Name2Key Database

I'm not Kris.. but knowing her for ages and using some of her creations, I can maybe wager a guess Ulrika. Though I still want to see Kris answer if she wants.

You can have an opt-in list and not be there. All you have to do is have a device in world that collects the keys. And all a person has to do is click on it. Now I KNOW you know that part Ulrika. I'm not trying to say you don't. But I also know sometimes things are not thought of on a grander scale of use...

It would be nothing to get these devices and info out to various places. And people WOULD want to join. If you gave them the benefits of what it could mean...

*snickers*

I was the one that did the majority of the disputing with JSecure. In his case though, it wasn't just about his opt-out system, it was about his not honoring the request of those who stated they wanted to opt out. Ulrika at least I will give a brownie point for honoring such requests.

- Newfie

(hrmm, giving Ulrika credit twice now in the last month...I must have a cold or something....)

*hugs Blaze*

Well, true.. I am not the firecracker Ulrika is. Man do I admire that woman.. hehe.. But honestly, if you really knew me, you would know that when it comes to controversial issues, somehow I mostly end up on the *opposite* side of my friends. haha.. I'm so NOT politically correct it isn't even funny sometimes. My mother cries often about this..

hehe.. But seriously. I just can't agree about this mass of others that will shoot you down (mass being my words.. ). I have never had a problem being myself in SL. Speaking my mind. Often people ignore when I say something valid though. Sometimes people tend to dismiss me as too nice and think I'm just babbling... hehe.. but some *get* what I am saying. Even if they don't agree. But I've always been accepted.

My true belief.. it is more how you approach the topic and HOW you say what is on your mind, than it is actually *what* you say. But.. I've hijacked this thread enough. Back to the issue at hand!

Yes, it is how you say something, but if you soft ball it too much, your point (as you have seen) simply goes unnoticed.

I'm bi.. softball is naturally *half* my approach!!

Sorry if you found my use of "amig0" insulting. I use it often to connote that I mean this to be a friend discussion if you've seen my other threads.

The Linden in question didn't shut me down, just asked what I was doing. When I explained, they were fine with it. Again, I think this level of monitoring is JUST fine. We don't need to kill a function being achieved through a perfectly legitimate use of LSL in hysterics.

Either that, or as I said before - get rid of all of LSL, all textures (could be used to advertise to people - or child pr0n!), and text too... that could be used for hate speech! Definitely get rid of llSensor altogether which could, in conjuction with llShout or llInstantMessage, be used for just as bad spam as this list. While you're at it, get rid of the bloody shouting tringo machines too. I didn't opt-in to listen to those things 24/7 shouting all over SL, why should I have to opt out? SL should be for my personal enjoyment only and all other functions should be eliminated.

-Flip

Oh will you quit flirting with Blaze, it's creeping me out

damn you!!! I *almost* had him on the inside group!! MUHAHAHAHA



hehe.. j/k of course. Cris you meanie!

Tcoz, would you object as vocally about posting of conversations on 3rd-party websites?

As an example:

If you and I held an IM conversation within the confines of SL, and I posted a transcript of the entire exchange on a 3rd party website, against your wishes.

This seems comparable to what is being discussed here. Would you hold LL responsible for protecting your privacy, and expect them to somehow remove the material from my website?

I think your reaction to this may be a bit on the harsh side. Some things to consider:

-Ulrika's database does not include any way to tie your SL identity to your RL identity.

-The worst that anyone can use this list for is to send spam to your SL avatar, a practice that would take time and effort to do, because it involves setting up a SL account, and which would be slammed on once it happened (the account would likely be banned, possibly multiple accounts if they could be tied together).


Do you feel that LL has a responsibility not only to protect your privacy (YOU, the person in front of your computer screen), but your SecondLife avatar(Tcoz Bach) as well? Does this responsibity extend only as far as their own websites, forums, etc, or also to any 3rd-party websites that they are made aware of? If your avatar has a right to privacy, should the key2name function of LSL be removed because, arguably that violates the privacy of Tcoz Bach, even if it does not violate your (you, the RL person) privacy?

Way to go on twisting the facts and assuming a lot, Ulrika.

(1) There is a lot of difference between COLLECTING KEYS and storing them, and PUBLISHING THEM TO THE WORLD. Of course you don't have to ask to store them. I've already said that. Very practical, that. I can just see it now: 'Hello. This is Freds Visitor Counter. I'm sorry to disturb you, but I was about to record your visit for the guest list, and I'm required to ask your permission first. So how about it?".

Do you truly not grasp the difference between having something and not sharing it and publishing it to the world? It seems to me you struggle with the concept. Presumably thats why you don't see what a bad idea this list is.

(2) I have no goal at all. I'm not going to give them, trade them or use them in any way. I just said I *had* them. And I do.

The point was to illustrate that while there may be a large number of people in possession of a large number of keys, they haven't been abused thus far.

What YOU are doing is positively inviting abuse, and hiding behind reasons you really cant justify.

