Potential Precedent Setting Case

Yeah, but behind the alts, he's still just one person, with less than one person's worth of credibility (In my eyes, at any rate).

There is a very strong possibility this situation could birth a case wherein a ruling on the 'real world value' of game items and currency is made. This alone is a great and more earth-shattering thing than any other mentioned anywhere in this thread. It would have far-reaching effect on every single game in the genre, and even reach outside the realm of gaming to effect intellectual property law in any venue that deals in the digital domain.

Blaze, you need to return to your bridge.

http://en.wikipedia.org/wiki/Byte-code
http://en.wikipedia.org/wiki/Machine_language

I think you will find that while compiling to byte-code or lower does remove comments the resulting code does still have both organization and structure. It is just not terribly easy to read.


You are mistaken in your belief that decompiling programs will lead to widespread release of the source code. It did not happen even in this case. Programs are most often decompiled for a somewhat more tangible result.

Surely you have seen, or at least heard of, "cracked" versions of Windows, Photoshop, Office, etc... How do you think the people that released them worked out how to bypass the copyright protections? How do you think people work out how to produce fake serial numbers that are accepted as real? (Yes, I know that some are done only using a large number of known real numbers.)

Have you played a computer game where someone was accused of cheating? (Diablo comes to mind as a good example of this.) How do you think they worked out how to give themselves an unfair advantage? The people who produced these cheats are likely to have done so in a manner very similar to the creation of SecondLife's hacked client.

It really is quite rampant.

This is an interesting topic with many facets to it and as a bystander i am finding it a good read.

It is curious that the adults keep responding to, and commenting on the child who keeps screaming look at me. As a parent, when a child becomes disruptive to the adults conversation you ignore it for a time, then you send it to its room. You ignore it in the hopes that since it recieves no gratification from bad behavior, that alone will stop the bad behavior. Acknowldeging its bad behavior, even to correct the problem, can ultimately encourage more bad behavior.

I regret I have nothing else to contribute to this discussion.

You mean like our vendor database backend, which was exposed, which included emails and database keys to fake and spoof transactions?


Yeah. That should be open source. It's also a "non issue" I suppose.

Because when we work 3 months on an avatar, that should be, you know. free.

This doesn't make any sense to me, Jeffrey. Someone comitted a crime and stole people's intellectual property. It was code they stole. How can that be based on anyone else's intellectual property? Aside from the fact that it was illegal, it was an act of incredible assholery. Yet the "lynch mob" is the problem? That's just bizarre. The person deserves to have their balls in a vice.

It's also rather lame to make assumptions that people who are pissed off that this happened are hypocrites because their empires are based on stolen IP themselves. I sell two types of products... clothing and skins. Clothing designs can only be protected by design patents which are null and void after only a minor change to the design. Still, since my clothing is based on real world designs I wouldn't be very bothered if my textues got opensourced.

My skins on the other hand, where I make 95% of my income, are completely original. The photos I use for source are legally licensed. The software I use is legal and licensed. If someone stole my work and made it freely available, depriving me of the 1-2k a month I make in very real dollars, you bet your ass I'd pursue legal action if I thought it would be worth the cost and effort. I find your comments rather insulting.

That's a good point, and I'm glad someone has mentioned this.

Potential possibilities:

A company like Seburo (sp?) has had their code seriously compromised. Do they have recourse against Linden Labs? Can they sue?

Sure they can! You can sue someone for accidentally stepping on your foot. Whether they would win would be for the courts to decide. Likely they would have to prove predictable negligence on the part of Linden Labs, but nothing legal would stop them from attempting to do so.

HOWEVER... and more importantly, they definitely have recourse against the 5 people who perpetrated this CRIME. And yes, it is a crime. What they did is a FEDERAL crime. They used their computers to hack Linden Labs and exploit secure, proprietary code. That carries a 20 year slammer if I'm right.

So what is a definite possiblity here is that Linden Labs could receive a Court Order to release the names/addresses/phone numbers of the users invovled to court officials and both civil and criminal charges can be pressed against these people. Because the TOS is designed to protect Linden Labs-- not to protect people who intentionally exploit Linden Labs code with criminal intent.

A prediction: there are 2 things that can happen-- either the information they accessed was relatively minor and this will all blow over, or it was major and having gone out over the net, will be poured over by every high-level hacker on the planet, and within 2 months the entire Second Life economy is going to crash bigtime.

No, this isn't a minor matter. And if I were a betting man-- considering how many griefers there are out there who hate LL and SL-- I'd bet on the second scenario.

Only way to totally avert that, as far as I know, is to re-write the LL economy code. Change the external access methods, stop the hack before it gets started. And if I were Linden Labs, that is what I would seriously be doing right now.

