Should people be allowed to "rip" scripts?

Ok.

At present, it is possible to remove a script from a no-mod object's inventory, and move it into any other object you own.

The Lindens consider this "Fair Use". I call it bullsh*t. Following the same line of logic, I should be able to remove a texture from an object and place it on any of my other objects. I should be able to remove the size/shape data of an object and apply it to another object I own. Ditto for any other work any of you creative types do.

However, it gets worse. Since you can remove scripts from a no-mod object and put them into an object you own (and can therefore mod), you can make an exact replica of something like, say, a Darklife backpack, toss in a script of your own to sniff out the communication data going between all the scripts, and hack into the system to give yourself infinite health, gold, XP, and other such things. Similar hacking methods will work for any other scripting system that uses link_messages.

Not only that, but if you fail to set permissions perfectly, and want to make a copyable/no-transfer/no-mod scripted object (say a vehicle), but fail to apply the copyable/no-transfer permission to every last script in your vehicle, people can now copy and re-sell your no-transfer vehicle, in whatever shape/form they desire.

EDIT: llGetCreator() is not a valid solution, because then all you have to do is get ahold of a moddable object by the same creator, and you can do everything I just listed. Since most of the major creative types in this world also give away a moddable freebie or two, suggesting that llGetCreator() is the solution just punishes nice people.

So, should people be able to remove scripts from no-mod objects?

(I thought we went over this crap back in the permission system debates.)

llGetCreator() ?

A) Not everyone thinks of it.

B) Get a moddable object from the same person, and you've got the exact same problem.

On this case, I am tentatively voting towards allowing it. I can see advantages to both sides - but fixing this up is going to break things - say someone who sells scripts in boxes. I would much much much prefer a more powerfull system for covering this, than a simple patch which will most likely be worked around within days.

I would prefer the ability to enforce script licenses. '$x grants you the rights to do $y over $z for specified sum $a or conditions $b', SL contacts the DB server before performing any action on the object and checks that you are licensed to perform that action.

If the script is magically transfered to a 3rd party - it wouldnt be able to do anything, since you dont have a license over it. This would also be a fantastic way to handle script permissions with the revised system.

-Adam

It doesnt help in all of the above situations, but I make my script so it only works in an object named specifically, and renames the object and resets the descriptions of the linked set its in. It's certainly a deterrant against people putting your scripts in their objects.

But yeah, in general, this whole perms thing sucks.

Having said that.... I'd still kinda like the ability to turn off scripts in no mod objects. Know why? Because SO many people put crappy animation override type stuff in shoes, bags, and other accessories that are great otherwise. And I somehow doubt that everyone that makes items like this is going to make two copies of everything available - one with, one without.

So make the box modable.

I can't think of any legit use that this change would cripple.

I understand Adam's concerns - and I'm the first to criticize changes that are backwards incompatible - but I vote that we should not be able to modify nomod objects, ie we should not be able to drag scripts out.

It wouldnt be particularly hard to create a migration procedure to move to new permissions fairly smoothly.

Worst case create a new permission called "really nomodify", that is unset in current objects, but can be set if we choose.

Azelda

I vote no, and moleculor, that is exactly how I hacked DLs backpacks.... but if you try that anymore you may find it doesent work so well... there is a workaround

default
{
     state_entry()
     {
           if(llGetOwner() == "your key here")//your actual avatar key, hardcode it into the script here
           {
                  state running;
           }
           else
           {
                   llDie();//ok, if you arent so mean you can make a sleeper state or something
           }
     }
}

state running
{
...

Any time a no copy/no mod script(not sure about other perm setting, might work for more) is taken out of an object and placed in a new object it gets reset, forced through the default state, and checked. If you drag an entire folder of scripts into an object they will stay... however this is only because it unchecks the running box.... the person can then recompile all scripts in selection.... but as soon as that happens bam, they get put through the check.

Might not be the prettiest fix but hey, it works, and unlike the name/description check there is no way around it.

I always thought it weird that no-modify allowed modification of contents.