Web stores or services in the past have had to come up with their own ways of verifying their customers keys. It's hardly been a problem for either end, and SHOULD be part of the opt in sign up process, in my opinion.

I see precisely zero value in a ready built list of keys, frankly - after all, if anyone actually uses it, they're going to get massively abuse reported.

I don't see what your reason for doing this is at all, because I don't think any of your reasons given hold any water. And I don't think deflecting attention at me for owning a list of keys that I've never used and don't intend to and insinuating that I'm going to sell it or misuse it is going to disguise that fact.

secondserver and metaadverse are both using such a list to great benefit for their SL businesses.

I really don't think they're getting abuse reported.

I use mine for gift giving through SLBoutique - plain and simple. I'd never use it for spam, or every single person in Second Life would converge on Indigo with pitchforks and torches. Not to mention these facts, which keep getting ignored:

(1) After sending out about 600 LEGITIMATE items using a script and keys to my registered users, a Linden had contacted me about what I was doing; once I explained that I was simply passing out the new wallet feature I'd finished, they were fine with it.

(2) To send to 40,000 avatars with a 3 second delay? That's a LONG time. If the Lindens got to be after about 600 of these passes, what do you think they'd do to someone actually spamming?

Tcoz, It really isn't necessary to keep repeating terms like 'scumbag'. I've tried to be nothing but friendly throughout these discussions. And yes, your key has been removed from my list.

Regards,

-Flip

flip,

i guessed that the gift feature used a key list, because it doesnt allow for the same verification as someone joining to buy stuff (see I'm not too blind to see more than one side to an argument!) but it does pose a general question or two:

i dunno bout your site, but certainly some of the others sell goods that would offend some people, or may even be considered abuse. If someone who has signed up for your service then sends a gift to someone else designed to offend or whatever, who is accountable from the recipients point of view? from the service providers point of view? From the Linden point of view? From everyone here's point of view?

Is it the account holders fault for sending the undesirable gift? is it your fault for supplying them the key and therefore the mechanism to do so? Or (c) other?

Should, perhaps, a keylist NOT be used, and the onus be on the person who wishes to make a gift to provide the key. If they know someone well enough to want to gift them, surely they know them well enough to get their key? At least this way the service itself isn't really responsible (save for providing the transport mechanism).

This was really my objection to a previously proposed IM service as it originally stood. Again, I feel it should be opt IN to say 'yes, I am prepared to receive IM's from other users of this service', rather than the service providing a mechanism for anyone who has joined to IM absolutely anyone else unsolicited.

Like I said right at the start of the thread and elsewhere, I'm not against key databases. Used reponsibly, and with the consent of people on them they can provide some nifty services. But there are also a lot of things from quite innocent yet annoying to downright abuse that can come of them, and ultimately someone somewhere has to be accountable when people get pissed off. But do we know who'd be suspended? Or what's acceptable and what isnt as far as the Lindens are concerned? How will the abuse reports even read? Will people say 'Avatar Foo spammed me/sent me offensive material?' or 'SLServiceXYZ just spammed me/sent me offensive material?'.

Well, in my view, its all down to the individual circumstance, which is why I wouldnt want a blanket ruling on collecting or using keys. Like anything, it can be abused, but confining it within a tight little set of rules or banning it does more harm than good.

At the same time, and while arguing against any legislation against collecting or using keys, and believing the abuser should answer for their offences, I really don't think any good can come of publishing the raw list for download on a public website (nor selling it to any joe shmoe that asks, for that matter, so Ulrika and I agree on something at least).

But then how do LL regulate 3rd party websites if they insist on doing something like that anyway? And should they anyway? I don't think so, personally. I don't think LL should take action against Ulrika for publishing it. I just dont think it's responsible behaviour, because I believe it WILL cause a problem where previously it's been pretty self regulating. I'm happy to be proved wrong.

So yeah. Questions, questions. And I never said I had the answers. Just opinions

Fuck me. That was a long one. Sorry.

Very good points Kris, and ones I've already been working to address.

First, let me tell you a little bit about the SLBoutique back end. We keep two separate tables with avatar name / key pairs in the database. The first is for members. This contains a primary key, their avatar name, their avatar key, the userid the avatar is tied to(multiple avatars can be tied to a single username/password account), and so on. (About 600 rows in this table, currently)

The second table is just a huge list of name/key pairs. (About 13000 rows in this table, currently)

To be able to give a gift, you need to have an account and be in the first table (600 users). If someone were to abuse the system and give gifts to people that would be found offensive, or to grief the receiver, they would be immediately suspended while the situation was investigated and reported to Linden Lab.

This is by no means a perfect solution, but the best I can think of given the current technology. Thankfully, we haven't had to cross that bridge yet.

I have spoken to Philip several times about how we can better provide service. So please be aware that better solutions to this entire problem are being thought about as well. The whole "keeping a prim rez'd in world"..."verify its contents"..."verifying XML-RPC channels"..."needing keys to pass inventory"... its all very klugey, for sure. But it works pretty well for now, and is currently the only way to do it.

