Sad news...... Scripts are vulnerable now

It's a security problem if, for example, the protected content were plans for a tabletop nuclear weapon.

It's a security problem if, for example, the crytographic algorithms used to protect the content. were wrongly implemented or revealed cryptographic keys.

It's a security problem if, for example, an unauthorized agent were to gain access to my login and account details.

It would be fair to say "Failure of DRM is not always a security problem".

The thing is -- many times it is... so a snap-meme like "DRM is not a security problem" is essentially misleading.

regs,
/esc

There is no such thing as 100% security. I stated that "the current breach"... etc

I'm trying to find the original message that I was replying to with my DRM comment, but it seems to have been deleted. I should have quoted it... it doesn't make any sense without that context because this scripting access control problem doesn't seem to have anything to do with DRM: SL does not use DRM to protect scripts.

However:

If you're protecting plans for a tabletop nuclear weapon with digital rights management technologies, then that's the security failure... using an inappropriate technology to protect the content.

If in doubt, change the proposition.

It doesn't? What's with those mod/copy/transfer checkboxes for scripts, then? O.o

Access Control flags. They behave like "ideal" DRM in-world because if SL was reality instead of virtual reality you'd need "ideal" DRM to get the same results.

So SL is, among other things, a simulation of what the real world would be like if the ideal DRM in (say) Karl Schroeder's book "Persistence" was a reality.

In the real world Digital Rights Management technology is where you send someone the ciphertext and the key and the encryption algorithm and depend on obfuscation to keep him from applying the key to the cyphertext and extracting the plaintext. It doesn't work.

Sorry but I have been out of commission for the last couple of days. My source did send me this as a reply to a few questions here:

" 1) no permission settings prevents this, 2) script creator and permissions can be changed, 3) there are ways to uncover scripts owned by someone else (but the other party has to do some stuff before, something like scamming) 4) copy of script becomes full permissive and reveals all the content"

That being said, he is interested in testing again using an alt in Aditi with the latest server version. I haven't had a chance to reply to him yet but I did send a feeler to Dan Linden. He is interested in this too and needs to know the SEC number to reference but either he or Vector would welcome a test. Those that have been around long enough realize that there are two sides to the lab; political side and technical. You don't hear very much from the Bug Hunter crew and they don't have flashy web pages advertising themselves, but I am definitely hopeful. Dan, Beast, Milo, Vector et al are good people.

It sounds to me like you're playing a semantics game. DRM isn't solely intended to be implemented via cryptographic technologies.

Even the *cough* Wikipedia description of DRM states that it "is a generic term that refers to access control technologies".

They *are* a form of DRM. That they aren't the same form of DRM that the MAFIAA et al choose to champion doesn't change that.

Well, I don't think I'm "playing a semantics game", but apparently I've stepped into a semantics tarpit, assisted by the ability of people to tracelessly delete messages in this software (not saying someone was deliberately trying to trap me or anything, the whole thing seems accidental).

I was using "DRM" in the common cryptographic sense that it's used on the Internet, OK? Calling the equivalent of the UNIX file permissions "DRM" instead of a simple access control list just sounds weird to an old fuddy-duddy like me.

I wouldn't call copy/mod/transfer "equivalent" to "read/write/execute". The former are a lot closer to being access controls for purposes of enforcing copyright-style restrictions/rights than simple access controls for files on a filesystem. There are some elements of commonality, to be sure, but the intended goals are significantly different.

If you are referring to my message, which I deleted, I apologize for causing a misunderstanding. I went back and deleted my message about Bruce Schneier because on reflection I didn't think it really belonged in this thread.

.

You mean "Permanence"? I don't see one called Persistence.

Yes, Permanence. Excellent book, by the way... not in the same timeline as the Ventus and Lady of Mazes, though Lady of Mazes takes yet another look at the same general concepts... both Permanence and Lady of Mazes take place in an environment that's so heavily computer-mediated that the distinction between RL and VR is almost academic, but the goals of the computer mediation are quite different in the two civilizations.

"I don't see one called Permanence." should read "I don't see one called Persistence". I corrected it as fast as I could, but Argent had already quoted it the wrong way. No matter how fast you correct a typing error, it always seems to have been quoted instantly, while if one posts something they think is clever or witty or exceptionally useful, there's generally no indication that anyone saw it at all. Such is life. Sigh.

It's been so long since I've read a science fiction book that if I started back again there would actually be new ideas like nano-tagging IP rights into objects as themes in them!

I miss Usenet too.

I'll have to talk to Day Oh about this, I've had a few ideas.

well let's face it --- if it happens once it's almost certain to happen again.

How about this, plain and simple. I'll make a script, stick it in a simple box, and tell EVERYONE the UUID. Someone PROVE to me that this can really be done. Show me it's actually a problem, and not another elf bowling incident.

I hope it's not something important! :<

The magic word is "Squeamish Ossifrage".