Hi,

This is a spite play post

I've been around for 2 years as the top mod. The sub grew from 40k members to 600k users in that timespan - that's an order of magnitude. I've been here trying to make your lives easier and I like to think I've done a decent job. At least you've been telling me nice things about my style and I appreciate that.

Now it's Reddit's turn to make things my life harder

Reddit recently rolled out an age check for EU-based members. Non-age verified redditors cannot view mature content. Any post made under the "NSFW" tag, any NSFW subreddit and any profile with even a single NSFW contribution is off-limits to me. I get the pictured pop-up and it's making my ability to tell bad actors from good contributors just that much harder when I'm unable to view a user's profile (at all). It's not like they hide the mature content, I just can't access the profile. Normally I'd be able to see +-30 days of the user's all contributions (even if their profile is curated) which Reddit thinks is a good idea "for moderation [purposes]". Apparently if they've ever posted a picture of a rotten tomato on a food sub with the NSFW tag enabled I need to be procted from that. Then it's not longer a good idea to show any of the other contributions.

On top of this Reddit is hiding my own content tagged as "NSFW" from ... me. If I post on r/bugs (the subreddit where you're supposed to report bugs with the platform) saying "Hey, I cannot view my own NSFW posts" I will be unable to see it. Ask me how I know.

I hope you see why this could be a problem.

My alternatives are:

1. Age verify by sending a selfie or a government ID (passport) photo to Persona, the 3rd party service that had privacy issues and was subsequently ditched by Discord.
2. Ask my fellow mods to address the items/members I cannot access. It's many a member. Not all of you/them are bad actors.
3. Quit.

I chose the third option. I love you all but killing the 3rd party API access, introducing pointless AI tools & mandatory filters, then killing the API self-serve tool and now hiding some essentials is taking a toll on me. There's no drama in the mod team and nothing wrong with you - purely a Reddit issue. I will be around for a few days to address some loose ends but then it'll be time to log out, uninstall the app and turn the lights off.

I want to thank you all for the wonderful times we had. 💜

Wish the remaining team good luck and be supportive of them!

Feel free to chat with me while I'm still around. Just leave a comment! :)

I saw it in a dream

Inspired by: https://www.reddit.com/r/mtg/s/vum8CDaty4

This isn't pertaining to any particular era or meta but the card showcases that colour's most iconic effect and does it so in a recognisable way.

"Best, barely unplayable" means that the card always has a slightly better alternative that costs a little less for this effect or it has a similarly costed alternative with upsides.

For white I picked [[Glorious Anthem]]. White is known for tokens, Auras, small creatures, protective spells, Vigilance, Angels and - my pick - static effects granting upsides to creatures. Sure, [[Healing Salve]] is probably the most useless and widely recognised protection spell but I wanted to include a card that actually does something. The overarching theme seems to be "be smol, get stronk" and I felt like Glorious Anthem fit that bill best.

For blue I picked [[Divination]]. Blue is hands down best known for drawing cards so the choice is obvious. Divination is barely unplayable and very iconic so I think it represents blue's domain best. The other very strong contender is [[Cancel]] as the best unplayable counterspell but between the two cards that reference drawing outnumber cards that counter spells.

For black I picked [[Murder]]. Black is known for its generic ability to "kill" as in get rid of a creature. The choice is between self-sacrifice, recursion/reanimation, target creature removal, Demons, and life loss as a resource. [[Painful Lesson]] is a card that's outside of getting rid of a creature but it's not very iconic. All its siblings that are iconic are very efficient and as such they don't qualify. [[Reassembling Skeleton]] is iconic and embodies the reanimation side of black but ultimately I felt like Murder has to happen before reanimation.

For red I picked [[Lightning Strike]]. While not the most iconic card it does what red is best known for: direct damage. A more iconic contender would have been [[Lava Axe]] but Lightning Strike is mechanically very close to [[Lightning Bolt]], the pinnacle of red power.

