These forums are CLOSED. Please visit the new forums HERE
HTML in SL |
|
Jesse Linden
Administrator
Join date: 4 Apr 2005
Posts: 285
|
04-27-2005 14:40
Enable viewing of web pages on the surface of primitives in SL
|
Psyra Extraordinaire
Corra Nacunda Chieftain
![]() Join date: 24 Jul 2004
Posts: 1,533
|
04-27-2005 14:57
I voted for this in the votes, though I'm not sure of the trickiness of this. :>
I'd be happy if you could simply set a picture URL in place of llSetTexture(). ![]() Full webpages would be nice too. Could make (literally!) photo albums and other toys. :> _____________________
E-Mail Psyra at psyralbakor_at_yahoo_dot_com, Visit my Webpage at www.psyra.ca
![]() Visit me in-world at the Avaria sims, in Grendel's Children! ^^ |
Lance Hedges
Brian Peppers!!
![]() Join date: 23 May 2004
Posts: 151
|
04-27-2005 15:17
lol I'd be nice if we could post on the forums while in SL on a prim ^_^
_____________________
|
Nekokami Dragonfly
猫神
![]() Join date: 29 Aug 2004
Posts: 638
|
04-27-2005 20:38
If you have some way to accept input on the prim, you could do a lot with CGI on the website that could really add a lot of dynamic content in-world. Being able to detect and send clicks would be nice, of course, but even being able to accept a message through a chat channel would open up a huge range of possibilities.
Imagine being able to look at Snapzilla from within world.... ![]() neko _____________________
Help build InnerLife, a biofeedback adventure in Second Life
Please Vote: Prop: 203 - Support local devices beyond mouse and keyboard Prop: 201 - Scriptable Avatar Prims/NPCs/Mannequins/Animals Prop: 199 - Capes, Cloaks, Coats, Veils, Belts, etc. |
Editorial Hare
Second Life Resident
![]() Join date: 11 Nov 2004
Posts: 116
|
04-27-2005 20:53
Please see this thread also.
_____________________
Please see my alternate account disclaimer here
The world tolerates conceit from those who are successful, but not from anybody else. - John Blake |
Hiro Pendragon
bye bye f0rums!
![]() Join date: 22 Jan 2004
Posts: 5,905
|
04-27-2005 21:23
Today at the Town Hall meeting Cory Linden officially confirmed this will happen, but did not give a timeline.
_____________________
Hiro Pendragon
------------------ http://www.involve3d.com - Involve - Metaverse / Emerging Media Studio Visit my SL blog: http://secondtense.blogspot.com |
si Money
The nice demon.
Join date: 21 May 2003
Posts: 477
|
04-28-2005 12:14
I am beyond extremely concerned about the security of implementing this idea. With the way SL implements this sort of feature, it seems that it would basically tie into an outside rendering engine (Gecko, hopefully something lighter).
My concern is you're basically running a web browser on your PC and turning over the controls to an outside entity. This idea is probably enough to make me quit using SL entirely, unless a Linden can comment about how security of this is being approached (and a very thorough discussion of it as well). Without this explanation, I have to say flat out this is the worst idea i've ever heard. I realize a lot of people blindly want the idea to use their blogs and such in SL, but how many of you would let every resident of SL use your PC without your control or oversight? _____________________
Like a soul without a mind
In a body without a heart I'm missing every part -- Progress -- Catherine Omega: Yes, but lots of stuff isn't listed. "Making UI harder to use than ever" and "removing all the necessary status icons" things.... there's nothing like that in the release notes. ![]() |
Tizzy Calliope
Mew!
Join date: 27 Feb 2005
Posts: 38
|
04-28-2005 12:35
I'm ... not exactly sure what your concerns are. The HTML code would be on SL itself, so how would it be "using someone else's PC"?
|
Nekokami Dragonfly
猫神
![]() Join date: 29 Aug 2004
Posts: 638
|
04-28-2005 12:42
I think the security concerns depend on how much is to be implemented. HTML by itself is not especially problematic, being merely a formatting markup language. Javascript could be an issue. Flash or Java applets would have to be very carefully sandboxed. I would not consider using a system that allowed ActiveX, but as that's a proprietary system, I don't suppose it's very likely.
