Huh. The researchers seemed to gloss over the Cloudflare Pages URL, but it's actually pretty interesting. I haven't had a chance to look at it in depth yet, but it appears to use the search-ms: URL protocol to show an attacker controlled WebDAV server to serve the malware.
The server hosting the malicious files seems to be down now, but this post details a similar attack:
It also seems to be part of a phishing kit, or potentially generated with AI due to the presence of the following comment.
// Замени на свой URL
Which in English is:
// Replace with your URL
And various other descriptive comments like
// Полностью очищаем страницу (Completely clear the page)
// Создаём новый контейнер с индикатором загрузки (Creating a new container with a loading indicator)
// Через 3 секунды скрываем Cloudflare и запускаем загрузку (In 3 seconds, we hide Cloudflare and start the download.) [Though this was next to a 900ms timeout, so there's definitely been some tweaking]
They're the kind of comments that don't really make sense if the author is writing them themselves, but would if they're using something off the shelf, or asking some LLM to output code. The descriptive comments of what the code's doing definitely makes me lean towards the latter.
> The descriptive comments of what the code's doing definitely makes me lean towards the latter.
Sadly, it's that exact kind of descriptive comments that are the kinds of comments that I expect to see in well-documented code. The kind of comments that I would expect from a seasoned engineer.
Tangentially related, I just recently found out that Lumberyard actually was spun out[1] into the open source Open 3D Engine[2] under the stewardship of the Linux Foundation. It's a nice surprise to see that Lumberyard didn't just die out, and is joining the ranks of open-source engines.
I'd call D&D more of a framework for collaborative storytelling that can absolutely be played as a game. The DM leads the adventure, the players decide how to respond to things. Everyone plays D&D a bit differently.
The most straightforward adventures that typically have a "win condition" are one shots/self-contained adventures from either WoTC or 3rd Party Publishers, like Curse of Strahd, Waterdeep: Dragon Heist, etc.
However, a lot of D&D groups I've played with might have characters die, but will rarely have a group "lose". However, because every group runs things a bit differently, a different group can drastically change how the game feels.
During the initial kerfuffle, a Unity employee did quote one of their lawyers saying the following[1]:
> Our terms of service provide that Unity may add or change fees at any time. We are providing more than three months advance notice of the Unity Runtime Fee before it goes into effect. Consent is not required for additional fees to take effect, and the only version of our terms is the most current version; you simply cannot choose to comply with a prior version. Further, our terms are governed by California law, notwithstanding the country of the customer.
The communication around this rollout was absolute rubbish. Even employees were trying to get clarity, and they were forced to figure it out and real time.
> Further, our terms are governed by California law, notwithstanding the country of the customer.
So presumably if you’re a customer in the EU you’re still doing business directly with their CA HQ and not an office registered in Ireland/Luxemburg/etc. (pretty much how every other major company does it?)?
Then again why wouldn’t you say stuff like that as a lawyer? The fees from all the lawsuits would’ve been pretty immense (regardless of who wins..)
I know for me (as someone who would likely never have had to pay a dime under either pricing scheme) the crux of the issue was unilateral, retroactive changes to a license that was supposed to be tied to the software version, as well as the nebulous "we'll know what to charge you because of our proprietary data model, trust us" messaging that they first went with.
That, combined with the fact that there was no safeguard for the install fee to be capped at some percentage of gross revenue made it so clear that they were trying to get something out of their free to play market specifically, which seems to have been to force their F2P customers to use their Unity Ads service over Applovin or similar competitors since they gave credits towards the runtime fee if you vertically integrated with Unity.
Definitely use a battle-tested HTML sanitization library if possible. There's a million different pitfalls and footguns with XSS. See: Some of the insane XSS polyglots out there that can be used for testing.
