I notified TKSTAR, Amazon and ALDI at the time, but they didn’t seem to take much/any action. I also left product reviews. I am now publishing my findings here.

Known Security Issues

1. Use of Default Password (Insecure Authentication)

Providing a default password on purchased devices is a well-known poor security practice. In this case, the default password occurs almost every year in the list of most commonly leaked passwords.

Most companies switched away from this practice many years ago. They should instead use auto-generated passwords, or the user should be required to change the password when first using the device.

Since 29th April 2024, it is now illegal in the UK to sell smart devices with a default password which can be easily discovered online. The default password is on a cloud service rather than device which may mean that the law does not apply, but this is worse in my opinion. If left unchanged, the default password can be used to remotely access the device.

See the New Security Law for Smart Devices card from the National Cyber Security Center for more details about the law.

2. Auto-incrementing ID/Username (Enumeration Attack)

TKSTAR usually do not refer to it as the username and instead refer to it as an ID. It is functionally is more typical of what people would know as a username though. In this case it is just the device serial number. Since device serial numbers are usually incremental (and indeed are in this case), determining the ID/Username for another device is as simple as adding or subtracting 1 from a known serial number.

When combined with the default password, it is extremely easy to gain access to other accounts. Many users may not bother to change the default password since it is easy to remember. It is not possible to change the ID, which in addition to being a limitation preventing uses from making their accounts more secure, means that returned or refurbished devices which are resold cannot be given new credentials.

Other Concerns

Sensitive Information

The information being sent by these devices is sensitive. As a very basic example:

• If the tracker does not move and is in the same place across numerous days, it is likely at someone’s home address.
• If the tracker then moves from this location, it is likely they have gone out and the house may be empty.
• If the tracker regularly moves to the same location during the day, it is likely someone’s place of work.

I did not check, but I am unaware of anything within the web app to show where people logged in from. Users may be unaware if they are being monitored.

It would also not be difficult to write a program to attempt login using the default credentials, starting from a known serial number and working outwards. This could then build a database of vulnerable active trackers. There is a CAPTCHA on the page (I am unsure if this is a new addition) but it appears to be an older version which may be easily bypassed.

Lack of Multi-Factor Authentication (MFA)

Many sites now support MFA (sometimes referred to as two-factor authentication or 2FA). For a site holding near real-time location data, the user should ideally be prompted to enable it when first logging in. MFA helps protects against password re-use and can mitigate the risk of some data breaches. As noted in the previous section, the data is highly sensitive and this level of protection should be available.

Password Reset

The password reset procedure is not something I have investigated thoroughly, but I have concerns at the level of information required to have the password reset to the default.

From my email history, I believe I attempted to change the password on my device to something more secure. When I generate passwords, I will occasionally generate them too complex and the services will set the password to an unknown or invalid value. On this occasion, I had to email support to ask them to unlock my account. They seemed to do action this with only the device ID. It is possible they also checked my email address, but I am unsure if I had this stored on the account. The account was pre-registered by them, so I did not need to register using it.

Additionally, the forgot password dialog requires the device ID and a phone number. I suspect this is the phone number of the sim card in the tracker. This does mean that if these details are compromised, since the ID cannot be changed, it should at least be possible to change the phone number of the device. Based on other observations, I expect using this form will simply reset the password to the insecure default.

Lack of End-to-End Encryption

This is a prime use case for end-to-end encryption, and something which Google has implemented in their item trackers from the initial release. This would prevent even the manufacturer from seeing the location data that it is sending.

Responses

I did contact both TKSTAR and ALDI about these issues in Feb 2022. I have not published the findings before now because this is very easy to exploit, and I had hoped they would improve their security. They have not.

ALDI’s Response

We are sorry to learn that the product is not as it should be. I have logged your comments on our system to be reviewed by our Quality Assurance department.

Aldi provide a 60 day inspection period on all our products, customers are given the opportunity to exchange or refund an item under our no quibble guarantee.

The product remained on sale. As far as I know, no updates were provided to the product and no recall was issued.

TKSTAR’s Response

Regarding the default password and incrementing ID:

You can reset the password yourself after you get the device activated.

I pushed on the issue further highlighting that this requires customers to know they need to change the password to secure the devices. This resulted in the following response:

Thank you very much for your suggestion, I have contacted the technical staff, it will be improved later.

The login page may have been updated to include a basic CAPTCHA to prevent basic scripting attacks, but it appears to be an older CAPTCHA which likely can be easily bypassed.

Amazon

I am unsure the response I got from Amazon. I have email traces of the reason for the return, and the review I left on the product highlighting the issues.

Outcomes

Some of my reviews have been marked by other users as helpful. The CAPTCHA may be as a result of this but is insufficient to address the issues.

I am unsure if it is the device I bought from Amazon or ALDI, but I found the serial number in my email. It seems it has been sold on to someone else who has neglected to change the default password.

Conclusion

The lesson here is far greater than just for this tracker. I expect there are many aimed at the budget market which have similar or only slightly better security. Location information is highly sensitive, and we should be careful who we are trusting with that data.

There are a number of reasons you may need to do this and cannot use a USB cable. In my case, the desktop machine I was using has some rather stringent restrictions on the USB port which could lock me out if it was concerned about the device. Connecting wirelessly was a far less risky option.

I knew Chrome remote debugging was an option, but had never tried it, even wired. If you can use USB, you are probably better doing so. Debugging over wireless is very slow.

Steps

This guide is was produced using an Ubuntu 24.04 desktop and an Android 15 mobile device. The desktop steps should work for any Linux or Mac version I believe, so long as they support adb. For Windows, you may need to replace ./adb with .\adb.exe. The Android steps may be different for other versions of the OS.

1. Download Android SDK platform tools

2. Enable developer mode on the mobile device:

   1. Go to settings and find the version number. On my device is was Settings > About Device > Version > Version No.

   2. Press it a few times and you should start getting a toast message about developer mode. Keep pressing it until the toast says that developer mode is enabled.

      

3. Enable wireless debugging on the mobile device:

   1. Go back to settings and find “Developer Options”. On my device it was Settings > System & Updates > Developer Options.

   2. Find the option for “Wireless Debugging” and toggle the switch to on.

      

   3. When prompted, press “Allow” to enable debugging on your current network. If you are on a trusted network, you can check the box to always allow.

      

   4. Tap the left side of the same “Wireless Debugging” item to open wireless debugging settings.

      

   5. Set the mobile device aside for now.

4. Configure the wireless adb connection:

   1. On your desktop, open a terminal and navigate to the directory containing the adb executable.

   2. On the mobile device, select “Pair device with pairing code”.

      

      A dialog with a pairing code and connection details should appear:

      

   3. On your desktop, run the following command using the IP address and port from the previous step.

      ./adb pair <ip-address>:<port>
      

   4. When prompted, enter the code displayed on your device. You should get a success message.

      ~$ adb pair 192.168.4.2:40625
      Enter pairing code: 123456
      Successfully paired to 192.168.4.2:40625
      

   5. Next, run the following command.

      The port should be the one on the “Wireless Debugging” settings page, NOT the port used for pairing..

      ./adb connect <ip-address>:<port>
      

      You should get a notification on the mobile device that wireless debugging is now connected.

      

5. Connect chrome devtools:

   1. Open chrome on both devices (you can also use chromium).

   2. On your PC, navigate to chrome://inspect/. You should see a list of all open tabs for the mobile device (it may take a few seconds to appear).

      

   3. Click “Inspect” for the tab you want to debug

Result

You should now be able to debug any web page open on the mobile device. You can even interact with the preview to control the page on the device.