Probably there should be security settings as browsers have, to allow users to select the level of risk they are willing to accept. For example, most likely your browser allows you to decide whether or not to view images, execute javascript, run Java applets, store cookies, etc. These options would need to be implemented in the SL client. I agree that further discussion of security issues around this is needed. neko _____________________
Help build InnerLife, a biofeedback adventure in Second Life
Please Vote: Prop: 203 - Support local devices beyond mouse and keyboard Prop: 201 - Scriptable Avatar Prims/NPCs/Mannequins/Animals Prop: 199 - Capes, Cloaks, Coats, Veils, Belts, etc. |
si Money
The nice demon.
Join date: 21 May 2003
Posts: 477
|
04-28-2005 13:57
I'm ... not exactly sure what your concerns are. The HTML code would be on SL itself, so how would it be "using someone else's PC"? How many rendering engines have you come across? There are really about 3 total which are actually functional in current standards of W3. Even across those 3 there are very serious compatibility problems about how each handles the rendering of pages. If LL is planning on completely implementing their own HTML/CSS/etc rendering engine, I am absolutely fine with that. However, with the way SL is made, I would suspect this is not the way they plan to do it, but rather use an opensource HTML rendering engine. If it does get implemented this way, I suspect 90% of the people who want this feature will scream bloody murder when their pages aren't rendered the same way they are in [IE, Firefox, Mozilla, Opera, lynx, elinks, Netscape, Netcraft, whatever]. I think the security concerns depend on how much is to be implemented. HTML by itself is not especially problematic, being merely a formatting markup language. Javascript could be an issue. Flash or Java applets would have to be very carefully sandboxed. I would not consider using a system that allowed ActiveX, but as that's a proprietary system, I don't suppose it's very likely. Probably there should be security settings as browsers have, to allow users to select the level of risk they are willing to accept. For example, most likely your browser allows you to decide whether or not to view images, execute javascript, run Java applets, store cookies, etc. These options would need to be implemented in the SL client. I agree that further discussion of security issues around this is needed. neko Those security measures are good, when combined with the ability to control what sites you are visiting. Since the controller of the visited site is not you, those security measures aren't really enough -- nor are they an appropriate method for mitigating the risk. The biggest problem is that most security problems are not ones which are controlled within those options, they are flaws in the rendering engine. _____________________
Like a soul without a mind
In a body without a heart I'm missing every part -- Progress -- Catherine Omega: Yes, but lots of stuff isn't listed. "Making UI harder to use than ever" and "removing all the necessary status icons" things.... there's nothing like that in the release notes. ![]() |
Lex Neva
wears dorky glasses
Join date: 27 Nov 2004
Posts: 1,361
|
04-29-2005 09:07
To elaborate on what si Money just said, most security risks in IE (especially) and Netscape are the kind that simply require a user to surf to a certain website to be vulnerable. If SL used the Internet Explorer rendering engine (and it seems like they might because it has a convenient embedding API), all of the vulnerabilities in IE become exploitable simply by placing the appropriate webpage on a prim in the world. If the webpage loads automatically like music does, the user's computer will be compromised immediately upon entering the parcel. If the current texture-replacement method used in movies is also used for HTML-on-prim, the texture can simply be hidden and the user would never even know they've been subjected to a security risk.
What's the solution? Well, one thing that prevents such simple exploits is the fact that users tend to know where they're going just by looking at a URL, and they avoid being tricked into going somewhere they didn't intend. At the very least, I think every use of HTML-on-a-prim will need user confirmation before the browser is launched. It won't be enough though. I think we'll see exploits performed with this feature. |
Jeffrey Gomez
Cubed™
![]() Join date: 11 Jun 2004
Posts: 3,522
|
04-29-2005 09:53
Let's slice this issue up a bit.
