client source opened - sky falling?

But, presumably the bad guys are vastly outgunned I have high confidence that there will be far greater numbers of highly skilled "good guys" who want what's best for SL.

That's not really reassuring, honestly. If LL uses resident submitted "fixes" then the official viewer becomes the rogue one. I'd rather live with a bug then have just anyone come along, proclaim they have the magic fix and LL happily just throws it into the mix.

If they're going to examine every little fix thrown their way, without hiring more people, then that means LL's developer time becomes less than it now already because in addition to working on the grid and viewer they now have to deal with a flood of fixes that aren't guaranteed to even work, let alone be safe.

A little paranoid voice in me says that it has to possible to submit something that looks innocent but has an intended nasty side effect . Firefox doesn't have a direct link to my credit card, the SL viewer does.

I thought this exact same thing.

And we all know LL 'tests' their product before releasing yet with every release there is a thunderstorm....

One of the benefits of opensource is that the source is (for lack of better word) open for peer review to anyone who wants to look at it. Each code that is tagged for inclusion into the official client will be thoroughly tested and validated.

Simply put, the "good guys" won't let the "bad guys'" code through.

And to make clear, the portion of the Second Life tier of applications that was open-sourced has no access to your credit card. This is, essentially, the viewer that defines how you interact with the world. The world itself is generally unaffected. The central servers (asset server, etc) and the code that runs the sims themselves are remaining closed.

I'm afraid I can't comment intelligently on what you've said here. I don't know enough about how this sort of thing is typically handled by companies with open source products, or how LL in particular plans to do it.

However, I do know that the Lindens I met in SF were no dummies. LL has on staff former employees of Real, Netscape, and Mozilla, who are not short on experience in how to transition successfully from a closed source to open source business model.

My impression was they really seemed to have their bases covered. They've been planning for this for four years, after all.


Well, actually Firefox does have a direct link to your credit card if you've ever bought anything online while using it. How do you know your CC data is not being logged and sent to some evildoer somewhere in the world? How do any of us?

In truth, we really don't know, but at some point we trust that Mozilla is doing its job keeping their product secure, and we trust ourselves not to be boneheaded enough to download anything we shouldn't. That's all we can do with SL too.

You have every reason to be concerned. You are a tremendous asset to the SL community, but happen to work within one of the least secure sectors. It is in fact exceedingly easy to steal textures, not cumbersome at all. Always has been. Always will be.

The fact that you have thus far done as well as you have tells me loud and clear that there are by far more honest people in SL willing to pay for things than people who only steal them, and that the SL community itself is at least adequate at sniffing out and dealing with dishonest people who would rather destroy someone else's business than create their own through hard work.

Call me an unshakeable optimist if you like, but I strongly believe that you will continue to do well. I believe that in the long run we will see that your concerns, while valid, are out of synch with what will actually happen.

I have every reason to believe this. I have been a software developer for 13 years, and during that entire time it has been possible (even trivial) to steal what I work hard on. In fact, I know with certainty that my work has been stolen on several occasions. And yet, I continue to make a decent living and even to maintain my optimism that people are generally honest and that it will all work out.

Whatever happens, you and all other hardworking SL content creators have my best wishes!!!

Oh, it does.... I use it to buy online with my credit card. I create accounts where I add my credit card info.

Morwen

I suspect that you're probably right, Robby (and thanks for the kind words!). My take on it (despite my first couple of posts which would have benefited from some deep breathing exercises) is that if and when profits dip to the point that the time spent is no longer easily justifiable, I'll stop. Until then I'll try and do what I can to make myself less vulnerable (which unfortantely isn't much) and carry on.

My advice to other content creators who worry about the future is to start thinking of ways to keep your customers involved in your brand. Don't put all your eggs in one basket. Look for ways to add value for your customers and give them reasons to keep coming back. Possibilities include things like add-on products, free upgrades, replacements for lost or damaged inventory, loyalty discounts, and so on. I think those kinds of efforts will go a long way towards mitigating some of the risk.

That does make me wonder, though, whether it is possible to add watermarking and other "source" information to the client without waiting for LL. It's just a thought off the top of my head, though it would almost certainly need backend support, but my hope is that if we all think of the best possible ways to make use of the open-source client, perhaps something good will come of it.

And Chip, I really really have to thank you for your templates. My wife uses them constantly, and they are indispensable. There are very good reasons why you and others like you are so well-regarded in SL These reasons will not go away, right?

Off-topic but: each number I use is uniquely generated and once used is tied to the credit card processor that used it. The number on file for me with LL will only work for LL and noone else which is why I'm not terribly concerned about it getting breached, it's worthless, but you could just use it to buy and transfer L$ and drain the underlying credit that way which the viewer is capable of.

I'll save asking how LL decides who can contribute and who can't for when more questions are getting answered in LA but I'd hope it would be restricted to verified residents only. If only so they could be held accountable, however unlikely it might turn out to be.

