The Thieves Motherload

No.

LL learned a great lesson in the 2nd half of 2006: not requiring people to provide RL id is a great way to get craploads of new customers. They cannot unlearn this lesson.

The mechanics of being able to gather & verify RL ids doesn't even come into it.

Yep, these are the same countries that apparently have high speed internet available to householders but pay the bill with chickens and potatoes.

Heck if everyone had a credit card linked to their account we might actually be able to sell stuff to them instead of waiting for them scrounge enough L$ from us.

If they're not paying, they're not customers.

It's a great way to inflate their user numbers, but that doesn't mean it actually makes them more money.

The idea that you need paying customers to actually make money is so out dated. Just look at AOL. The managment has been milking millions off of that for years and no one uses it. Hell, has it ever been in the black a single year? It gets traded on the stock market like it is actually worth something.

You know, it's funny that you mention Zindra. I think Zindra is the very reason LL will NOT go back to requiring all accounts to be verified. After all, wouldn't that invalidate the very purpose of Zindra?

Or at least what they *had* the will to do, three years ago. Since then, they've been under more pressure from content creators to do something. Unfortunately also since then they've embraced the wild delusion that they can pay the bills off educational and corporate accounts, so user-created content is less important in their current crazy view of the future.

As Kitty mentions, some of the Adult content debating points seem a little "off" now. I no longer believe that any meaningful share of the SL resident market is unable to adult verify, one way or another. The argument that it's illegal to supply a Canadian SIN, for example, is pretty bogus: it's illegal to *require* that form of identification, and in fact no knowledgeable Canadian resident would supply it, but alternate forms of identification were always accepted. (That's not a great example of anything, however, because Aristotle age verification doesn't retain a link to RL identity, as would a verified CC billing address. PIOF through PayPal may not either; I'm not sure. The point of the whole exercise must surely be to have an address to which papers can be served.)

But (dammit), I was trying not to talk about verification; it makes the nice hedgehog testy.

Argent, I appreciate your response (some pages ago) to my question about your position on this. I'm particularly interested in the ability to crawl transaction data to find the source of illicit copying, and then nuke all Inventory references to that asset further down the chain. (I posted a mention of that in a Commerce forum post, now hidden in their star chamber roundtable thingy, and Des posted about it on SLU yesterday.)

I've just assumed all along that this was a straightforward tree algorithm (so, yeah, it would be a program, not a single query). I suppose it would be possible to just not record enough information to make possible such tree traversal, neither in inventory records (some "provenance trace", nor transactions. It's difficult for me to imagine anybody half-way competent coming up with such a data design, unless they were intentionally avoiding an audit trail (oh, I dunno, to facilitate RL terrorists, maybe).

Do we know whether LL has ever demonstrated the ability to crawl the tree of inventory transfers, even on a small scale?

No.

If I had had to come up with a credit card or other RL creds to *try* SL when I first heard about it, I would have kept walking. I would be amazed if I was alone in this.

You aren't.

If I didn't have to come up with a credit card to just try SL, but I was under any of the restrictions that people want to impose on unverified accounts after I joined, I would have kept walking. I would be amazed if I was alone in this.

:0 to re-clarify (again ;0) what i've been proposing... anonymous accounts can remain. just that they get restricted to, say, 'no transfer, no cashouts'.

age verification is a separate thing here; it's 'already been done'. i understand though, throwing around the word 'verified' applies to several different parts of one's account's status.

there's age verification, there's billing (premium) 'verification', and then, as proposed, another 'verification' to validate one's rl address (which can be wrapped up into premium, but i propose it as a separate process so that free accounts can use it too).

each verification serves a different purpose. -no one- gets kicked out for not wanting to reveal their rw address... but if they want to pursue commerce, they must. dat's de whole idea in a nutshell...

p.s. and no one has to give up cc info to do so (short of premium), or pay for anything, save the cost of postage and some wait-time for snailing.

Unacceptable.

;0 known outcome.

Unless I missed a big change educational institutions (and non-profits) only pay half the tier we do which was quoted 2 years ago as being "below operating cost".

Yeah. I think the discount is less now, at least for Homesteads, but the rest of tier-payers are still subsidizing all the educationals. And knowing a bit about the costs of selling into the Enterprise market, I'm sure we're supporting the corporates, too, if the marketing budget is included in the equation.