But, I use the name/description workaround in my katanas' color-changing script, combined with the fact that it's copy/no trans. No one will be doing any reselling of the script unless they pay me for additional copies, and ... I'm sorta alright with that

I think the solution may be a "remove contents" permission, not a simple yes/no.

Well yeah - as I said, I'm only slightly leaning to 'yes' because some stuff may never be moved to the new perms - in which case we may end up with content loss. And if this is going to be fixed - it may as well come with a new permissions system, something a little bit more flexible for everyone's uses.

-Adam

Why not have a keycode assigned to objects (that the creator sets) and their script checks this keycode when it runs to make sure its in a valid object with the correct keycode? Make this keycode not viewable by anyone that doesnt have mod permissions on the object. When people buy a copy of the no-mod object from a vendor or whatever, they all keep the same keycode. The down side is that it becomes one more thing to track for every object. And yes Im probably sure someeone else thought of this before.

Edit: Also, couldnt someone impliment this already? I dont know scripting, other than the useful script library, but I assume scripts can read the parameters of the object its in currently right? And a no mod object greys out alot of the object properties fields/values right? So why not take a field that isnt redibly noticeable, and change the value slightly so it differs from the default or normal state. Then have your script read this field and if the value doesnt match then dont run.

"No modify" should mean that you can't modify the object. It should make it like a black box. Nothing goes in, nothing comes out. You can move it around, move it between the world and your inventory, copy and/or transfer it (according to those permissions), but that's it. Allowing people to remove scripts poses a tangible threat to scripters who are passing sensitive data in link messages.

I have to wonder: To those of you voting yes, why is it ok to remove a script from a box? Isn't that like removing a texture from a skin or object and using it for yourself?

Actually I think there just may be a simple solution to all this to protect the scripters and to protect the consumer.

For instance currently they have a "Contents" tab as everyone knows why not simply make a "Script Contents" tab that sets permissions on the scripts seperately from the other contents.

What would this accomplish?

A. It would give the Scriptors exclusive rights to lock down their scripts.

B. It would allow users to drag Other things out of the box for instance if you have a person "Selling" a script they would put it in the "Contents" Folder and not the "Script contents" as then it would make it an object of sorts for sale versus and active script that controls the function of that object.

C. With a Script Tab you could also set an allow access in it like a specific list of avatar names or keys that have full access to mod or what ever if they dont then they cant get in.


But Im just speculating here hell this may be a bad Idea but figured Id throw it out.

Shadow.

Because situations like the one I mentioned haven't been addressed. The question was 'So, should people be able to remove scripts from no-mod objects?'. The simple answer is yes.

The more complex answer is no, fine, as long as I have the proviso I mentioned above, because sometimes people's scripts plain suck. I don't mind if I can't remove it, I don't want to replace it, just as long as I can stop it running.

You know Kris I agree they should put that on the UI that if you own the object and have it selected you can click on the pull down for tools at the top and click scripts and it open a list with the "X" to turn them "off" and "on" in that object. But you would have to be the owner or have permissions for that persons stuff. Again just another thought and minor changes to the UI but would help emensely.

Shadow

So you'd be ok with scripts spontaneously self-destructing when removed under the current system (if the box is no-mod)?

yes. I dont want the scripts. I just want a way to get rid of 'em.

Why shouldn't I be able to take a script out of one object that I bought, and put it into another object? If the permissions on the script itself are locked down, I won't be able to resell it, give it away or modify it.

It seems analogous to buying a computer but taking the motherboard, RAM, processor, whatever and sticking it in another system.

If I do have transfer permissions on a script, and put it into another, similiar object, and resell it, why not be able to do this as a value-added product? As long as I'm not able to copy the script, I'll still have to pay full price for every copy that I use. The original creator will benefit, as will I, dictated by market principles.

If the script is locked down with no-transfer, why should I not be able to co-opt it for uses that the original seller might not intend?

Sure it's been said a 100 times, but there should be a flag and it should default off.

The fact is, anyone who 'rips' a script is probably very knowledgable and is just stealing not looking for 'fair use'.

What are examples of how a script can be "ripped" from an object and used in a way that is not "fair use"?

If the script is no-mod, I can't alter it, but might be able to apply it to other objects that I create or own.

