cut of the ransom.
• Negotiating Agents: Handle interactions with victims.
• Laundering Services: Exchange cryptocurrency for fiat currency on exchanges or otherwise transform ransom payments into usable assets.

Victim-side Service Providers

Beyond the collection of entities directly involved in the deployment of ransomware, the broader ecosystem includes other players on the victim’s side, who, for better or worse, stand to profit off of ransomware attacks. These include:

• Incident response firms: Consultants who assist victims in response and recovery.
• Ransomware brokers: Brought in to negotiate and handle payment on behalf of the victim and act as intermediaries between the victim and operators.
• Insurance providers: Cover victims’ damages in the event of an attack.
• Legal counsel: Often manage the relationship between the broker, insurance provider, and victim, and advise on ransom payment decision-making.

Are Victim-side Providers Complicit?

While these providers work on behalf of victims, they also perpetuate the cycle of ransomware. For example, insurance providers that cover businesses in the event of a ransomware attack often advise their customers to pay the ransom if they think it will minimize downtime as the cost of extended downtime can far exceed the cost of a ransom payment. This becomes problematic for a few reasons:

• First, paying the ransom incentivizes cybercriminals to continue plying their trade.
• Second, as Colonial Pipeline discovered, the decryption tools provided by cybercriminals in exchange for ransom payments aren’t to be trusted. More than a month after Colonial paid the $4.4 million ransom and received a decryption tool, CEO Joseph Blount testified before Congress that recovery from the attack was still not complete. After all that, they had to rely on recovering from their backups anyway.

The Emergence of Ransomware as a Service

In the ransomware economy, operators and their affiliates are the threat actors that carry out attacks. This affiliate model where operators sell ransomware as a service (RaaS) represents one of the biggest threats to SMBs and organizations today.

Cybercrime syndicates realized they could essentially license and sell their tech to affiliates who then carry out their own misdeeds empowered by another criminal’s software. The syndicates, affiliates, and other entities each take a portion of the ransom.

Operators advertise these partner programs on the dark web and thoroughly vet affiliates before bringing them on to filter out law enforcement posing as low-level criminals. One advertisement by the REvil syndicate noted, “No doubt, in the FBI and other special services, there are people who speak Russian perfectly, but their level is certainly not the one native speakers have. Check these people by asking them questions about the history of Ukraine, Belarus, Kazakhstan or Russia, which cannot be googled. Authentic proverbs, expressions, etc.”

Though less sophisticated than some of the more notorious viruses, these “as a service” variants enable even amateur cybercriminals to carry out attacks. And they’re likely to carry those attacks out on the easiest prey—small businesses who don’t have the resources to implement adequate protections or weather extended downtime.

Hoping to increase their chances of being paid, low-level threat actors using RaaS typically demanded smaller ransoms, under $100,000, but that trend is changing. Coveware reported in August 2020 that affiliates are getting bolder in their demands. They reported the first six-figure payments to the Dharma ransomware group, an affiliate syndicate, in Q2 2020.

The one advantage savvy business owners have when it comes to RaaS: attacks are high volume (carried out against many thousands of targets) but low quality and easily identifiable by the time they are widely distributed. By staying on top of antivirus protections and detection, business owners can increase their chances of catching the attacks before it’s too late.

The Financial Side of the Ransomware Economy

So, how much money do ransomware crime syndicates actually make? The short answer is that it’s difficult to know because so many ransomware attacks go unreported. To get some idea of the size of the ransomware economy, analysts have to do some sleuthing.

Chainalysis tracks transactions to blockchain addresses linked to ransomware attacks in order to capture the size of ransomware revenues. In their regular reporting on the cybercrime cryptocurrency landscape, they showed that the total amount paid by ransomware victims increased by 311% in 2020 to reach nearly $350 million worth of cryptocurrency. In May, they published an update after identifying new ransomware addresses that put the number over $406 million. They expect the number will only continue to grow.

Similarly, threat intel company, Advanced Intelligence, and cybersecurity firm, HYAS, tracked Bitcoin transactions to 61 addresses associated with the Ryuk syndicate. They estimate that the operator may be worth upwards of $150 million alone. Their analysis sheds some light on how ransomware operators turn their exploits and the ransoms paid into usable cash.

Extorted funds are gathered in holding accounts, passed to money laundering services, then either funneled back into the criminal market and used to pay for other criminal services or cashed out at real cryptocurrency exchanges. The process follows these steps, as illustrated below:

• The victim pays a broker.
• The broker converts the cash into cryptocurrency.
• The broker pays the ransomware operator in cryptocurrency.
• The ransomware operator sends the cryptocurrency to a laundering service.
• The laundering service exchanges the coins for fiat currency on cryptocurrency exchanges like Binance and Huobi.

In an interesting development, the report found that Ryuk actually bypassed laundering services and cashed out some of their own cryptocurrency directly on exchanges using stolen identities—a brash move for any organized crime operation.

Protecting Your Company From Ransomware

Even though the ransomware economy is ever-changing, having an awareness of where attacks come and the threats you’re facing can prepare you if you ever face one yourself. To summarize:

• Ransomware operators may seem to be single entities, but there’s a broad ecosystem of players behind them that trade services on the dark web.
• Ransomware operators are sophisticated business entities.
• RaaS enables even low-level criminals to get in the game.
• Ransomware operators raked in at least $406 million in 2020, and likely more than that, as many ransomware attacks and payments go unreported.

We put this post together not to trade in fear, but to prepare SMBs and organizations with information in the fight against ransomware. And, you don’t have to fight it alone. Download our Complete Guide to Ransomware E-book and Guide for even more intel on ransomware today, plus steps to take to defend against ransomware, and how to respond if you do fall victim to an attack.

The post Introducing the Ransomware Economy appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

When you’re someone that watches a lot of horror, there comes a time where it can all feel monotonous. It can be hard to find something truly exciting and unique at times. If you’re one of those people, then do I have a surprise for you. It’s BRAND NEW CHERRY FLAVOR.

From the twisted minds that brought you Channel Zero comes BRAND NEW CHERRY FLAVOR, based on the novel by Todd Grimson. The 8-episode limited series centers around Lisa Nova (Rosa Salazar) a filmmaker who comes to LA dead set on directing her first movie. But when she trusts the wrong person and gets stabbed in the back, everything goes sideways and a dream project turns into a nightmare. Finding herself in dire straights, she meets a mysterious tattoo artist (Catherine Keener) who has a penchant for cats and likes to put curses on people. However, not everything goes as planned as Lisa’s going to have to figure out some secrets from her own past in order to get out alive.

Recently, Nightmarish Conjurings’ Shannon McGrew had the chance to speak with actors Rosa Salazar (“Lisa”) and Catherine Keener (“Boro”) where they discussed everything from vomiting up cats, rooting for a flawed character, and more.

Thank you both so much for speaking with me today! BRAND NEW CHERRY FLAVOR is probably one of the wildest shows I’ve watched in recent years. What was your reaction when you found out the type of characters you would be playing? 