To be fair, both of those may be good strategic decisions, if the educationals drive lots of full-paying customers down the road, and the corporates become "sticky" at full tier or better (add-on services, maybe). Not much evidence of either of those effects so far, however, and it's not entirely pleasant when the officers rub our noses in the fact we're paying extra for the privilege of being marginalized.

:\ well, most shop/club owners 'subsidize' a bit (or a lot) already just for traffic's sake; freebies, giveaways, money prizes. i don't mind 'soft taxation' by government when it provides services to worthy institutions... it's often beneficial to the world around me; if not to me directly, to others i know; and it's -never- as expensive as a war. (let alone two or three at once.)

i suppose, in parallel, that i don't like when a wasteful avenue, like content thievery, is allowed to continue unchecked (like 'unregulated offshore tax havens'). although changing anonymous account status 'attacks' a basic underlying principle of the grid ('free for everyone, just like the net'), the plain (and sad) fact may be that 'free != freedoms'. or at least, it should not. :\

in other enterprises, 'free' implies 'restricted access'. 'premium/verified' implies 'full privileges'. (and no one outside the company is supposed to have 'god status'.) and, i dare say, no other online enterprise like sl offers, like sl, to 'cash out' what one earns (p.s. nooo wait, i'm wrong - ebay, amazon, etc; 'lots' of places to earn mons online, although usually rw goods/services vs 'virtual' - and by now i think a lot of us do not even see that as a difference). so the stakes are intrinsically high.

Most people pay for their internet access so that analogy doesn't really work.

Millions of people also don't seem to mind paying for WoW, music on I-tunes or hundreds of other online services; just SL seems to have to be magically exempt for a lot people (and ideally it should not only be free but also provide free L$ to those unlucky people who can't afford $10 to buy L$ with ).

qie: 'Do we know whether LL has ever demonstrated the ability to crawl the tree of inventory transfers, even on a small scale?'

:0 sure, wasn't that what happened once to stroker? in an 'early experiment' with such a mechanism... it kinda screwed up stroker's biz for a few months. that was an 'early experiment' i think to perform an inventory crawl (that unfortunately messed up a large number of people; i think because of that now they are keeping inventory crawls limited to just the accused/named in filings).

in the big 'rat's nest' that kicked off this very thread, it's been mentioned that the lab -cannot- do such a crawl against these infringing items, -because they share the very same uuid as the original legitimate products.- wiping out the copies would wipe out the originals. these weren't re-uploaded items; they're ingrid 'carbon copies'.

:\ i guess the solution to that would be to rekey every transfered item... but is uuid really that 'infinite' to support such a thing? (and gosh, talk about an even -bigger- recoding job... :\)

;0 well i grok ya; i pay to access, but as far as the 'net itself', i don't send a subscription fee or verification info to the NIC (and they don't even 'run' the entire net anymore do they? went international i though a few years ago...) so besides, the same 'access fee' i pay to comcast for the net also pays for the same access to log into sl. similar but diff'rent... that 'sl would be free' was an original vision for the grid (i think rightly attributable to mr. rosedale. but, i guess to hammer the nail even more, 'free != verified'... 'free access != unrestricted for trade or commerce'.

:0 and there's still a 'signup bonus' in lindens isn't there, after a grace period?

I thought you couldn't copy no modify scripts out of SL? Can Neil Life (or whatever) change the perms on an object to do this?

:0 it was an exploit (i.e., grid protocol/security bug/weakness) that allowed non-copiable items to be copied ingrid (and their contents including no-mod/no-whatever scripts en-total), no 'cracking' or re-uploading assets, so it kinda didn't matter -what- it was. (i think the items had to be 'rezzible' inworld first, but i'm not sure on the details; might've been an inventory-compromising exploit.)

exact copies - save for, as i understand it, that the infringer altered the 'copiable and transfer' permissions to 'allowed'. some items and content remain no-mod, but the containing package got changed to be 'copiable and transferable'.

and -because- these are exact duplicates of other users - nay, their creator's - legitimate inworld assets, down to identifying grid-keys, a large-scale inventory wipe may not work.

(and what specifics i -do- know, i won't mention, other than to reiterate that the official linden lab viewer, no matter -what- its weaknesses and/or deficiencies, is the only truly safe and non-exploitable viewer, in and of itself. :0 there's links and more info out there; sorry if i don't offer much more myself here - others have already reported what they know; plenty of links around to check out.

