What bots can and cannot do

Hi,

there is a huge debate going on in the Resident Answers forum, entitled Automated Burglary, following my own experience in my own Estate, concerning the new 'service' offered by Electric Sheep, whereby you can search for items that are marked for sale in any sim, and the data the site provides is the Item and Description, the For Sale price, the Owner, and the location of the item.

There is a lot of information and misinformation in the thread, so I would like the experienced scripters to comment on the truthfulness of the explanation below, from various comments i have sifted from the forums, concerning what bots can do and cannot do, using LSL scripting alone. As the topic of land bots has been well covered in several other threads, this posting will be confined to what a bot can discover about avatars and objects (prims etc) only, in a sim. If there are any myths below, please explode them.

I know many scripting functions have limitations on them, like the llSensor command, which is limited to a scan range of 96m, but which can easily be overcome by moving the object containing the sensor script around the sim, or rezzing multiple sensor objects. So in considering the lists below, please decide if something is true or false based not on general limitations, but taking into account all known workarounds and hacks.

Having searched the general forums and the Wiki for the information below, and having searched the Scripting Tips forum, I was surprised to find that there is no function whatsoever in the LSL script language, that allows for the For Sale status and price of any object to be detected. This is also borne out by the answers given in this Forum to previous enquirers, but I would like to know if the situation has changed recently in any update.

So, to ask the question plainly: is there any function or parameter, direct or derived, that can currently provide to a script the For Sale status of a prim, or the sale price?

If the answer to those two questions is NO, can anyone offer an explanation how Electric Sheep may have obtained this information? If the only way to get this info, is to enter a sim as an avatar, and click on objects to see if they are for sale, and what the price is, then this is simply too-far fetched to believe, as a sim can hold 15000 prims currently. To map every sim like this is simply too onerous a task, without even considering the ethical considerations of an avi sleuthing around your home checking the current sale status of all your possessions.

START====================================

What Bots Can and Cannot Do.

1. A bot can enter sim, and nothing can keep them out. Even autoreturn can be overcome by measuring the autoreturn time, and then spawning the right number of bots, at the right time intervals, until their work is done. It should also be remembered that bots do not have to be physically in the sim that they wish to scan, they can even do their work from an adjacent sim.

2. Once inside a sim, they can scan the entire sim, and detect the keys (UUIDs) of all avatars and all objects (prims) within that sim (only objects that are within objects are not detected), and relay that information back to a controller script, or the bot owner directly. Current range and detection limitations on bots can be easily overcome by rezzing multiple bots and moving them around sims.

Using the UUIDs, the following information can be discovered:

3. AVATARS
Their name
Their height
Their exact location
What they were doing at the time of the scan, i.e
flying; had attachments (but not how many or where they are attached nor what they are); in mouselook; sitting on ground; sitting on an object; away; walking; in the air; typing; crouching; busy; had running enabled. Further information is available on most of these states, such as flying slow, hovering, hovering up, hovering down, etc.
A list of all animations currently playing for the avatar
Their creation/born date (ie when they joined SL)
Their current ratings (ratings are about to be abandoned by SL, if not already done so)
Payment Info (no payment info on file, Payment info on File, Payment info used)

Furthermore, once the UUID of the avatar is known, their online status can be checked at anytime, or monitored continuously

4. OBJECTS
Their name
Their description (for linked prims, this returns the description of the root prim only)
Their creator
Their owner
Their exact location
The name of the script within the object (if scripted)
Their prim count (how many prims does the object consist of)
All object parameters, such as whether it is phantom, temporary, physical , it's size, color, shininess, flexible properties, material, physics, light properties, rotation, texture
Their permissions (separate values for the Current User, and the Next User): Copy; Modify; Transfer; plus the extras of: Anyone Can Copy; Anyone can Move; Share with Group.

As the replies to this request will be summarised and posted to the Resident Answers forum, where most people have little or no knowledge of scripting, could I ask that you keep scripting terminology to a minimum in your replies.

Many thanks in advance for your informed comments, and if I have left out any information that a bot can discover about an avatar or an object, please feel free to add.


Rock Ryder
Fair-Isles Estate

Bots are not written in LSL, unless you count those annoying greeter bots that charge at you when you enter a sim.

However, to answer some of the points:


Not AFAIK. Because bots are operating as avatars, they get the same info that avatars do. When you hover over an item, you can see if it's for sale or not, and what price. This is how ESC do it.


