In this 2017 GDC session, Lunarch Studios’ David Churchill describes the Hierarchical Portfolio Search AI system created for Prismata, and how it can be adapted to fit almost any genre of game, including search-heavy ones like strategy games.

It was a detailed dive into a fascinating technical challenge rich in takeaways for game devs, so if you missed seeing it live, take advantage of the fact that you can now https://www.youtube.com/watch?v=sQSL9j7W7uA“>watch it for free on the official GDC YouTube channel!

In addition to this presentation, the GDC Vault and its accompanying YouTube channel offers numerous other free videos, audio recordings, and slides from many of the recent Game Developers Conference events, and the service offers even more members-only content for GDC Vault subscribers.

Those who purchased All Access passes to recent events like GDC or VRDC already have full access to GDC Vault, and interested parties can apply for the individual subscription via a GDC Vault subscription page. Group subscriptions are also available: game-related schools and development studios who sign up for GDC Vault Studio Subscriptions can receive access for their entire office or company by contacting staff via the GDC Vault group subscription page. Finally, current subscribers with access issues can contact GDC Vault technical support

Starting at 2:00 p.m. PST today, members of the Xbox One Preview Beta Ring will begin receiving the latest 1905 Xbox One system update (19H1_RELEASE_XBOX_DEV_1905\18362.3038.190424-1940) Read on for more about the new features, fixes and known issues in the latest 1905 system update.

DETAILS:

• OS version released: 19H1_RELEASE_XBOX_DEV_1905\18362.3038.190424-1940
• Available: 2:00PM PDT 4/27/19
• Mandatory Date/Time: 3:00 AM PDT 4/28/19

New Features:

The 1905 features are highlighted here in a new blog post  https://news.xbox.com/en-us/2019/04/25/improvements-to-xbox-game-pass-friends-list-and-messaging-coming-to-xbox-insiders/

My Games and Apps – Better Sorting

• Based on user feedback, we’re broadening your ability to sort games and apps by date, including updated options to “last updated” or “last used” title selection. Please check out this change in “My Games & apps” and let us know what you think!

Friends list shows where your friends are playing

• You can now see where your friends are playing their games. Keep an eye out for the console, mobile and PC icons next to your friends’ names in your friends list in the Guide!

Voice channels in messaging

• Voice channels have been added to Xbox Live messaging on console. This feature is only available in Alpha and can only be used between Alpha users. If you and a friend are both in Preview Alpha, we’d highly encourage you try adding a voice channel and let us know what you think!

Fixes:

My Games and Apps

• Additional fixes for an issue in which switching from media apps such as Youtube/Hulu to a game or from a game to a media app would crash the console.

Known Issues:

Audio

• Headsets are not being assigned to the users profiles.
• Some users are experiencing no audio with headsets and we are investigating
• Some users are encountering no audio on their Xbox console after boot (no shell audio, no game audio, no app audio), then have CSS ask them to perform the following steps:

1. Cold reboot the console

OR

2. Go to Audio settings on console
3. Change their HDMI audio settings to the highest supported uncompressed channel count for their equipment
4. Switch back to the desired format
5. Audio should be restored

My Games and Apps

• We are tracking the video corruption issue with Youtube and Netflix 4k playback.

Profile Color

• Sometimes users may encounter the incorrect Profile color when powering on the console.

Today’s Deal: Save 67% on Sid Meier’s Civilization® VI and the Digital Deluxe Edition!*

Look for the deals each day on the front page of Steam. Or follow us on twitter or Facebook for instant notifications wherever you are!

*Offer ends May 20 at 10AM Pacific Time

While modern IT environments move towards Linux containers, the need to secure these environments is as relevant as ever. Containers are a process isolation technology. While containers can be a defense mechanism, they only excel when combined with SELinux.

Fedora SELinux engineering built a new standalone tool, udica, to generate SELinux policy profiles for containers by automatically inspecting them. This article focuses on why udica is needed in the container world, and how it makes SELinux and containers work better together. You’ll find examples of SELinux separation for containers that let you avoid turning protection off because the generic SELinux type container_t is too tight. With udica you can easily customize the policy with limited SELinux policy writing skills.

SELinux technology

SELinux is a security technology that brings proactive security to Linux systems. It’s a labeling system that assigns a label to all subjects (processes and users) and objects (files, directories, sockets, etc.). These labels are then used in a security policy that controls access throughout the system. It’s important to mention that what’s not allowed in an SELinux security policy is denied by default. The policy rules are enforced by the kernel. This security technology has been in use on Fedora for several years. A real example of such a rule is:

allow httpd_t httpd_log_t: file { append create getattr ioctl lock open read setattr };

The rule allows any process labeled as httpd_t to create, append, read and lock files labeled as httpd_log_t. Using the ps command, you can list all processes with their labels:

$ ps -efZ | grep httpd
system_u:system_r:httpd_t:s0 root 13911 1 0 Apr14 ? 00:05:14 /usr/sbin/httpd -DFOREGROUND
...