Catherine Keener: I thought, holy shit I’m going to need a lot of help, which I got [Laughs]. Rosa had asked me a question [about the series] and I was like yeah, I’m fucking Boro, man. That [ended up] became our thing [Laughs].

Rosa Salazar: I liked that Lisa was totally fucked up. You’re not necessarily rooting for her, but like you are rooting for her, but you’re not necessarily like all’s forgiven. She has this myopic viewpoint of, “I’m just going to make my art,” and that for me was a very direct through-line through the entire series. It’s nice when you know a character’s ultimate motivation: I’m a filmmaker and I’m making this art and whatever crazy shit happens to me along the way I’ll react authentically, but that’s not going to stop me. Boro’s not going to stop me. Vampires aren’t going to stop me. Real-life predators, like Lou, aren’t going to stop me. There are parallels to real life, we just heightened it a little bit and that’s what I liked about it. Life is like this, it is a rigmarole like this. It is full of predators and vampires. And I liked that this person was not just like, you fucked with the wrong girl, but you fucked with the wrong filmmaker. And that’s what I really liked about the chance to play Lisa.

Okay, you know that I can’t do this interview without asking about the cats. The cats are just coming out of everywhere! It was horrific and disturbing at times. So, what’s up with the cats?

Catherine Keener: Well some people are dog people and Boro was a cat person. I also felt the same [about the horror of it]. I can relate to what you were saying. What we’ve been through in the last…aside from this horror that’s gripped the world, I think it was easier to imagine this story than to imagine what reality we’ve just gone through. Because talk about a horror show, you know? There were a lot of allegorical bits to this that kind of resonated with me. I did like the idea that these two characters were of a certain world in some sort of nether gender world that was magical. What was happening now, but informed by the past, there’s a lot of mythology, which I find to be very real.

Rosa Salazar: The cats are a metaphor for the price you pay for your art. If someone had asked me back when I was working three jobs and struggling to put myself through acting school and all of that if someone said I can help you but you’re going to have to throw up cats, I would’ve said yes! I would have signed up. And here I am actually doing that on this show, but it’s the price you pay. It’s also fucking cool, dude. When we got these scripts from the minds of Nick Antosca and Lenore Zion…

Catherine Keener: I called her and said come over, I don’t understand anything [Laughs].

Rosa Salazar: And I went over there and we talked for an entire day about what is this? The reason I said yes is that there’s so much crap out there…there’s so much content. And a lot of it you throw it on and you text through it or you scan through your social media or you’re buying stuff on Amazon, or you’re cleaning the house, I don’t like that. I wanted to do something that cuts straight through, whether it’s your vibe or not you’re definitely not going to be looking at your phone while the show is on. I want to make an art piece, I want to do something that is captivating. I’m a big fan of weird shit. I love horror. I love Cronenberg. I love that they’re throwing out that comparison. Every time I see that it turns me on, I get a boner for Cronenberg. I have a “Bonerberg.” [Laughs]. The thing that this has that a lot of horror projects that come our way [don’t have] is it had this next-level insanity to it. You will have a captive audience, no matter what. If you go full throttle, which indeed, obviously Catherine is a living legend, but if you go full throttle then you can achieve this ability to go, “Hey! I’m throwing up a cat from my side, go see it!”

Catherine Keener: On the other hand, I feel that a lot of horror comes out of the mundane. I happen to like the mundane, I do [Laughs]. Because I feel like it’s a misnomer, you know? To me, it’s just keeping your eyes open, sometimes keeping your mouth shut and looking for luck, you know?

Piggybacking off of that for our last question, let’s talk about the WILD sex scene that had me screaming in shock at the TV screen [Laughs]. What was it like to film that with actor Jeff Ward?

Rosa Salazar: I got really lucky with Jeff. When he walked into the room…you always hope, you know, when you’re doing chemistry reads you go through actors and you’re like, I wonder if I’m going to feel it, I wonder if I’m going to feel it. Every single time I do a chemistry read I’m like, I wonder if I’m going to feel it. And then Jeff walked into the room when I was there and I was like, Jeff! He’s our Roy! There’s just no other person for Roy, it’s Jeff Ward. So I got really lucky. It felt fun to film that scene. He’s also one of the funniest people on the planet so to do that with him was a joy. We had a great time filming that.

Catherine Keener: Everybody had chemistry with Jeff [Laughs].

Rosa Salazar: I gotta say, in terms of that sex scene, big props to Netflix. I mean, this is the same platform that brought you The Queen’s Gambit, and then you have something like this? Now that’s what we’re talking about, that’s some diverse content right there. And to take a big swing, such a weird out-of-this-world swing, and to let us just go and play and do this weird show, big props to Netflix.

BRAND NEW CHERRY FLAVOR is now available exclusively on Netflix. For more on the series, check out our review here.

The post [Interview] Rosa Salazar & Catherine Keener for BRAND NEW CHERRY FLAVOR appeared first on Nightmarish Conjurings.

[link] [174 comments]

Lately, my toddler has been putting all sorts of items in the dryer. He sees me putting clothes in it, and he wants to help, but he still hasn’t figured out that only certain items are meant for the dryer. The result is that I have to check very carefully before turning the dryer on, as I’ve discovered everything from…

Read more...

[link] [60 comments]

Taiwan may or may not have been the birthplace of commercial video game piracy, but it certainly has a strong claim to have been its nursery.  When video games skyrocketed in popularity in Southeastern Asia with the Famicom, it seemed as through the entire island of Taiwan wanted to cash in on the efforts of the Japanese.  Taiwan was the first source of unlicensed Famicom clones and pirate cartridges.  But cartridges were expensive to make, even for Taiwan fabs and the larger games were not very profitable to clone.  Then Nintendo handed the pirates a gift, the Famicom Disk System.  But as it turned out this was a gift that kept on giving.  While copying FDS games was child's play for the organized pirates, they saw in the FDS an opportunity to pirate to go beyond games originally released on disk. They created RAM cartridges, hardware devices that worked with the Famicom and the Disk System to permit cartridge games put on disk to work.  In this blog entry, I will describe my personal experiences with one such device, the Venus Turbo Game Doctor 6M.Read more »

[link] [55 comments]

You may not think about it all that often, but that cardboard salt container in your kitchen (the one with the handy metal spout) is pretty useful. Not only does it allow you to more easily pour out all that fine salt (without using a spoon, which can introduce unwanted moisture), it can also be put to use even after…

Read more...

[link] [175 comments]

As we all get back out there and travel again, we might have forgotten how to properly fit all of our items into a suitcase. If you can’t remember what to roll and what to fold (or how much underwear you need for a long weekend), then check out our best packing hacks.

Read more...

