Round and round the roulette spins. Here are five more random choices from Apple Arcade’s selection. Will we strike gold this time? Or just strike out? If you missed our first batch, as reminder: Apple Arcade is out, and with it over a 100 new games for you to try and explore at your leisure. There’s almost too many for us to consider individual reviews, although we know other outlets have gone down that route.

If you want to cut to the chase, read our list of our favourite Apple Arcade games so far.

So, we’re running a new feature where we take a randomly selected batch of five games across a spread of genres, and run through some quick reviews so that you can get an idea of what’s worth your time, and what isn’t.

Hot Lava (Platformer) (2-Stars)

Normally I love everything Klei comes up with but this was a disappointment. Hot Lava has a pretty obvious premise: remember playing that ‘the floor was lava’ game when you were a kid? And it has a great theme: you’re pretending to be a character from a sweet 90s Saturday morning cartoon, with all the kitsch and bombast that comes with that genre. But the gameplay itself is just preset obstacle races with instant death when you fall into the lava.

What’s more, this precision 3D platformer does not work with mobile controls. One control option has you using the gyro in the phone to control your view, which is precise, but awkward if you’re in a space where you can’t move around. The other option is touch only, but doesn’t give you easy access to all of your abilities. If you have a controller, give it a try, but it’s not worth the hard drive space otherwise.

Where Cards Fall (Puzzle) (2-Stars)

I guess ‘moody navigation puzzler’ is now a well-established thing, and Where Cards Fall is the latest entry in it. There have been some standouts in this genre, Monument Valley being the most obvious one, that built their deliberate pace around smart and mind-bending puzzle design. However, in this case, Where Cards Fall‘s slow pace, requisite for ‘atmospheric’ titles, meant that in my brief time with it I barely scratched the surface of the puzzles.

You walk a character through various isometric playing fields, dragging around packs of cards. The cards essentially are platforms that can be collapsed and moved to create paths that the hero can jump through. Lead him to the magic card portal exit and you get to watch an inscrutable vignette. In the time I spent with this game, the hardest part was the fiddly controls—it took a while to figure out that with some care I could control the size of the platforms created by pinching my fingers ever so slowly. The puzzles themselves weren’t challenging at all.

Mutazione (Adventure) (4-Stars)

This adventure game’s story is told with a light touch but it’s instantly compelling. Your character, Kai, has immediate motivation, as she attempts to fulfill her grandfather’s dying wish and understand what he had devoted his life to. The setting, too, is immediately intriguing: Mutazione is an island of mutated people and plants, whose characters are quickly and efficiently drawn.

The game starts feeling like a traditional adventure game, but its conversation trees are mostly for flavor (like obvious influence Kentucky Route Zero) and its puzzles all revolve around amateur botany. It’s occasionally awkward to control, especially the lengthy plant encyclopedia that is inexplicably indexless. But for players looking for a unique interactive story, Mutazione should be your first stop on Arcade.

King’s League 2 (Strategy/Management) (3-Stars)

A sport’s management game without sports, King’s League puts you in charge of a team of fantasy fighters as they battle their way up the titular league. The story mode is entertaining with well-written (albeit broad) characters and it does a good job introducing the concepts of the game. If you don’t want to bother clicking through dialogues, you can also just jump in to creating your own custom team.

You recruit team members from town, choose training styles to mould them, and buy new gear. When you get into a match, most of the battle is handled for you, as your units march forward and bounce off one another. All you do is occasionally activate a special ability, when you have the chance. Because the matches are so simple, the team management is necessarily also simple. King’s League definitely has more of a ‘mobile game’ feel with its simplified gameplay. If that’s what you’re looking for, though, it might be a good fit.

Shinsekai: Into the Depths (Platformer) (3-Stars)

Capcom takes a break from arcade ports to bring us this Metroidvania set at the bottom of the ocean. This is one of the best-looking games on Arcade and probably they best sounding. Headphones are a must if you want to get the full underwater experience. The game itself is a slow paced platformer with forgiving controls that work pretty well on a touch screen, with a swipe-anywhere stick and tap and drag controls for actions.

In the time I had with it, I saw a lot of potential, but not too much interesting or challenging happening in the first hour or so. The slow pace is also a blessing and a curse: easy to handle with touch controls, but often dragging out basic movement in ways that kill the pace of the game. Your goals are also not entirely clear, which can be a motivation-killer in a wide-open game like this.