For green I picked [[Colossal Dreadmaw]]. Meme. Hehe. But it's also a (slightly overcosted) Trample creature, which is what green does best. Having a chonker of an attacker is how green applies pressure. Pump spells such as [[Giant Growth]], or recursion such as [[Regrowth]] could have worked, too. (Obviously those two are "good" cards so they wouldn't qualify.) I just felt like it should be a creature.

What would you pick? Criteria: you wouldn't play it competitively because it has a better alternative but it embodies that colour's philosophy.

Hi,

Starting as of ~yesterday many Magic: The Gathering Discord servers were hit by bots that DM innocuous looking links on Discord. In reality those links don't lead to the place they're supposed to - this is called domain masking. More info: https://en.wikipedia.org/wiki/Domain_masking The scammer's link hijacks your accounts and they lock you out of them.

How it works:

1. An account DMs you. This can even be a trusted friend, because they may have already fallen victim to this scam.
2. The DMs are mostly harmless but at some point they prompt you to "see their new project" which has thus far been mostly Steam links but I suspect it could be anything from a blog post to a Soundcloud link.
3. The link is masked. On Discord you [put the link text here](https://url-goes-here.lol) and the end result is just an ordinary looking link. The confusion arises from "put the link text here" looking like another website.
4. You open the link. Discord will prompt you (RE: see post image) to confirm you want to go to this site. Please pay attention as this is your last line of defense. If you "Go Back" nothing bad has happened.
5. The link leads to a script that hijacks your active sessions on your browser. All of them. If you have your Google account signed in, they get it. If you're on Reddit, they get it. No amount of 2FA will prevent this step, because the scammer isn't stealing your credentials, they're stealing you existing on the Internet. Difference is between someone stealing your car keys, breaking in and driving off in your car versus them kicking you out of the car in red lights and driving off while the car was already running.
6. The prompt asks you to authorise your Discord to the malicious app. Don't do it. This is the way they gain access to your session.
7. Once they have access to your sessions they'll quickly use those to change as many credentials as they can - ultimately locking you out of your accounts.

Please, please be really careful on the Internet.

---

A more technical and comprehensive explanation of session hijacking: https://www.pingidentity.com/en/resources/blog/post/session-hijacking.html

Image 1:

My profile via Android while logged in. Settings say my profile is "curated" to show 21 communities.

Image 2:

My profile via Desktop Web and Mobile Web while in incognito mode (not logged in). Blocked by "network security".

Image 3:

My profile via Desktop Web while logged in. Everything is hidden.

Image 4:

Logged into my other account via another Chrome browser profile. Everything is visible, including communities I've "curated" / hidden.

Image 5:

I am not suspended or restricted.

------------------------

What on Earth is going on?

I pre-emptively took a screenshot of my post before submitting it. I cannot see the post in the picture. It's not visible on the feed or in my profile while I'm logged in.

Just asking for a friend. Haven't seen them lately.

Context: "pre-errata" means the original rule for the way Companions worked before they received functional errata. Originally you were able to cast your Companion once per game for its mana cost, straight from outside of the game / your Sideboard (see rule: 702.139a). Lurrus is currently banned in Pioneer, Legacy and Modern. It's not restricted in Vintage, because it received functional errata where you now need to pay {3} to put the Companion from your Sideboard into your hand before casting it. Lurrus costs nowadays twice as much as it did in the beginning.

For Vintage this was a problem. It was essentially the 8th card in your hand and you had access to it every game. This also meant that you were able to cast Black Lotus twice on turn 1 and having access to it for as long as Lurrus remained on the field. Since in Vintage they only restrict cards to one copy (they don't ban) it meant that you still had access to the only Lurrus in your Sideboard. This is why the Companions received functional errata meaning they changed how it works after release.

Essentially what Lurrus does is it makes each mana value 2 or less permanent count as multiple copies of itself (once per turn). You were able to cast a Black Lotus off of it every turn, giving you access to three free mana every turn. Lurrus also gives access to your graveyard letting you self-mill whatever small thing you want and be able to use it immediately. Lurrus is still seeing occasional play, because it is just so much value.

What do you think? Is Lurrus one of the most powerful cards out there in whole of Magic - if not the most powerful?