Shaolin master streamer

This week, we’re talking about milkmen, slimes, and Mario's strongest soldiers.

If you’re new around here – hello! This is EX’s weekly digest of interesting finds from the gaming realm and the posting zone. Thanks for reading.  

A long history of gamer security incidents gets longer

On Sunday, two Apex Legends pros were hacked mid-tournament and mid-sentence by an attacker who activated cheat tools like wallhack and aimbot inside the streamers’ clients. This led to speculation online that Apex has a Remote Code Execution (RCE) vulnerability, which is a “they hacked the whole site, man”-level problem that you don’t want to have. (Security guy/streamer @PirateSoftware, on the other hand, pointed out that players' PCs might have been compromised without Apex having RCE.) However, the Apex Legends Global Series was merely a more glamorous stage for (possible!) RCE to make its début — it has appeared in many games previously.

• Log4Shell, an “apocalyptic” Java vulnerability that Wired described as “liv[ing] up to the hype,” affected Minecraft: Java Edition and Steam before a 2021 patch. The issue encompassed so many services that the gamer angle wasn’t usually the headline.
• A long-standing RCE exploit in the Source Engine (CS:GO, Half-Life 2) wasn’t fixed for two years after security researchers warned Valve about it.
• Many old Call of Duty games on PC had RCE exploits for years, as Adin Ross found out back in 2022 when hackers took control of his PC live on stream. The most severe issues have since been patched, but cheats remain rampant.
• The Dark Souls games also saw widespread hacking on PC — in DS3, trolls could spawn forbidden items into your inventory that would cause the game’s anticheat to ban your character permanently. In January 2022, an actual RCE vulnerability was discovered, which led the publisher to take the servers for all three Souls games offline for seven damn months.

It still isn't clear how serious Apex's issues are, but players have resurfaced dozens of old clips of the same hacker spawning a horde of bots in a ranked game, gifting hundreds of purchasable item packs, and stream-sniping the game's biggest players for months.

Vtuber shoot-em-up gets beat-em-up sequel

In many ways, it’s nuts that Holo x Break exists at all. It’s an upcoming retro-inspired beat-em-up starring Vtubers signed to Hololive Production, an agency owned by Cover Corporation. It’s also the follow-up to 2022’s HoloCure, a freeware Vampire Survivors-like auto-battler fangame that remains one of the genre’s most popular titles, even with players who've never watched a minute of Vtubing. Unlike HoloCure, however, Holo x Break will be published as an official Hololive title under their new “holo indie” division — a rare success story in the world of fangame development.

HoloCure’s overwhelming popularity helped it escape the usual fangame trap, where earning any real money risks drawing the ire of copyright holders. Kay Yu — HoloCure’s creator and the lead animator behind River City Girls — noted that there were so many people playing on launch that they were forced to shut down the online leaderboards. Last year, as a response to HoloCure’s runaway success, Cover Corp established the holo x indie publishing division for managing “derivative works.” Now that Holo x Break is a holo indie title, Yu and the team have the ability to work directly with Hololive’s talent in producing voiceovers and assets.

Where did this nugget come from, and where will he go?

Part of the ongoing mission of EX is to document the roster of characters appearing in brain-melting shortform video animations — characters who will be as familiar to the graduating class of 2034 as figures like Goku or Dick Cavett are to us. Last week, we mentioned a chase TikTok featuring a character widely known as Omega Nugget or the Roblox Chicken Nugget. Since then, we’ve been seeing him everywhere. Know Your Meme provides an invaluable record of the nugget’s origins on TikTok, which have apparently been deleted, as well as the source for his song. Regardless of where he came from, the nugget has now joined the Titan Cameraman, Herobrine, the “Tenge Tenge” kid, Granny, Spider-Man, etc., in the eternal shortform playground. 

The unlikely subgenre of ID-checking games continues to thrive  

That’s Not My Neighbor turns the canonized passport puzzler Papers, Please into a cartoon creepypasta about spotting evil doppelgangers. Papers, Please was a huge hit with mainstream YouTubers like Markiplier, so it’s not surprising that variants like this and Contraband Police remain popular as streamer games. Many people online have also been drawing fan art of the game’s Milkman character, which may be a case of trying to make tumblr sexyman happen, but seems like a welcome development for anyone trying to market a small game. The game’s creator, Ignacio Alvarado/Nacho Sama, said on Instagram that it was his first commercial project.  

Welcome to the mid-email information oasis. EX is a free weekly-plus newsletter written by Chris, Clay, and Pao. It’s about the future of culture, and about turning each week’s mass of links into a few useful thoughts. If you enjoy reading EX, please share it on the social platform of your choice.