It should be noted that this will be much slower than debugging in a local browser. Ideally, you only use this for diagnostics. With modern responsive design, there should be very few issues specific to a mobile device. It is however very useful for finding the cause of an issue, so that it can be more easily reproduced on a desktop browser.

One of my annoyances with “Smart TVs” is how they are still reliant on an antenna connection for live TV. It is possible to use apps instead for live TV, but you usually have to login to each app with a different login, and give up your privacy as the app tracks clicks throughout the navigation, watching habits, etc. It’s like having someone peering through your window constantly while you watch TV.

Even the Freeview app (the UK service for live broadcast TV), doesn’t allow you to stream in the same way you can receive a live TV signal. Instead, it manly acts as a guide which will then open the broadcaster’s app (e.g. BBC iPlayer), requiring you to login, if the broadcaster’s app is integrated at all.

So we’re left with broadcast TV instead, but this feels like a step backwards, and has it’s own issues:

• A cable has to run to each TV
• The signals are easily distorted by external sources, low quality cables, and long cable lengths.
• Splitting the cable can reduce the signal strength, or requires an amplifier, which can also amplify the noise.
• No on-demand services

There is no way we can solve the lack of on-demand services (legally), but we can reduce the signal issues.

Local IPTV

IPTV is technically TV which is broadcast over the internet, but we’re going to do the same locally. The concept is:

• To have a tuner connected directly to the antenna, using a high-quality shielded cable.
• The tuner then connects to the home network, allowing broadcast of the TV signals over Ethernet or WiFi.

This setup ensures that:

• There is no signal splitting,
• Cable length can be minimised,
• The signal can be accessed without a direct connection between the TV and the antenna.

Something to consider with this approach is heat. The antenna in your home can often be in loft space or on the roof. The closest indoor area to the antenna might not be the most sensible location, as the heat in these spaces may cause the tuner to switch off (overheating protection), or damage the circuit boards. It may be better to locate it slightly further away, with a single high-quality shielded cable from the antenna to the tuner.

Requirements

Below is the required software and hardware, along with the software versions and model of the HDHomeRun I used. This may work with other versions and models of the HDHomeRun, but you may need to research beforehand and adjust the setup as required.

• Jellyfin (Version used: 10.10.7)
• HDHomeRun (Model used: Flex Quatro)
• TVHeadend (Version used: 4.3-2432~g0af87f13f)

Setup

Setup HDHomeRun

Setting up the HDHomeRun device is fairly straightforward:

1. Connect device to ethernet, your antenna, and power
2. Browse to the device in your browser, either by http://hdhomerun.local/ or http://<ipaddress>/
3. Go to the channel lineup page
4. If no channels are listed, click the “Detect Channels” button, and wait for the channel list to build
5. Test:
   1. Right click one of the channel numbers and copy the link
   2. Open VLC
   3. In the media menu, select “Open Network Stream…”
   4. Paste the link into the URL field, and select play!

If the stream opens, then your HDHomeRun is configured.

Setup TVHeadend

Next, we’re going to setup TVHeadend. There are a few ways to configure this, but we’re going to use IPTV rather than DVB. There are a few advantages to this:

• TVHeadend when running in a container doesn’t need to be running in host network mode
• It avoids issues with DVB-T stream locking
• It is a more modern protocol

The disadvantage with this approach is that the EPG is not provided from the antenna. We’ll look at that in a later section.

There are two ways to configure TVHeadend with HDHomerun over IPTV. Most online guides show how to use the “IPTV Network” and manually create the channels. I’m going to cover using “IPTV Automatic Network” instead, using the lineup playlist file.

Some of the user interface and concepts in TVHeadend can be a little confusing. If you want more information, be sure to look at the TVHeadend documentation.

To setup TVHeadend for use with Jellyfin and HDHomerun:

1. Create a user for Jellyfin:

   1. Go to Configuration > Users > Access Entries > Add

   2. Set the following:

      • Enabled: Checked
      • Username: jellyfin
      • Change parameters:
        • Rights
        • Channel number range
        • Channel tags
        • DVR configurations
        • Streaming profiles
        • Connection limits
      • Web interface: Checked
      • Streaming:
        • Basic
        • Advanced
        • HTSP
      • Video recorder:
        • Basic
        • HTSP
        • View all

      

   3. Click Save

   4. Go to Configuration > Users > Passwords > Add

   5. Set the following:

      • Enabled: Checked
      • Username jellyfin
      • Password: Create a strong password to use

      

   6. Click Save

2. Create the network:

   1. Go to Configuration > DVB Inputs > Networks
   2. Click “Add”
   3. Select “IPTV Automatic Network”
   4. Select the “Enabled” checkbox
   5. Name your network (e.g. HDHomeRun IPTV)
   6. Set the maximum number of input streams based on your device. For the HDHomeRun Flex Quatro I used, it is 4.
   7. Set the URL. This will be the path to the channel lineup page on the device, but replacing .html with .m3u (e.g. http://hdhomerun.local/lineup.m3u).
   8. Click “Create”

   

3. Wait for Muxes

   1. Go to Configuration > DVB Inputs > Muxes
   2. The muxes should be added automatically. Wait for the “Scan result” column to show OK for all of them.

4. Setup channels

   1. Go to Configuration > DVB Inputs > Services
   2. In toolbar, select “Map Services” > “Map all services”
   3. Leave the defaults and click “Map services”

   

5. Test:

   You can watch TVHeadend streams in the web interface, but didn’t work for me. That could be due to codec issues with Firefox.
   1. In TVHeadend, go to Configuration > Channels / EPG > Channels
   2. Make a note of the “Number” column for one of the channels.
   3. Open VLC, and select “Open Network Stream…” from the media menu.
   4. Set the URL to https://tvheadend.app.g-de.co.uk/stream/channelnumber/1, adjusting the channel number as required.
   5. Click play!

If the stream opens, the basic TVHeadend configuration is complete.

If you encounter issues (or are just curious), go to the HDHomerun in your browser and go to the “Tuner status” page. It should show the selected channel for one of the tuners. You can also check the TVHeadend console output.

Setup JellyFin

1. Install plugin
   1. Go to Menu > Dashboard
   2. Open Plugins > Catalogue
   3. Find and install “TVHeadend”
2. Restart jellyfin
   1. While still in Dashboard view, select “Dashboard” from the menu
   2. Click “Restart”
3. Configure plugin
   1. Go to Menu > Dashboard
   2. Open Plugins > My Plugins
   3. Select the TVHeadend plugin
   4. Set the hostname, username and password
4. Test!
   1. Go to home
   2. Live TV
   3. Select “Channels” from the top menu
   4. Select a channel

Fixing the Channel Names

Due to the way HDHomeRun formats the playlist file, all of the channels will be prefixed with the channel number. Jellyfin will also prefix channels with the channel number, resulting in names such as “1 1 BBC One”.

Unfortunately, although the channel name without the prefix is in the playlist file (as the tvg-name tag), there doesn’t seem to be a way to have TVHeadend use this instead.

Given I only had 103 channels, I just updated them manually. It doesn’t take long once you get into a keyboard rhythm, and you only have to do it once.

Configure the EPG

I believe this step is optional, but Live TV without an EPG doesn’t seem the most useful, and having it enabled adds some nice functionality to Jellyfin.

Unfortunately, it is the most manual and tedious part of the setup.

