Book of Lost Spells On Sale Now

It's out? Cool!

And now I'm *really* nervous!

Cheers!

 

[MerricB]

For Caustic Spittle, I think the biggest potential issue is being able to use it from stealth. If you get the jump on someone, you can easily do like 8d6 to 12d6, which is pretty crazy for a level 1 spell.

Just on that situation, I'd normally rule that casting it breaks stealth (they can hear you), so combat would begin immediately.

Note that to use it for 12d6 damage, you have to hold it for nine rounds - that's a lot longer than most combats go for. And while you hold it, you can't have other concentration spells active.

That said, it does have the potential to be broken. I'd like to see if players can do it!

Cheers!

 

[MerricB]

Another spell question while you are around...

For Molten Strike, it explicitly mentions the material component needs to be within 5 feet of you. Except you normally don't need the material component if you have an arcane focus. Is this an exception to that, or is it supposed to be consumed?

Also, is the casting time for it really supposed to be 10 minutes? Not sure how you would use it in combat if so

Argh! Header error strikes again!

It should be 1 action casting time.

I'd run it as an exception to the arcane focus rule.

Cheers!

 

[Nebulous]

Ah, yeah, I would rate that as OP. It's like the Lucky feat, but 5 points instead of 3, and at the super cheap cost of a 4th level spell slot instead of a feat. Or compare fighter indomitable, a once/day reroll they get at 10th.

I would amend it to 1 fortune point for a 4th level slot (given the 1 day duration, you can use it when you most need it). Then add 1 fortune point per 2 spell levels, so 2 points at 6th, 3 points at 8th.

At first blush, that does seem way too powerful.

 

[painted_klown]

Hey all, I just ordered up a physical copy of this today. I downloaded the PDF version, but haven't yet had time to go through it. Excited to read it over.

 

[transtemporal]

Yikes... the froggodgames checkout seems to be transmitting credit card numbers over a plain old unsecured http connection. Can anyone with a bit more security background confirm that?

 

[HarrisonF]

Yikes... the froggodgames checkout seems to be transmitting credit card numbers over a plain old unsecured http connection. Can anyone with a bit more security background confirm that?

It does seem to be doing so. Glad I paid with Paypal!

 

[Charles Wright]

Checking on that with our web guy, now.

 

[Charles Wright]

Out of personal curiosity, how are you determining that the connection is unsecure?

 

[FormerlyHemlock]

Out of personal curiosity, how are you determining that the connection is unsecure?

One way is to use Fiddler (the web debugger) to watch yourself when you hit the "Review order" button. You can see that it's POSTing on http, not https (s = "secure"), which means that anybody on the Internet between you and Frog God could see the response. For example, an employee at my Internet ISP could theoretically see the following request that I sent by pressing the "Review Order" button. Important parts are in bold and underlined.

POST http://froggodgames.org/cart/checkout HTTP/1.1
Host: froggodgames.org
Connection: keep-alive
Content-Length: 1249
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://froggodgames.org
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://froggodgames.org/cart/checkout
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: SESScc1f44852c5ccd60bbd50900320207fe=P8MvfcLzJ6Ng9W1u34ZCjwDaQVNZUB3rAoIuXDjrwrQ; _gat=1; has_js=1; _ga=GA1.2.2005799827.1423092023

panes%5Bcustomer%5D%5Bprimary_email%5D=[snip private info]%5D%5Bcc_number%5D=222222222&panes%5Bpayment%5D%5Bdetails%5D%5Bcc_exp_month%5D=1&panes%5Bpayment%5D%5Bdetails%5D%5Bcc_exp_year%5D=2015&panes%5Bpayment%5D%5Bdetails%5D%5Bcc_cvv%5D=333&panes%5Bcomments%5D%5Bcomments%5D=&form_build_id=form-KmNAQYK0ijIcRleCIZhd6DeBubTTMI_BRBzKqDQSu38&form_token=pyCd8Mlr8Di7sYg24VQbDulpaL7blDko6cqsF1mpftg&form_id=uc_cart_checkout_form&op=Review+order

Another way to find this same info would be to look at the HTML/JavaScript, but for me it was quicker just to start up Fiddler and use it to watch traffic.

 

[Charles Wright]

Thank you emdw45.

From our Webmaster:

We have an SSL (secure socket layer) on the server. I will contact Hostmonster and see what's up.

--------

Just wanted to let you folks know that we're trying to figure out what's going on.