To see which objects are labeled as httpd_log_t, use semanage:

# semanage fcontext -l | grep httpd_log_t
/var/log/httpd(/.)? all files system_u:object_r:httpd_log_t:s0 
/var/log/nginx(/.)? all files system_u:object_r:httpd_log_t:s0 
...

The SELinux security policy for Fedora is shipped in the selinux-policyRPM package.

SELinux vs. containers

In Fedora, the container-selinux RPM package provides a generic SELinux policy for all containers started by engines like podman or docker. Its main purposes are to protect the host system against a container process, and to separate containers from each other. For instance, containers confined by SELinux with the process type container_t can only read/execute files in /usr and write to container_file_t files type on host file system. To prevent attacks by containers on each other, Multi-Category Security (MCS) is used.

Using only one generic policy for containers is problematic, because of the huge variety of container usage. On one hand, the default container type (container_t) is often too strict. For example:

• Fedora SilverBlue needs containers to read/write a user’s home directory
• Fluentd project needs containers to be able to read logs in the /var/log directory

On the other hand, the default container type could be too loose for certain use cases:

• It has no SELinux network controls — all container processes can bind to any network port
• It has no SELinux control on Linux capabilities — all container processes can use all capabilities

There is one solution to handle both use cases: write a custom SELinux security policy for the container. This can be tricky, because SELinux expertise is required. For this purpose, the udica tool was created.

Introducing udica

Udica generates SELinux security profiles for containers. Its concept is based on the “block inheritance” feature inside the common intermediate language (CIL) supported by SELinux userspace. The tool creates a policy that combines:

• Rules inherited from specified CIL blocks (templates), and
• Rules discovered by inspection of container JSON file, which contains mountpoints and ports definitions

You can load the final policy immediately, or move it to another system to load into the kernel. Here’s an example, using a container that:

• Mounts /home as read only
• Mounts /var/spool as read/write
• Exposes port tcp/21

The container starts with this command:

# podman run -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

The default container type (container_t) doesn’t allow any of these three actions. To prove it, you could use the sesearch tool to query that the allow rules are present on system:

# sesearch -A -s container_t -t home_root_t -c dir -p read 

There’s no allow rule present that lets a process labeled as container_t access a directory labeled home_root_t (like the /home directory). The same situation occurs with /var/spool, which is labeled var_spool_t:

# sesearch -A -s container_t -t var_spool_t -c dir -p read

On the other hand, the default policy completely allows network access.

# sesearch -A -s container_t -t port_type -c tcp_socket
allow container_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };
allow sandbox_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };

Securing the container

It would be great to restrict this access and allow the container to bind just on TCP port 21 or with the same label. Imagine you find an example container using podman ps whose ID is 37a3635afb8f:

# podman ps -q
37a3635afb8f

You can now inspect the container and pass the inspection file to the udica tool. The name for the new policy is my_container.

# podman inspect 37a3635afb8f > container.json
# udica -j container.json my_container
Policy my_container with container id 37a3635afb8f created!

Please load these modules using:
 # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}

Restart the container with: "--security-opt label=type:my_container.process" parameter

That’s it! You just created a custom SELinux security policy for the example container. Now you can load this policy into the kernel and make it active. The udica output above even tells you the command to use:

# semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}

Now you must restart the container to allow the container engine to use the new custom policy:

# podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

The example container is now running in the newly created my_container.process SELinux process type:

# ps -efZ | grep my_container.process
unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434 1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash
system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305 0 13:49 pts/0 00:00:00 bash

Seeing the results

The command sesearch now shows allow rules for accessing /home and /var/spool:

# sesearch -A -s my_container.process -t home_root_t -c dir -p read
allow my_container.process home_root_t:dir { getattr ioctl lock open read search };
# sesearch -A -s my_container.process -t var_spool_t -c dir -p read
allow my_container.process var_spool_t:dir { add_name getattr ioctl lock open read remove_name search write }

The new custom SELinux policy also allows my_container.process to bind only to TCP/UDP ports labeled the same as TCP port 21:

# semanage port -l | grep 21 | grep ftp
 ftp_port_t tcp 21, 989, 990
# sesearch -A -s my_container.process -c tcp_socket -p name_bind
 allow my_container.process ftp_port_t:tcp_socket name_bind;

Conclusion

The udica tool helps you create SELinux policies for containers based on an inspection file without any SELinux expertise required. Now you can increase the security of containerized environments. Sources are available on GitHub, and an RPM package is available in Fedora repositories for Fedora 28 and later.