As I understand it: the notecard exploit apparantly allowed you create a notecard containing arbitrary asset UUIDs.

Educated guess: since assets (aside from objects/linkset - see below) don't have permissions applied to them (the actual permission settings are a part of the inventory item data) everything that goes in to a notecard has to be full permission from the start (which is what the normal case is). LL could have probably made an extra effort to allow for limited permission notecard items but that would have required extra code (and wouldn't have stopped the exploit since it seems it's a case where the sim wasn't sanity checking viewer-supplied information).

Continued guess: since everything that comes out of a notecard ends up full permission, as long as you can stuff in the proper asset UUID you would have been able to turn animations/textures/etc (but not objects) into full permission inventory items.

Still guessing: in the case of an object you should have two sets of permissions, one associated with the inventory item and one associated with the actual prims (and their contents). So objects copied out of a notecard would have appeared as full permission in inventory (ie they could be copied and transferred).

However you'd run into two situations:
- the asset UUID that was put in the notecard already had limited permissions (someone bought the item and rezzed it which would have triggered the next owner permission slam and took it back into inventory and ended up creating an entirely new asset) so while the item would have appeared in inventory as full permission, its actual prim permissions would be the exact same as the original it was created from
- the asset UUID that was put in the notecard was basically the same asset the creator has in inventory. However when rezzed the sim would notice that the owner has changed so it would slam the permissions to the "next owner".

So the exploit should never have resulted in a prim linkset that was more permissive than how the creator sold it (when it is rezzed), even though the inventory item is full permission so even though rezzed permissions are restricted anyone can still hand out an unlimited amount of copies.

Of course scripts might have gotten extracted from the copied linkset and run through the notecard exploit a second time which would yield a full permission script inventory item (and since script assets don't permissions set to them the only thing that would get looked at is the inventory permissions which allow opening and reading the script).

(And please don't take this as fact, it's a guess based on what I think I understand of how the asset / permission system works and based on tidbits about the exploit that would seem to validate my reasoning)

;0 my brain just turned into a pretzel. (;0 thanks though; i forget how convoluted things get at that 'slambit' stage... frankly the way it all works, your answer is complicated enough to probably be mostly correct. ;0)

p.s. speak of which, i'd always found that annoying with notecards; why can't they also take on 'interleaving permissions' the way rezzed prim packages do?? :0 and the fact that there is no 'update once-for-all' option, if not primary function, of them (although that makes preserving non-editable copies chancy for evidenciary reasons). i'd kinda really like to update all my packaging's notecards once instead of having to re-rez every single one to just update the notecard, and occassionally landmark...

Oyyy, my head is now swimmming.

As an unverified account, if I had shown up with the only thing being different that I couldn't transfer anything from myself to someone else, I wouldn't likely have noticed. It would have seemed perfectly natural, especially if it was explained in a positive light, in terms of "helping protect my IP". I still could have gotten lots of freebies, bought whatever I wanted, and as soon as I did what I was going to do anyway a few DAYS after joining, I would have had full access. Maybe some folks would have quit over it; I know plenty of folks who have quit over the situation now. At least it would cut down on a lot of the "Yardsale" alts, constantly reappearing and setting out boxes of infringed content for sale.

The problem is arbitrary restrictions; I don't have a problem with restrictions that have a purpose; those are kinda natural and expected.

As a result, I think the "no transfer rights until verified" idea has some legs still.

That's why they can't just blacklist the assets to solve this problem. So, instead of treating the *assets*, they have to find all *inventory* references to those assets that were created by transfers from that first illicit copy. For some asset types, they'd also want to find in-world objects that rezzed from those illicit inventory assets, or maybe even further copies made in-world. (Prims would get new UUIDs when rezzed or copied, of course, but their contents wouldn't, until somebody did stuff to them.)

I *thought* the problem Stroker had was due to a deleted script asset, not deleted inventory pointers. Now that I think about it, however, the earlier Eva Capallini (sp?) mess with MLP-scripted beds containing ripped animations seems to have been some weird mixture of such attempts, with most in-world objects containing (what they thought was) the offending content disabled or deleted, and some but not all inventory also affected--even though they must have all shared the same assets. That is, if I recall all that correctly.