Thank you SOE for respecting my privacy

I do not pay for these "vendor services". I want nothing to do with them, I do not want my name or key on the lists.

I pay LL for SL. That is it. I do not pay for bolt on services by any hack resident in an attempt to fatten THEIR wallet. I do not want to have to scour the internet to "opt out".

I shouldn't have to. Companies like Microsoft, Sony, and a variety of others, have retooled to specific "opt in", because it makes a statement of respect and a true concern for privacy and security "in the broadest sense".

And to me, THAT is good business.

Again I ask.

Why not require opt in? WHY force it, and the inconvenience of "opt out". One web site, sure, not so bad. But in a year, when it's 100, what then?

And how will LL control all the activity? They can't even control alts on the grid.

Sorry, unconvinced. I see a dismal future if this kind of piracy is permitted. It's just Gator all over again...which, btw, advocates the positives of "vendor services" and so forth.

And they had to change their name, the rep got so bad.

All of my questions remain unresponded to by LL. ALL of them. LL needs to make some clear statements regarding their ownership of the info, their release of it into the true public domain, their responsibility for what is done with it, the practice of extracting info from their software (and encouraging others to do so) and submitting it to tools for centralized publication, and so on. They have been completely avoiding doing so.

And yes, they need to. This is just the beginning. I have to shake my head when people say, "nothing bad has happened. So what's your problem".

Yes, I agree totally.

They likely avoid responding or discussing so as to reduce liability to litigation of any sort.
And they're right to do that given the complexity of the issue and the absence of any kind of elaborate body of torts rulings on these manners regarding MMORPGs.

Still, they need to grapple with it eventually and get this bit right if they do have aspirations of creating something called "the metaverse" and not just something called "the game pretending it's building the metaverse".

The need to get it right because the public -- as in RL public with Congress, law enforcement, courts, free media, etc. -- will demand it.

I suspect they will be poised long at this juncture, trying to decide the balance of secrecy and privacy and anonymity in MMORPG games...and then buckling under RL exigencies of the need to make a profit to pay for servers and labour and grow, as they have to become more accessible to RL companies.

I'm thinking they'll be likely to protect RL privacy in terms of keeping out spam and stalking capacities as other Internet sites do, but they'll drop their insistence on not linking the SL identity with the RL identity. I imagine that's what they'll sacrifice.

Whaaaa???? Please tell us who is tracking you. A bit paranoid?

Hack your account?? What in gods name are you talking about?

And the award for the most FUD filled post goes to you, Tcoz. How exactly do they track where you've gone? That is just utter bullshit. You also neglected to point out that ALL OF THIS CAN BE DONE IN SL RIGHT NOW WITH NO PUBLIC LIST. You can track someone's online status with their key. You can get their key just by going near them. No list needed.

As far as the dictionary attack, the public list doesn't make it any easier, you mix so many unrelated things into your argument. What makes you think that Linden Lab does not have something in place to detect a dictionary attack? It is not exactly rocket science to lock out an account after a few failed password attempts for a set period of time. Even raising the spectre of dictionary attacks is just stupid. It is so completely a non-issue that has nothing whatsover to do with public lists of keys.

Okey okey..I don't understand a word of it.

What exactly is a key? What's this thing about going near someone and getting it?

Cool, I googled my avie and found out he's from San Francisco, California and was elected for a three-year term as director for the American Road and Transportation Builders Association.

Seriously, when you're talking about all this privacy, what exactly are we talking about? Ability to obtain passwords? Emails? Actual home address and pant size?

I love being the one to actually ask the stupid questions that I KNOW half of you reading are thinking!

A key is just the way the system sees your avatar, instead of your name. It's just a UUID, the same as all other resources in the system have. It's not your phone number or address, despite any claims of that nature. It's just you, in the eyes of the system. It looks like a long string of letters and numbers.

You know how there are all these things that show what avatars are around or near? Visitor lists, radars, the like? Well those get the key of the avatar. Because thats how the system sees you. It's childsplay to add a line that sends all keys the script sees and the name they are assosiated with to an e-mail address.