If the script is no-transfer, I can't give away or resell any derivative works that I might create with it.

If the script is no-mod, transfer, even if I resell it, I'd have to do so at a higher price than I paid for it, or I'd lose money on the deal. Each instance of the script that I rip and apply to a new object will be value-added. I'd still have to purchase each original copy of the script at full price; and since the price is set by the creator, then they would directly benefit from my activities according to the price that they themselves set.


Example: I buy a plane from Cubey Terra. The plane is no-mod, no-copy, transfer (actually he sells his things no-mod, copy, no-transfer but let's just pretend) I don't like the way that the plane looks, and since it's no-mod, I create a new plane that looks kind of like the old one but with a custom paint job. I resell it at a higher price.

Unhygienix Gullwing, I know for big projects that allowing people to take scripts out of official items poses security risks.... with the limited script memory multiple scripts are often required, and those sripts must communicate information, the easiest, most efficient way is with link messages...

in a no mod item, with no mod scripts, people cant find out what is being said in those link messages, the second they take the script out and put it in their item, they can add a second script to listen to all the link messages, thus compromising security.

Additonally.... allowing people to remove scripts form a no mod object means if you are making a game there are likely scripts that would be benfitial to the player to remove.... there are workarounds for that too but they all end up leaving the item useless, and they take sripting memory I would rather put to better use.

Because a script can usually be coded to interact with other scripts that you do not own.

If SL is to ever have decent games of any type, this security flaw has to be fixed.

The point here is not to stop resale (though that's an added side benefit), it's to prevent people from hacking.

Next time you're in Darklife or SimCast, or whatever, how would YOU like it if someone came up to you and said "Bang, you're dead!" and voila, you were! Or "Bang, you're a newbie" and voila, you have 0xp?

Or someone manages to get their hands on an ATM for one of the money exchange sites or something, they rip the scripts, and start funneling money out of your account? Granted, -that- probably won't happen, but we already know that GOM has been scammed, what, two or three times now?

The point is that no-mod prevents me from removing and reusing a texture, it prevents me from removing and reusing the shape data, why doesn't it prevent me from reusing a script?

I think its just illogical for an object to be no-modify, yet it can still be modified in some ways, it seems contridictory to the term. If no-modify allowed you to take out textures or take appart the object, you'd be hearing an outcry from the people who do that as well. In fact, didn't that actualy happen? And the bug was fixed?

Also, Kris, couldn't you just click the Running check box in the script window of the script? I've not really tested this, but I think if an object is No-Modify and the script is No-Modify, you can still click on/off the Running check box (atleast you should be able to).

Unhygienix,

Some of us are concerned that customers will take scripts out of objects we've sold, put them into their own objects, and then sniff link messages in an attempt to reverse-engineer our products or sniff passwords that are used to authenticate communication with other devices. I believe our interest in protecting our systems from reverse-engineering (as well as outright malicious hacking) overrides any interest end users may have in using our scripts in outside objects. "Fair use" is a nice idea and all, but given the current permission system that LL is using, a lot of us are skeptical about the wisdom of handing certain products over to end-users.

The current situation compels us to limit the ways in which we distribute certain systems we develop, which is bad for consumers. In order to protect our intellectual property, as well as the external systems we rely on to make our products work, we may sometimes find it necessary to either forego certain features, or require that you buy some kind of product license and then have us drop a copy at your residence (so that it stays owned by us.) End-users are not likely to enjoy this scenario. Developers don't like it either - in order to protect themselves from the 2% that can't keep their hands to themselves, they have to be somewhat at odds with the 98% that aren't trying to screw them.

I would not mind having a flag to allow scripts to be copied out of no-modify objects, as long as I can turn it off. Moleculor is right - scripts deserve the same protection as any other asset in an object.

It would be nice if we could trust all of our customers. However, as I and many others can attest to, there are plenty of people out there who are all too happy to rip us off remorselessly. It would be nice if the only people who were interested in copying scripts out of no-mod objects were trustworthy, but too many of us have been bitten by sheisters and crooks, and we are just not willing to invest that kind of trust in 100% of the end-user community.