Wow. I know a whole generation of extremely badly-behaved, anti-social adults and children who have resulted because people buy in to this philosophy.

If you "ignore a child for a time"... it just causes that child to become even more demaning of attention, not less so.

I'm not going to get into the finer points of child psychology and rearing, but I will point out that Dr. Benjamin Spock in his later life admitted he was dead wrong. Tolerating bad-behavior is what encourages more bad behavior-- and is the reason you see so many tantrum-throwing little monsters in public places.

There's an old saying: "The delay in punishing a wrongdoing breeds more wrong-doing".

Our group has a zero-tolerance policy for trouble-makers. Members know that if they harm other users, they won't get another chance to do so. Those in the past who have shown anti-social attitudes have been directly cautioned, and if such behavior continues, removed from the group in order to protect other members. This makes everyone in the group feel safer, more peaceful, more protected.

Families are the same. When a child is disruptive, immediate censure (whether that is a "look", a verbal warning or if the case warrants it-- harsher consequenses)-- soon teaches that child what lines not to cross. Those are lessons that it will take into life and make it a stronger, more valuable adult.

Not meaning to get off topic, but had to respond to that one.

Valid points Blaze. About as valid as saying a local murder is unimportant because murders exist all over the planet.

While I appreciate the concept of not crying "the sky is falling", considering that Second Life is a RL economy-based system and that serious code has been compromised and sent out across the internet-- I find it amazing that you call this a non-event.

If it was YOU that made your living off of SL and it was YOUR code that was compromised and your business destroyed... would it still be a non-event?

As for whether this is minor or major, a lot of that will depend on A) how important the code was that was compromised B) how wide-spread that code becomes distributed C) How well Linden Labs initiates damage control procedures D) Whether or not the SL economy crashes within the next 30-60 days.

But frankly, if this is so unimportant and you don't think people need to be discussing it... I have to wonder why you found it necessary to post in this thread.

Sorry, couldn't resist a jab or two. This is the second forum thread I've seen where people jumped all over you for making non-empathetic statements.

It would also be very costly, with the risk of bankrupting any smallish organisation foolish enough to get involved.
Such a case should be left to the big boys, like Sony. We should keep out, just watching until the dust settles.

This is a bit tangential, but maybe interesting.Yes, but its a bit harder than difficult reading. I've done a some of this in my time, actually for a client who suffered from a disgruntled employee. He ran off with the source to some critical byte code embedded in their color printer. Since he had designed the hardware too, the only way to find out how to control the hardware was from finding how the whole thing worked from his code. Otherwise they would have had to scrap the lot.

I was doing low-level assembly code programming at the time (for the critical deepest loops of microchip-embedded software) and I dis-assembled/de-compiled their raw bytecode, straight from the chip, to give them back modifiable, understandable source-code. It was like detective work. Just the same puzzles, flashes of realisation, intuitive guesses. One could see the variables being changed, tested, acted upon, but what in hell did they mean, what were they for? Good fun, but time-consuming and difficult.



You're right. Once you understand what its doing, and have it documented, you dont necessarily take it all back to highest level source code. Some parts that will never need changing can be left as they are. Normally its done for a purpose, and critical bits will be extracted for use elsewhere, or critical changes will be introduced into the original. Particularly if the purpose is hacking.

On the legal points, I think only LL would have any right of action over the actual hacking of the client. They themselves suffered no loss. Why should they divert effort onto such a case. They won't bother.

A resident wants to sue over lost income from in-world. We know about 13 products were compromised. It seems LL know which. We, and they, can remain alert for fake copies etc, and act before any real sales losses occur. Indeed, if sales reductions show up, it can trigger an investigation. Remember, LL can see both scripts, compare them, and the new creators name tells you who to kick out. I think probably hard L$ damage will be minimal. And the claimant must do what he reasonably can to mitigate the loss.

What if it's not minimal? As defence attorney (which I'm not) I would argue that no such loss could be quantified, because no future income could ever have been counted upon. Why? Because the TOS says that LL can wipe out the whole pack of cards on whim at any moment, rendering your IP worthless since you cannot use the items, or even rezz them, elsewhere. The security and certainty of future income is zero. You cannot lose what you could not really expect. It was hanging by a thread already.

If someone hacked the GOM website, however, via a hacked in-world object made possible by a hacked client - that would surely be different. The client and the world together would just be a complex tool someone used to gain fraudulent access to a website. I think this would be a very ordinary case, and they would be in trouble. A tool is a tool, and the initiating person, and the hacked website, are neither of them inside a virtual world.

Just my guesses. If the financial and trading websites are ok, it'll be no big deal legally unless a resident goes for loss of earnings, in which case they will have a long expensive fight on their hands, and probably lose.

