Hey everyone, I know it's been a while since we released an edited ep of Path of Legends. I wanted to get Ep1 of Blood & Shadows out as soon as possible, and because of my work schedule, that took much longer than anticipated.

Unfortunately, there's a bit of bad news. Because I took so long, Twitch has since deleted my VODs of PoL E11 and 12, and I did not have a chance to download them yet. This means that the video portion of those episodes is unfortunately lost. The good news, though, is that the audio recordings are saved separately, and are still available.

This means that I will be able to produce these episodes, however they will be audio-only. I apologize for the inconvenience. Starting with yesterday's session, we are now recording the stream video locally in addition to streaming it to Twitch, so we should avoid this issue in the future.

Thanks, everyone.

I'm so proud to announce that the first episode of our new show Blood & Shadows is now available for everyone to listen to! Please consider giving this episode a view, like, and/or comment to help out the new show. Thanks everyone~!

In this episode, the party arrives for their new job in Talmandor's Bounty, immediately gets saddled with chores, meets the four-hooved star of the show, and much more!

Hinoki-chan enjoying a hinoki onsen.
Fanart for Naycelium because I love their characters and they are a good critter.

Watermark-free and effects-free alts on Patreon.

Announcing a new Pathfinder 2e TTRPG Actual Play show! Blood & Shadows is a self-contained show where we play through the Shades of Blood adventure for Pathfinder 2nd Edition. In this story, the heroes travel to the island settlement of Talmandor's Bounty as research assistants for an astronomical study. However, deep beneath the island of Ancorato, dark secrets of the ancient Azlanti civilization lie dormant, just waiting for dark forces to use their power for evil.

How to Watch
You can catch our episodes live Saturdays at 3:30pm Eastern on Twitch each week (schedule depending on cast availability). Edited episodes will be available on Patreon as soon as they are available, then shortly thereafter on YouTube.

Cast
We have an excellent cast of new and returning players, as well as a new GM! Check them out!
Juan (@JuanApolinário) - GM
Sarah (@baphxyz)
Abby (@FoxyPumpkin)
Tyler (@Bellmont)
Rex (@Myval)

In this episode, the party tangos with some Average South Carolinians, mouths off to the authorities, and plots a health code violation.

Hey everyone, I'm sure you've noticed that most of our posts have disappeared. Not a big issue, there was only a handful of them and it was mostly just posting our podcast episodes from YouTube. Turns out, I made a big oopsie.

On the permalink page for each post (the dedicated post page), there are post control buttons (edit, delete) that appear if the current user has proper permissions. None of you will see these controls, and that's by design. However, there was a problem.

In order to avoid accidental deletions, I had added a modal (popup box) that asks the user to confirm that they really really wanted to delete the post. This modal, like a lot of other UI elements on my site, uses the BlazorBootstrap library. I had assumed that, like many page elements in Blazor (the framework this site is built upon), that if the modal was not being shown, then it wasn't actually being rendered to the DOM. However, it turns out this is NOT the case, and it is indeed rendered, but just hidden.

That means that any time you create a modal in your Blazor page, unless you are taking some manual measures to make sure it is unloaded, your modals will be loaded at all times. That means that any Joe Schmo from off the street can load up the page source in their browser tools and force the modal to show. In which case, you better be absolutely sure that any buttons or actions called from within that modal are properly checking authorization on the server side, otherwise the attacker has full access to any of them.

Fortunately, this was an isolated incident with relatively low stakes. I have since fixed the issue. Other privileged actions on the site were not affected, as everything else is authorized on a full-page basis, meaning if you can't do a thing, you can't access the page at all. So, in a way, I'm grateful to my anonymous friend for finding this vulnerability and teaching me this lesson in such a low-stakes manner.

In this episode, the party negotiates with terrorists, busts some ghosts, and does some yard work.