Still nothing too amazing this time around. I’m standing by my assessment that Arcade will probably be packed with a lot of good-but-not-great titles that are polished but not innovative. Let’s try again next time–hopefully the wheel will land on one of the new games Apple just added!

© 2019 Valve Corporation. All rights reserved. All trademarks are property of their respective owners in the US and other countries.

Click Here!

The creator of MagicaVoxel just released a new free interactive path renderer for heightmaps called AerioLOD.  It is a very early version, labeled 0.0.0 and available for 32 and 64bit Windows machines.

The very brief description from the homepage:

An interactive path tracing renderer for height maps.

• support rendering height maps of size up to 16384^2.
• support importing and exporting 8-bit and 16-bit png images.

Current release notes:

0.0.0 – 10/19/2019

You can check out AerioLOD in action in the video below.

GameDev News Tools

By Josh Brown 17 Oct 2019

Barry

SameSite is a 2016 extension to HTTP cookies intended to mitigate cross site request forgery (CSRF). The original design was an opt-in feature which could be used by adding a new SameSite property to cookies. It had two values, Lax and Strict. Setting the value to Lax indicated the cookie should be sent on navigation within the same site, or through GET navigation to your site from other sites. A value of Strict limited the cookie to requests which only originated from the same site. Not setting the property at all placed no restrictions on how the cookie flowed in requests. OpenIdConnect authentication operations (e.g. login, logout), and other features that send POST requests from an external site to the site requesting the operation, can use cookies for correlation and/or CSRF protection. These operations would need to opt-out of SameSite, by not setting the property at all, to ensure these cookies will be sent during their specialized request flows.

Google is now updating the standard and implementing their proposed changes in an upcoming version of Chrome. The change adds a new SameSite value, “None”, and changes the default behavior to “Lax”. This breaks OpenIdConnect logins, and potentially other features your web site may rely on, these features will have to use cookies whose SameSite property is set to a value of “None”. However browsers which adhere to the original standard and are unaware of the new value have a different behavior to browsers which use the new standard as the SameSite standard states that if a browser sees a value for SameSite it does not understand it should treat that value as “Strict”. This means your .NET website will now have to add user agent sniffing to decide whether you send the new None value, or not send the attribute at all.

.NET will issue updates to change the behavior of its SameSite attribute behavior in .NET 4.7.2 and in .NET Core 2.1 and above to reflect Google’s introduction of a new value. The updates for the .NET Framework will be available on November 19th as an optional update via Microsoft Update and WSUS if you use the “Check for Update” functionality. On December 10th it will become widely available and appear in Microsoft Update without you having to specifically check for updates. .NET Core updates will be available with .NET Core 3.1 starting with preview 1, in November.

.NET Core 3.1 will contain an updated enum definition, SameSite.Unspecified which will not set the SameSite property.

The OpenIdConnect middleware for Microsoft.Owin v4.1 and .NET Core will be updated at the same time as their .NET Framework and .NET updates, however we cannot introduce the user agent sniffing code into the framework, this must be implemented in your site code. The implementation of agent sniffing will vary according to what version of ASP.NET or ASP.NET Core you are using and the browsers you wish to support.

For ASP.NET 4.7.2 with Microsoft.Owin 4.1.0 agent sniffing can be implemented using ICookieManager;

public class SameSiteCookieManager : ICookieManager
{ private readonly ICookieManager _innerManager; public SameSiteCookieManager() : this(new CookieManager()) { } public SameSiteCookieManager(ICookieManager innerManager) { _innerManager = innerManager; } public void AppendResponseCookie(IOwinContext context, string key, string value, CookieOptions options) { CheckSameSite(context, options); _innerManager.AppendResponseCookie(context, key, value, options); } public void DeleteCookie(IOwinContext context, string key, CookieOptions options) { CheckSameSite(context, options); _innerManager.DeleteCookie(context, key, options); } public string GetRequestCookie(IOwinContext context, string key) { return _innerManager.GetRequestCookie(context, key); } private void CheckSameSite(IOwinContext context, CookieOptions options) { if (DisallowsSameSiteNone(context) && options.SameSite == SameSiteMode.None) { options.SameSite = null; } } public static bool DisallowsSameSiteNone(IOwinContext context) { // TODO: Use your User Agent library of choice here. var userAgent = context.Request.Headers["User-Agent"]; return userAgent.Contains("BrokenUserAgent") || userAgent.Contains("BrokenUserAgent2") }
}

And then configure OpenIdConnect settings to use the new CookieManager;

app.UseOpenIdConnectAuthentication( new OpenIdConnectAuthenticationOptions { // … Your preexisting options … CookieManager = new SameSiteCookieManager(new SystemWebCookieManager())
});

SystemWebCookieManager will need the .NET 4.7.2 or later SameSite patch installed to work correctly.