USCYBERCOM and the Cybersecurity and Infrastructure Security Agency (CISA) are sounding the alarm just before the Labor Day weekend in the U.S., urging organizations to patch a critical vulnerability (CVE-2021-26084) affecting Atlassian Confluence Server and Data Center. 

read more

The new Plextor PCIe 4.0 M10P(G) 2TB NVMe M2 SSD surprised the Guru of 3D with it's performance, surpassing almost every other drive in real world testing, apart from the benchmarks it…

[link] [55 comments]

[link] [28 comments]

Just when you thought blockbuster movies couldn’t possibly get any longer, the fine people at Universal Pictures announced the runtime for the next, long-delayed entry in the James Bond series. When it opens in October in the US, No Time to Die is set to keep movie-goers in their seats for a bladder-busting 2 hours…

Read more...

For all that it was a period with some significant sparks of heat and light, we might reasonably call the time between 1989 and 1994 the Dark Ages of Interactive Fiction. It was only in 1995 that the lights were well and truly turned on again and the Interactive Fiction Renaissance began in earnest. This was the point when a number of percolating trends — the evolving TADS and Inform programming languages, the new generation of Z-Machine interpreters, the serious discussions of design craft taking place on Usenet — bore a sudden and rather shockingly verdant fruit. It became, one might say, Year One of the interactive-fiction community as we know it today.

The year is destined always to be remembered most of all for the very first Interactive Fiction Competition, better known as simply the “IF Comp” to its friends. Its influence on the design direction of what used to be called text adventures would soon become as undeniable as it was unwelcome in the eyes of some ultra-traditionalists: its guidance that entries should be finishable in two hours or so led in the course of things to an interest in depth in place of breadth, in literary and formal experimentation in place of the “gamier” pleasures of point-scoring and map-making.

But the Comp’s influence would take time to make itself known. This first edition of it, organized by an early community pillar named G. Kevin Wilson, was a relatively modest affair, with just twelve entries, six in each of the two categories into which it was divided: one for TADS games, one for Inform games. (This division would fall by the wayside in future Comps.) The entries did prefigure some of the self-referential experimentation to come: Undo by Neil deMause placed you at the very end of a (deliberately) broken, corrupted game and expected you to muddle your way to victory; Mystery Science Theater 3000 Presents Detective by C.E. Forman made somewhat mean-spirited, television-inspired fun of a really, really bad game released a few years earlier by a twelve-year-old author; The Magic Toyshop by Gareth Rees took place all in one room, thus becoming the perfect treat for mapping haters. Yet in my opinion none of these games join the ranks of the year’s very best works.

In retrospect, the lineup of games in that first Comp is perhaps most notable for becoming the venue for the first polished work of interactive fiction by Andrew Plotkin; his influence on the future direction of the community, in terms of both aesthetics and technology, would be comparable only to that of Mike Roberts and Graham Nelson among the figures we’ve already met in previous articles. But his A Change in the Weather, a punishingly difficult meta-puzzle of a game which one couldn’t hope to solve without many replays, stands as a fairly minor entry in his impressive oeuvre today, despite winning the Inform category of that first Comp.

So, I’d like to reserve any more discussion of this and subsequent IF Comps for future articles, and focus today on what I consider to be the real standout text adventures of 1995, of which there are a gratifying number. The games below evince no concern whatsoever about keeping their playing time down to a couple of hours. On the contrary: all of the games that follow are big enough that Infocom could conceivably have released them, while at least one or two of them are actually bigger than Infocom’s technology could possibly have allowed. Over the years, I’ve come to realize that works like these are my personal sweet spot for interactive fiction: big, puzzly works which are well-written but which aren’t afraid to be games — albeit games which incorporate the design lessons of those pioneers that came before them. Neo-classical interactive fiction, if you will. (Yes, I’m aware that we’ve jumped from the Renaissance to Neoclassicism with dizzying speed. Such is life when you’re making broad — overly broad? — historical metaphors.) If your preferences are anything like mine, the games that follow will be heaven for you.

In fact, let me close this introduction with something of a personal plea. I’ve noticed a reluctance on the part of many diehard Infocom fans to give what came afterward a fair shake. I do understand that nostalgia is a big part of the reason people read sites like this one and play the games that are featured here, and there’s nothing inherently wrong with that. Although I do try very hard to keep nostalgia out of my own game criticism, I firmly believe that no reason to play a game is ever a wrong one, as long as you’re enjoying yourself. And yet I also believe, and with equal firmness, that the games you’ll find below aren’t just as good as those of Infocom: in a lot of ways, they’re superior. There’s nothing postmodern or pretentious or precious here (all of these being labels I’ve heard applied to other strands of post-Infocom interactive fiction as a reason for not engaging with it), just good clean old-school fun, generally absent the worst old-school annoyances. Please do consider giving one or more of these games a try, if you happen to be a fan of Infocom who hasn’t yet explored what came afterward. Nostalgia is all well and good, but sometimes it’s nice to make new memories.

---

Christminster

You haven't seen your brother Malcolm since he received his fellowship at Biblioll College - pressure of work was his excuse not to come down to London. So when you received that telegram from him you leapt at the excuse to come up to the university town of Christminster for the day and visit him.

It’s all too easy to dismiss Gareth Rees’s “interactive conspiracy” Christminster as a sort of Curses-lite. It shares with Graham Nelson’s epic a droll, very English prose style, an arch sense of humor, and a casual erudition manifested in a love of literary quotations and classical references. Indeed, the connections between the games go deeper still: Graham and Gareth were not only both Oxbridge academics but friends who helped one another out creatively and technically. If you spend enough time poking around in Christminster‘s library, you’ll discover that their games apparently belong to the same universe, when you uncover numerous references to the Meldrew family of Curses fame. But going too far with this line of description is doing Christminster a disservice. It may be smaller than Curses — to be fair, very few games aren’t — but it’s plenty rich in its own right, whilst being vastly more soluble by a reasonably motivated person in a reasonable amount of time.

Christminster takes place in the fictional English university town of the same name, but is obviously drawn to a large extent from the author’s lived experience.^[1]For example, Graham Nelson informs us that “the appalling Professor Bungay,” the principal villain of the piece, “is a thinly disguised portrait of [name withheld], a Cambridge tutor, an awful man in a number of respects though not quite so bad as Gareth makes out. There is a wonderful bit where he can be heard gratuitously bullying a history undergraduate, winding up with a line like ‘Perhaps you had better change to Land Economy.’ This was an eccentric Cambridge degree which combined the second sons of the gentry, who would actually have to run large landed estates as their career, with a random selection of hapless students washed out of more high-brow subjects. Switching to Land Economy was Cambridge jargon for failing maths.” The time in which it occurs is kept deliberately vague; I vote for the 1950s, but one could almost equally opt for any point within a few decades to either side of that one. You play Christabel, a prim young lady who’s come up to Christminster to visit her brother Malcolm. But she soon discovers that he’s nowhere to be found, and that a shadowy occult enterprise seems to be afoot within his college’s ivy-covered walls. And so the hunt is on to find out what’s become of him and who is responsible.