HTML on a prim would be a good idea. XML on a prim is a good idea (and is possible with Quicktime already). ActiveX and Certain Types of Web Scripts on a prim are NOT a good idea. I think we can see why. While certain plaintext and image-based media would be good, external scripts that could potentially harm the servers themselves should be avoided at all costs, in my opinion. As always, IE-and-Microsoft standards are the big ones in this category. Furthermore, how would pop-up/spam be dealt with? How about Javascript? User-protection? It's an interesting issue - and one that's a relative certainty. If it were me, I'd begin slicing up the Firefox/Mozilla browser and using some of the good elements from it for this project. Another good link on this topic from several months ago: /120/01/29331/1.html _____________________
---
|
Jeffrey Gomez
Cubed™
![]() Join date: 11 Jun 2004
Posts: 3,522
|
04-29-2005 10:30
Copying some relevant comments from another ongoing thread to this one to consolidate discussion:
I had a realization last night while talking with a friend about how people relate to SL and to the web. I am still very new to SL, and very aware of what it does to "players" and how they interact with each other and things in the world. The virtual world of SL is very real to our senses, and adding more realistic physics, via Havok 2 or otherwise, will strengthen the experience. For me, I don't require much suspension of disbelieve to feel I am there already. More physics done faster will make it more fun, more immersive, but already it is enough for me. The dominant experience in SL is being there, making connections with people, feeling you really are there, and almost mind melding with them. It is a powerful experience that many of you have felt. And what do we do with our connections? Lot's of fun things, but one thing is that we share bits of information, usually lost to the ephemeral chat stream... In contrast, the web is information first, with little or no feeling of being connected. In the early days of the WWW, people noticed the feeling of "going to a web site", and we still talk about it that way, but even though you are there, you are just a click away from not being there. And you don't (usually) see who else is there. The value of the web is access to the vast ocean of information, disorganized as it still is. The collaborative aspects are also valuable, but mostly limited to messaging, again with little feeling of being connected. So what will be the effect of combining SL and the web, bridging the gap between information and connection? Will we be able to find each other more easily? Will web sites more to SL? I don't know if we can predict - the potential is enormous. Just remember how much the web changed the world, and multiply that by 3. But what we mean by adding the WWW to SL could be very different depending on what features are supported. If the only feature we are talking about is static display of a web page on a prim, as if it were a texture, that would be a good start, but it wouldnt go very far. If we can make the URLs dynamically computed, that would allow a lot more, since it could be used to submit different requests to servers based on what the users are doing. But what about interacting with the page display? Can we click on links in the page, or invoke any of the other actions that web pages support? Click and keyboard events in SL must be translated into events on the web page to support that. Beyond that, further integration of the WWW with SL is possible if the WWW browser is built into the SL client, not just a page pasted on a prim. It would be great if we could use JavaScript as the scripting language not only for dynamic web pages but for all SL objects. Then we could begin to dissolve the web page, make it an integrated part of SL, and vice versa. How about making SL available on the web as well? An applet or plugin to the browser could provide a minimal UI with limited capability, enough to get more people experiencing the connectedness, and draw them into the full SL experience. My guess is that the first step will be to have the normal browser live and running, and to write its window into the SL world so that it fits onto a prim, replacing chosen texture, as video does. Since that is probably pretty easy now, I would hope that the problems now being solved are to do with transmitting screen clicks back to the browser so that we can click normally on browser links, and surf the web normally, on the prim. Thats what I think we'll get first. Without clickability it would be not much use IMHO. The only way to use this facility to control in-world events would be (as suggested above) to use an entirely different route back from webserver to world, like email or XML/RPC. So no script could directly access, and act upon, any data displayed in the browser window. It just wouldn't have access to it. Thems my guesses at the most it would be realistic to expect in the first implementation. Anybody disagree ? Anybody realistically expecting more ? ... if HTTP: in SL happens, wouldnt that allow us to view web supported video that isnt QT supported (such as avi) on our prims now? Just a thought _____________________
---
|
Nekokami Dragonfly
猫神
![]() Join date: 29 Aug 2004
Posts: 638
|
04-29-2005 10:42
In thinking about it, I guess I was reacting more to the title "HTML in SL" than the description "Enable viewing of web pages on the surface of primitives in SL." I wouldn't want the latter. What would be the point of looking at a whole web page rendered through SL? I have a perfectly good tool for that already, that I can adjust the size of to make pages readable on my screen. By contrast, in SL, prims (even 10m ones) tend to not take up the whole screen, so the image of a typical web page would be squashed, distorted, and probably unreadable.