Photo by Samuel Zeller on Unsplash.

By Christine McKee
Monday, May 06, 2019, 06:16 pm PT (09:16 pm ET)

B&H Photo just unveiled the Payboo Card, which offers shoppers a tax-equivalent loyalty reward to counteract sales tax assessed on purchases. This new marketing initiative sets B&H apart from competitors, such as Best Buy and Amazon, that collect sales tax on purchases in all applicable states without the reward, potentially putting hundreds of dollars back in the pockets of consumers.

B&H Photo Payboo Credit Card with tax incentive

Shoppers subscribed to B&H emails began receiving a message describing Payboo as “the solution to the sales-tax challenge,” which references the South Dakota vs Wayfair ruling that allows states to collect sales tax on purchases made from out-of-state sellers, even when said sellers do not have a physical presence in the state. As we reported in October 2018, B&H began collecting sales tax in additional states after the ruling, with even more states added to the list during the remainder of 2018. As it stands now, B&H collects sales tax in a total of 26 states and reports purchases in several more, due to local taxation laws.

Shortly after 6 p.m. Pacific, B&H launched the Payboo Credit Card page, with a message reading “you pay the tax, we pay you back.” Shoppers in eligible states will receive a reward equivalent to the amount paid in sales tax on every purchase with the B&H Payboo Card. At press time, the tax-equivalent loyalty reward is not valid in Alabama, District of Columbia, Indiana, Iowa, Nebraska, North Dakota, Vermont, West Virginia and Wyoming, although other Payboo Card incentives may be available.

Payboo comes on the heels of Apple’s own Apple Card announcement, which offers 3% cash back on purchases made at Apple and 2% back on purchases using the Apple Card via Apple Pay.

This story is developing. Stay tuned for more details following B&H’s official announcement.

If you are looking for a tool to quickly create complex shaders by mixing and matching existing shaders, ShaderFrog might be the perfect tool for you!  Running entirely in your browser, ShaderFrog can be used to create WebGL shaders in two ways.  First you can create a shader by connecting together existing shaders, to create a new composite shader.  Shaders can even be imported from ShaderToy or the GLSL Sandbox.

In addition to the composition based approach, there is also a full blown GLSL text editor with automatic compilation/error reporting, syntax highlighting and more.  Once you are happy with your created shader, you can save it, share it, or export it to iOS, Unity or Three.js.

Check out ShaderFrog in action in the video below.

Programming Design Art Tools

We apologize that some players were unable to view the Unvaulting event. Anyone who jumped into the Unvaulting playlist will be granted the Arcana Glider in the coming days. Players who purchased the Arcana Glider previously will be refunded their V-Bucks.

— Fortnite (@FortniteGame) May 5, 2019

Retro gamer Matt Sephton, who goes by the handle @gingerbeardman over on Twitter, has shared a forgotten interview with us dating back to 1992. It’s from issue 25 of the publication Electric Brain and features the one and only Shigeru Miyamoto talking about the development of The Legend of Zelda: A Link To The Past along with the first two Zelda entries on NES.

Throughout the interview, Miyamoto speaks about the various challenges and design choices Nintendo faced during development – such as trying to cram all of the game onto the cartridge. He also explained how the company often began projects with only a handful of people and even revealed how the development team had “all sorts of titles” for the SNES Zelda, like “Gannon Strikes Back” until a decision was made to stick with the original name.

In the second half of the interview, Shigeru touches on the role-playing genre, in general, and states how Zelda paved the way – with a number of original ideas that eventually became “bog standard” for all games under this banner. Later on, he references the original Mother (Earthbound) game on the NES and Pilotwings.

One of the final questions is about future production plans for the company. Miyamoto follows this up by saying how Nintendo “will never run out of ideas” and new genres can be easily created. Read the full interview below:

Did you enjoy reading this classic interview featuring Miyamoto? Share your thoughts in the comment section.

Microsoft’s autonomous systems platform overcomes some of these challenges by using a unique approach called machine teaching. It relies on a developer’s or subject matter expert’s knowledge — someone who may not have a background in AI but understands how to steer a drill or keep the airflow in an office building at safe levels — to break a large problem into smaller chunks.

Instead of having reinforcement learning algorithms explore how to solve a problem randomly or naively, which could take forever, that person uses a programming language called Inkling to show the system how to solve simpler problems first and provide clues about what’s important. This shortcuts the learning process and enables the algorithms to hit on a solution much faster.

Microsoft’s platform also enables non AI-experts to establish and tweak the reward system, which is key to arriving at a solution that truly works. And it selects and configures the algorithms to tackle the task, eliminating the need for machine learning experts to custom build solutions.