None of this need be taken overly seriously. The game’s milieu of bumbling, slightly cracked old dons comes straight from the pages of Waugh, Amis, and Wodehouse, while its gloriously contrived central mystery would doubtless have pleased Agatha Christie. Thankfully, Christminster runs on plot time rather than clock time: the story evolves in response to your progress rather than placing you in thrall to some inexorable turn counter, in the way of the polarizing early Infocom mysteries. This leaves plenty of time to poke at every nook and cranny of the musty old campus and to enjoy some ingenious puzzles. In a few places, the design does show its age; the very first puzzle of the game is one of the very hardest, leaving you trapped outside of the college’s walls with nothing to do until you solve it — not exactly the most welcoming opening! But by all means do try to carry on, as the English like to say. If you do, you might just find Christminster to be one of the best cozy mysteries you’ll ever play.

---

John’s Fire Witch

It’s a cold weekend in December of 1990, and it’s been far too long since you have seen your friend John Baker! But you’ve finally managed to take some time out of your schedule to drive to Columbus and spend some “quality time” together. Quality time, of course, means that you and he are going to sample every bar that Ohio State University’s High Street has to offer.

John was to meet you at a favorite pizza and beer spot to start off the evening, but he hasn’t showed up. John’s always been rather spontaneous (read that as ‘erratic’), so you think he’ll show up eventually. But as the night wears on and you tire of downing beers by yourself, you decide to drive to his place and see if he’s left a note or something for you there.

You find his front door unlocked and John nowhere to be found. Pretty tired from your earlier drive, and also buzzing a bit from the beer you drank, you quickly doze off in the living room.

It is now morning. A terrible snow storm is raging outside, the worst you’ve ever seen. You can’t believe how much snow has piled up over the night. You still haven’t heard from John, and you seem to now be trapped in his apartment.

John’s Fire Witch by John Baker is an example of what we used to call “snack-sized interactive fiction” back in the day. Although the shortest game featured in this collection of reviews, it would be considered medium-sized today, with a typical play time in the range of two to five hours — i.e., not much if any shorter than, say, Infocom’s The Witness.

But no self-respecting member of the interactive-fiction literati would dare to release a game that opens like this one today. Waking up in your slovenly friend’s apartment is just one step removed from that ultimate in text-adventure clichés: the game that starts in your — or rather the author’s — bedroom. Make that half a step removed: note that the guy whose apartment you wake up in and the author of this game are the same person. “John, like many IF characters,” wrote David Welbourn in an online play-through of the game, “seems to live in a pigsty and eat nothing but snow.”

So, John’s Fire Witch is willfully unambitious; all it wants to do is entertain you for a few hours. Poking around your vanished friend’s apartment, you discover that he’s gotten himself caught up in a metaphysical struggle between an “ice wizard” and a “fire witch.” It’s up to you to rescue him by completing a number of unlikely tasks, such as collecting a handy grab bag of the seven deadly sins for a certain pitchfork-wielding character who dwells in the Down Below. (Luckily, good old John tends to partake in just about all of them on a regular basis, so his apartment makes a pretty good hunting ground.)

For two and a half decades now, critics like me have been intermittently trying to explain why John’s Fire Witch succeeds in being so appealing almost in spite of itself. Its prose treads that fine line between breezy and tossed-off, its thematic aspirations are non-existent, its puzzles are enjoyable but never breathtaking. In the end, maybe it just comes down to being good company. Its author’s personality comes through in droves, and you can’t help but like him. Beyond that… well, if it it never does anything all that amazingly great, it never does anything all that egregiously wrong either.

The real John Baker disappeared without a trace after making this modest little game — good luck Googling that name! — leaving it behind as his only interactive-fiction legacy. He tells us that he’d like his players to send him $6, for lunch: “My favorite lunch is a soup & sandwich combo at a restaurant on Sawmill Road.” I for one would be happy to pay. Just drop me a line, John.

---

Lethe Flow Phoenix

A cool wind whips across the peak you stand on, sending tiny dust-devils whirling about your feet. The stars above you seem especially bright tonight, their silver light reaching across generations to speak to you. It is midnight, the hour of magic. The moon is not in sight tonight. All is still. All is waiting.

Perhaps it was a mistake to come and camp out here on this night. Not something you could have predicted in advance, of course, but still ... perhaps it was a little foolish. All Hallows’ Eve is not the most auspicious of nights. Still, you packed your bags up, tossed them next to the one-man tent in your trunk, and drove out here to spend a few days and get your life sorted out.

You were awakened in the middle of the night by something. You weren’t quite sure what, but you could tell something was wrong when you woke up. The desert was too quiet, too dark ... too eager. Like a sleep walker, you stumbled to the cliff nearby. You stood for a minute, catching your breath, and looked around. Behind you, at the other end of the shaky dirt trail, your car and tent wait patiently for your return. In other directions, you have a wide-open view of the desert, and can see it stretches in all directions, until it touches the feet of the mountains. The missing moon, curiously, does not concern you, nor does the fact that you can see as well now as if it were there.

You absentmindedly take another step forwards. If possible, the night becomes even more quiet, and the stars even brighter. Another step, and then another. You stand silently at the very edge of the cliff, looking outwards.

Then the ground gives way. “I’ve gone too far,” you think, almost casually. Not even screaming, you fall from the edge of the cliff.

***

There is a sudden sense of a presence around you as you fall. When you are rescued in mid-air, the event seems almost natural – bluesilver wings surround you, feathers caress you, and merciful darkness embraces you.

***

You awaken, and find yourself in a grassy field. The sun is shining brightly overhead, and a brook babbles gently as it flows along. A small tree grows in the center of the field, its branches ripe with apples.

If John Fire’s Witch is the My Stupid Apartment sub-genre of interactive fiction elevated to a weirdly sublime pitch, then Dan Shiovitz’s Lethe Flow Phoenix does the same for another hackneyed perennial of the post-commercial era: the Deeply Meaningful Exploration of the Subconscious. One always seems to find one or two games of this stripe, generally the products of younger scribes whose earnestness is almost painfully palpable, sloshing about in the lower rungs of any given IF Comp. Alas, their attempts to reveal inner truths through surrealistic imagery tend to come off as more banal than profound — rather like reading the diary of that angst-ridden fifteen-year-old so many of us used to be.

Dan Shiovitz was himself a fairly young man when he wrote Lethe Flow Phoenix, a game whose labored Latinate title doesn’t appear to bode well. Yet it turns out to be far better than one would ever dare to hope. Shiovitz has a knack for devising and describing beautifully twisted landscapes, through which he then proceeds to thread a series of deviously satisfying puzzles. At times, this game almost plays like a textual version of Myst, with much the same atmosphere of stately desolation and the same style of otherworldly but oddly logical dilemmas to overcome.

