HTML in SL

HTML on a prim...hmmm....

Can I have fries with that?

Oh...and do you have that special sauce?

I say.. Absolutely not! The last thing we need is more banner ads, flash schtuff and the like in our SL experience..

Just wanted to chime in and say that not all vulnerabilities come from rendering.

Vulnerabilities can also come from malformed URL's. Therefore, even if the engine only renders xhtml, the client side embedded browser may still be unsafe.

Additionally, all clients will remain vulnerable to each new threat until Linden releases a patch to their embedded web browser. Since they have difficulties releasing patches quickly, security updates may come slowly.

On top of that, others have already pointed out that unsolicited page fetches are much much worse than solicited page fetches.

So far, i think LL has done a great job of sandboxing their environment. As they add more and more client side components, they open up more vulnerabilities. It's very easy to imagine a widespread SL worm.

SL is already a hostile environment and testbed for malicious coders (griefers).
Imagine guns which not only unseat you and launch you a few sims away, but direct you to a malformed URL, then inject hostile executable code which crashes your PC.

Worse yet, the hostile code includes a keyboard sniffer. Next time you log on, your userid and password are sent to the gun creator.

FUN?

To reduce the risk of malformed URLs, LL could set up a proxy server which sanitizes all http requests. Might as well sanitize the xhtml at the same time.

IMO:

welcome to the magnificent world of www.3d.com.

I see 4 things right off the bat:

1)kewl html in sl i like that as an artist.
2) eek what about malevolent sites and the stability of sl. Enormous difference between controlling a griefers’IW bomb; and a 3rd party web virus. Would you like to buy this item? “YES!”
…. Now downloading, virus.exe into your system. Are we left on our own to determine the security of each site we visit via a prim IW?
3) lag; a huge concern and how will this affect the current stability of sl?
4) yeah more commercials, show me something innovative that has zilch to do with player to player economic gain.

Its not a metaverse yet; it’s a metaphorically marketing stratagem IMO. Continue down this existing path and I don’t see it attaining much more.

No, because it's Mozilla. Those sorts of security problems are pretty much limited to IE. Mozilla avoids the vast security hole that is ActiveX by simply not executing ActiveX controls, which makes sense, as they're a proprietary Microsoft technology. There are still other, generally more specific security holes, but they've historically been mostly theoretical and been patched within days. Patches would take longer to be integrated into SL/Mozilla, but they'd still be done in a timely fashion.

It will be optional. Websites are unlikely to load without your consent, and the entire feature will be able to be disabled in your options. The added memory overhead of Mozilla will likely necessitate that for systems with low amounts of RAM.

In the other thread, I posted a half dozen examples of what this could be used for. Everything from games to signs, to enhanced communications is possible. Better documentation, or even entire books, as well. You could play a game like Monopoly with objects within SL, while another player played on their cell phone in another country.

I know you have your reservations about this, but just because someone can have ads on their website, it really doesn't mean the sole use of the web is to display ads.

I've only seen one valid complaint about not doing HTML in SL. This complaint was bases on *security* Now take a step back for a second. Understand what the problems of running ANY program as the SUPER USER. Now step back to the table. Run SL as a regular user, NOT ROOT NOR SUPER USER and not your BUILT IN ADMIN account!!! Instantly even if the SL program was hacked, or you loaded a web page with malicous code. Since its a weak limited user access, walla you just stopped them from causing trouble. If your a linux user, permissions are easily used and understood. If your a windows user, simply create a limited user, and share the folder *disable simple file sharing* run CPAU so you can login as super user, but run SL as limited user. Enable all the fast switching and terminal service crap. Note XP HOME SUCKS and you will need to login with a limited user as it has no support for fast user switching, GET XP PRO. If your running a mac, i have no idea i don't use them your on your own. If you have trouble running SL as a user feel free to contact me in game.
Steve Fox

This feature is now marked as abandoned in the voting page.

A feature is abandoned when the original voter removes their votes, right?

Since it's been accepted by LL, then there's no reason to keep voting for it.

Mom! Someone let Prok out of his cage!!!!!!

ah! got it.. phew.