Lastly, TRUST ME - I'll never accuse you of being short of opinions!

Regards,

-Flip

I have yet to hear of a flood of unstoppable spam as a result of creating an open name2key database. Additionally, I believe that most folks feel satisfied with the opt-out system. Up next I hope to work with a few bright folks to implement an XML-RPC version of the database that can be used in world by scripted objects.

Given that the sky hasn't fallen, could it be that we're ready for a real llName2Key function with an opt-out check box? All signs point to "yes".

~Ulrika~

According to the town hall, Robin was supposed to post something in the forums about the nature of users keys..

Would any unsolicited use of these keys in contacting said user be required to contain a disclaimer as to where the key was retreived?

Honestly I don't really care if people have my key -- most people probably do and don't know it. I would be curious to see the direct impact if you are responsible for it though.

While I think that a consistently updated, comprehensive name2key service is a good idea (in lieu of an actual llName2Key* function), I can't think of any legitimate uses for this particular incomplete/inaccurate database.



* I say llName2Key, but I think what is more likely is a llRequestAgentKey(string name) function which returns the uuid via the dataserver event.

In regards to your comment on accuracy and completeness, I'll repost details about the statistical validation method I used to check the keys and discuss why a complete database isn't as necessary as one would think.

Validation
All the keys in the database are statistically validated through cross-correlation methods. Because I have a vendor system, I was able to create an initial trusted database of a few thousand keys. As "name.cache" files come in, I use a cross-correlation technique (checking between files) to assign a confidence level to each file and each entry in a given file. In the end, it is very easy to toss out bogus entries. Currently, every single file of the 50 or so submitted correlates with every other file with no inconsistencies.

What's good about cross-correlation is that it provides a quick way to statistically validate high-frequency keys, which are likely to be the most useful. That is, high-frequency keys, which are of more use to an online retailer, are better validated than low-frequency keys, which are of less use to an online retailer.

The final step would be to do a true validation, using llKey2Name to lookup every entry in SL. I'll leave that as an exercise to someone with a little more time than myself.

Completeness
Here's a little thought experiment, which demonstrates why an incomplete data set (which samples the top 10% of a power-law distribution) can have virtually the same utility as a complete data set.

1. The agent keys of those who spend the most time in SL are the most valuable to retailers.
   
2. A list of avatars ranked according to time spent in SL follows a power distribution.
   
3. Those who spent the most time in SL are the ones most likely to have their keys in the database already.
   
4. Therefore the database contains a list of keys which are the most valuable to retailers.
   

With any power distribution, 90% of the utility can be had by sampling only the top 10% of the population.


Finally, the name for the proposed function, llName2Key, was chosen as it's the logical counterpart to the existing function llKey2Name already implemented in LSL.

~Ulrika~

I have verified your current list already, thus my comment regarding the inaccuracies. You have no means for me to submit my corrections back to your database however, so I can't update your database with my findings.

I did not use llKey2Name as that requires the agent to be in the same simulator to work properly in a constistent manner. I used llRequestAgentData which prompts a dataserver event containing the name (thus my comments regarding the probable name/usage of the missing function).

If you would like my server side Perl code and the accompanying LSL script required to verify the lists in world with XML-RPC, I would be happy to share it with you.



This is a nice experiment, but for retailers to completely forgo the process they are currently using to obtain keys, the database needs to be complete and accurate or there's no use for it.



As I stated above, llKey2Name only works for agents in the same sim (and child agents too). llRequestAgentKey would be the logical counterpart to llRequestAgentData, the function that is required to retrieve the information regardless of whether or not the agent is in the same sim.

I don't mind it. Nice implementation

Suggestion, provide a link to the TOS/CS, with a quoted passage about spam, noting that it is against said documents to use it for spam.

Also perhaps some in-world way of accessing it, maybe a script that uses email and/or RPC to get a request. Or would that make it more suseptable to spam?

Really?

Wow!

I would like to state publicly, that you just took me to school. Thank you for being so patient and taking the time to explain things to me.

With that said, I'd certainly love a copy of your code or a list of corrections. Not just for the information but for the chance to learn something.

Agreed. A true verification process is needed.

Ushuaia drives toward the basket, jumps into the air, plants his foot on Ulrika's head, and slams the ball through the hoop. It doesn't happen often. Enjoy it.

~Ulrika~

Great suggestions, the both of them! I bet there's someone in SL who's done this before. I'll have to ask around to see if there's some code or pseudocode out there to get me started.

~Ulrika~

And once again, a thread concludes with Ulrika learning something. Fire hot burns me ouch. You are so cute, Ulrika

Ha ha.

Actually, this was a slightly different ending. My tried-and-true "fire hot burns me ouch" ending is how I gracefully back out of a controversial thread where I've been knocking heads together for the better part of six pages. This on the other hand is capitulation to facilitate assimilation. I mistook Ushuaia for a troll but he was instead speaking from a position of knowledge that I was unable to appreciate. Now that I understand, I'm not going to waste time on posturing but instead take advantage of an opportunity to learn.

~Ulrika~