1. Configure EPG grabber in TVHeadend

   1. Go to Configuration > Channel / EPG > EPG Grabber Modules
   2. Disable all except “Internal: XMLTV: XMLTV Url Grabber”
   3. Select the “Enabled” checkbox
   4. Set the priority to 1
   5. For extra arguments, use the URL to an XMLTV guide for your country. For the UK, I used: https://raw.githubusercontent.com/dp247/Freeview-EPG/master/epg.xml
   6. Click “Save”
   7. The EPG grabber should run automatically, but click “Re-run internal EPG Grabbers” if not.
   8. Wait for the EPG Grabber to finish. You can monitor progress via the TVHeadend console output.

   

2. Map channel to EPG

   1. Go to Configuration > Channel / EPG > Channels
   2. Ensure the View Level is set to either Advanced or Expert
   3. Double click in EPG Source column for a channel
   4. Select the channel from the list (may have to wait for grabber to finish). In theory you can start typing the channel to filter the list, but I ran into issues where it would select the wrong channel sometimes. Remember to save regularly!

3. Test:

   1. Go to the Electronic Program Guide tab. The table should now display shows.

4. Refresh the EPG in Jellyfin

   1. Open Jellyfin
   2. Go to Menu > Administration > Dashboard
   3. In dashboard view, go to Live TV > Live TV
   4. Click “Refresh Guide Data”. Don’t worry that there is no tuner or guide provider configured. Jellyfin will read from the TVHeadend plugin instead.
   5. Wait for the guide refresh to complete.

5. Test:

   1. Go to the Jellyfin home page
   2. Select “Live TV”. You should see programs from the EPG.

Conclusion

So far the setup has been working great! A number of channels on one of my TVs which were not available due to signal issues, are now available again. The picture is also more stable, and now all of my media is in a single app. I don’t have to login to any apps, keep them all updated on all of my devices, keep accepting privacy updates, keep checking my privacy settings are correct, etc. If I need to adjust the antenna, I can also view the stream from my phone.

As an added bonus, using my home VPN connection, I am able to stream regional live TV to my devices wherever I am. Not that I have any need for that at the moment 😂

Take turns playing “The Victim” and score points when your fellow players match how you rank five worst-case scenarios. The Victim’s Wheel decides your fate on every turn, but when disaster strikes… all that matters is who thinks alike!

I am attempting to walk 60 miles in June in aid of the National Autistic Society, usually accompanied by my beagle buddy.

Read the announcement post

Overview

First lets run through the result, and then look at the build in more detail.

Working from top to bottom, left to right, the rack contains:

• A Turing Pi with 3 Raspberry Pi Compute Module 4 (CM4) nodes
• A GigaPlus PoE+ network switch
• A Rack Mount with NVMe boards for Raspberry Pis. In the rack mount are:
  • 2 Raspberry Pi 5s
  • 2 Raspberry Pi 4s

This is all enclosed in DeskPi RackMate T0 10 inch 4U mini-rack.

The only power supplies are to the network switch and the Turing Pi. Everything else is using Power over Ethernet (PoE) which removes a number of cables and makes things much neater.

The Build

Chassis

The rack size was restricted a little by the size of the cupboard it was going in*. I could buy a bigger rack and modify the cupboard for it to fit, but I determined I could probably** get everything to fit in a 4U rack. So I went for the DeskPi RackMate T0 - 10" 4U Mini Server Rack.

Assembly of this was fairly straightforward. I was a little surprised to find that you can add fans into the bottom. This didn’t seem to be listed on the product page or wiki, but is in the instructions. For some reason it doesn’t include size information either, but I believe two 80mm fans would fit.

*The front of the cupboard has been modified to include 2 fans acting as an intake and exhaust to improve cooling.

**Uncertainty of it fitting will be covered in the Turing Pi section.

Raspberry Pi Rack Mount

We’ll start at the bottom with the 2U 10" Rack Mount with 4x PCIe NVMe Boards for DeskPi RackMate. The plan here was for:

• 2 Raspberry Pi 5s (Pi5), each using:
  • A Corsair 500GB NVMe drive for storage
  • A Waveshare PoE hat (G) for power
• 2 Raspberry Pi 4s (Pi4)
  • A Corsair GTX USB drive for storage
  • A Waveshare PoE hat (E) for power

Raspberry Pi 5s

The first Pi5 was fairly straightforward. It was already running HA OS, so it was a case of mounting the NVMe board to the base plate, the Pi on top, and the PoE hat on top of that. Then I had to move the OS from the USB drive it had been using previously, to the NVMe drive. I had forgotten to get a USB NVMe enclosure to do this, so had to boot Raspberry Pi OS on the device itself from another USB drive, then plug in the HA OS USB drive and transfer it to the NVMe. HA OS automatically resized on boot.

When I first booted the Raspberry Pi using the NVMe or PoE board for power, it would not boot. These boards supply power directly to the GPIO pin headers, and as a result, the Raspberry Pi seems unable to determine how much power is available. In order to prevent issues resulting from trying to draw more power than is available for things such as USB devices, the Pi refuses to boot without pushing the power button. Given there is plenty of power available through the PoE hats, the fix is quite simple. I just had to add the line usb_max_current_enable=1 to the /boot/firmware/config.txt file. I also added dtparam=pciex1_gen=3 to enable PCI Gen3 support for the NVMe drive.

The next Pi5 was a little different. The hardware setup would be the same, but it was being repurposed from elsewhere, and would be running Raspberry Pi OS Lite, and be running K3s to become part of my Kubernetes cluster. This was going to replace a Pi4 which had been running a secondary DNS server on my network, and eventually it will take over the AI workload. For now though, booted Raspberry Pi OS from a USB, and then used the Raspberry Pi Imager to prepare the NVMe. After making the same config.txt changes as the first Pi, I rebooted, and then applied my Ansible playbook for my k3s nodes.

Raspberry Pi 4s

The two Pi4s presented with some hardware difficulty. All of the PoE hats arrived with only female-female type standoffs. In order to attach the PoE hats for the Pi5s, I had used the standoffs from the other NVMe boards. After some time frustrated at having to buy more standoffs, I came up with a workaround. The holes for the standoffs in the base plate go all the way through, and the PoE hats include some longer screws. By putting the screws through the bottom of the board instead of the top, they poke out by about 2mm. The female-female standoffs can then attach to the ends of the screws. These standoffs are slightly longer than the NVMe board standoffs, so the ports on the Raspberry Pis happen to line up perfectly with the face plate.

From here, the setup of the Pi4s were straighforward. They would each be running from a Corsair GTX which I now had spare, so could be setup using the Raspberry Pi Imager from a laptop, adding the usb_max_current_enable=1 setting, and then again applying the Ansible playbook to configure them as K3s nodes.

Turing Pi

Next we will jump to the top of the rack, for reasons which will become apparent.

The Turing Pi was to be moved from another room where it sat in a Mini-ITX case. The CM4s running here had a tendency to run hot and thermal throttle. They had heatsinks, but no active cooling. Hopefully this move would allow better airflow.

I had bought the ITX mounting shelf and mounted the Turing Pi to it. I had forgotten in the planning that one of the nodes had an SSD attached to it. After mounting the Turing Pi, I noticed some holes around the edge of where the board was mounted. I have no idea if this is their intended use, but they are perfectly placed for the SSD mounting holes. Even without the SSD, the Turing Pi would take up more than 1U of space. Handily, there is a bit of space in the top of the rack. The CM4 nodes still have a little space between the top of the adapter board and the top of the rack, while the SSD touches the top and is still angled slightly (It isn’t being pushed over, the sides of the SSD are angled slightly so it naturally sits like this, but it is also touching).