For ASP.NET Core you should install the patches and then implement the agent sniffing code within a cookie policy. For versions prior to 3.1 replace SameSiteMode.Unspecified with (SameSiteMode)(-1).

private void CheckSameSite(HttpContext httpContext, CookieOptions options)
{ if (options.SameSite > SameSiteMode.Unspecified) { var userAgent = httpContext.Request.Headers["User-Agent"].ToString(); // TODO: Use your User Agent library of choice here. if (/* UserAgent doesn’t support new behavior */) { // For .NET Core < 3.1 set SameSite = -1 options.SameSite = SameSiteMode.Unspecified; } }
} public void ConfigureServices(IServiceCollection services)
{ services.Configure<CookiePolicyOptions>(options => { options.MinimumSameSitePolicy = SameSiteMode.Unspecified; options.OnAppendCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); options.OnDeleteCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); });
} public void Configure(IApplicationBuilder app)
{ app.UseCookiePolicy(); // Before UseAuthentication or anything else that writes cookies. app.UseAuthentication(); // …
}

Under testing with the Azure Active Directory team we have found the following checks work for all the common user agents that Azure Active Directory sees that don’t understand the new value.

public static bool DisallowsSameSiteNone(string userAgent)
{
    // Cover all iOS based browsers here. This includes:
    // - Safari on iOS 12 for iPhone, iPod Touch, iPad
    // - WkWebview on iOS 12 for iPhone, iPod Touch, iPad
    // - Chrome on iOS 12 for iPhone, iPod Touch, iPad
    // All of which are broken by SameSite=None, because they use the iOS networking stack
    if (userAgent.Contains("CPU iPhone OS 12") || userAgent.Contains("iPad; CPU OS 12"))
    {
        return true;
    }     // Cover Mac OS X based browsers that use the Mac OS networking stack. This includes:
    // - Safari on Mac OS X.
    // This does not include:
    // - Chrome on Mac OS X
    // Because they do not use the Mac OS networking stack.
    if (userAgent.Contains("Macintosh; Intel Mac OS X 10_14") &&  userAgent.Contains("Version/") && userAgent.Contains("Safari"))
    {
        return true;
    }     // Cover Chrome 50-69, because some versions are broken by SameSite=None,  // and none in this range require it.
    // Note: this covers some pre-Chromium Edge versions,  // but pre-Chromium Edge does not require SameSite=None.
    if (userAgent.Contains("Chrome/5") || userAgent.Contains("Chrome/6"))
    {
        return true;
    }     return false;
}

This browser list is by no means canonical and you should validate that the common browsers and other user agents your system supports behave as expected once the update is in place.

Chrome 80 is scheduled to turn on the new behavior in February or March 2020, including a temporary mitigation added in Chrome 79 Beta. If you want to test the new behavior without the mitigation use Chromium 76. Older versions of Chromium are available for download.

If you cannot update your framework versions by the time Chrome turns the new behavior in early 2020 you may be able to change your OpenIdConnect flow to a Code flow, rather than the default implicit flow that ASP.NET and ASP.NET Core uses, but this should be viewed as a temporary measure.

We strongly encourage you to download the updated .NET Framework and .NET Core versions when they become available in November and start planning your update before Chrome’s changes are rolled out.

By Christine McKee
Sunday, October 20, 2019, 10:41 am PT (01:41 pm ET)

Apple latest iPad Pro with 1TB of space has just received a $250 markdown on Amazon, bringing the price down to $1,099, a record low. Supplies may be limited, so act fast to snap up the deal.

1TB iPad Pro hits new low price

Amazon’s $250 price drop applies to Apple’s current 11-inch iPad Pro with 1TB storage capacity and Wi-Fi functionality in your choice of Space Gray or Silver. With an MSRP of $1,349, this $1,099.97 price is the lowest ever offered on Amazon, and is at least $50 cheaper than other Apple Authorized Resellers, according to our 11-inch iPad Pro Price Guide.