And then, around the halfway point, Lethe Flow Phoenix turns into something else entirely. Shiovitz provides an explanation for his protagonist’s personal problems, and it’s not at all what you might expect. I hesitate to say too much more here, but will go so far as to reveal that aliens from outer space — as opposed to just alienated humans — suddenly come into the picture. Again, this development should be disastrous, but somehow it works. The game manages to maintain your interest right up to its happy ending.

Dan Shovitz went on to write several other text adventures after this one, perhaps most notably Bad Machine, an exploration of the frontiers of language sufficient to set any postmodern linguistic theorist’s heart aflutter. But even that experimental masterstroke shouldn’t be allowed to overshadow this early piece of work. Yes, the author of Lethe Flow Phoenix is clearly a young man, but this particular young man is also an observant, talented writer. His protagonist’s final redemption is genuinely moving, the journey to that point satisfying on several levels. Lethe Flow Phoenix pairs heart with craftsmanship, and the results are pretty great.

---

The Light: Shelby’s Addendum

A strangeness has fallen. You first became aware of it with the darkening of the skies: the majestic, threatening storm clouds that seemed on the verge of deluging the earth in a torrent, yet hung motionless, impatient, as though awaiting further instructions from some unseen and malignant higher power. Of course Holcroft had on many occasions disproved to you the existence of such higher beings with his charts and calculations, and you do not believe in such foolishness as ghosts, gods and goblins, but events such as those unfolding before you now are causing you to question all that you have learned.

First the clouds, then the sudden silence of the birdsong, and the people. Where were the people? The village was deserted as you passed through. Not a soul to be seen. You knew you had to alert Barclay and Holcroft that something was terribly wrong with the balance of things, but before you had reached even the main gate an impenetrable mist had rolled in from below the cliffs and obscured the path to the lighthouse.

You decided to wait in the drum shed until the mist had lifted, rather than risk life and limb on the cliff walk, but you were weary from your journey and fell into a deep sleep. When you awoke it was near nightfall. The mist had barely dissipated, but your task was too important, so you took your chances on the cliff walk regardless. It was so dark. Why hadn’t Barclay or Holcroft lit the beacon? In the two years since beginning your apprenticeship you had never known the Regulators to neglect their duties. On the contrary, you found them to be slavishly by the book. “Routine begets knowledge,” Barclay once told you. (He had obviously never cleaned the septic tank every month for two straight years).

When, at last, you reached the courtyard entrance, something even stranger happened. You began to feel suddenly and inexplicably weak, as though the very life were being drawn from your bones. You had eaten well on the train journey from the Commission’s headquarters in the capital city, and passed your last physical with glowing colors, yet you felt as though you were at death’s door.

You had to see Holcroft. He, perhaps, could explain....

Colm McCarthy’s The Light: Shelby’s Addendum is another game that’s better than its ambiguously pretentious name. You play the eponymous Shelby, a junior — very junior — apprentice in a lonely lighthouse that provides more than just illumination: its beam maintains a delicate balance between our reality and other, alternate planes of existence. The hows and wherefores of its functioning are never explained all that well; ditto just when and where this story is supposed to be taking place. (We’re definitely on the Earth, probably in the near future, but is this our Earth or an alternate Earth?) In the end, the vagueness matters not a whit. A more thorough explanation would only interfere with the game’s atmosphere of mysterious Lovecraftian dread. You can almost smell the fetid seaside air as you play.

As the game opens, you’re returning to your post from a much-deserved holiday, only to find the lighthouse and even the village near it devoid of their usual inhabitants. Worse, the beacon itself has gone haywire, and the multiverse is slipping out of harmony as a result, producing unsettling effects all around you. Exploring the environs, you turn up evidence of the all-too-human disputes that gave rise to this slow-moving cosmic disaster. It looks like you are the only one who can correct the fault in our stars.

A big, lavish game, carefully written and implemented in most ways, The Light does from time to time trade in its polished personality for a more ramshackle old-school feel. If you don’t solve a pivotal puzzle within the first 100 turns — and you almost certainly won’t the first time through — it’s game over, thanks for playing. And there’s a mid-game submarine ride where the atmosphere suddenly changes from Lovecraftian dread to a scene straight out of the Beatles’ Yellow Submarine. Like most reviewers, I can only shake my head at this bit’s existence and wonder what the heck McCarthy was thinking.

Still, such breakdowns are very much the exception to the rule here. I’m nonplussed by some reviewers’ struggles with the puzzles; I solved the entire game without a hint, a feat which I’m happy to consider a testament to good design rather than any genius on my part. I’m kind of bummed that the sequel Colm McCarthy promises us in his denouement has never materialized. I’d love to know whether poor Shelby finally got a promotion after saving the multiverse and all.

---

Theatre

Another day, another dollar! Life is good at the moment, the property market is booming. Still, it does have its down side; when showing those Mulluer Corporation executives around that old theatre dump, err, opportunity you must have left your pager down in the basement. Better hurry, you have to meet the others at the opera in an hour, and be careful. It wouldn’t do to show up with your clothes all dirty.

Brendon Wyber’s “interactive night of horror” Theatre does us the favor of including its inspiration right in the game itself. As Wyber writes in his introduction, he made Theatre after reading an allegedly true haunted-house story by Joel Furr, one of the early Internet’s more prominent online characters, whose claims to fame include popularizing the term “spam.” Furr’s story, which is readable in its entirety via an in-game menu, is riveting whether you choose to go on to play said game itself or not. It involves the Lyric Theatre of Blacksburg, Virginia, a rambling old place stemming from 1930 that has been restored and is enjoying a new lease on life today, but was at its lowest ebb when Furr made its acquaintance in the early 1990s. As a Kiwi, Wyber had never been to the Lyric, yet that didn’t stop him from using Furr’s description of it as the basis for the setting if not the plot of his game.

You play a yuppie real-estate agent who rushes back inside the old theater he’s trying to unload to retrieve his forgotten pager — this is the 1990s, after all! — only to emerge again to find his car stolen. Rather than venturing out into the seedy neighborhood around the theater on foot, you opt to spend the night inside. Let the haunting begin…

Our frustrations with the medium understandably cause us to spend a lot of time talking about the things that textual interactive fiction, and adventure games in general for that matter, struggle to do well. For better or for worse, we tend to spend less time on the medium’s natural strengths. I’ll just note here, then, that setting must top any list of same. All of the games I’ve featured in this piece make this point, but none do it better than this one. Its name is no misnomer: the theater truly is this game’s main attraction. Its geography expands slowly and organically as you solve puzzles to open up new areas; there’s always some new cranny or crawlspace to uncover in the building, always some new aspect of its sinister history to bring to light. And it’s a fresh spine-shivering delight every time you do.

Before you become a full-fledged participant in the proceedings, you learn about the horror story at the center of it all through the journal pages you discover as you worm your way deeper and deeper into the theater’s bowels, deeper and deeper into its past. I must say that I like the first two-thirds of the game best, when it has a Gothic flavor in complete harmony with Joel Furr’s story. In time, however, it goes full Lovecraft, and not even in the relatively understated way of The Light. Still, one can’t accuse Wyber of pulling any punches; the big climax is as exciting as you could ask for.