It has absolutely no meaning outside of SL. At all.

Okay, all the UUID key is, is a different representation of your SL account/avatar name. Much as www.google.com is simply another way of stateing the IP address of 64.233.187.99, the UUID key is simply the actual number that represents your avatar in Second Life's database. One is more human usable (the name) the other is more useful for machines (the key/IP Address).

The only difference between the two is Second Life's quirk that you must either be "physically" near the avatar in question, or have an appropriately-scripted key lookup object near them, whereas anybody can use a domain name server to look up the IP of Internet addresses.

This is why I find Tcoz's concerns rather funny. Worried about spamming thanks to "public lists of keys" when anybody can just look up "Tcoz Bach" and hit "Send Instant Message"...

Or send pictures of kittens, or your latest version of a creation, or pay Tcoz L$1000... really, the possibilities for griefing with the Find People tool are endless, I tell you!

The one quirk of LSL here is that LSL only deals in keys, for the most part. So to make an automated IM-sending object, you need keys, not names.

OK, so I'm standing near a person. How do I get his key?

If others have my key, I want to know how to get theirs. For no practical purpose; just so I know how.

coco

Coco,

It involves putting a script in an object that uses the sensor event - if you really want to know, I can show you in world. The sensor event returns the keys of those things around it that it senses. It is how the little attachments that show you who is around you, or the little visitor counter scripts work, or many security scripts that detect a list of banned people - it is done with keys.

You can also get a key when someone clicks on something through the touch event.

to make everyone happy, let's just have them create our own individual servers, for each and every one of us, so no one can see our name's or interact with us in any way.

That should solve any and all issues on this matter.

Thank you, have a sparkly.

Joseph

Yes, I would like to see how it works, Cristiano. I'll get ahold of you, thank you.

This to me is just another example of how Scripters Rule. I am SO hobbled by not being able to script the things I make or the things in the houses I make.

It's insane! It's like being able to make a lovely four-course meal, except no one can eat it. Or designing beautiful furniture, except no one can sit or lie on it. SOOOOOOOO FRUSTRATING!!!!!!!!!!!!!

I am going to figure out this scripting thing or die in the effort. Because not knowing scripting is the worst handicap someone can have in this game, and this business about being able to get people's keys if you know how is just another example of that.

Problem is, it will probably take me about ten years to figure it out. The stuff on the wiki and all that junk - I swear, that stuff is written for computer programmers. All the stuff I have read is apparently for people who are already coders, and it exists solely to explain how the LSL Linden coding language is different from the coding language they assume everyone is already proficient in!

OOOOOO that makes me mad. But I will get this stupid stuff, I will.

coco

True enough, but again... even WITHOUT a public key list, it's trivial to set up key-gathering objects in a few busy places, which I imagine is done currently by a few.

Getting those spammy IMs is annoying, btu that's why you can mute people.

um hate to tell you Microsoft is infamous for doing it but backing out once public gets wind of it. They also did had OPT OUT instead OPT IN when they took over hotmail. my inbox went from 10 messages from friends and loved ones to 300 email a day (No I am not kidding I pretty much use it for spam now). Why because I did not OPT OUT of something they mentioned in thier 10 page new TOS agreement. I finally figured out how to opt out and did so but the damage ahs taken...5 years or more to correct.

The irony of those spammy IMs is they don't come from some IM generating object fueled by a public key list - they come from some idiot IMing all of their calling cards using a lovely feature built right into SL.

Ah Cristiano jesus christ. I swear you must have some vested interest in this stuff.

It's not FUD. You seem to assume that only people that pull tricks out of some Steal This Book edition 2 ever attempt to hack networks or websites.

To say this is not a dangerous precedent ignores an overwhelming amount of evidence. All I can do is sadly shake my head when I read all this "nothing bad can ever happen we live in heaven and SL is totally secure" rubbish.

Absence of proof is not proof of absence, as the saying goes.