Because the bots used are actually avatars, they do not need to be concerned with auto return. Even if it was a scripted object, "object entry" denial would take care of that. Because they are avatars, an access list or having them on the banlist will keep them out.


That depends on any limits that may exist in returning for sale status to an avatar. There may be a theoretical maximum distance, but someone with experience in the viewer code would have to confirm that.


Objects within objects are detectable. Click "buy" on any box set for sale, and you will get a window showing what you are buying.
What cannot be detected is the contents of scripted vendors, where the vendor is not actually for sale (so the contents will not flash up in that box). Even so, an avatar has the ability to "edit" an object and take a look at the contents list. If an avatar can do it, the bot can do it.
Detection of all objects/avatars is available to anyone. Check out some of the huds for detecting people or objects.


All those listed items are available to any scripted object, they are not specific to bots.
Some things will only work if the avatar is in the same sim though, so some of those are not possible if the bot is banned from the sim.
There is probably a lot more data available to the bot from the regular client/server communication. Someone with experience would have to confirm what though.


Again, available to everyone, with more data available to the bot through the regular communication with the server than through LSL.

My short version of what bots can and can't do would be this:
They can theoretically do anything a normal avatar can do, but faster.
They cannot steal items not set for sale, they cannot force land to be sold at a set price, they cannot force people to make mistakes, they cannot do magic.

Absolutely correct.

Nope


The bot enters the sim as an avatar, and "looks" around. Just as your avatar is sent data for all objects within your draw range, a bot is also sent the exact same data. But, to a bot, that data is rich in information whereas to a human player it's just drawn on the screen until they right-click it or interact with it. It's the same data you get, though a bot can then decide to dig deeper, effectively "right-clicking" anything it wants.


Absolutely false


Not relevant, bots are just avatars.


They can do much of the necessary work from an adjacent sim, just as you can see into the next sim over with your avatar. Depends on the task the bot wishes to perform, just as there are many things a human player cannot do from the next sim over.

TrueBots are not "rezzed", this comment doesn't really apply.Mostly true, although in fact a bot *can* tell how many attachments you have and where they are attached.

True.

This sounds alarmist to me. It's true, but you can do that with any of the hundreds of available "online checkers" too. Nevertheless, it is true.

True.

As mentioned above, this is not LSL script. It's not possible to create a highly functional bot using Linden Scripting Language. "Bots" as used in the context of this thread are external programs that log in to a regular player account and make use of the Second Life client-server protocols to drive the avatar and process the data that is normally sent to the player's viewer program.


That is a good overview. There are more things that can be done, but nothing earth-shattering in terms of "bots can do X and Y". What's causing all of the hubbub about bots is not individual capabilities, but the speed with which they process data, and the data mining that can be performed on the data.

And I just want to point out: Whether search bots and land bots are evil or not is debatable, but not all bots are bad. I have to beat this drum constantly, because I see so many "there is nothing good being done with this stuff" comments. I personally know at least two people making NPC bots for themed sims, to enhance the role-play and community aspects.

Please keep that in mind when spreading "information" about bots. And be careful how you disseminate that information if you are not an expert on bots, please. To many people are acting like experts and delivering statements that are perhaps well intentioned but not exactly true.


.

Many thanks Sys, that has cleared up one misconception. Bots are not fancy roaming scanners, using LSL scripts, they are in fact fancy avatars.

Is this your interpretation of what a bot is, the common understanding among scripters of what a bot is, or is there an actual resource that defines a bot?

This is actually more disturbing than if a scanner scanned my property for information. This actually suggests that an avatar entered my sim, (there are no nearby sims, so I don't think use of an extended camera was employed in this case), personally visited all my homes, and checked my possessions one by one.

Another question, if I may. Is it possible for an avatar to fly above bans lines, use an extended camera to penetrate inside the home that is being protected, and click all objects to see their properties? If the answer to this is 'Yes', is there no protection from this whatsoever, if the sim is an open sim?

Thanks again for the detailed response.

Rock

Another interesting point. Following the answer given by Sys, I checked the log of the avatar scanner we use for our sim (we use this so we are notified when a potential tenant comes to view, and a sales manager goes to meet and greet them and ask if they need any help). There was no unknown avatar entering our sim prior to the first person who purchased one of my objects.