Through it all, the real star remains the theater itself, whose faded elegance and delicious decay will remain with you long after you’ve exorcised the malevolent spirits that roam its spaces. You might want to save this one for Halloween.

---

Jigsaw

New Year's Eve, 1999, a quarter to midnight and where else to be but Century Park! Fireworks cascade across the sky, your stomach rumbles uneasily, music and lasers howl across the parkland... Not exactly your ideal party (especially as that rather attractive stranger in black has slipped back into the crowds) - but cheer up, you won't live to see the next.

As the follow-up to his two-year-old Curses, Graham Nelson’s “interactive history” Jigsaw was the most hotly anticipated text adventure of 1995. This game is even bigger than Curses — so big that Nelson had to employ a new, post-Infocom incarnation of the Z-Machine, a version 8 standard with the ability to handle story files of up to 512 K in size, in order to run the full version.^[2]Nelson did also provide a version of Jigsaw that could run on older interpreters by moving his historical notes and some other bits to a separate story file. Although it will never be able to compete with its predecessor in terms of its importance to the history of its medium, in this critic’s opinion Jigsaw is the more accessible and enjoyable of the two games to play today.

It definitely doesn’t lack for ambition. Written just as millennial jitters were beginning to find a home in the minds of many of us, it’s a time-travel caper focusing on the horrible, magnificent century that was about to pass away, ranging in time and space from Kitty Hawk, North Carolina, on the day of the Wright brothers’ first flight to Berlin on the day the Wall came down. The principal antagonist and possible love interest — a timeline-wrecking “rather attractive stranger” of indeterminate gender, whom the game refers to only as “Black” after his or her choice of wardrobe — is misguided rather than evil, attempting to alleviate some of the century’s many injustices rather than bring on any apocalypse. But such retroactive changes are out of our mortal purview, of course, and can only lead to worse tragedies. “The time is out of joint,” as Hamlet said. Now, it’s up to you to set it right.

The amount of research required for the game’s fourteen historical vignettes was considerable to say the least — and that before a universe of information was only a visit to Wikipedia away, when one still had to go to brick-and-mortar libraries with printed encyclopedias on their shelves. Nelson doesn’t always get every detail correct: I could nitpick that the Titanic was actually not the first ship in history to send an SOS distress signal, for example, or note that his depiction of the Beatles of 1967 (“lurching wildly from one project to the next, hardly collaborating, always arguing”) seems displaced in time by at least a year.^[3]Still less can I agree with his opinion that “a good deal of their music was dross by this stage.” I’ll be the first to argue that the Beatles never made a better album than A Hard Day’s Night, only different ones, but come on… Likewise, he’s sometimes a bit too eager to place ironic twists on the things we learned in our grade-school history classes. In light of what Nelson took on here, though, we can forgive him for all of this. He does a wonderful job of capturing the feel of each historical event. I also appreciate that his choices of historical linchpins aren’t always the obvious ones. For every voyage aboard a Titanic, there’s a visit to the cork-lined Parisian flat of Marcel Proust; for every trip to the Moon, there’s a sojourn in the filthy and disorganized laboratory of Alexander Fleming, the luckiest microbiologist who ever lived.

The episodic structure keeps Jigsaw manageable despite its overall sprawl, in marked contrast to Curses. Nelson, who had been thinking and writing seriously about design since his first game, went so far as to include a helpful little gadget which can alert you as to whether you’re leaving behind anything vital in each time period. Meanwhile the puzzles themselves are never less than solid, and are often inspired. One of them, in which you must decode a secret message using an only slightly simplified example of the German Enigma machines from the Second World War, has justly gone down in interactive-fiction lore as one of the best ever. Like so much of Jigsaw, it teaches even as it intrigues and entertains. I missed an important clue when I played through the game recently, which made this particular puzzle much harder than it was supposed to be. No worries — I enjoyed my two or three hours as a member of Alan Turing’s legendary team immensely, and positively jumped for joy when I finally produced a clear, cogent message from a meaningless scramble of letters.

My one real design complaint is the endgame, which takes place in a surreal fantasy landscape of the sort we’ve seen in too many other adventure games already. It feels both extraneous and thoroughly out of keeping with what has come before — and too darn hard to boot. I’ve said it before and I’ll say it again: by the time an adventurer reaches the endgame, especially of a work of this size, she just wants to be made to feel smart once or twice more and then to win. The designer’s job is to oblige her rather than to try to make himself feel smart. I must confess that I broke down and used hints for the endgame of Jigsaw, after solving the entirety of the rest of the game all by myself.

But the frustration of the endgame pales before the other delights on offer here. Nelson would never attempt a game of this size and scope again, making Jigsaw only that much more worth cherishing. Curses may be his most important game, but by my lights Jigsaw is his masterpiece.

Bonus:

Graham Nelson on Jigsaw

---

Curses had been written under the spell of the great cave games – Colossal Cave, Zork, Acheton. Games delving into a miscellany of doors, light puzzles, collection puzzles, and the like. Games written incrementally which ended up with epic, sprawling maps, but which started out only as entertainments written for friends. Each of those things is true about Curses as well.

But not Jigsaw. Once again Gareth Rees and Richard Tucker were the playtesters and de-facto editors, and the two games were recognisably from the same stable. There are many similarities, even down to having a one-word title, which I liked because it meant that the filename on an FTP server would likely be the whole title. It was always going to be a Z-machine story file once again, written with Inform. And it was playable under the same .z5 format as Curses, though I also offered a sort of director’s cut version with some extra annotation using the new .z8 format. (This was a sneaky way to try to persuade interpreter-writers to adopt .z8, which I worried people might think bogus and non-canonical, and so would not implement.)

Unlike Curses, though, Jigsaw was conceived holistically, had a rigorous plan, and was meant for the public rather than for friends. I set out to make the sort of rounded cultural artefact which middle-period Infocom might have offered — Dave Lebling’s Spellbreaker and Brian Moriarty’s Trinity are the obvious antecedents, but not the only ones. (Let me also praise Mike Dornbrook here, who was instrumental in making those games into clearly delineated works.) Those mature works of Infocom were satisfying to start, and satisfying to finish, and distinctive from each other. Infocom wasn’t big on historical settings (a shame that Stu Galley never completed his draft about the Boston of 1776), but in presentation, Jigsaw wouldn’t look out of place in their catalogue. In that sense, it’s rather derivative, even imitative, but this wasn’t seen as an eccentric or retro choice at the time; more of a mark of quality. But in any case, Jigsaw had other ambitions as well, and it’s on those other ambitions that it stands or falls.