For instance, team members worked with Schneider Electric, a global company working to digitally transform energy management in homes, buildings and industries, to test whether AI could help reduce the carbon footprint of HVAC systems that are used to heat and cool large commercial buildings.

“Schneider is very focused on sustainability, and large buildings are a top contributor to carbon pollution. So there’s a really important mandate to make HVAC systems more energy efficient,” said Barry Coflan, senior vice president and chief technology officer for Schneider Electric’s EcoBuildings Division.

Centered on a longstanding relationship, a proof-of-concept test was conducted using the Microsoft toolchain and Schneider supplied simulation to train an AI system to autonomously run the HVAC systems that controlled airflow and heating in a conference room. It had to balance saving energy with other goals, such as keeping the temperature comfortable for people inside and making sure there’s enough fresh air to keep carbon dioxide levels from building up.

Optimizing for all those factors — which are controlled by different physical systems — requires far more intelligence than a simple thermostat, says Microsoft’s Hammond. The system has to account for environmental variables that are constantly changing: energy costs that fluctuate throughout the day, people coming and going from the room, what the outside weather is doing, the physics of how air flows.

Using a machine teaching approach, Schneider and Microsoft experts first taught the reinforcement learning system to control temperature well. Then the AI system learned how to control air flows to keep air quality at healthy levels.  Then it learned to consider how room occupancy affected those outcomes.

Taking all those factors into account, Microsoft’s AI system was able to reduce energy consumption in the room by about 20 percent, while preserving comfort and high air quality when it mattered. The teams are now embarking on a second phase of collaboration to scale the simulation across different types of rooms and further boost energy savings.

Coflan said the laddered approach to teaching and the ability to layer in different rewards enabled Schneider Electric to understand how the AI system was learning and track which factors contributed to the biggest gains.

“A lot of what we do has safety ramifications so we really need to understand how the AI system is making decisions,” Coflan said. “This approach lets you see how the system is getting smarter and gives you an audit trail that is essential for safety and reproducibility. Our customers would want that too — you can’t just put a system out there and say ‘Trust us.’”

Click here to load media

Microsoft’s autonomous systems platform uses a simulated warehouse environment in AirSim to train an intelligent forklift to pick up and deliver loads autonomously while recognizing and avoiding other obstacles. This video illustrates the vision for a future warehouse with pre-trained, intelligent forklifts assisting people in everyday activities.

Running simulation at scale in Azure

Because no company can afford to let a robot or an intelligent control system make millions of mistakes in a real-world factory or wind farm or highway as it is learning, reinforcement learning algorithms need to practice in a simulated environment that can replicate the thousands or millions of different real-world scenarios they might encounter.

The Microsoft toolchain also includes AirSim, an open source simulation platform originally developed by Microsoft researchers to use AI to teach drones, self-driving cars or robots to learn in high fidelity simulated environments. Or, the team can work with customers to train autonomous systems using existing industry-specific simulators.

In either case, running these data-hungry simulations in the Azure cloud enables the system to test thousands of different decision-making sequences in parallel, which allows the AI models to learn what does and doesn’t work much faster.

“If I have the ability to spawn thousands of simulations at once and in each one the pedestrian crossing the street is different and the curve of the road is different, suddenly the AI system is able to gather much more diverse experience in a short amount of time ,” said Ashish Kapoor, Microsoft principal research manager. “Azure gives us the ability to run these simulations at scale, which is really important.”

AirSim also allows developers to train different AI and control tools to solve different parts of more complex problems. In helping develop autonomous forklifts for Toyota Material Handling, for instance, researchers broke the task down into sub-concepts that are simpler to learn and debug: navigating to the load, aligning with the pallet, picking it up, detecting other people and forklifts, delivering the pallet, returning to the charging station.

In these complex scenarios, Kapoor said, it may make sense to use reinforcement learning to train a forklift on basic control tasks, like picking up a pallet. Machine teaching helps the system learn in progressively more difficult steps, such as aligning the lift horizontally and then finding the proper angles.

But other parts of the problem might be better solved by entirely different tools like obstacle detection and avoidance algorithms, robotics path planning or classical control techniques. Decomposing the larger task into smaller ones allows developers to select and deploy the best tool for that particular job.

“We are working to provide a comprehensive platform for customers who want to build intelligent autonomous systems, covering development, operation and end-to-end lifecycle management,” Hammond said.

Top image: An experimental version of the Sarcos Guardian S, a visual inspection robot that can be used in disaster recovery or for industrial inspections, has learned to avoid obstacles and climb stairs on its own using Microsoft’s autonomous systems platform. Photo by Dan DeLong for Microsoft.

Microsoft Build 2019 — related autonomous systems links:

 Jennifer Langston writes about Microsoft research and innovation. Follow her on Twitter