On the other hand, using very bare-bones HTML rendering would allow dynamic text and images to be rendered on prims, which I would think very useful. Again, the idea of being able to script simple access to a special version of Snapzilla using clickable controls would be very cool. I would rather not see Javascript attempted to be rendered as part of web pages in-world (how would you do popups and new windows?) and if Java applets are ever supported, I'd rather they were handled separately from HTML rendering. So if you stripped out the executable content tags (replacing them with "unsupported content" or somesuch) and just rendered simple HTML (maybe even leaving out tables, which are horribly complicated to render), how much of a security problem would that represent? neko _____________________
Help build InnerLife, a biofeedback adventure in Second Life
Please Vote: Prop: 203 - Support local devices beyond mouse and keyboard Prop: 201 - Scriptable Avatar Prims/NPCs/Mannequins/Animals Prop: 199 - Capes, Cloaks, Coats, Veils, Belts, etc. |
Editorial Hare
Second Life Resident
![]() Join date: 11 Nov 2004
Posts: 116
|
04-29-2005 12:11
All I want is the ability to send data via URL reliably and instantly to an outside php script via an LSL call without having to run through a bunch of SL communication hoops.
I don't care if there is full rendering capablity in SL. In fact less is better. No Java, no Active X, no Flash, just bare bones html, with the ability to define the destination URL dynamicly from within an LSL script with no delay. _____________________
Please see my alternate account disclaimer here
The world tolerates conceit from those who are successful, but not from anybody else. - John Blake |
si Money
The nice demon.
Join date: 21 May 2003
Posts: 477
|
04-29-2005 12:19
All I want is the ability to send data via URL reliably and instantly to an outside php script via an LSL call without having to run through a bunch of SL communication hoops. I don't care if there is full rendering capablity in SL. In fact less is better. No Java, no Active X, no Flash, just bare bones html, with the ability to define the destination URL dynamicly from within an LSL script with no delay. I think you're looking for an entirely different feature then. The description of this feature would be for rendering of HTML on a prim face, not for LSL HTTP interfaces. _____________________
Like a soul without a mind
In a body without a heart I'm missing every part -- Progress -- Catherine Omega: Yes, but lots of stuff isn't listed. "Making UI harder to use than ever" and "removing all the necessary status icons" things.... there's nothing like that in the release notes. ![]() |
Jack Digeridoo
machinimaniac
![]() Join date: 29 Jul 2003
Posts: 1,170
|
04-29-2005 12:27
GIVE US COM INTERFACES SO WE CAN EMBED OUTLOOK, EXPLORER AND ANY OTHER APP THAT SUPPORTS COM ON A PRIM
_____________________
If you'll excuse me, it's, it's time to make the world safe for democracy.
|
si Money
The nice demon.