I have also stated that it is not simple "today" hacking that I am concerned with. It is the precedent this sets for SL. I do NOT like it. I think it is detrimental and will divert SL from the truly incredible thing it may one day be. Try to look beyond the history logs and next 48 hours whydontya.

And for crying out loud if you don't like what I'm saying IGNORE MY POSTS. Unless some missionanry zeal or my incredibly odd yet apparently irresistable charisma forces you to read them.

And again I repeat. NONE of my questions directed to LL for policy on this matter have gone answered. That includes three emails, all through the proper channels, and numerous posts. All people continue doing is shouting "hysteria!!!".

But the questions remain unanswered. All of them. And now I suppose it's going to be all "LL doesn't have to tell you anything they know you're wrong so they're not going to bother and anybody who agrees with you in the smallest degree is wrong and hysterial and crazy and insane and in league with this other player who is also crazy and insane and always wrong but we CAN"T SEEM TO IGNORE HIS POSTS EITHER so on and on and on and on and on and on and on and on it goes.

My questions remain unanswered by the one authority that can make the final statement on all of them. Until we have those answers, you may as well admit that what you state is entirely speculative. You don't work for LL, you don't know the deal with their network, and way, way stronger sites than LL's have been hacked for a hell of a lot less reason. You might want to check your own logs...

It is foolish not to examine these issues. I maintain that the precedent, which so many other companies have moved away from, is not in the best interests of anybody other than intrusive residents and wanton capitalists that would take over SL and turn it into just another way to count impressions on the hapless public.

Your sabre is rattling just as loud as mine.

WHERE ARE THE ANSWERS FROM LL.

Tcoz,

I am all for a rational discussion of privacy issues. What I will push back against every time is the kind of patently false stuff that you mix into your arguments. When Cocoanut asked you a direct question about what could be done with keys, you said that they could track everywhere she goes in SL. That is just complete bullshit. You know it, oh master scripter who needs to laud his own credentials. That is FUD, no way around it.

Whatever valid points you make about privacy (for example, opting in, which I do agree with), they are lost under the din of you wailing like a banshee about how sacred the avatar name Tcoz Bach is that it must be protected at all costs from every spilling out of SL because somehow that is synonmous with your RL info, which is just silly. Unless you are stupid enough to use your real name for your avatar name, in which case, one would only have one's self to blame.

I don't blame LL for not answering, since every time you ask you tack on another REALLY BAD THING(TM) that will come to pass. What you neglect to grasp is that so much of what you are going on about can all be done today in SL with no public list. The public list is just something you are so fixated on that you can't see beyond it. Keep putting out misinformation like what you said to Cocoanut, and you will get someone to push back against you every time.

I'd say not just Cris has a vested interest in this issue, but anyone of us who feel like your accusations are causing more harm than good to SL. Or hell, even those that agree with you. You are bringing up an issue *about* SL on an SL Forum. Every single one of us has every right to respond to your posts, as well as rebutt you if we feel you are wrong. This is not your personal forum to monologue. This is a *discussion* forum.



Well, I got one answer my first time asking. From the Town Hall:




Perhaps if you tried actually asking a question that wasn't draped in accusations, you would get the answers you wanted. Granted, they would be the same answers that have been described here *many* times by other SLers who *do* understand how keys work. So I hope that you don't get too excited by the prospect of them giving you a different answer.

Cristiano, if people can track the availability of public land down to within a minute, and many do (just look what happens when a piece of land goes public), people can track whether or not you are online, and where you go. There is nothing FUD about that at all.

I used to track all avatars that came onto Game Dev 2. I knew exactly who was looking at my plot, and how long they stayed. I could check this info anytime by simply pulling up a webpage. Didn't need to be logged in or anything. It was a feature of the game, tracking stats and so forth, but the use for standard sleuthing was obvious to me.

So, I decided to employ it as a team tracking tool. I set one up, took me oh, half an hour?

