Among our coverage of Dragon Age: The Veilguard this week was our official preview of the game, a deep dive into how BioWare has avoided conforming to a single canon, a look at how factions affect relationships throughout your protagonist’s journey, and, of course, our reactions after having full freedom with the…
Hey,Connections fans—it’s that time again. The Sunday puzzle today is not quite as challenging as the notoriously difficult Sunday Times crossword, but it’s no walk in the park either. It’s a great way to close the weekend—that, and of course, fantasizing about what the Nintendo Switch 2 will be like. (OK, maybe…
One of the feature that separates the Arc browser from its competitors is the ability to customize websites. The feature called "Boosts" allows users to change a website's background color, switch to a font they like or one that makes it easier for them to read and even remove an unwanted elements from the page completely. Their alterations aren't supposed to be be visible to anyone else, but they can share them across devices. Now, Arc's creator, the Browser Company, has admitted that a security researcher found a serious flaw that would've allowed attackers to use Boosts to compromise their targets' systems.
The company used Firebase, which the security researcher known as "xyzeva" described as a "database-as-a-backend service" in their post about the vulnerability, to support several Arc features. For Boosts, in particular, it's used to share and sync customizations across devices. In xyzeva's post, they showed how the browser relies on a creator's identification (creatorID) to load Boosts on a device. They also shared how someone could change that element to their target's identification tag and assign that target Boosts that they had created.
If a bad actor makes a Boost with a malicious payload, for instance, they can just change their creatorID to the creatorID of their intended target. When the intended victim then visits the website on Arc, they could unknowingly download the hacker's malware. And as the researcher explained, it's pretty easy to get user IDs for the browser. A user who refer someone to Arc will share their ID to the recipient, and if they also created an account from a referral, the person who sent it will also get their ID. Users can also share their Boosts with others, and Arc has a page with public Boosts that contain the creatorIDs of the people who made them.
In its post, the Browser Company said xyzeva notified it about the security issue on August 25 and that it issued a fix a day later with the researcher's help. It also assured users that nobody got to exploit the vulnerability, no user was affected. The company has also implemented several security measures to prevent a similar situation, including moving off Firebase, disabling Javascript on synced Boosts by default, establishing a bug bounty program and hiring a new senior security engineer.
This article originally appeared on Engadget at https://ift.tt/1ur2M3z
Elden Ring: Shadow of the Erdtree added a splendid Incantation called Roar of Rugalea. If you enjoy roaring at your foes to deal the hurt and dish out heavy poise damage, whether in the streets or in the game, this powerful spell could be just what you’re looking for. And all you’ll need to do is take down the big bad…
To commemorate PlayStation’s 30 years in the game, Sony revealed some nostalgia-tinged redesigns of both the PS5 and the forthcoming PS5 Pro. With that classic gray colorway and the old-school logo, there’s a similarly styled DualSense controller and even a chunky retro-designed cable wrapped around the typical USB-C connector.
The PS5 Pro bundle even includes a standard controller, a DualSense Edge and a retro cover for the optional disc drive and the charging stand. Even the PlayStation Portal is getting a 1994 colorway.
Pre-orders start on September 26 through the company and at participating retailers, launching on November 21. Sony has me trapped: Design it in the colors of my childhood gaming memories, and I will probably buy it — especially when early impressions of the PS5 Pro show it could be capable of some leaps in game engine performance.
— Mat Smith
DJI launches the Action 5 Pro camera with subject tracking and improved video
The iOS 18.1 public beta is here, bringing Apple Intelligence (almost) to the masses
At its in-person fan event for Geeked Week this year, Netflix showed teasers and sneak peeks for the second season of Avatar: The Last Airbender as well as Squid Game season two, with last season’s protagonist, Lee Jung-jae, wearing his player 456 uniform again. There were also new clips for One Piece, Wednesday, Splinter Cell, Devil May Cry and more.
YouTube is turning paused videos into its newest ad space. The company first started looking at using ads on pause screens in 2023 with select advertisers. YouTube’s viewers are less enthusiastic. The new ads also pop up when you pause videos on the YouTube mobile app.
A YouTube rep told The Verge they’ve seen “strong advertiser and strong reviewer responses” since they “rolled out Pause ads to all advertisers.” Great.
A documentary on Oprah Winfrey is no longer coming to Apple TV+. Because, well, Winfrey, herself, bought back the rights to it, PageSix reports. Allegedly, Winfrey and filmmaker Kevin Macdonald clashed on the final product, with the latter not making the requested edits. Winfrey was initially very involved in Apple TV+, even speaking at its launch. She signed a multi-year deal with the platform, launching shows such as The Oprah Conversation, but the agreement ended in 2022.
This article originally appeared on Engadget at https://ift.tt/koQZfmU
The Spirit Glaive is a new Halberd added in Elden Ring:Shadow of the Erdtree. This unique weapon has a really cool Ash of War skill attached to it, and can be a fantastic choice for Intelligence builds looking to add some melee flair to their kit.
Firewalk Studios, the dev behind massive PS5 flop Concord, is facing an uncertain future. Kotaku has revealed that game director Ryan Ellis (formerly Destiny 2 creative director at Bungie) has stepped down, and employees are bracing themselves for mass layoffs and even full studio closure.
Kotaku‘s sources have said that Firealk employees are in limbo ever since Sony took the unprecedented step of shutting Concord down within two weeks of launch. Like analysts and many in the gaming community, some Firewalk devs are also skeptical about Concord’s return.
The report further claims that some employees have already jumped ship while others are preparing to exit Firewalk. The team is expecting mass layoffs, with some going as far as anticipating potential closure because Firewalk is one of the “more expensive” developers in the PlayStation Studios family on a “per-head” basis.
It looks like Sony has yet to make a decision about both Concord and Firewalk, but Kotaku’s report suggests that employees have positive things to say about Ellis, noting that he genuinely believed in Concord and “poured a great deal of himself into the game.” “Regardless of there being things that could have been done differently throughout development, he’s a good human and full of heart,” they added.
The post Devs Behind PS5 Flop Concord Fear Studio Closure – Report appeared first on PlayStation LifeStyle.