And something valuable has resulted. We now have a more secure client, with one more vulnerability closed to future expoitation. Maybe by some stealthier people might have got much more, and made worse use of it before being discovered. But now they can't do any such thing.

*IM ONLY REPLYING TO THIS*
to prove loss of sales the offending party has to have used you items in question to promote their own sales such as opening a shop wityh a lower price gadgit but simply seeing how manny people have that script and haveplaced it and or modded it is quite impossible if you know what your doing scripting wise you can change the structer of a script in to some thing unreconizeable which make damage controal near impossible all you can do is try not to draw attention to what was stolen or you risk causeing a large black market for these things and its the same thing if you know who did it.

at any rate the linden have toe ability to see what was stole and probly contanct the owner for it and possibly repay them for their greif something on that level deserve more than a ban though.

They have suffered loss of goodwill. You can't list goodwill on a balance sheet, but it still has value.

Irony. Oh, irony all over it. Classic.

Actually, I'd like to take a moment to comment on this as I've heard this statement in concept before, and I believe that really wouldn't stand up in a court of law. Why?

First, I wish to state up front that this is all totally hypothetical. Any software has the potential of being breached. Any security system can be broken by sufficiently determined individuals. It is not surprising that someone hacked SL. Such happens. No need for folks to talk about suing SL; LL surely had no intent that this would happen and unless someone from the inside was involved, no responsibility that I can determine.

But regarding the TOS and the question "Can LL be sued for this or that?"....

The TOS is a basic guiding document. It is a concept in principle that gives a foundation on which SL is to operate. However, the TOS does not negate 200 years of contractual case law, nor does it negate current laws regarding business operation, warranty, negligence laws, or right of tort.

This stated, suffice it to say that the TOS does protect SL to an extent. However, it could I think be successfully argued in a court of law that since Linden Labs designed Second Life to be an economy-based enterprise, they did take on some degree of forseeable responsibility and accountability.

If the system was not economy based, then all they would be liable for is returning people's moneys for unfulfilled contractual obligation if they decided to close shop. However, since it IS economy based, and since people do earn real life incomes from Second Life, then Linden Labs has conceivably taken on a community responsibility to keep the financial system in reasonable order.

As an example, say Phil decided to close down Linden Labs tomorrow and retire. So he just shuts the doors, tells everyone too bad, see ya, and left. (Of course, I am by no means stating that this would happen).

Such an action could trigger several areas of established legal precedent, including criminal negligence, malicious vandalism of private properties (although Second Life is owned by Linden Labs... the creative content and copyrights is the property of the builder/users), willful destruction of private property, etc. Such action could even entail criminal charges. In addition, it has to be remembered that civil law is a very flexible and versatile system. All someone would have to do is claim that Linden Labs caused them severe financial disheaval, did so knowingly, willingly and with maliscious disinterest in the welfare of its clients, and Linden Labs would be in for a fight for its life, TOS or no TOS. Shoot, a competent attorney might even take such a case on contingency, it would be that good.

Bottom line: attorneys would argue that regardless of the TOS and the imagined protection it supposedly offers Linden Labs, the company has a certain degree of responsibility to its clients. And I think that any court of law in the nation would accept those arguments and at least hear the case with all seriousness.

This is just hypothetical of course. All I'm pointing out (and have pointed out to others) is that the TOS is not a protect-all shield. It's just a basic lincensing agreement from which LL would TRY to form a defense should such be needed. But if push came to shove the TOS would be the first thing a prosecuting attorney would target, and I doubt it would last long. The attorney would attempt to get the court to consider the case from a malicious/negligent standpoint and getting past that, the TOS would be dead and the fight would be on.

I've heard too many "TOS is word-o-God" arguments, and I've seen too many businesses sued to the gills by trusting in such documents to relieve them of civic responsibility. Fact is, such documents don't mean much when a judge is considering whether the actions of a company foreseeably and knowingly put a trusting client into bankruptcy.

One other point... 'cause I saw it mentioned twice (and please forgive the double post. LOL)

Regarding being unable to claim lost sales because there's no way of knowing what sales would have been...

tut tut. Of course you can. Businesses do so every day. That is what stockholder predictions and company forecasts are all about. Businesses have trends. These trends, although not set in stone, are trackable and predictable.

If I have sold 200 qty per day of Widget X-5 for the last year then suddenly my sales drop to 10 units per day, and it is later learned that my computers were hacked and coincidentally my competitor started selling an exact replica of my product for 1/3 less than me, then that is arguably grounds for a criminal investigation. Should such charges be proven, that competitor can be sued for every unit that can be reasonably forecast that I would have sold but didn't due to that criminal act. It is called "Opportunity Loss" and it has real, measurable financial value.