Other 11-inch iPad Pro storage capacities are also on sale, with prices as low as $674 (a sampling can be found below). And if you plan on taking notes or creating artwork using the 11-inch iPad Pro, the second-generation Apple Pencil 2 is currently $10 off as well.

Best iPad Pro deals

Save on the Apple Pencil 2

2019 AirPods are also on sale

Additional Apple Deals

AppleInsider and Apple authorized resellers are also running a handful of additional exclusive savings this month on Apple hardware that will not only deliver the lowest prices on many of the items, but also throw in discounts on AppleCare and accessories. These deals are as follows:

Interested in additional Apple hardware? See if there is a Mac, iPad or Apple Watch deal that will save you $100s by checking out prices.appleinsider.com.

This is the latest in a series of articles on Cockpit, the easy-to-use, integrated, glanceable, and open web-based interface for your servers. In the first article, we introduced the web user interface. The second and third articles focused on how to perform storage and network tasks respectively.

This article demonstrates how to create and modify local accounts. It also shows you how to install the 389 Directory Server add-on (or plugin). Finally, you’ll see how 389 DS integrates into the Cockpit web service.

Managing local accounts

To start, click the Accounts option in the left column. The main screen provides an overview of local accounts. From here, you can create a new user account, or modify an existing account.

Creating a new account in Cockpit

Cockpit gives sysadmins the ability to easily create a basic user account. To begin, click the Create New Account button. A box appears, requesting basic information such as the full name, username, and password. It also provides the option to lock the account. Click Create to complete the process. The example below creates a new user named Demo User.

Managing accounts in Cockpit

Cockpit also provides basic management of local accounts. Some of the features include elevating the user’s permissions, password expiration, and resetting or changing the password.

Modifying an account

To modify an account, go back to the accounts page and select the user you wish to modify. Here, we can change the full name and elevate the user’s role to Server Administrator — this adds user to the wheel group. It also includes options for access and passwords.

The Access options allow admins to lock the account. Clicking Never lock account will open the “Account Expiration” box. From here we can choose to Never lock the account, or to lock it on a scheduled date.

Password management

Admins can choose to Set password and Force Change. The first option prompts you to enter a new password. The second option forces users to create a new password the next time they login.

Selecting the Never change password option opens a box with two options. The first is Never expire the password. This allows the user to keep their password without the need to change it. The second option is Require Password change every … days. This determines the amount of days a password can be used before it must be changed.

Adding public keys

We can also add public SSH keys from remote computers for password-less authentication. This is equivalent to the ssh-copy-id command. To start, click the Add Public Key (+) button. Finally, copy the public key from a remote machine and paste it into the box.

To remove the key, click the remove (-) button to the right of the key.

Terminating the session and deleting an account

Near the top right-corner are two buttons: Terminate Session, and Delete. Clicking the Terminate Session button immediately disconnects the user. Clicking the Delete button removes the user and offers to delete the user’s files with the account.

Managing 389 Directory Server

Cockpit has a plugin for managing the 389 Directory Service. To add the 389 Directory Server UI, run the following command using sudo:

$ sudo dnf install cockpit-389-ds

Because of the enormous number of settings, Cockpit provides detailed optimization of the 389 Directory Server. Some of these settings include:

• Server Settings: Options for server configuration, tuning & limits, SASL, password policy, LDAPI & autobind, and logging.
• Security: Enable/disable security, certificate management, and cipher preferences.
• Database: Configure the global database, chaining, backups, and suffixes.
• Replication: Pertains to agreements, Winsync agreements, and replication tasks.
• Schema: Object classes, attributes, and matching rules.
• Plugins: Provides a list of plugins associated with 389 Directory Server. Also gives admins the opportunity to enable/disable, and edit the plugin.
• Monitoring: Shows database performance stats. View DB cache hit ratio and normalized DN cache. Admins can also configure the amount of tries, and hits. Furthermore, it provides server stats and SNMP counters.

Due to the abundance of options, going through the details for 389 Directory Server is beyond the scope of this article. For more information regarding 389 Directory Server, visit their documentation site.

As you can see, admins can perform quick and basic user management tasks. However, the most noteworthy is the in-depth functionality of the 389 Directory Server add-on.

The next article will explore how Cockpit handles software and services.

Photo by Daniil Vnoutchkov on Unsplash.