Jigsaw strains to be a work of art, and though the strain shows from time to time, I think it mostly gets there. There are little embedded prose poems, generally at hinges in the story. Certain images – the nightjar, for example – are suggestive rather than explicated. There is also something a little poetic — and here I’m perhaps thinking more of the modernism of Ezra Pound’s cantos than of his more famous friend Eliot — about the interleaving of old formulations, old turns of speech. Jigsaw plays on the tantalising way that past times were so confident at being themselves. Nobody using an Apollo Guidance Computer thought of it as twee or retro. And you could say the same about a tram-ticket or a gas lamp, things that people used without a second thought. We have absolute confidence only about our own present moment, while the past seems hazy and uncertain. But the people who lived in that past felt exactly the same about their own present moments. For historical fiction to work, it has to side with them, not with us.

And on the other hand, while it is a modernist impulse to clash the old and the new, it’s a Romantic one to re-enact the old, to imaginatively take part in it. I’ve always liked the biographer Richard Holmes’s observation that to write a biography is an inherently Romantic act.

As I wrote Jigsaw in 1995, the twentieth century was coming to a relatively placid end — I hope anyone caught up in the Yugoslav civil wars will forgive me writing that. It was zeitgeisty to see the story of the age as being mostly done, even with a few years still to go. Francis Fukuyama’s The End of History (1992) was less sceptically received at the time than its later reputation might suggest. People were already gathering and tidying up the twentieth century. So I wasn’t the only one to jump the gun in writing about it.

Jigsaw has a classical IF structure, with a prologue, a middle game, and an end game. Less conventionally, a form of the end game – an area called “The Land” – is seen in a ghostly way throughout, while the middle game is divided into a grid of what amount to mini-games. Notably, these have named chapter headings.

The prologue takes place on the final night of 1999, on the margins of a public festival. I anticipated an event at a London park, and that was indeed the English response, though it turned out to be the ultra-modern Millennium Dome at Greenwich (begun in 1997) and not my more Victorian-sounding “Century Park”. The setting has something of the flavour of H. G. Wells’s The Time Machine, but in fact I semi-lifted it from an episode of Charles Chilton’s iconic BBC radio serial Journey into Space. That involved an enigmatic character named Whittaker who had been taken out of normally-running time in 1924 from a London park celebration (“There are special trains from Baker Street”). Other than scene-setting, the prologue’s goal is to make the complex jigsaw mechanism comprehensible. It’s a familiar IF travel-around-the-map mechanism, with the puzzle pieces serving as objects of desire which unlock further play. But at the same time, it is also the game’s organising metaphor. So these mechanics have to seem natural and fun to players. Getting the textual display and command verbs right was a major concern in early play-testing.

With prologue out of the way, we enter the past. Jigsaw claims in its banner to be “an interactive history”, which is awfully bold of it. As we’ve already established, it’s a work of fantasy. But perhaps the claim to be “a history” can just about be made. Attempts to define what that even means — cf. E. H. Carr, “What Is History?”; Richard Evans, “In Defence of History” — end up devoting much of their space just to enumerating lines of approach, after all. Mine is odder than most, but less odd than some. At its crudest, the historian’s choice is between asking “who took what decisions?” and asking “what was life like?”. Is 19th-century Europe the story of Napoleon and Bismarck and Garibaldi, who started wars and redrew maps, or is all of that froth compared to railways, manufacturing, anesthetics, and newspapers? Jigsaw goes the second way, with Lenin being I think the only world leader seen close up.

The Titanic sequence, the first one I wrote, is the one I would now leave out. Rich people drowned, but other rich people took their places, and history wasn’t much dented. Perhaps it left a greater sense of possible catastrophe in the popular imagination, but the Sarajevo 1914 sequence makes that point better anyway. Besides, having an accidental time traveller arrive on the Titanic is a very hackneyed plot device. (I’ve just been dismayed to find from Wikipedia that it’s even the pilot episode plot of Irwin Allen’s spangly TV show The Time Tunnel.) Still, the ocean liner was fun to recreate as a period piece. The bit where a passenger says, “Never mind, worse things happen at sea,” is my favourite joke in the whole game. And researching this did lead to one happy accident. Going through a heap of books and pamphlets in the Bodleian Library, I chanced on something I remembered from somewhere else, and this led to a short paper in the literary-discoveries journal Notes & Queries. That squib of a paper is still occasionally cited, and I was amused to see “Nelson, Graham” back to back with “Nietzsche, Friedrich” in the bibliography of a monograph as a result.

A better choice was the Apollo programme. The lunar module was controlled using VERB and NOUN commands, which made it pleasingly IF-sounding: why not send the player to the moon? I also wanted to have something about the mid-century zenith of big-state action — a world in which Kennedy could just decide that the United States would do something immense, and it would happen. (The Manhattan Project is another example, but Trinity had already done that.) Another take on Apollo would be that it changed our sensibility, forcing us to see ourselves from the outside. The cover art for Jigsaw is the Apollo 8 shot of the earth rising from lunar orbit, maybe the most reproduced photo of the century. But I also tried to evoke Apollo’s troubling sense of abandonment. First steps were last steps. The century’s most powerful civilisation did something astonishing and then just lost interest. To me, the question about the Pyramids is not why the pharaohs built them, but why they stopped.

In fact, even as I wrote, Apollo’s posthumous reputation was beginning a slow comeback. A new generation of geeks devoured Andrew Chaikin’s landmark book A Man on the Moon (1994). Also, the Internet had arrived. In 1995, Eric Jones’s Apollo Lunar Surface Journal became an extremely useful website. I corresponded a little with Eric at the time; he was, tellingly, having trouble finding a publisher. But thanks to his work, the Apollo sequence of Jigsaw — whatever its fantastical additions — is quite true to the actual Taurus-Littrow valley of the moon, and not a grey abstraction.

Fourteen historical vignettes is too many. It was hard to do much in so few rooms and items each, especially as they had to be playable in multiple orders. A fundamentally un-cave-like quality of Jigsaw is that you can’t wander about from era to era, and it is only rarely that something in one era is helpful in another. (Even then, alternative solutions are sometimes provided.) But I worried that the lack of space made these mini-games too easy, and over-compensated with highly convoluted device-based puzzles. Fly your very own B-52! I truly repent of how difficult that sequence is to play.

A happier example was the Enigma machine. I’ve used one in real life, encoding a very short message on a surviving Enigma which belongs to the science writer Simon Singh. Still, this section was really based on the oral histories of Bletchley Park edited by Hinsley and Stripp in 1993; accounts which, a bit madly, had only just been declassified. I imbibed some of the recherché jargon of the codebreakers, who lived in a strangely appealing world of their own. I was very taken with the vulnerability of Enigma, caused by the frequent presence of double letters in German words. One of the myths of Bletchley was that the invention of the computer flat-out defeated Enigma, as if you just had to press a button. It would be fairer to say that the computer made breaking the code just on the edge of what was possible. A certain cunning was still needed, and luck as well. They found ways to make their own luck, but there were also terrible periods when they failed, and when many sailors went to the bottom of the Atlantic as a result. My grandfather served on two Royal Navy convoys to Murmansk, and he was fortunate that those coincided with a good run at Bletchley, though he never knew it. That, and the thought that I might have been there myself if I had been an Oxford maths post-doc in 1942 rather than 1995, made this vignette more personal to me.

