Can objects really steal your $L?

I am working on a patch for this issue. I've posted a spec for the feature change, and I'd be happy for comments or criticism: http://ablewhitman.blogspot.com/2007/05/second-life-viewer-patch-to-address.html

i had this experience, where i had this object looked like USD cash... when i first wear it,, there is a pop-up screen to ask me , should i allowed to bank my pocket,, scare to hell,,, i quickly thrashed it away.... damn to those cheatersss

be careful....

Well this also opens another bug in permissions.

When a script asks for multiple permissions they should all be seperate requests that you can individually allow/deny.

Also the fact that the popup windows are in a fixed location is very annoying. It would be nice to be able to drag them around, and to add a bit of a delay in allowing you to clcik on the buttons on any dialog (I've accidently clicked the wrong thing when a new dialog pops up while trying to answer one that is already up).

Yes, that could be a bit of a problem as well. Imagine an object asking for an animate permission - and just that - but half a second later popping up a dialog for a debit permission. Since the OK button resides at the same location it is possible that you then click on the OK for debit permission and you're hosed.

A variation would be to 'flood' the user with dialog boxes with the OK button residing at the same location of the OK button of the debit permission dialog which is maliciously hidden in the stack of open boxes.

Definitely a design flaw. The next client update should take care of it that such things won't get drawn into the usual click sequence.

Another idea would be to introduce some general settings like in Preferences. Just like:

Allow objects to....
Animate your avatar o Yes o No o Ask
Debit your account o Yes o No o Ask
Take over the controls o Yes o No o Ask

If it makes sense, even divided between own and foreign objects.

I agree with you Alderic.

The simple truth is most people will NEVER need to give permision debit.

The only time you need to allow them is when putting out vendors, gambling machines or something similar.
Once the machine is out and running you dont need to accept any more requests.

The default state in preferences should be to BLOCK all permision debit requests.

I should mention that I attempted a solution to this here:

/54/63/158231/1.html

The idea is that the maker of an item writes all their program code in a regular script, with the exception of the line of script code which actually takes your money (llGiveMoney()). The script that does the llGiveMoney() is open source, and can be verified to refuse to give out money if doing so would mean the object has given out less money than it's taken in. To confirm that it's the open source script that's asking for debit permission, it has a space in it for you to enter a "secret", which is displayed when debit permission is requested. Since the secret is just a variable setting in a script, the closed source scripts have no way of reading it, so they can't fake the display.

Able, two thumbs up! That would be a big help.

Yumi, I'll have to think about your suggestion a bit more. The problem is, it's hard to change people's behavior -- especially habits like saying "Yes" after clicking a dance ball, without looking closely. That doesn't mean there isn't merit in your idea. But I don't think that a zero-sum rule is much of a guarantee. First, all scripts I write aren't zero-sum -- the owner ends up with the left over money, intentionally. And being zero-sum doesn't prove anything because it could give the money to any party. Perhaps I'm missing something.

The script was mainly made for vendors and similar - it allows the script to give out *less* money than it's taken in (for change giving, prize payouts, or similar) but not *more*. I understand this isn't ideal for every case.

Yes, a vendor using it could give all the takings away, but it should not be able to steal the L$ that were already in your account at the time you rezzed it.

Also, it seems there is a change you can make yourself: From your Second Life install directory, look in skins\xui\[your language]\notify.xml, and all of the permission strings are in there, so you can change the one for "take money from you" to something a bit more conspicuous.