Join date: 21 May 2003
Posts: 477
|
04-29-2005 13:17
GIVE US COM INTERFACES SO WE CAN EMBED OUTLOOK, EXPLORER AND ANY OTHER APP THAT SUPPORTS COM ON A PRIM How about.. no. I don't want people in SL to have that much control over my computer. _____________________
Like a soul without a mind
In a body without a heart I'm missing every part -- Progress -- Catherine Omega: Yes, but lots of stuff isn't listed. "Making UI harder to use than ever" and "removing all the necessary status icons" things.... there's nothing like that in the release notes. ![]() |
Nekokami Dragonfly
猫神
![]() Join date: 29 Aug 2004
Posts: 638
|
04-29-2005 13:25
GIVE US COM INTERFACES SO WE CAN EMBED OUTLOOK, EXPLORER AND ANY OTHER APP THAT SUPPORTS COM ON A PRIM Thankfully, I don't think I have to worry about that on the Mac version. neko _____________________
Help build InnerLife, a biofeedback adventure in Second Life
Please Vote: Prop: 203 - Support local devices beyond mouse and keyboard Prop: 201 - Scriptable Avatar Prims/NPCs/Mannequins/Animals Prop: 199 - Capes, Cloaks, Coats, Veils, Belts, etc. |
Morgaine Dinova
Active Carbon Unit
![]() Join date: 25 Aug 2004
Posts: 968
|
04-29-2005 15:51
The security considerations of full browser-type functionality running client-side but viewed on a prim face are just too horrendous to contemplate. Broadband-connected Windoze PCs around the world are already in a never-ending firefight against attacks, and the webpage-to-browser is a primary vector for it. The last thing we need is another attack vector via SL.
Barebones HTML and XML are inherently safe technologies, but anything with an active client-side component is not. The initial implementation of "HTML in SL" should therefore limit itself entirely to those two aspects of markup and rendering. Once we see how it's been designed, we can then comment in an informed manner on the security aspects of triggering client-side actions. _____________________
-- General Mousebutton API, proposal for interactive gaming
-- Mouselook camera continuity, basic UI camera improvements |
Editorial Hare
Second Life Resident
![]() Join date: 11 Nov 2004
Posts: 116
|
04-29-2005 16:01
I think you're looking for an entirely different feature then. The description of this feature would be for rendering of HTML on a prim face, not for LSL HTTP interfaces. I assume that there will be some abilty, via LSL, to determine the URL to render on the prim face. _____________________
Please see my alternate account disclaimer here
The world tolerates conceit from those who are successful, but not from anybody else. - John Blake |
si Money
The nice demon.
Join date: 21 May 2003
Posts: 477
|
04-29-2005 16:03
I assume that there will be some abilty, via LSL, to determine the URL to render on the prim face. Probably, but is it going to help you when the response is displayed on a prim face in rendered HTML rather than returned via an event? _____________________
Like a soul without a mind
In a body without a heart I'm missing every part -- Progress -- Catherine Omega: Yes, but lots of stuff isn't listed. "Making UI harder to use than ever" and "removing all the necessary status icons" things.... there's nothing like that in the release notes. ![]() |
Editorial Hare
Second Life Resident
![]() Join date: 11 Nov 2004
Posts: 116
|
04-29-2005 16:08
Yes, because I just want data out. Also that URL variable can be used to pull data for dynamicly created HTML, to then be rendered on the prim face.
_____________________
Please see my alternate account disclaimer here
The world tolerates conceit from those who are successful, but not from anybody else. - John Blake |
Morgaine Dinova
Active Carbon Unit
![]() Join date: 25 Aug 2004
Posts: 968
|
04-30-2005 10:04
Perhaps those of you with a very strong interest in this subject could ask Cory (via Hotline to Linden) the general parameters of his ideas on this so far, purely to help us in our discussions?
The key question would have to be whether any interpretation is done client-side, because that is where the totally collosal security liabilities come in. If the answer to that is NO, then the subject becomes immensely more tractable. In-world uniformity would then be automatic and security of clients is then assured, but inevitably at some cost to the server. If the answer is YES to client-side, then ... well let's not go there for now. _____________________
-- General Mousebutton API, proposal for interactive gaming
-- Mouselook camera continuity, basic UI camera improvements |
Lex Neva
wears dorky glasses
Join date: 27 Nov 2004
Posts: 1,361
|
04-30-2005 10:37
The thign is, when most people ask for "HTML on a prim", what they really are thinking is beign able to send people to a certain webpage, on a prim. Any webpage. Without all the standard javascript and DHTML and such that people have grown to associate with "the web", most websites won't work, some not even at all. People might well want "full" support for all the webpages out there. They'll toss out phrases like "if it works in IE, why can't it work in SL?" and stuff like that.
I don't think most users will appreciate bare HTML on a prim as much as the techie crowd will, and they'll whine and complain. |