In case you missed LL's key list publication policy

This is the difference.

The hardest part of spamming is getting a collected, validated list of data. And if that list targets a specific sort of user, more the better. And that is precisely what this list does.

It is a convenient, open target to a private community of users. This is a clear opportunity for spammers. Just do some reading on the topic, you'll see that this list is a gold mine.

I'm not going to be drawn into the, "there are other ways to do it" argument. There are many ways to steal, all of them are illegal.

LL is the owner of this info. Not Ulrika. LL is effectively turning over ownership of it to all takers and removing themselves from any responsibility of what is done with it.

Keep in mind, your 1st Life profile, by their definition, is also public info. And many, many people have pictures, locations, and other personal info in that profile.

But hey. I can just right click you and get it. No extraordinary measures. It's just laying there for me to pick up and use. That is, as long as I don't use it to spam anybody in SL.

Other than that, it would seem, anything goes.

Sorry Tcoz but I disagree.

You may eventually manage to find a valid email address using my Avatar first name (should be fairly easy given it's Andi), but you are not actually going to be targetting me because none of my emails contain that name and you're going to need a lot more RL info about me to get to the bits that go after the @ sign. You'll just end up spamming a whole bunch of people that know nothing about SL, which kind of misses the point doesn't it.

Cienna summed it up pretty succintly.

Sorry guys, I did it to myself and it worked perfectly. It's not a question of agreeing or disagreeing. When I did my reading I was actually surprised how readily these lists enable this practice. All the more reason to continue fighting it.

And yes, I probably will hit a bunch of people that aren't involved. Hey that's ok, the more validated mails, the better.

If I can even hit one SL resident by using that list, it's too much. And I assure you, I would hit far more than one. Many people might even respond.

And if course, the whole, "dummy account/send emails to all SL resident's keys from Starbucks" thing still exists.

LL is the owner of this info. Not Ulrika, not you, not me. LL is effectively turning over ownership of it to all takers and removing themselves from any responsibility of what is done with it. Just look at the conversation. We're not talking about where to get the data anymore. We're now talking about how to exploit it, and it is most definitely possible. Saying "there's nothing that can be done with it" is just foolish, people always, always find a way. This just makes it easy.

I just can't understand how the typical SL user can be indifferent to this, or would rather talk about how it is not effective as opposed to how it possibly can be effective. I also can not understand how LL can say they are concerned with our privacy and security, but turn a blind eye to this. As long as you don't attack LL's assets, they apparently don't give a damn what is done with the in-world data.

And again, according to their freely available info definition, your 1st life profile is public data, and I am free to compile a list of it and publish it. Hey, I just might do it.

Of course, there would be an opt out option, which may or may not work, if I get around to it sometime.

Since you ignored me, you won't see this, but for others:

Because the average SL user is/is not: (Take your pick, any or all of these)

A) That paranoid

B) Stupid enough to have divulged truely sensative RL information

C) Signed on with stupidly-traceable usernames if they are A or B

D) That ignorant about the internet that they need such vulnerabilities pointed out to them.

E) Not using the same username in their e-mail account as their SL name

F) May be doing E, but is using an e-mail account that exists for nothing but SL-related e-mail, so they don't care

G) Has followed sane advice for protecting themselves online and accepts SL as an acceptable risk

H) Realizes that spam is unavoidable and uses spam filters anyhow, and deals with the few bits that slip through without throwing a hissy-fit.

I) Just doesn't care in the first place

Hmm, well this thread is preeeetty good.

But Canadian politics have you guys beat on drama as of late.


http://www.cpac.ca

I think it is important for people to know that sending e-mail to the SL community through the UUID list provided in the database is probably NOT limited to people in the game or in-game objects. This list looks like it can be used by any person with an e-mail account to send spam mail. I have used pop e-mail to carry on interactive conversations with people in the game, while being out of the game. I can't say with certainty this capability exists using the database, because I noticed the keys I use in e-mail seem to have different values than the keys in the database for the same person. I may look into this a bit more.

As to whether it's right or wrong or who is to blame, etc. I am not one for tossing the president of Colt in jail because they made a gun that someone used to kill his neighbor or the putting the Ford CIO behind bars because someone got drunk and took out a predestrian with his 2004 Bronco. However, it is important that people know the potential for spam seems to exist outside of the game, and if that's the case then the game designers would be powerless to stop it.

This is completely false. A non-SL member could not initiate spam to an SL user via email into SL. The email to IM function only works if an outbound IM from SL intiiates it. If you don't respond to an offline IM in a day or so, you can't respond to it.

Well, it's not completely false. First, I said it "may" be the case, but the keys I did notice were not the same, and I said that in my post, so I need to determine what correlation exists, if any, between the key sent from an IM and what is stored in the database.

Regarding IM initiation needed to respond from e-mail within a a day or so, I disagree with you. I have initiated contact with people several days later who were in-game without a problem. I just looked and I have identical keys for a person I contacted on 5/19 and also on 5/28. So, the keys could last as long as at least 9 days, and possibly longer - so that kinda blows the "one day or so" theory, at least in that case.

Again, I am not stating I have conclusive proof that spamming is possible from the outside. I am saying it may be possible. Certainly one can initiate a conversation several days later from e-mail.

I did just try to sent e-mail to my key from the database, and it failed to deliver, so that was good news. I'll probably play around a little more with this though.

The conversation has to be initiated from in SL in the first place - you can't just take a random key and IM someone with it. Also, Linden Lab themselves have stated that they do time out - and I have experienced it myself. The bottom line is, there is no way for a non-SL member, or even an SL member to spam someone with the email to IM functionality.

Maybe I am wrong, but it seems an SL member could do a lot of spamming in that 9+ days before the key expires. I just would not be so quick to rule out what is possible - people are creative.

*singing*

Fuzzy hair on a polar bear
means more to me than a lavatory
you won't get far in a motorcar
with my avie's key.....