With the Turing Pi attached, it had to be put into the rack lower down, and then moved up into the top position. I then drilled a hole in the blanking plate supplied with the rack chassis, and mounted it on the rear as the power port for the pico-PSU of the Turing Pi.

Network

The final component is the network switch. The main requirement here was I wanted it to support PoE at full power for the 4 Pi nodes. I selected the GigaPlus from the list at Jeff’s mini-rack page. It also has 2 SFP ports which I may play with at some point. The switch is then mounted using the 3D printed rack ears mentioned on that same page.

I typically try to use red boots for any critical network connections between switches, routers, and access points. I will sometimes use some colour coding, but it tends to be specific to where the cables are. The cables are coloured in this case but stick to a similar scheme: red are for network critical, black is for the Turing Pi, blue is for the Pi5s, and yellow for the Pi4s.

Conclusion

So was it worth it? Well…

• The “Server Cupboard” has fewer cables and looks much neater
• It is much easier to temporarily move things to a different room
• The Turing Pi has been moved freeing up valuable shelf space
• The nodes within the Turing Pi run about 10 degrees cooler and aren’t thermal throttling
• My Kubernetes cluster is upgraded with:
  • 2 more nodes, one of which is a Pi 5 which should vastly increase performance and stability
  • Increased storage volume capacity within the cluster
• I gained new knowledge about:
  • PoE
  • NVMe on Raspberry Pi
  • USB power limitations on Raspberry Pi
• I have improved/added learning platforms for future use (Kubernetes and Fibre Networking)

…but most of all, it was fun!

I will be attempting to walk 60 miles in June in aid of the National Autistic Society, usually accompanied by my beagle buddy.

Autism is an extremely misunderstood condition in our society. It may not be very apparent when someone has autism, even to those with the condition. In adults, it is often discovered due to mental health issues, which are more likely for those with Autism. The signs can be missed even by medical professionals, and people do not get the help they need.

The National Autistic Society are there to help the 700,000 autistic people in the UK and their families - be it running specialist schools, campaigning for improved rights, or training companies on being more autism-friendly. They are dedicated to transforming lives and changing attitudes.

Your donations towards my efforts are greatly appreciated, and will help in creating a society that works for all autistic people and their families.

Thank you!

This guide is only for rooted LG TVs. I am unsure if similar is possible on other TV models.

Check Remote button presses can be detected

On one of my TVs, button presses on the remote were not detected, so it’s best to check first.

1. Open the Homebrew Channel.

2. Install and open the “LG Input Hook” app.

3. It is usually easier at this point to move to use a browser on a laptop. The instructions for this are displayed at the top of the screen.

4. Check that LG Input Hook can detect button presses on your remote. To do this, scroll down to the “View logs” select dropdown. There is guidance for each option. Select the correct option, and test it by pressing a button on the remote. The key number should appear in the logs.

   

Configure Home Assistant

In order to trigger Home Assistant actions from the remote, we are going to use the REST API:

1. In Home Assistant, click you username in the bottom left, or click the button below:

   

2. Click the “Security” tab.

3. Go to “Long-lived access tokens” at the .

4. Create a new token, and make a note of it.

Setup a Key Bind

1. Back in LG Input Hook, click the “Add Keybind” button.

2. Set the ID of the button. This should appear in the logs you viewed before as id => 0/1.

3. Set the Action to Execute.

4. Set the Command to call the Home Assistant API. You will need to customise the command based on the service you want to call. Full details of the API are available on the Home Assistant documentation.

   curl --request POST -H "Authorization: Bearer <token>" -H "application/json" -d '{"entity_id": "remote.living_room_remote", "device": "surround_sound", "command": "mute"}' http://homeassistant.local:8123/api/services/remote/send_command
   

   In the above, device and command are parameters of the remote.send_command action in Home Assistant.

5. Click “Save changes”.

6. Test the key binding.

Bonus: Remap Service Buttons

The LG remotes, like many I expect, include buttons for specific streaming services. I expect services have paid a lot of money to be included on the remotes. If you don’t have these services, then they just become useless buttons on the remote, or buttons you might accidentally press causing the TV to open the app store.

You can use LG Input Hook to either disable these buttons, or remap them to a different app. For example, I have remapped one to open the Jellyfin app instead, and another for YouTube ad free. Just use a different Action for the key bind instead of “Execute” as above.

Login Issues and Changing Terms

Unfortunately, the most recent LG TV I bought has a new restriction. You cannot download apps unless you first login to LG. This seems a ridiculous requirement to me, and was made worse by their login system being broken. When I tried to create an account on the website, it just errored stating “Invalid terms type”. I contacted support, but they seemed unable to help. Best guess is they had misconfigured something, and you have to agree to more terms than what it showed as required on the page. Not wanting to legally agree to terms just to test a theory, I eventually found a workaround from a forum post almost a decade ago, which was to login at lg.com first.

To re-iterate that, this has been an issue with the LG login system for almost 10 years!

There are a few things that bother me with this saga:

• Even with screenshots of the error and a full HTTP dump from my browser, LG seemed unwilling to investigate. They seemed to want me to perform their testing for them, even suggesting I create a new email account to try with in case it is a problem with my account.
• If you don’t login, the TV doesn’t do what it is marketed to do. I was unable to login with an LG account due to their system being broken, so from my perspective, the TV is broken and should be fixed or refunded.
• Many smart products such as TVs now require you to sign up for an account, which usually involves agreeing to some terms at any point, sometimes with no notice at all. They usually also reserve the right to update the terms. This happens AFTER you make the purchase, and I am unsure if they would consider “I don’t agree to the terms”, or “You updated the terms and I no longer agree” as valid reason for a refund, even though they don’t specify anything about the terms at the time of purchase.

I was only trying to download an app, but it ended up taking days. Combined with my annoyance at YouTube putting adverts in the middle of sentences, my patience expired, and I decided to root my TVs.

Rooting My TVs

This was surprisingly straightforward, but annoyingly, you have to have the LG login working.

1. Enable dev mode

   1. Ope the LG Content Store. Search for and install “Developer Mode”.
   2. Open and login to the Developer Mode app.
   3. Set “Dev Mode Status” to “On”. The TV will reboot.

2. Enable and connect to SSH

   1. Reopen the Developer Mode app and set “Key Server” to “On”

   2. Download the SSH key from: http://<hostname>:9991/webos_rsa

   3. On linux, ensure the key file permissions are set correctly: chmod 600 ./webos_rsa

   4. Connect to the TV via SSH. You will be prompted for a passphrase, this is shown on the TV.

      ssh prisoner@<hostname> -p 9922 -o HostkeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -i ./webos_rsa
      

3. While connected to the TV via SSH, run autoroot

   1. Change to a writable directory: cd /tmp

   2. Download the autoroot script to the TV:

      wget https://github.com/throwaway96/faultmanager-autoroot/raw/refs/heads/main/autoroot.sh
      

   3. Make the script executable: chmod +x ./autoroot.sh

   4. Run the script ./autoroot.sh

   5. ⚠️ IMPORTANT: Remove the Developer Mode app! ⚠️

   6. Reboot

Post-root Configuration

After rooting, you should have the Homebrew app installed on your TV. I have seen different settings configured by default, some seem questionable for security, so I perform the following steps:

1. Open the Homebrew app
2. Select the settings cog
3. Disable Telnet
4. Disable SSH Server
5. Turn on “Block system updates”
6. Disable “Failsafe mode”

1. The page wasn’t included in the warning
2. The TODO wasn’t very visible in the page
3. Passing HTML into the shortcode would inject it into the page

So here’s the improved version:

