Are there any official CR 8 beasts that are not dinosaurs, for the purpose of the Polymorph spell?

Although the party wizard has had a wand of polymorph since finding it in a hand-converted U3: The Final Enemy (before the release of Ghosts of Saltmarsh), she has typically used it defensively, turning enemies into slugs and such. Only recently has she begun to use it offensively. After fighting some carnivorous apes, she turned the 7th-level barbarian in the party into a CR 7 Giant Ape when he was low on HP.

Per the description of the polymorph spell:

The new form can be any beast whose challenge rating is equal to or less than the target’s (or the target’s level, if it doesn’t have a challenge rating).

As a result of that battle, the party has leveled up, and the wizard can now polymorph the barbarian into a beast of CR 8.

Unfortunately, I know of only one CR 8 creature that is a beast – the Tyrannosaurus rex. While RAW there is no restriction on using polymorph to achieve forms that the character has not seen before, it would harm the verisimilitude of my game, in which none of the characters have even heard of dinosaurs.

Do any official published products include CR 8 beasts that are not dinosaurs?

Is the Midgard Heroes Handbook Centaur race considered as Medium, or Large, for the purpose of grappling and shoving?

In the "Midgard Heroes Handbook" from the Kobold Press, there is a playable character race, the Centaur. Their size is rather unique – a Medium/Large hybrid, so to speak :

Size. Centaurs stand between 8 and 9 feet tall and weigh in excess of 1,000 pounds. Your size is Large.

Humanoid Torso. Although you are Large, you wield weapons and wear armor sized for a Medium creature, thanks to the proportions of your humanoid torso.

It is clear to me that, as a creature with a Large, equine lower part, a Midgard Centaur can be ridden by a Medium creature (provided they’re wearing a saddle), but as a creature with a Medium, humanoid upper part, they cannot wield oversized weaponry.

But what about grappling and shoving ? Are they considered Large, or Medium for such things ? I can see an argument for either interpretation – since they’re of Large category, but have Medium sized hands…

What’s the purpose behind this phishing attempt?

As probably all of you, I got an email that was intended as a phishing attack.

The HTML version of the email was pretending to be a Facebook email of a security warning.

phishing image

The links do lead to Facebook, for an account-switching crafted URL. I get that one.

However, the text version of the email has something like this:

mailto:xxx@stanforduni.com;xxx@massachusettsins.co.uk;xxx@e-irosky.me;xxx@harvarduni.org;xxx@univofcambridge.eu;xxx@univofoxford.com;xxx@yandex.ru;xxx@yandex.ua;xxx@yandex.kz;xxx@yandex.by;xxx@yandex.com;xxx@mail.ru;xxx@yahoo.com;xxx@aol.com;xxx@gmail.com 

(I redacted out usernames from those addresses.)

Some of those names seem to be related (maybe the same person across multiple domains?). Some others seem generic but on a similar vein (mostly universities).

My question is: what’s the purpose of this "attack"? Clicking on those would trigger my email client to prepare an email for all those addresses. What does an attacker gain out of this?

What’s the purpose of signatures in Google Maps APIs?

There’s something I don’t understand about signatures in Google Maps APIs.

The documentation says "We strongly recommend that you use both an API key and digital signature, regardless of your usage". In this case we are talking about the Maps Static API, where requests are made by the frontend with a URL that generates an image to embed on your website. API keys should be restricted by referrer, so nobody else will be able to steal your key and use it in another project. So what’s the purpose of also adding a signature to the request?

As far as I know, signatures are used to make sure the request isn’t modified by an attacker. But I don’t think any parameters in Google Maps APIs can be abused in this case. What’s even more confusing is the fact that if you check out other Google Maps APIs like the Distance Matrix API or the Roads API, they only recommend you restrict your API key (by referrer) and don’t mention anything about adding a signature.

So is a signature really needed or not? And why?

For the Purpose of Detect Magic and Identify. Would a Magic item that ran out of power for the moment be considered a magic item?

If a magic item runs on "Magic Batteries" when the Item is out of power would it be considered a magic time for the purpose of the Identify and Detect Magic spell?

For example, I have a Mirror that shows through illusions, it has crystals around it that are destroyed as you used it, you can replace the crystals for more uses when it has no crystals, would it still be considered a magic item detectable by the spells?

Would the same work for items with charges that recharge at dawn? If the item has 0 charges and is not dawn yet, would it be still be considered a magic item?

Purpose of randomization/derandomization in basic randomized algorithm for MAX SAT

In Sections 5.1 of The Design of Approximation Algorithms by Williamson and Shmoys, they describe a basic randomized algorithm for MAX SAT and how to derandomize it. The algorithm is just to assign each variable 1 (true) with probability 1/2 and 0 (false) with probability 1/2. In other words, sample uniformly at random from the space of all solutions. They show that this is a 1/2-approximation.

Then in Section 5.2, they describe how to derandomize it using the method of conditional expectations. (I won’t describe the process here because it is not very complex and widely known I’m assuming.)

My question is, why bother derandomizing this way? Or even, why bother making the algorithm random in the first place?

It seems to me that an equally good algorithm would be the one-liner which deterministically sets all variables to 1. Given some MAX SAT instance as input, it seems to me that you would also expect this to (i.e., "in expectation it would") satisfy half of the clauses. To me, the analysis of the random algorithm really seems to say that any fixed guess is "good." (Rather than showing that our random algorithm is inherently good.) So why go through the process of randomizing and derandomizing in the first place?

Thanks in advance!

Is using an Eagle Whistle considered as wearing/carrying it for the purpose of Telekinesis?

The description of the Eagle Whistle from Tales From the Yawning Portal p. 228 states:

Wondrous Item, Rare

While you blow an eagle whistle continuously, you can fly twice as fast as your walking speed. You can blow the whistle continuously for a number of rounds equal to 5 + five times your Constitution modifier (minimum of 1 round) or until you talk, hold your breath, or start suffocating. A use of the whistle also ends if you land. If you are aloft when you stop blowing the whistle, you fall. The whistle has three uses. It regains expended uses daily at dawn.

While you are blowing the eagle whistle, are you considered as wearing or carrying it for the purpose of the telekinesis spell ?

Object. You can try to move an object that weighs up to 1,000 pounds. If the object isn’t being worn or carried, you automatically move it up to 30 feet in any direction, but not beyond the range of this spell. If the object is worn or carried by a creature, you must make an ability check with your spellcasting ability contested by that creature’s Strength check. If you succeed, you pull the object away from that creature and can move it up to 30 feet in any direction but not beyond the range of this spell.

This is important, as a creature flying in the air thanks to the Eagle Whistle would certainly not want its beloved whistle to be automatically snatched away.