That is the basis in fact, of many if not most of the lawsuits today. "I am suing this man for $250 million for lost sales, malicious and illegal theft of clientele, pain and emotional suffering". All you have to do is give reasonable cause, and the $$$ amount is established.

I apologize if it appears I'm tarring everyone in the thread with the same brush. This is not the intent.

The problems here are twofold. One, stealing others' work is wrong, regardless of stated purpose. Two, many businesses in Second Life are founded on this practice, yet go under the radar because the people they'd normally piss off aren't residents here.

As such, I feel it is very hypocritical to constantly bear down on these issues, yet turn a blind eye on the stolen property in one's own backyard (despite much discussion, there remains woefully little enforcement). This observation is pointed at no one in particular for the time being, yet I cringe every time I see a random someone open a business selling avatar depictions of others' work.

The final problem is how swift we can be as a community to judge people on very little information. Regardless of whether the reaction is the "right" one or not, I call such posts part of the "lynch mob" precisely because it's a recurring event here with that flavor.

I know full well how swift people can be to judge from having them bear down on me before on a similar issue. Most people didn't even realize what was going on or what had happened; they just happily proceeded to string me up on a post despite my vain attempts to stop the problem before it even started two whole months prior. Fewer still comprehend the original purpose of that old script to boot, which wasn't about copying at all, and came complete with failsafes that have since been strengthened to the point of absurdity. C'est la vie.

So yes, I'm not pleased at the reaction I've seen. While people here are rightfully apalled, the swift judgment factor and blind eye I'm noticing bothers me considerably. This all tells me that, as a community, we still have far to go.

You're lumping everyone into the same pile.

Suppose I like koolaid, and I make (and sell) a kool-aid man avatar. Kool-aid is not suffering any loss. You're not competing with them. In fact, it's free advertising.

What's going on here is completely different. You're just screwing people out of their own hard work.

Oh, and remember the reason you came under fire was because your utility could be used as a tool for screwing people out of their own hard work too.

First of all, Kris, please don't put words in my mouth or I'm going to walk away from this thread:




Second, the line between "Fair Use" and "Relevant Gain" is really very, very shaky in Second Life. I will agree that for the time being, the perception is that these things are not directly damaging due to their small market share - for now.


I'm well aware of that, which is why I spent so long trying to get LL to see the issue before it even began. I spent the better part of two months looking into possible alternatives, talking directly with a few Lindens, support groups, and even tried releasing a "fix" for people using No Modify objects.

The final answer was to just gimp the code. The problem still exists, and remains as one of the basest of priorities. I don't exactly call that good for SL; I call it killing the messenger.


The difference here is the group involved acted in direct malcontent by taking it upon themselves to run amok with other peoples' code. That, by contrast, is a definite wrong. The point I draw the line is at passing judgment upon them.

Oh noes! Your high horse went thataway ---->

(btw, what words did I put in your mouth?)



Right. so you understand why they're pissed then. Good. I was beginning to think you didnt get it at all, and that you figured that these handful of talented content creators didnt have a right to be upset because, after all, all too many people in SL ride on others coattails.



Aren't these two lines in direct contradiction of each other?

Not at all. Stating something is morally wrong is completely different from stating "this person should go to jail," or the colorful ways I've seen that the perpetrators should be harmed.

To be fair, you can catch me saying "I think LL will ..." about the perpetrators, above. Even in the hypothetical, I'm stretching my own base a bit there.

I think so, Kris. That ain't no high horse, it's a fence he is sitting on.

Jeffrey, I was going to say I love the hurt bunny theme running through your posts....I love this particularly:

which makes it look as though the script in question had some other much more noble purpose and that those rat finks hijacked it for nefarious reasons.

I can see why you are getting a bit uncomfortable up on your fence there. I see NO difference between your script, designed to allow people to copy objects in world...objects which I make...and this hack, designed to copy scripts. Except that scripters think objects and their uniqueness are worthless, and scripted items are not.
Cali

With that I'm done posting to this thread. There's no point in bothering when we'd rather dwell on attacks.

I am no moral angel by any meaning of the term, and you can quote me on that. I simply exist to offer my take on the matter, and if you don't agree with it, that's your perogative.

In a way, it's a pity, as I really respect what you've done for Numbakulla, Cali. Good day.

I understood Jeffrey's comments and didn't read an all-encompassing accusation; i saw the word "many". And i suspect he's correct in that assessment.

I also agree with his sentiments. However wrong the actions taken by the hacker(s), i sadly wonder how many complainers are themselves appropriating intellectual property for their own gain (and to the detriment of their SL competitors). Not the sort of thing that should be going through my head right now.