{{/* /layouts/shortcodes/todo.html */}}
{{- warnf "TODO: %s (%s)" (.Inner | strings.TrimSpace | plainify) .Page }}
<div class="todo">
  <h6>TODO</h6>
  <div class="todo-body">{{ .Inner | strings.TrimSpace | markdownify }}</div>
</div>

/* todo.css */
.todo {
  background: rgba(255, 255, 0, 0.1);
  border: solid 1px rgba(255, 255, 0, 0.5);
  border-radius: 0.5em;
  padding: 0.5em;
}

(How you add the CSS will depend on the theme you are using)

…and here is what it looks like:

Change detected, rebuilding site (#29).
2025-03-23 21:15:42.949 +0000
Source changed /posts/2025-02-21-hugo-todo-shortcode/index.md
WARN  TODO: Rework content here... (/workspaces/g-de.co.uk/content/posts/2025-02-21-hugo-todo-shortcode/index.md)
Web Server is available at http://localhost:1313/ (bind address 127.0.0.1)
Total in 12 ms

Features of the new version:

• The body is parsed as markdown, allowing rich markdown content, but preventing HTML
• The build warning now includes the page location
• The styling makes the todo much more visible in the page*

*This may require adjustments to better stand out in your theme.

Here’s a simple Hugo shortcode to help track todo items while authoring pages.

{{/* /layouts/shortcodes/todo.html */}}
{{- warnf "TODO: %s" .Inner }}
<span>TODO: {{ .Inner }}</span>

You can then insert a TODO into page content as follows:

{{< todo >}}Rework content here...{{< /todo >}}

When you build the site, it will output a warning to the console to remind you the content is unfinished:

Change detected, rebuilding site (#18).
2025-02-21 12:36:59.795 +0000
Source changed /posts/2025-02-21-hugo-todo-shortcode.html
WARN  TODO: Rework content here...
Web Server is available at http://localhost:1313/ (bind address 127.0.0.1)
Total in 7 ms

If preferred, you could make this an error rather than a warning, or remove the span element so that the text doesn’t show in the page.

Table Structure

Recessed Center Play Area

The center of the table is a felt-lined recessed play space with LED lighting. It is sized for the largest footprint in my collection, Ticket to Ride: Japan.

Raised Player Areas

Each player also has an felt-lined area for their individual components.

Cup Holders

Each player has a cup holder recessed into the table to minimise the risk of spillages.

Hidden Storage Space

One end of the table contains the electronics, the other contains a small hidden storage space.

Completely Covered for Dining

The lid of the table completely covers the play space for dining. This also ensures that any spillages will be mostly directed away from the play surface.

Software and lighting

The electronics are controlled via an ESP32 micro-controller running ESPHome.

Standby Lighting

When in standby mode, the inner light track will display various lighting effects.

Starting Player Selector

When enabled, the table will randomly select a starting player, including a variety of suspense building effects.

Player Colour Indicators

During game play, the inner light track will display a player’s colour so that they can be easily identified.

Current Player Tracking

For turn-based games, the current player will be indicated by their player colour pulsing on the inner light track. Their player button will also flash to indicate it is their turn. At the end of their turn, they push the button to move to the next player.

Alternate Game Types

Quiz game mode is also available for games where you need a “fastest finger first” style of play, and a timed mode for games where a timer is needed for each round (video shows at x2 speed). If you just want player colours to show, you can select the “Other” game type.

Winner Celebration

You can indicate which player won the game. The table will display their colour to celebrate.

Control Panel

The control panel uses a LocalDeck running ESPHome for control via Home Assistant.

Mode Buttons

The mode buttons indicate and allow selecting the current mode for the table.

The colour of the Off button indicates if the table is in Standby mode (Blue), or Off (Red).

Setup

Player colours can be more easily selected via the control panel. Press a player button, then a colour.

Settings

Settings such as game type, starting player selector (Inspired by Chwazi), and player button functionality can be quickly changed from the control panel.

Playing

When playing, the current player will be highlighted. Player button functionality can also be adjusted mid-game.

Winner

A winner can be selected to have the table show their colour to celebrate.

Media Controls

The media buttons can be used to control an Amazon Alexa. The playlist button will start a pre-configured playlist, while the “BT” button will ask Alexa to connect to my phone.

Home Assistant Integration

The table is integration into Home Assistant. This was the initial method of controlling the table. While this is still possible, is now primarily controlled via a physical Control Panel.

The table is still integrated with Home Assistant, as it will automatically control the smart plug powering the inner LED string, and dim the lights for dramatic effect while selecting the starting player.

The Bucket List- There are so many amazing places in this world you’ve wanted to visit. With your bucket list written—now is the time to journey out and experience the world in one big life-fulfilling trip!

Each player begins the game with a Bucket List card, which has eight locations around the world they can visit. At the end of your turn, if you are on a location that matches any location on your Bucket List, “cross off” that location — then gain the Itinerary token depicted on there, either a Sightseeing token or a Worldly token.

Travel Personas- At setup, each player is given 2 Travel Persona cards to choose from. One is discarded, and the one that is kept becomes your Travel Persona for the game. The Travel Personas grant unique powers to use throughout the game and also offer a starting boost with new sets of starting tokens.

Note: The Bucket List expansion came packaged inside the base game’s box for Kickstarter backers, but will be sold by itself.

—description from the publisher

In Machi Koro 2, veteran players will notice some big changes. Under the new zoning laws, players receive a limited budget to choose their own starting establishments. The available cards are pulled from three decks and arranged for all to see. It’s a race to grab the coolest new establishments and landmarks in the land!

The cards in this set have exciting, never-before-seen effects. But choose what you build wisely, as your landmarks might also benefit your opponents! With more variety than ever before, no two games will be the same. Machi Koro 2 will have fans visiting again and again!

—description from publisher

In Braggart, a game of heroes, lies and unfortunate fish, each round players play cards from their hand which each contain a part of their story to combine them into a compelling tale. Stories are by turns hilarious or awe-inspiring and other players can accept them or accuse them of lying, downgrading their boast into something much less impressive (though usually much funnier!).

In Exit: The Game – The Secret Lab, players must use their team spirit, creativity, and powers of deduction to crack codes, solve puzzles, collect objects, and earn their freedom bit by bit.

Extra material: It is highly recommended that you have pens/pencils, writing paper and scissors at hand when you play the game. Note: There is a printing error in the first English Edition on the 2nd ‘Star’ clue card. Please refer to the forums if you are confused after using that clue card.

In 2003 re-published by Überplay.

In 2003 published with a new theme by Amigo as Einfach Tierisch.

In 2006, published by University Games as Animalement Vôtre (French version) and Beestenveiling (Dutch version).

In 2008, re-published by Eagle-Gryphon Games

In 2018, re-published by Osprey Games

With the simplicity of UNO and depth of Gin Rummy, Mantis is designed for both kids and adults. But adults should be warned that kids will often beat them at this game.

Memoir ‘44 includes over 15 different battle scenarios and features a double-sided hex game board for both beach landings and countryside combat. Each scenario mimics the historical terrain, troop placements and objectives of each army. Commanders deploy troops through Command and Tactic cards, applying the unique skills of his units – infantry, paratrooper, tank, artillery, and even resistance fighters – to their greatest strength.

“By design, the game is not overly complex”, says Memoir ‘44 designer, Richard Borg. “The game mechanics, although simple, still require strategic card play, timely dice rolling and an aggressive yet flexible battle plan to achieve victory.” In addition to the large, double-sided gameboard, Memoir ‘44 includes 144 amazingly detailed army miniatures - including historically accurate infantry, tanks and artillery; 36 Obstacle pieces, 60 illustrated Command cards, 44 Special Terrain tiles, and 8 Custom Wooden dice.