The 36th Chamber of YouTube

The YouTube channel Wu Tang Collection provides a valuable service: uploading low-rent kung fu movies in the shittiest quality possible. The dialogue sounds like it’s being fried. The films look like they were stored inside someone’s shoe. If they have subtitles, it’ll be white text on a graying print. But the channel always provides a context-free blast of kung fu shouting and foley artistry, which is comforting to experience in passing, like a video store CRT playing an unknown film.

But it all raises some questions. Why does the channel have its own app? What is their relation to the old Wu Tang Collection DVD imprint (if any)? And does the abundance of comments reminiscing about Saturday afternoon TV broadcasts and long-shuttered theaters reflect a universal desire to escape into the past by watching movies in terrible quality?

Super Mario Maker caucus beats every Wii U level ever (almost)  

Last week, someone on Twitter announced that a group of hardcore Super Mario Maker players who go by “Team 0%” had just finished their crowning achievement: They completed every single SMM level uploaded to the Wii U version of the game before Nintendo shuts the console’s servers down on April 8. That means all of them, from punishing kaizo obstacle courses to the 20-second level your little brother gave up making. Well, almost all of them — there’s actually still one nigh-impossible level left called “Trimming the Herbs,” but its creator admitted that he cheated (via TAS, or tool-assisted speedrun) to upload it, rendering it "illegitimate."

According to Ars Technica, the team started clearing all of the game’s unplayed levels way back in 2017, inspired by a list of uncleared levels from Reddit. They accelerated their heroic efforts after Nintendo announced they’d be preventing players from uploading new levels in 2021, effectively creating a limit to the amount of levels they’d need to complete. While the situation around "Trimming the Herbs" caused some last-minute confusion, the project was officially completed on Friday night. According to the tracker, Team 0% has moved on to Super Mario Maker 2.

The weirdest mode in Dragon’s Dogma never got its due

Capcom’s big RPG Dragon’s Dogma 2 just came out yesterday, and so far it seems good in all the ways that the 2012 Dragon’s Dogma was good. In fact, it seems incredibly close to the original recipe given the 12-year hiatus. But one thing it doesn’t have (yet) is the old game’s oddball Speedrun Mode. This DLC addition didn’t just place a timer onscreen — it was a full New Game+ mode with permadeath. You could bring in all your items and skills from a previous save, which shifted the focus from execution to planning, making runs feasible for people who were just looking for a challenge and not a true speedrunner reset grind. For anyone who remembers how the main story in Dragon’s Dogma is supposed to work, the optimized routing showcased by Bafael in the video above will be a wild ride.   

Chum Box

• The Vtuber/artist @flyann made a custom game world where their chatters spawn as slimes that the streamer can attack in action-RPG style. This innovation was shared by shindigs, another experimental Vtuber whose own stream is a series of ever-changing visual gags.
• Twitch’s itinerant CEO Dan Clancy popped up on the improv stream EverythingNow to play a judge in a Shark Tank riff. Bloomberg chronicled Clancy’s streamer listening tour late last year; he continues to materialize randomly at streamer gyms and Ren Faires.
• Steam reviewers are big mad about microtransactions in Dragon’s Dogma 2. This marks the second time this year that a widely acclaimed game "went negative" on Steam at launch — the other was Helldivers 2.
• Someone’s making a full-on Sisyphus rage game called Pushing It! With Sisyphus. After the recent success of other ragers, the 2023 TikTok craze for Camus, and previous Gmod takes on the concept, maybe it was inevitable.
• Slice & Dice, a well-regarded “dicebuilder” tactical roguelike, finally migrated to Steam after 7 years of development.
• If you've accepted that you're never actually going to play the 1998 cult RPG Shadow Tower yourself, this 140-minute video essay has you covered.
• Everyone knows The Matrix Resurrections was bad. What this tweet presupposes is: maybe it wasn’t? Follow the quoted tweets up the rabbithole and you end up at an argument that Madame Web is good, actually, too.
• This week in stomach-churning AI advances: an entirely machine-made Mississippi blues song. You can read more about Suno, the platform that created it, in Rolling Stone.
• No Bells explores the dense, high-irony Instagram meme pages fueling the rise of IRL rap collectives like Shed Theory and 1c34.
• TikToker papawheelie_ continued his horndog adventures in an MSPainted “furry kingdom” that looks like an old Flash animation.

Coming Attractions

• Open Roads - 3/28
  An intriguing narrative-driven adventure game from Annapurna Interactive, starring Keri Russell. 
• Shabazz Palaces - Exotic Birds of Prey - 3/29
  Shabazz Palaces’ 2010 debut Black Up is one of the best albums of the millennium; they’ve spent the years since getting funkier, spacier, and much more abstract.
• Ride - Interplay - 3/29
  To some, there’s a shoegaze renaissance lurking on the horizon; to Ride, however, shoegaze never left. If their previous post-reunion LPs have been any indication, we can expect more of the same here.

That’s it for this week. We’ll be spending next week watching a pristine copy of Shaolin Invincibles.