One time, I used this information, which I tested extensively, to inform a team member that a time that individual claimed to be on the plot working for X hours, was likely untrue. I only spec'd that one time, but from my info, knew that the person had hardly ever showed up at all. Days of scanning revealed this person was only on the land once, and for a very short time. Naturally, the person was EXTREMLY indignant. Your script is broken. Etc. etc. How dare you imply. And so on. But numerous tests did not incline me to believe that. The script worked, perfectly, dozens of times, and dozens of avatars.

I did later confirm it by just asking people that were working next door.

And that was ONE IMMOBILE SCANNER. How about if I just threw the switch on these mobile land scanners to be an AV tracker? You know, the ones that are nearly impossible to delete, are self replicating, and so forth? Perhaps you would like me to test this theory out on you?

Not possible? Oh come on. Cristiano if I put my mind to it I could openly publish on the web where you are, when you were logged on, and could probably even start figuring out who your alts are, or at least publish enough info to let people make their own conclusions.

You seriously underestimate the ingenuity of people bent on a task. Pete Fats land scanners are the perfect example. There is no reason the same technique can't be used to track avatars and publish their whereabouts and on/offline data.

Stating that this is FUD is just HITS (Head In the Sand). And the thing that makes me so suspicious of your motives is that (at least I thought) you've been around long enough to know better.

Tzoc, with someone who has scripting skills like you have. I would be sure that you would know the difference between tracking what AV's are in a sim, versus which sim an AV is in. I am really agreeing with Cristiano here, you are using half truths to fight this battle.

You are on a one man crusade right now.

FUD - "F***ed Up Drama?"

coco

To clear up a whole ton of misconceptions here:

1: Land Scanning and AV Scanning are fundamentaly different processes. They have NOTHING in common insofar as how they function. I've wrote scripts to do both.

2: While it would certainly be possible to build a network of AV scanners, unlike land scanners AV scanners require use of the sensor functions. These are vastly more lag-inducing, and LL's policy on "You dont have the right to lag the entire grid" would probably be enforced here. But, but all means, go ahead if you want.

3: AV Scanning does not, in any event, require keys. AV scanning *obtains* keys. You can scan for and track avatars quite effectivly without ever knowing their key, just by their name. So while fear is certainly justified, to an extent, it is not relevent to this issue, as keys are not essential for the process in the first place. This entire line of reasoning is a red herring, and will not be considered or discussed further unless it can be demonstrated to have some useful connection with the topic.

Tcoz,

You're still doing it. No single example showed how anyone could track all your movements throughout SL, which is what you stated. Of course you can use a sensor in a sim, again, no public key list needed for that one. However, you cannot track someone's movements throughout SL. You would need access to land in every single sim on the grid, with enough range for sensor to cover the entire sim. Now what was that about not being FUD? Again, it is complete and utter bullshit.

You can call my motives into question all you want. That is a common tactic when one does not have a leg to stand on. My only motive here is to make sure that in your religious quest for the sanctity of all things Tcoz, that all the hysterical half truths you come up with are shown for what they are.

While your interpretation is certainly appropriate here, FUD refers to fear, uncertainty and doubt - a common scare tactic used to get people on the side of an issue by falsely raising their fears with misinformation (IE - if you elect John Kerry, the US will have another terrorist attack.)

The more I read here, the more it seems that Tcoz has lost the plot, and will rake in, and muddle up, anything that will help him give the impression that he has a logical position.

Dictionary attack on forum website ! Which for the uninformed means logging on repeatedly using someone elses name, and trying to guess their password. You can get programs that will try thousands of times, guessing from a "dictionary" of well used passwords.

How on earth is this relevant ? Keys are useless. The forum itself gives you the names to try. Almost certainly the software would lock you out with a big delay once you had 5 or 6 tries. Anyone concerned can easily increase their protection by using a long nonsense password. It is true that if someone succeeded they could then come into the game as you, since the passwords are the same, and they could then do you a lot off harm.

But none of this is in any way facilitated by published lists of keys.

If he wants to say "don't choose an easy-to-guess password guys" then this should always go without saying, and has no place pretending to support the paranoid arguments in this thread.