Memoir ‘44 is designed for 2 players but easily accommodates team play. With Memoir ‘44 Overlord scenarios, players can use multiple boards and up to 8 players to conduct large scale operations, experiencing the challenges of troop coordination and military chain of command on a large scale battlefield. Average game length is between 30 and 60 minutes, encouraging match play where players can command first one side and then the other.

The Memoir ‘44 series consists of the base game and a number of expansions.

This game is based upon Richard Borg’s Command and Colors system.

Strategically position your animal by the moonstones, activate their capabilities at the right time, and be careful not to stay too long in the shadow of the Great Elder Tree!

This expansion requires the base game to play.

—description from publisher

Ticket to Ride Map Collection 2: India & Switzerland presents players with two scenarios:

• India from Ian Vincent – On this game board for 2-4 players, in addition to scoring points for claiming routes and completing tickets, a player can also score points in two other ways. First, the player with the longest continuous path of trains receives a ten point bonus. Second, each player scores bonus points for connecting the cities on one or more tickets with two distinct routes. The first two such tickets earn five additional points each, and the next three earn ten points each for a maximum bonus of 40 points.

• Switzerland from Alan R. Moon – This is a reprint of Ticket to Ride: Switzerland, first published in 2007. This game board is for 2-3 players only. Instead of connecting only cities, some destination tickets connect a city to a country or one country to any of those surrounding Switzerland; a player who completes such a ticket scores the highest point value for which they qualify. Unlike most other TtR games, discarded tickets are removed from the game instead of being returned to the ticket deck. Also, Locomotives can be used only to build tunnels.

Part of Ticket to Ride series.

In the game, you take turns building out your own terrain area and populating it with wildlife. You start with three hexagonal habitat tiles (with the five types of habitat in the game), and on a turn you choose a new habitat tile that’s paired with a wildlife token, then place that tile next to your other ones and place the wildlife token on an appropriate habitat. (Each tile depicts 1-3 types of wildlife from the five types in the game, and you can place at most one tile on a habitat.) Four tiles are on display, with each tile being paired at random with a wildlife token, so you must make the best of what’s available — unless you have a nature token to spend so that you can pick your choice of each item.

Ideally you can place habitat tiles to create matching terrain that reduces fragmentation and creates wildlife corridors, mostly because you score for the largest area of each type of habitat at game’s end, with a bonus if your group is larger than each other player’s. At the same time, you want to place wildlife tokens so that you can maximize the number of points scored by them, with the wildlife goals being determined at random by one of the four scoring cards for each type of wildlife. Maybe hawks want to be separate from other hawks, while foxes want lots of different animals surrounding them and bears want to be in pairs. Can you make it happen?

Each player is a deadly disease and they must battle against each other to spread their plagues, develop new symptoms and ultimately wipe out humanity.

Starting with Patient Zero, you spread your infection across the world by placing tokens in cities - earning DNA points and preventing other players from becoming dominant. Players choose which countries are placed on the board but you must be both climate resistant and connected to a country before you can infect it. Eventually, as countries become fully infected - you try to kill them using the Death Dice.

Each player’s unique pathogen can be upgraded by evolving trait cards onto an evolution slide (with DNA points). At the start, your disease is weak and unspecialised, so you will need to add new symptoms to make it stronger. Choose carefully and plan ahead in order to react to the changing world and exploit opportunities created by other player’s actions.

A simple nosebleed could accelerate things early on, whilst diarrhea will help you thrive in hot countries. Sneezing can infect new continents by air but Total Organ Failure would allow you wipe out multiple countries each turn.

As countries start to fall, use powerful event cards to alter the balance of power. You might try to eradicate a dominant player by bombing their diseased cities, or hold the Olympics to cause huge numbers of infected people to travel to a healthy continent.

When the world collapses, who will be the ultimate plague?

*5 players with 5th player expansion

Overview

Module 1, which includes the longer Race track and the new Supporting dice, makes for a longer and more exciting game, as Camels may move twice per Leg now. Also, you may spice this module up with an additional action.

Module 2 includes the Photographer and gives rewards for correctly predicting the movement of Camel stacks.

Module 3 introduces bets on positions, which makes betting more flexible.

Module 4 introduces Betting Partnerships, which allow players to cooperate more openly in games with 6 or more players.

In the Japan half of the expansion, some routes are reserved for the Bullet Train network, and once such a route is claimed, it can be used by all players to complete destination tickets. To claim such a route, discard a number of cards equal to the length of the route with all the card being the same color, then mark the route with a single Bullet Train miniature; instead of scoring points for such a route, advance your marker on the separate Bullet Train track as many spaces as the length of this route. At the end of the game, whoever has contributed the most to this shared project receives the largest bonus, with the player who contributes least being penalized.

This game board also has a small inlay for the Tokyo subway system, so players are effectively working on two networks at once. You might have a ticket that lists a city outside Tokyo and a station with Tokyo, and you need to complete a route from that other city to Tokyo, then from the central Tokyo station to that particular subway station.

In Italy, the game board is divided into regions, and players score bonus points based on how many regions they connect in their network, with three regions — Sardegna, Sicilia, and Puglia — counting as two regions in your tally. If you have separate networks, then you score each one separately.

The board also introduces a new type of ferry route. On this game board, all gray routes are ferry routes, with these routes having 1-4 spaces marked with a wave symbol. To cover a wave symbol, you must play a locomotive or a ferry card from your hand (in addition to the other cards needed to claim this route); a ferry card is a special type of card that can be drafted on its own on your turn, and it contains two wave symbols, so it can be used on its own to cover two symbols on a route.

The player trains and game cards from Ticket to Ride or Ticket to Ride: Europe are needed to play this expansion.

More than just a new map, Ticket to Ride: Europe features brand new gameplay elements. Tunnels may require you to pay extra cards to build on them, Ferries require locomotive cards in order to claim them, and Stations allow you to sacrifice a few points in order to use an opponent’s route to connect yours. The game also includes larger format cards and Train Station game pieces.

The overall goal remains the same: collect and play train cards in order to place your pieces on the board, attempting to connect cities on your ticket cards. Points are earned both from placing trains and completing tickets but uncompleted tickets lose you points. The player who has the most points at the end of the game wins.

Copyright 2002-2014 Days of Wonder, inc.

Part of the Ticket to Ride series.

They thought the secret of Warwick mansion had been solved and the spirit had found peace, but now new signs have emerged that were previously hidden. New suspects, places, and objects that do not fit into the picture — and the presence of the ghost is strong once again.

In Mysterium: Hidden Signs, the spiritualists must return to the old mansion and investigate these disturbing visions. Will they understand all the instructions this time and give the ghost its final rest?

Through careful planning, you must make the most out of your turn, taking the available actions in whichever order you consider most beneficial. But be careful, as each of your opponents can choose to follow each action you take by expending valuable resources. This means that it can always be your turn, even when it is someone else’s turn!

Players will colonize new planets throughout the game, thereby earning victory points and accumulating special abilities which they can activate for their galactic empire. Careful spending of resources will ensure the fastest growth of your empire, while allowing you to receive the biggest possible pay‐off from the actions you take.

Will your influence be enough to control the most powerful planets in the galaxy? Will you be able to meet your secret objective along the way? Will your empire stand victorious?