Fourteen vignettes is also too few. I chose Marcel Proust and the Beatles as my artists of the century, for example, and with them I had used up the entire space available for cultural history. My fourteen moments have to spread themselves very thinly over a lot of ground, and there is clearly no single or perfect solution to this. Still, Jigsaw has a clear Western bias. I probably should have chosen the release of Nelson Mandela in 1990 rather than the fall of the Berlin Wall in 1989. Africa appears only tangentially, in the Suez Crisis of 1956, which has to stand for the whole of postcolonialism. Even then, my main inspiration was Christopher Hampton’s autobiographical play White Chameleon, and Hampton is British. China does not appear at all, which from a 21st-century viewpoint seems very jarring. From the vantage point of 2021, civil rights also look pretty salient, but in 1995 it did not seem that way: the movement for women’s suffrage is all you get. Why no M.L.K.? That now seems very odd, except that I had plenty of the 1960s already. Some potential topics were also dropped just for lack of puzzles about them, or because they didn’t really fit anywhere. Though I don’t know to what extent players were ever aware of it, the connection points on the jigsaw pieces tried to suggest thematic links. The Wright brothers to Apollo, and so on.

Another consideration was, for want of a better word, taste. Fascism seemed mostly done in 1995, but it had clearly been a big part of the story. It isn’t a big part of Jigsaw because, in the end, is there any ethical way to recreate the experience of being massacred for no reason? The Holocaust does have a presence in Jigsaw, but very indirectly. Buried somewhere is a little anecdote about a young Jewish boy in Berlin in the 1930s, who had picked up a shiny badge in the street with no understanding that it was Nazi regalia which he could be killed just for touching – one of the few moments in Jigsaw told to me by an eye-witness, the boy himself, who survived to be a retired professor. What I really did not want to do was to recreate a version of Auschwitz which came with an escape hatch. And then of course Vietnam, Cambodia, the genocide of the Armenian Turks, Kosovo, Rwanda, you name it. Quite the charnal house we made for ourselves, you have to say. In a room of the end game which, if memory serves, was called the Toll Gate, there is a cumulative graph of humans deliberately killed, plotted against time. This graph surges at the World Wars but it certainly isn’t flat in between them.

There are a few other grim moments like that in the endgame, too. The endgame is the strangest part of Jigsaw and probably the least successful. But here’s what I think I was trying for. The Land does partly bring in concerns not tied to specific moments – pollution, for example, though not global warming, which we were all cheerfully ignoring in 1995. (But not now, right? Right?) At the same time, I didn’t want bleakness to dominate, and I wanted to end on brighter, more fantastical colours. There is supposed to be a sort of Eden-like rebirth as another century is coming, with this endgame area as the Garden of that Eden. Underlying all of history, but often invisible from it, there is always the goodness of the world, our one place of happiness. The chapter title for the endgame is “The Living Land”, and it’s about life in opposition to death.

But it is also too fiddly and is not the enjoyable romp I intended it to be. I don’t like the self-indulgent references to past IF games: what are they even for? The extent of the Land was a more understandable mistake — it’s because of the structural obsession of Jigsaw with its key mechanic. Rooms in The Land correspond to the original pieces, but that meant having quite a lot of them, which in turn meant padding out this space with puzzles. In fact, the endgame is so long that it has a little endgame of its own, taking us back to Century Park. But that was absolutely the right way to end. When you are composing a set of variations, finish on a da capo repetition of the original theme.

Finally, whereas Curses has no significant characters other than the protagonist, in Jigsaw the player has a significant other, called Black. In timecop sci-fi novels, the hero generally does battle with a rival time traveller. One tries to rewrite history, the other to keep it on track. Well, that is basically the situation here. Emphasising this, Black is a symbolic and non-human sort of name: White’s opponent in a game. (The Apollo lunar lander shared with Black has the call-sign “Othello”, and this is a reference to the strategy game, not the Shakespeare play.) The neutral name Black also worked better for blurring gender than having to use contrived unisex forenames like Hilary, Pat, or Stevie.

In retrospect, this genderless romance is the main thing people remember about Jigsaw. I wouldn’t make much claim for the depth or solidity of that romantic subplot: but at least it was there, and was something you wouldn’t find in the Nancy Drew/Hardy Boys sort of milieu of most earlier IF. There is even, however glancingly, a presence of sex. That much was deliberate. But when I was writing, the absence of genders seemed just another narrative choice. I wanted a certain universalism, a sort of every-person quality to the player. And I didn’t want some sort of performative nonsense like the barroom scene at the start of Leather Goddesses of Phobos, where you demonstrate your gender by picking a bathroom, but have no way to demonstrate your orientation.

Anyway, this seemed like a statement only after publication, when I began to get rather touching emails from players. I think Jigsaw may have been quite widely played, and this was easily the aspect most responded to. Happy emails were often from women. I did also get a smaller amount of homophobic mail, and that was invariably from men, who reacted as if they’d been catfished.

We easily forget now that in 1995 gay relationships were socially invisible. There were no openly gay characters in The West Wing, Gilmore Girls, or Star Trek: The Next Generation. A handful of New York sitcoms were just starting to go there, but for the most part, in popular culture, gay people existed as people with problems. Tom Hanks won an Oscar for Philadelphia in 1993, but it’s a movie about a closeted man with AIDS. Sleepless in Seattle, the same year, could easily have played some non-binary games with its two lovers, since they don’t meet until the very end. But it doesn’t. In the 1990s, romance in popular culture was almost exclusively straight. Nobody thought that odd at the time, and nor did I. I didn’t write a gay romance at all, I simply wrote a romance which was whatever you wanted to imagine it was. I would like to say that the gender games in Jigsaw were a nod to the gradual emancipation of love in the twentieth century. But that was the one thing about Jigsaw which was completely unplanned.

One of those emails I received was from the young Emily Short, though we did not meet for many years, and it was in another century that we married. History is full of surprises.

---

(All of the games reviewed in this article are freely available via the individual links provided above and are playable on Windows, Macintosh, and Linux using the Gargoyle interpreter among other options.)

Network Detection & Response (NDR) is an emerging technology developed to close the blind security spots left by conventional security solutions, which hackers exploited to gain a foothold in target networks. Nowadays, enterprises are using a plethora of security solutions to protect their network from cyber threats. The most prominent ones are Firewalls, IPS/IDS, SIEM, EDR, and XDR (which

A set of new security vulnerabilities has been disclosed in commercial Bluetooth stacks that could enable an adversary to execute arbitrary code and, worse, crash the devices via denial-of-service (DoS) attacks.  Collectively dubbed "BrakTooth" (referring to the Norwegian word "Brak" which translates to "crash"), the 16 security weaknesses span across 13 Bluetooth chipsets from 11 vendors such