(sidetrack topic)

So if the engine of the browser is not set in stone yet, has anyone taken a look at opera now? On the other thread I tried it out for the first time and find that they make their browser for every little device. Maybe they'd be the ones to make a special SL browser?

They have SVG too btw!

I could definately see this happening, but my only gripe with it is, is why would i be playing a game within a game when i could just go out and play runescape on my minitor instead of a prim in sl.....kinda hard to security issues in keeping passwords and names a secret when some meatbag sees you type them in or say them in world! Who knows maybe itwill lock you in, but personally i'd rather just be viewing sitesd only. Infotech was an amazing feature that maybe could lock certain sites on it to go and search around. Maybe we can do that with the sl wiki crap

Could we at least get linkable URLs in IMs? Maybe down the road you could make URLs in main chat and help notecards linkable too. But for now private IMs would be nice.

LOL I can imagine the 3D pop up ads. OH NOES!!1

wwwyzzerdd: Surely this convenience entices you!

Already asked them this question. They said the browser (to paraphrase) "won't support popup, and it would be something extra they'd have to code, anyway."

But... meh. 3D popup is already doable, and happens, in SL and online. That's what a good hosts file (or ignore log) is for.

Hehe i was just being silly

Probably if the browser did permit popups it would be directed to your default non Sl browser. Like firefox, IE, or opera.

Thanks the Gods we will be getting embedded Firefox, NOT embedded IE.

Nor any other conventional browser.

It damn well better be possible to disable this, with some mechanism to let you bring up HTML content out-of-world instead of in-world.

I don't normally leave firefox running when I'm in SL, because FF can be a horrible memory hog. I don't even want it sharing memory with SL when it's not in use.

Thats why i use 2 computers. One of them is for SL, the other one does messengers/browsers/3rd party apps/exc. I like firefox but i find opera a little more flexable since spyware/popups dont seem to effect it as much. When firefox first came out, it was completely uneffected by spyware/popups. Now look at it. :/ And its built in popup blocker doesnt help at all. but hey if it's added to SL and theres a way to prevent popups, il just be using SL for all my browsing needs from then on. XD

This is a dead horse I think but it's not in the game yet, Linden! Before everyone in ALL of SL starts using webpages for dynamic content (they will, especially computer terminals and stuff like that they could make.) you could use a tier system and your Linden currency to help curb the number of websites painted on every prim, this is a cool feature that I would not want to turn off but don't want everyone to be doing it because it's easy.

Basically: 20L to paint a website on a prim, 40L to make it interactive, and maybe 100L for interactive auto-updating flash playing, etc.

I don't really get your reasoning for this. All the content would be externally hosted anyways, so why would LL care? It's not their bandwidth that would be used.

I see nothing wrong with making development easier. Allowing more people to create new and better things should be encouraged, not punished.

For some reason if people can click on stuff I imagine alot of advertisements and such, I would not make it free to paint a webpage on anything. Thats all.

Not sure I favor the idea of HTML-enabled prims. Sure, it opens the doors to a lot of neat things, but I am deeply concerned about security. Most security concerns have already been highlighted in previous posts, so I will not rehash them. But another concern that comes up is IP Address harvesting. All you need to do is run an apache webserver, put a HTML-enabled script somewhere, and if they're auto-loaded by anyone passing by, you get their IP address. Griefers could acquire your IP address, something they cannot do very easily right now, and attempt direct attacks against your system.

With that in mind I'm not sure I would feel comfortable with this feature being available.

Increased ability to use the embedded browser would be nice.

Nice bump, by the way.

It would really depend on implementation.
The kind of HTML-onna-prim we want is text and text formatting for use in texures (on the sides of prims such that you can have dynamic text for a product or sign or whatever) or notecards so that bold things can be BOLD.
Which makes me think we'd get a gimped version of HTML that is in a form commonly known as BBC.

The other possibility is that the HTML-texture is compiled server side. Oh noez, now you have the sim's IP, which with ethereal I'm sure you'd already have.

Now, server-side HTML isn't the best as it means that the server does the work instead of the client and it has to transmit the texture instead of just the HTML bytes.

as long as we can opt to choose 'off'