Tiny Epic Galaxies FAQ

Like its brethren, Star Fluxx is the game of ever changing rules. It starts out as Draw 1, Play 1, but even that can change. When a Goal card is played, you can win by meeting the Goal, usually by having the correct Keeper cards in front of you. Action and Surprise cards help you to meet the Goal, or stop your opponent. Creeper cards usually prevent you from winning, but are sometimes necessary to meet the Goal.

As in Trivial Pursuit and The Game of Life, Therapy is a race to collect six pieces (one for each of the six phases of life). Pieces are not only granted for correctly answering questions, but also for guessing what your fellow players answer while they are in therapy. Depending on the version, you will play with different unusual playing pieces (e.g. tiny psychiatry couches and brain lobes).

Recommended for Ages 16 and up

First player to reach the center of the Helipad tile and kill the Zombie there, or kill a total of 25 Zombies wins. When a player is killed they move back to the starting tile and lose half their Zombie kills.

Zombies!!! is the original game in the Zombies!!! series.

Players roll all 5 dice to setup the start positions of the camels. On each leg, players pick one betting card for each color camel, showing how many coins they will win/lose, depending on the camel’s position after the leg. The dice are then rolled in the pyramid dice roller, which allows one die to come out at a time and moves the matching color camel. Players can also place oasis cards to earn extra coins. After all 5 camels are moved, bets are resolved and a new leg start. Play continues until a camel passes the finish line.

Once a camel crossess the finish line, all end of race bets are resolved and the player with the most coins wins.

Unable to talk, the amnesiac ghost communicates with the mediums through visions, which are represented in the game by illustrated cards. The mediums must decipher the images to help the ghost remember how he was murdered: Who did the crime? Where did it take place? Which weapon caused the death? The more the mediums cooperate and guess well, the easier it is to catch the right culprit.

In Mysterium, a reworking of the game system present in Tajemnicze Domostwo, one player takes the role of ghost while everyone else represents a medium. To solve the crime, the ghost must first recall (with the aid of the mediums) all of the suspects present on the night of the murder. A number of suspect, location and murder weapon cards are placed on the table, and the ghost randomly assigns one of each of these in secret to a medium.

Each hour (i.e., game turn), the ghost hands one or more vision cards face up to each medium, refilling their hand to seven each time they share vision cards. These vision cards present dreamlike images to the mediums, with each medium first needing to deduce which suspect corresponds to the vision cards received. Once the ghost has handed cards to the final medium, they start a two-minute sandtimer. Once a medium has placed their token on a suspect, they may also place clairvoyancy tokens on the guesses made by other mediums to show whether they agree or disagree with those guesses.

After time runs out, the ghost reveals to each medium whether the guesses were correct or not. Mediums who guessed correctly move on to guess the location of the crime (and then the murder weapon), while those who didn’t keep their vision cards and receive new ones next hour corresponding to the same suspect. Once a medium has correctly guessed the suspect, location and weapon, they move their token to the epilogue board and receive one clairvoyancy point for each hour remaining on the clock. They can still use their remaining clairvoyancy tokens to score additional points.

If one or more mediums fail to identify their proper suspect, location and weapon before the end of the seventh hour, then the ghost has failed and dissipates, leaving the mystery unsolved. If, however, they have all succeeded, then the ghost has recovered enough of its memory to identify the culprit.

Mediums then group their suspect, location and weapon cards on the table and place a number by each group. The ghost then selects one group, places the matching culprit number face down on the epilogue board, picks three vision cards — one for the suspect, one for the location, and one for the weapon — then shuffles these cards. Players who have achieved few clairvoyancy points flip over one vision card at random, then secretly vote on which suspect they think is guilty; players with more points then flip over a second vision card and vote; then those with the most points see the final card and vote.

If a majority of the mediums have identified the proper suspect, with ties being broken by the vote of the most clairvoyant medium, then the killer has been identified and the ghost can now rest peacefully. If not, well, perhaps you can try again…

You must succeed. You are the brave men and women of fire rescue; people are depending on you. This is what you do every day.

Flash Point: Fire Rescue is a cooperative game of fire rescue.

There are two versions of game play in Flash Point, a basic game and expert game. In both variants, players are attempting to rescue 7 of 10 victims from a raging building fire. As the players attempt to rescue the victims, the fire spreads to other parts of the building, causing structural damage and possibly blocking off pathways through the building. Each turn a player may spend action points to try to extinguish fires, move through the building, move victims out of the building or perform various special actions such as moving emergency vehicles. If 4 victims perish in the blaze or the building collapses from taking too much structural damage, the players lose. Otherwise, the players win instantly when they rescue a 7th victim.

The expert variant included in the game adds thematic elements such as flash over, combustible materials, random setup, and variations on game difficulty from novice to heroic. The game includes a double sided board with two different building plans and several expansion maps are available.

The main board is for 3-5 players played out over a city map for sector control. A 2-player map is included for the Guardians of the Galaxy card game.

In Cards Against Humanity, play begins with a judge, known as the “Card Czar”, choosing a black question or fill-in-the-blank card from the top of the deck and showing it to all players. Each player holds a hand of ten white answer cards at the beginning of each round, and passes a card (sometimes two) to the Card Czar, face-down, representing their answer to the question on the card. The card czar determines which answer card(s) are funniest in the context of the question or fill-in-the-blank card. The player who submitted the chosen card(s) is given the question card to represent an “Awesome Point”, and then the player to the left of the new Card Czar becomes the new Czar for the next round. Play continues until the players agree to stop, at which point the player with the most Awesome Points is the winner.

This, so far, sounds like the popular and fairly inoffensive Apples to Apples. While the games are similar, the sense of humor required is very different. The game encourages players to poke fun at practically every awkward or taboo subject including race, religion, gender, poverty, torture, alcoholism, drugs, sex (oh yes), abortion, child abuse, celebrities, and those everyday little annoyances like “Expecting a burp and vomiting on the floor”.

In addition, there are a few extra rules. First, some question cards are “Pick 2” or cards, which require each participant to submit two cards in sequence to complete their answer. Second, a gambling component also exists. If a question is played which a player believes they have two possible winning answers for, they may bet an Awesome Point to play a single second answer. If the player who gambled wins, they retain the wagered point, but if they lose, the player who contributed the winning answer takes both points.

From the website:

“Cards Against Humanity is distributed under a Creative Commons Attribution-Noncommercial-Share Alike license - that means you can use and remix the game for free, but you can’t sell it.”

The game has players at a new colony location trying to survive with new survivors against brand new challenges. Can you handle being raided by members of other colonies? Will you explore more and unravel the mysteries of the Raxxon pharmaceutical location to find powerful items but release stronger enemies? Or will you upgrade your colony to help it better withstand the undead horde? These are all choices you will get to make in this new set, and if you want, you can mix in the survivors and cards from the original set to increase the variety even more.

Part of the Dead of Winter series.

—description from the publisher

In One Night Ultimate Vampire, the sun has just set, and vampires have descended on your sleepy little town, slowly turning the villagers into even more vampires. Fortunately, the village has several residents with special powers, with most willing to help eliminate this fanged menace!

One Night Ultimate Vampire is a fast game for 3-10 players in which everyone gets a role: The nefarious Vampire, the well-meaning Cupid, the sneaky Assassin, or others, each with a special ability. In the course of a single evening, your village will decide who among them is a vampire…because all it takes is finding one vampire to win!

One Night Ultimate Vampire can be combined with One Night Ultimate Werewolf or One Night Ultimate Werewolf Daybreak or both games.

One Night Ultimate Werewolf is a fast game for 3-10 players in which everyone gets a role: One of the dastardly Werewolves, the tricky Troublemaker, the helpful Seer, or one of a dozen different characters, each with a special ability. In the course of a single morning, your village will decide who is a werewolf…because all it takes is lynching one werewolf to win!