That's fine if xyzcompany sells something other than web page content. Microsoft's web pages have little value. They don't sell web pages. Download 'em all and they aren't out anything but some bandwidth. And most of their web pages, in order to be useful to anyone, would have to be modified using the same skills it takes to write them in the first place.

Enough with the web page analogies.

The analogy also fails for any content that can be previewed without full release to non-purchasers. Go to one of those stock photo sites and you won't be able to just grab a copy of anything you want. Same goes for music, books, 3D models, etc. It's all easy to copy from someone who already has a copy, but not so easy to steal from the source.

In SL, on the other hand, fully-functional copies can be had right from the source. See an avatar with a great outfit? Steal a copy. No need to locate it on a P2P network.

Here's my attempt at a non-technical explanation of how open-source development would work for something like this

* Let's say I start working with the SL client source code, and I make a change of some sort. A bug fix, or improvement, or whatever. Let's say I figure out how to make the IM tab not flash until the person's finished typing their IM (yes, I know this will be fixed tomorrow ).

* I build my own version of SecondLife.exe that includes my change, and test it. Everything looks good.

* I then submit the code changes to some central code repository. This tells everyone else exactly what code I changed, and why I changed it. These code repositories are maintained in a way that allows individual changes to be included or removed. Note that at this point, this is still in an open repository for source code, this is *not* the code that LL uses to create the official SecondLife.exe. That code is protected by LL, and no one on the outside has access to it.

* Once my changes are in there, every other developer can look at my proposed changes. If I tried to sneak some malicious code in, they'll most likely find it. They'll also be able to point out a new bug I might have introduced while trying to fix an existing bug, or suggest additional tests to cover other side effects that I didn't think about, and things like that. The other developers can also include my change in their own private versions of SecondLife.exe and make sure it works.

* At some point, Linden Labs comes round and looks at all the changes that have been submitted. They look at mine and decide that:
(a) It's a clear enough change, i.e. it's easy for a developer to understand what I changed and why
(b) It's a very targeted change, i.e. it only affects a specific portion of the code
(c) They're satisfied with the testing that's been done

... and they decide to include that change in the next release of the official SecondLife.exe. Alternatively, LL could decide that I have no clue about what I'm doing, and they wouldn't take my change, and probably even have it removed from the repository. Or, they could say "Well, this looks good, but it's too deep inside the code, and affects too many other features, so we won't be picking this up right now".

So, risky changes would not get included, and you certainly wouldn't have them picking up changes that no one else had looked at.

Hope that made some kind of sense

Not from what you said, but from where Cory Linden said that "people will want to download their SecondLife.exe from SecondLife.com, not from Bob's Porn Shack". Now that would be fine, except that the "bad guys" won't name their sites "Bob's Porn Shack". Have you been to www dot secondlife dot org recently (note: really, really, really don't go there.. notice, I carefully avoided posting "a link" )? They'll name their site "Linden Technologies, Inc." or something.



Well, I'm now a little bit worried. My two best selling products in world are HUD-based UI enhancers. I'd love to include them in the client, because they'd be about 10 times more effective and useful there - but according to the GNU license, if I do I have to give them away for free, and start getting ready to pay my tier from my RL bank account again. But if I don't, someone else will. I immediately thought of trying to add a prim aligner that works on the highlighted selection - but how would that make the makers of things like Skidz Primz and Prim Docker feel?

Radars? Texture organisers? All things that would be wonderful in the client but that, if they wind up there, will either mean someone gives up all their sales or kill a market.

Because everyone has a god given right to profit from every last thing! Damned commies and their open source! They are ANTI CAPITALIST TERRORISTS!

Most people don't have a thousand hours to put into something just for the hell of it. I have at least that much in my product line. I'm sure there are others who've invested even more time. Attitudes like yours are one of the primary reasons why people worry about this stuff.

Ah, I get your meaning now. I'd imagine eventually there might be a list of trusted sources, but for the immediate future, I'd guess that people will continue to download from
secondlife.com.

As for spoof sites like the one you mentioned (and no I haven't been to it), those will always exist. Paypal has a million of them, for example. It's up to the individual to be smart enough to know where not to go, I guess.




LL is so pro-business in SL, perhaps it might be wise to talk to them about helping to encourage development of a client extension business model. I think it's a great idea. Some people will undoubtedly give away extensions and mods for free while others will prefer to sell their hard work for profit. We see this already with plenty of inworld products. I don't see any reason why the same could be true for client add-ons.

I'm not sure you'd have to give everything you do away, even under GNU, by the way. Thinking about other open source products, like phpBB for example, the system itself is open, but people do sell add-ons and mods for it. I'd imagine the same would be possible for SL.

Golly I love open source, but I do believe that people have the right to attempt to profit off of hard work, and I believe that is absolutely ridiculous to say otherwise.