There is a confusion in the OP about what constitutes a bot. I dont think the majority of SL user are truely aware of what having an open client really means in terms of exploitation by building function targeted clients (aka bots)

The bot can have a draw distance of 512m the server send the information to the bot so it don't cam around, but while saying using an extended camera and clicking all objects is technically wrong in describing what the bot does, it's functionally the same. The information of EVERYTHING in it's draw range (almost 15 sims) can be accessed. The ESC searchbot appears to have put in there own limiting feature of only scanning parcel that the bot have access to, but it would be a simple matter to remove that protection.
Only protection is to use a rezzer that way the object don't exist to be scanned.

Keep in mind, though, that client code is not directly used in most cases. To my knowledge, at least, most bots (including the ones that I make) are created using libsecondlife rather than the client code, and the client code is referred to when trying to figure out a specific need that is not yet addressed by libsl (which is really not much nowadays).

That could just mean that the bot was outside the range of your avatar scanner. Most have a max range of 96 meters, right? Even if you have several linked, it's possible there were dead spots.

Bots *ARE* avatars, driven by a program instead of a human player, so they can't magically avoid avatar scanners.

This could mean that the first person who did it just found it and then IM'd a few friends... It is quite possible that it wasn't a bot that provided the information at all, and remember that the ESC search bot only sweeps the grid once every 24 hours, so stuff has to be out for a decent amount of time on average in order to even be listed.

And... It will likely *remain* listed until the bot's next pass, so it would have been possible to find out if your items were in fact listed or it was just a strange fluke of someone finding a "good deal".

Never forget the human element, there is a reason that security experts are concerned about social engineering just as much as they are about technical security.



.

Well, can you do that? If so, then a bot can do that. If not, then a bot cannot.



.

I'll conceed that point although it makes little real difference when it comes down to the wire about which codebase is being used. The end result is still similar.

True. Quite true, but there is a reason I keep hammering on that point

The difference is largely in the perception of the average Second Life citizen. Since it's easier and more efficient to make a bot using libsecondlife, that's what's used in most cases.

There are HUGE numbers of comments on these and other forums about how the open source viewer has resulted in things like landbot, copybot, searchbot, etc, etc. Those things are not a result of the open source viewer, at least not directly, and would almost certainly still exist today even had LL not open sourced the viewer.

That may seem like a small point to many, but it's not a small point to me, and the more it is repeated the more voodoo power it will come to hold.

Nevertheless, since both codebases work on the same protocols and principles, you are correct that there is little functional difference.

.

Again I agree with you, since libSL was up and running long before they open sourced the client it has an advantage. Plus it is by all accounts considerably 'lighter' since for the most part it dispences with any graphical front end.

The Landbots I've seen seem to appear out of nowhere, they are pretty plain avatars who float in at the time the plot of land is set to a certain low price. i've heard you're able to catch them and screw them up by teleporting them out, but I never did this. So it is possible to see these avatars, but they mostly seem to appear out of nowhere float in, do their job quickly and they are gone.

Bots can be turned mad easily with a bit of scripting if that s what you're looking after.

Suppose your vendor is scripted to move to another random location periodically or increase/decrease slightly the sell price, with a little work you could have the bot run in an endless loop or have its memory explode.

The keyword in computing is *repeatability*: if it can be repeated it can be automated, now if you break this rule you are safe from any bot.

It may be possible that the avatar appeared and disappeared between sweeps, depending on the setup of the scanner. As you say though, they are avatars, so it's possible for anyone quick enough to do the same.


In the context of landbots and the ESC bot, they are avatars controlled by a machine. It's possible to have a bot scripted in LSL as well, such as greeterbots etc.
Bot is just a general term for something that performs an automated task. I think the difference between a bot and a regular script/program would come down to interaction.
A script will generally respond to some human input and lie dormant until it gets such input, a bot will do what it does without interaction. That does not exclude it from being a bot if it can interact with humans, nor make it a bot if it can continue operate without interaction.

A security "orb" could be considered a bot even though it interacts with humans, sending warnings to intruders and messages to the owner. It's main purpose it to automatically eject users regardless of that interaction.
A slot machine wouldn't be considered a bot even though it continues to flash lights and make noise when nobody is around. It's main purpose is to interact and respond to human input.

I'm sure someone else will be able to put it better than me though.

My whole take on libsl vs opensource, I'd say all the blame shouldn't be placed on libsl. Most of these things are based on it, sure, but you don't have to use either of these to create bots. I'm hoping to take a look at the protocols at some point, with a view to possibly creating php interaction through an avatar. The libsl code and the client code wont be much use to me in that situation, only the base specs and protocols.
Open source is not to blame (if you must blame somebody), the unencrypted and insecure protocols that can be sniffed easily are.