Because One Night Ultimate Werewolf is so fast, fun, and engaging, you’ll want to play it again and again, and no two games are ever the same.

This game can be combined with One Night Ultimate Werewolf: Daybreak.

Assassin Module: Ever since we announced The Resistance: Avalon the request has been to take the exciting new roles from Avalon and make them available for The Resistance. We are very excited to now make that available - the Assassin module of Hidden Agenda contains all the Avalon roles, rethemed and renamed to fit into The Resistance Universe.

Defector Module: Two variants in one, the Defectors were included as part of the Avalon promos. In one variant, the Defectors can switch allegiance during the game - ensuring that players are never quite certain who to trust. In the second variant version the two Defectors know each other - ensuring that the accusations of deceit begin from the very opening of the game.

Trapper Module: Every proposed Mission Team includes an extra person that won’t go on the mission. The leader will isolate a team member and watch their every move - making sure they can’t make the mission fail. If you are a spy on the Mission Team, you’ll never know if you will cause a mission to fail or simply be giving your identity away. But resistance members will have to approve some missions knowing that a spy is on them and trust that the leader chooses to isolate the spy.

The first printing of Hidden Agenda omitted the rules for optional character powers. Those rules can be found here elsewhere on this site.

Includes 25 new cards (89mm x 64mm) and 1 team token.

The Resistance is a party game of social deduction. It is designed for five to ten players, lasts about 30 minutes, and has no player elimination. The Resistance is inspired by Mafia/Werewolf, yet it is unique in its core mechanics, which increase the resources for informed decisions, intensify player interaction, and eliminate player elimination.

Players are either Resistance Operatives or Imperial Spies. For three to five rounds, they must depend on each other to carry out missions against the Empire. At the same time, they must try to deduce the other players’ identities and gain their trust. Each round begins with discussion. When ready, the Leader entrusts sets of Plans to a certain number of players (possibly including himself/herself). Everyone votes on whether or not to approve the assignment. Once an assignment passes, the chosen players secretly decide to Support or Sabotage the mission. Based on the results, the mission succeeds (Resistance win) or fails (Empire win). When a team wins three missions, they have won the game.

Rule Correction:

For first printing (2010 purchases), the expansion rules should read: “Games of 5-6 players use 7 plot cards, games with 7+ players use all 15 Plot Cards.” and “…each Round, the leader draws Plot cards (1 for 5-6 players, 2 for 7-8 players, and 3 for 9-10 players)” - This has been corrected in the subsequent printings.

In more detail, each team has their own screen, and in this screen they tuck four cards in pockets numbered 1-4, letting everyone on the same team see the words on these cards while hiding the words from the opposing team. In the first round, each team does the following: One team member takes a code card that shows three of the digits 1-4 in some order, e.g., 4-2-1. They then give a coded message that their teammates must use to guess this code. For example, if the team’s four words are “pig”, “candy”, “tent”, and “son”, then I might say “Sam-striped-pink” and hope that my teammates can correctly map those words to 4-2-1. If they guess correctly, great; if not, we receive a black mark of failure.

Starting in the second round, a member of each team must again give a clue about their words to match a numbered code. If I get 2-4-3, I might now say, “sucker-prince-stake”. The other team then attempts to guess our numbered code. If they’re correct, they receive a white mark of success; if not, then my team must guess the number correctly or take a black mark of failure. (Guessing correctly does nothing except avoid failure and give the opposing team information about what our hidden words might be.)

The rounds continue until a team collects either its second white mark (winning the game) or its second black mark (losing the game). Games typically last between 4-7 rounds. If neither team has won after eight rounds, then each team must attempt to guess the other team’s words; whichever team guesses more words correctly wins.

The best part of the game occurs when everyone debates the scenarios that have been presented to the judge. “Does it include online store sales or just in-person sales?” “How much poop are we talking: a rabbit pellet or an uncomfortable amount?”

The best part of the game occurs when everyone debates the scenarios that have been presented to the judge: “Does it include online store sales or just in-person sales?”, or “How much poop are we talking: a rabbit pellet or an uncomfortable amount?”

The card deck consists of five different colors of cards, numbered 1–5 in each color. For each color, the players try to place a row in the correct order from 1–5. Sounds easy, right? Well, not quite, as in this game you hold your cards so that they’re visible only to other players. To assist other players in playing a card, you must give them hints regarding the numbers or the colors of their cards. Players must act as a team to avoid errors and to finish the fireworks display before they run out of cards.

An extra suit of cards, rainbow colored, is also provided for advanced or variant play.

Hanabi was originally published as part of Hanabi & Ikebana.

To play the game, you shuffle the 104 number cards, lay out four cards face-up to start the four rows, then deal ten cards to each player. Each turn, players simultaneously choose and reveal a card from their hand, then add the cards to the rows, with cards being placed in ascending order based on their number; specifically, each card is placed in the row that ends with the highest number that’s below the card’s number. When the sixth card is placed in a row, the owner of that card claims the other five cards and the sixth card becomes the first card in its row.

In addition to a number from 1 to 104, each card has a point value. After finishing ten rounds, players tally their score and see whether the game ends. (Category 5 ends when a player has a score greater than 74, for example, while 6 nimmt! ends when someone tops 66.) When this happens, the player with the fewest points wins!

6 nimmt! works with 2-10 players, and the dynamics of gameplay change the more players that you have. One variant for the game has you use 34 cards, 44 cards, 54 cards, etc. (instead of all 104 cards) when you have three, four, five, etc. players. This change allows you to know which cards are in play, thereby allowing you to track which cards have been played and (theoretically) make better choices as to which card to play when.

What causes this game to truly stand out among co-op and competitive games alike is the extreme detail that has been paid to the physical components of the game. It comes in a sturdy and organized tin of good shelf storage size. The plastic treasure pieces and wooden pawns are well crafted and they fit just right into the box. The cards are durable, well printed, and easy to understand. The island tiles are the real gem: they are screen-printed with vibrant colors, each with a unique and pleasing image.

With multiple levels of difficulty, different characters to choose from (each with a special ability of their own), many optional island formats and game variations available, Forbidden Island has huge replay value. The game can be played by as few as two players and up to four (though it can accommodate five). More players translates into a faster and more difficult game, though the extra help can make all the difference. This is a fun game, tricky for players of almost any age. Selling for under twenty dollars, oddly, Forbidden Island is a rare game of both quality and affordable price. For those who enjoy Forbidden Island, a follow-up project by Gamewright titled Forbidden Desert was released in 2013.

From the publisher’s website:

Dare to discover Forbidden Island! Join a team of fearless adventurers on a do-or-die mission to capture four sacred treasures from the ruins of this perilous paradise. Your team will have to work together and make some pulse-pounding maneuvers, as the island will sink beneath every step! Race to collect the treasures and make a triumphant escape before you are swallowed into the watery abyss!

In Forbidden Desert, a thematic sequel to Forbidden Island, players take on the roles of brave adventurers who must throw caution to the wind and survive both blistering heat and blustering sand in order to recover a legendary flying machine buried under an ancient desert city. While featuring co-operative gameplay similar to Forbidden Island, Forbidden Desert is a fresh, new game based around an innovative set of mechanisms such as an ever-shifting board, individual resource management, and a unique method for locating the flying machine parts.

This latest installment in the Forbidden… game series takes you to new heights with several novel challenges, including collectively planning a terrain using only limited information and constructing a real electrical circuit.