Triumph of the Leaping Lizards

In principle, I don't spend all my time earning raptor-related mounts, but that happens to be how things worked out this week.  There were two time-sensitive things going on in EQ2 at the moment - the always clever annual Halloween event, and the second part of an expansion prelude event that seeks to concoct a lore explanation for why we're suddenly getting Beast Lords. I'm not currently paying for an EQ2 subscription, but this is precisely the scenario where an EQ2X account comes in handy.  So, I dusted off my Inquisitor and got to work.

The Saliraptor, which comes in black for crafters and white for adventurers.

The events I came for were basically what I expected, but the visit reminded me that I had yet to obtain the game's new "leaping" mounts.  SOE promised that flight would remain an exclusive perk for high level Velious expansion owners, but they did also just spend a fair chunk of time redecorating most zones in the game to allow flying mounts.  The compromise was a new set of leapers for characters in their 30's, and "gliders" for characters in their 60's.  I never bothered to do these quests because Lyriana can already fly under her own power.  My mid-30's Inquisitor, on the other hand, was in the right level range, and promptly completed the questlines for both the adventuring and crafting forms of the leaper.

On the ground, including in areas that are not yet flight-enabled, leapers are slower than regular ground mounts.  The difference, in flight-enabled areas, is that they can jump.  Really high.  Like on top of buildings and up sheer cliffsides high.  The leapers also come with immunity to falling damage, which means that you won't kill yourself by leaping off a cliff or jumping towards a bridge and missing. 

It's an interesting mechanic - the jump is high and long enough that you can basically avoid combat almost as well as if you were on a flying mount, but this method takes a bit more attention to ensure that you don't fall off narrow landing spots, get stuck under terrain, etc.  Touching down on the ground also helps spot quest items, some of which aren't visible from too high above the terrain.

(The level 60 version supposedly adds a slow-gliding option that increases your travel distance and control.  I can see some value in this - when the leaper hits the end of its forward momentum, it basically drops straight down like a rock, in a way where a slow-falling mount would manage to coast across.) 

I've never been that fond of player-controlled flying mounts - I think that what we give up in terms of avoiding/trivializing content is not worth what we get from the experience of flying over the world, and I think that 99% of the benefits can be achieved with either NPC-controlled flight or player-controlled flight in specific constrained areas where being able to steer actually contributes to gameplay (e.g. airborne bombing runs).  As far as compromises go, the leaping lizard is not bad.   

Triumph of the Rift Raptor

It's been another few months in the life of Rift, which means time for another World Event, and the game's third Welcome Back weekend.  Telhamat made good use of the time, advancing from level 43 to 48, collecting a complete set of the (conveniently green) rare Transplanar armor, and completing the world event's Raptor mount.

Disapproving raptor disapproves.

World Events
I haven't been present for all of Rift's world events, but the three that have happened during free retrial weekends have all been very similar - one easy daily in town, a couple of quests to close rifts in the world (with event-specific rift invasions which open in zones that might not ordinarily be invaded by that elemental plane), and a token vendor in town with various goodies.  This time was only unusual in that a single weekend was enough time to snag the tokens I needed for the mount, the non-combat pet, an epic hat, and a larger backpack off the event vendor in some future phase. 

As Chris points out in pictoral form, the bad guys don't seem to be catching on that a couple of invasions aren't going to turn the tide and let them win.  Then again, this may be the point.  NPC invasions function as an extremely tame substitute for RVR - unlike enemy players, the devs can be sure that the NPC's won't throw matches, and won't get upset that they always lose. 

Invasion population

In one weekend, I earned more than enough Rift currency to collect all six pieces of the Transplanar gear set, plus a "synergy crystal" to provide a choice of set bonus options.

I'm finally high enough in levels to do zone invasions in the well-populated endgame zones.  This also means that I'm high enough to partake of greatly increased reward ratios that were recently implemented to draw players back into the Rift content.  The high level rare and epic currencies have been merged, and it's not uncommon to obtain 5-10 tokens for a single zone invasion.  This has brought down the prices on the previously costly mid-40's armor set down to a single event per piece, but is apparently meant to encourage purchases of consumable endgame essences.  

Unfortunately, the resulting zerg experience is much like it was in the newbie areas during launch - massive. lag-inducing crowds of players, and mobs that either melt under insane DPS or have ridiculously high HP totals to try and keep them alive so that players who have to ride across the entire zone can get there in time to hit the boss a few times. 

If feels like there is an extremely limited middle ground between too deserted to actually complete rifts at all (mid levels) and so crowded that you spend more time traveling from rift to rift than fighting.  Trion is apparently working on a new endgame zone, and I can only imagine how overcrowded this area is likely to be, even though it will reportedly be twice the size of one of the game's current larger zones.