The protocols are easy enough (though getting more complex <grin>, and I would be very interested indeed to see whether it's possible to use php to communicate with them, as I am just now getting into php and it might be a fun project to force me to expand my php knowledge.

No, you don't need either of those things to create bots, but the vast majority of people looking to create bots are going to explore an existing and relatively functional codebase first.


.

Huh? What???? Umm.... No. Why would you even write such a thing?

That would certainly have a detrimental effect on your sales, and your customer experience would probably be very poor, but you cannot make a bot's memory "explode". It's highly unlikely that you would make the bot run in endless loops, either, unless it was very poorly written indeed.

At best, this would result in useless data being gathered by the bot, nothing more.

I am continually amazed by the amount of, and quality of, misinformation about bots



.

Perhaps we could combine forces for something like this. I have about 6-7 years of php, and have put together a few bots. Mostly IRC, but I did once write one that interacted in bittorrent swarms to catch those who weren't really sharing data
As long as your server and the communication channels are stable, there's no reason it shouldn't be able to run for months at least without fail. Longest I ran my IRC bots was about six months before the server needed a reboot.

All my php coding is on hold at the moment (stupid depression), but I can give some pointers and example code if you want it.

A php bot would sure beat httprequest and xmlrpc as a way to get data to and from a webserver/mysql. You'd get your data in real time, and having an avatar say something on a specific channel is very easy to verify for security, rather than trying to verify an object.
To top it off, you could have the object hold processing until the bot clicked on it.
Would probably still need some shell access though, as forking and running as a daemon are pretty tricky (if not impossible) on most hosting setups.

Well, I currently have a bot written in C# using libsl that could be ported, though it's certainly a non-trivial task. But, having a clear example of what's required would be a good thing.

My bot is made for combat using the Combat: Samurai Island combat system, so it's a reasonable example of what would be necessary for a php bot to interact with other avatars and objects.

But.... I am currently slammed on other tasks both inside and outside of SL.

Still, sounds like fun! And having a php expert's brain to pick would be critical to success, I think.


.

I wont make any claims at being an expert, just experienced
I know how to do pretty much anything I want with PHP, and can code it without memory leaks and silly bugs in most circumstances
I even use it at home as a replacement for batch files these days.

I hope you don't mind procedural though, I've never gotten into the whole OOP thing. I spent some time with it a few months back, and thought I could see the potential, then I took a step back and realised I could do everything I'd just done more quickly and efficiently with procedural. I think OOP must have been designed by a committee of managers on a rainy monday

Procedural is fine to start with, and I have about 12 years worth of refactoring experience in other languages that should translate well enough, so making it OOP after is certainly doable

Your 6-7 years of php beats my 6-7 weeks hands-down Compared to me, you are an expert, haha.


.

The focus of this thread seems to have become what bots, LSL scripts and Avatars can and cannot do. I have skimmed this thread and did not notice this being mentioned. If your are still interested in what Electric Sheep is doing to have this information, it is worth considering that they own www.slboutique.com and through the products sold through their website, they have listings of products that are on sale, who makes the product, and the sim the slboutique sales inventory box is being hosted in.

Separately, the boxes to host items for sale on www.slboutique.com are scripted and we do not know what additional features they may contain but the main point I wanted to bring up is that www.slboutique.com does list Product Makers, Sale Prices on their Products and knows where their SL inventory boxes are located, all provided by the Product Makers themselves to www.slboutique.com and as such to Electric Sheep. Not a bad thing, just a source for that information totally outside what an LSL Script or Avatar Bot can or needs to do to acquire this information.

Bots can be very harmful, I'm wondering how many bots are programmed to camp chairs, it s a wonder to see how quick some of the most popular sims refill after a crash. Now you have a bot army and you want to camp chairs in a sim but all is full: fill the sim with your bots and force a sim reboot so your bots can get on the precious camping chairs. I know it sounds paranoid but I've experienced bots in Lineage 2 and it was very nasty.


Oh, I was speaking generally, it all depends on what the bot does and how it is written. I dont think bots are a good thing for the end user, and about the quality of programming, what I've seen from macro programs on UO, ATTTD and Lineage is that they are generally poorly written and make the servers exteremely laggy. I wouldnt be surprised if the recent slowdowns in SL have something to see with bots hammering the databases.