But... Just as in RL, there is no magic marketing solution in SL. Those people who have made successful SL businesses have provided a service or product that was needed, and have worked hard at it. Yumi makes a good point that some existing and successful products may be more efficient and better implemented directly in the client, and I imagine that some people will (rightfully) be incredibly upset if someone implements that functionality in the client and it hurts an existing business.

But just because there is currently a business based on something that would be better implemented in the client doesn't mean that the business should have some magical protected status.

Many RL business fail every year despite heavy investments of capital and hard work because they do not keep pace with the market or with technology or with a hundred other factors.

And many survive even in the face of devastating changes because the people running that business realize that their success is based on more than just a product and they turn their resourcefulness, creativity, and hard work in new directions.

If you have a successful business in SL, I really do want to know: Do you feel that you couldn't do it all again from scratch if you absolutely had to? Do you feel that you got once-in-a-lifetime lucky? Do you feel that you only got where you are because nobody knew how to steal from you? I would bet my entire L$ balance that at least a few SL "biggies" would answer a resounding NO to all of those questions.

You should have known the risks before you invested the time.

Is there a LLVerify_Client function in LSL to prevent content from being sent to non-official clients? If not, it's high time this ability was added to the server code.

Cheers!

What kind of content would be prevented from being sent, exactly? And how do you envision being able to verify the client? Although I am skeptical that this is technically feasable, I am interested in your thoughts, and I am quite sure that with security being on everyone's minds that helpful and viable suggestions will eventually make it to the right ears.

1. I'm just a medium little one-person business. I could do it all over from scratch if I had to, and if I wanted to. But there wouldn't be much point in doing it all from scratch - that is, I can't see where a condition that would render my business moot could be fixed just by me starting all over from scratch.

2. I don't feel that I got once-in-a-lifetime lucky. I've been successful at a whole lot of things in life. Luck had totally nothing to do with it. I came into SL, found something I liked, and did that.

But it may well be possible that I got at least most of the good out of a certain window of opportunity which may at some point no longer exist in SL, and if so, in that timing, you could say I was lucky.

In other words, it may no longer be a viable place to create pixel goods and sell them, in which case it would be time to move on.

There is a whole creative world out there outside of SL, and I would likely go do something else in it in my spare time, rather than trying to squeeze juice from a turnip or try to make SL be what it once was.

3. Of course I didn't get where I am because no one knew how to steal from me. If that was the only reason I got where I am, no one would WANT to steal from me! So the question is kind of circular.

I'm just going to hang around and see what happens. If it should turn out that the system no longer sufficiently supports people making and selling items, then I will quit making and selling items in SL. Seems reasonable to me.

coco

Yes, this is a very good explanation, everybody go back and read Ziggy's post!

I'm a programmer and I am not worried about this; I think it's a very positive thing. Many companies have been successfully dealing with open source for many years now and it's always been a good thing in terms of bugs getting fixed quicker, etc. Even if it ends up being a Linden who fixes a bug or patches a security hole, the fact that anybody can LOOK at the code and report such holes greatly increases the overal security of SL.

But rest assured nobody just incorporates someone's random fix into the official viewer without it having been looked at in the open repository, both by Linden and by peer review. If anything is amiss someone will find it.

And rest assured nothing about your credit account information or anything like that is going to be in the open source arena. All of that data will remain on the server which is not open.

All of this stuff is standard procedure and there's nothing about it that's particularly uncharted territory. But we can all look forward to lots of new features and extensions, improved building tools, inventory organizers etc.

I am glad that you answered! I was trying to make the point that there are qualities of sucessful people that will remain even if the sky does fall, and those qualities will continue to serve them well.

You do bring up a good point in saying that you may not wish to start over, and I agree that it may not feel worthwhile. I truly hope that few people are faced with such a decision!!!

How exactly do you patch an exploit in someone else's client? You can't patch the server side. It's not open sourced yet. Anyone want to bet that there are dozens of security holes only waiting to be discovered?

But the problem is, who then is going to implement them in the client? I'm not very happy that I have something that I think has been a good and appreciated addition to SL, and that I've had a lot of feedback about that I could incorporate, and that I find that (even if I can work through the confusion of the client source ) I simply can't implement it to the client unless I want to go back to finding my own tier.

So if and when it does get added in - who will be the one doing it? The most likely answer is, someone who's working for an external salary in a consultancy firm, or hoping for one. And that's externalising even more of the economy, which isn't clearly a good thing!

I can just about see an upgraded SL client being released under the "ransom model" - the GPL says if you give out copies, you have to let other people copy it too and include the source code, but it doesn't say you have to give out copies. But that encounters the trust issue, too.



Well, I'm no "biggie". But I honestly don't think I could do it from scratch. My business was based on finding new features that often hadn't yet been done in SL at the time, and were in demand, and adding them as best I could. If those features are already there, and demand has moved to features that can't be done that way (and it does tend to), then there's not a lot I can do. It's like Cocoa said - you have to take advantage of an opportunity, and there's no guarantee the same opportunity will come again. There might be other opportunities but they might not match what you're good at.