Meanwhile, in Telara
Fortunately, I've been pleasantly surprised by the non-dynamic portion of the game.  I just wrapped up Iron Pine Peak, and there will be large amounts of unused content I can complete for Planar Attunement/Alternate Advancement after I hit the cap.  I also healed a dungeon finder Lantern Hook PUG without a single death, and I genuinely enjoyed the experience. 

It does seem like the game may be falling into the same mudflation cycle that all MMO's are stuck in these days, with entire tiers of content falling by the wayside as new on-ramps emerge, but I might not mind taking a slower sight-seeing approach that lets me learn to heal in content that may be technically a bit below my level.  Whether I actually get around to paying money for the game again before another retrial weekend gets me to the level cap is an open question. 

Another bad guy who thinks he has a chance of winning.

PSA: Disable Blogspot Favicons (PVD re-declared safe)

Check the "icon" box now to add a security vulnerability to your blog, so that your readers can be hit with malware any time any site that you have linked to gets hacked.  Or do not do this.  Blogger opts not to advise you one way or the other.

If you host your blog on Blogger/blogspot and use the default blogroll widget, I strongly advise you to disable the "favicon" display (pictured above).  Users of other platforms are similarly advised to make sure your sites are not displaying blogroll icons.

Yesterday, the popular LOTRO podcast/news site Casual Stroll to Mordor was hacked and redirected to some sort of Russian malware site - see Google safebrowsing for more details. This attack pushed out a malware-tainted "favicon" - that's the little icon you see next to the links in many blogrolls, including the one that runs by default on Blogger/Blogspot - hosted on their site.  As a result, people who visited at least five Blogspot blogs, including Player Versus Developer, may have been exposed to malware.

According to CSTM's backup blog (ironically on Blogspot), the attack was discovered around 9 PM Eastern Wednesday (12 Oct), and they redirected their RSS feed sometime between then and the post (8:30 AM Eastern Thursday, 13 Oct).  Out of an abundance of caution, I'd advise that anyone who visited PVD (via the site, RSS readers should not have been affected) or any other site that links to CSTM between 6 PM 12 Oct and 6 PM 13 Oct (when I learned of the attack and disabled favicons from my blogroll widgets) to scan their computers for malware.  Those of you who also read/visited CSTM during that window are at a correspondingly higher risk. 

I'm not thrilled that this occurred, and I would not have clicked the "show blog icon" button (I think I opted in, though I don't even remember) if I had considered the implications of displaying a remotely hosted image on my blog.  I would strongly advise all of you who use Blogger to go into your blogroll settings panel and DISABLE icons.

The Google Blacklist
The other "fun" part of this is that Google flagged PVD and at least four other blogs as containing malware due to the tainted icons.  Web browsers that check Google's known malware API therefore displayed a warning to attempt to stop users from visiting the affected sites.    On one level, this is a well-intentioned service that Google provides.  On the other hand, I'm somewhat shocked at the power they wield. 

Getting the "suspicious" tag removed required that I register for Google Webmaster tools - never mind that this blog is hosted on a Google-owned site using my Google account - to manually request a review.  Hours after CSTM had been declared no longer suspicious (and after I had removed favicons), PVD remained on the Google blacklist (it was finally declared clean sometime after midnight, at least six hours after I requested the review), even though Google's own diagnostic indicated that the attack originated from CSTM's compromised server.

Maybe they would have automatically re-scanned the sites and declared them clean eventually, but it strikes me as odd that they can blacklist sites without any notice to the site owner.  I could see people who actually make money off their sites being seriously hurt by something like this. 

That said, I suppose a day of effective downtime is a small price to pay for the lesson not to display remotely hosted icons.  

PSA: Possible Malware Attack On PVD

Google Diagnostic Report

I came home this afternoon to find a comment saying that my site had been flagged as unsafe for browsing due to malware.  As nearly as I can tell, Casual Stroll to Mordor got hacked this morning and was serving links to malware on their RSS feed, which appears in one of the standard Blogger blogroll widgets on my site.  My guess is that only people who actually clicked the link to the CSTM feed (or people with browsers that pre-load links) would have been infected, but I have no way to verify that at this time.  I also have no way to request a review of my site to determine if the infection is gone, because the problem report has not yet propagated to Google Webmaster tools. 

In the absence of further information, I can only recommend that readers (especially those that also read CSTM) do whatever it is they do to check for malware. 

Update: According to a commenter on the CSTM refugee blog, the "icon" on Blogger's default blogroll widget is the culprit.  I have disabled this "feature", and strongly advise anyone who would rather not have their blog blacklisted by Google to do the same.  

Info from Google Diagnostics