this article is in reference to a comment replying to zfire xue which can be found under this blogpost here where I said I would expand on the violation information about zf redzone: http://treminarisecondlife.blogspot.com/2010/07/spywaretos-and-legal-violation-in.html?zx=e34557c63c81300e
ok someones already written an article on this but however I'm going to write my views on this law the Law I'm referring to is BPC17200-17210 which can be used to define the penalties for violation of BPC22575-22579 the article found here doesn't really explore the full scope of the law but gives idea about it which can be found here:(mind you this is the writers interpretation of the law based on their knowledge of internet and service and is not the law itself)
http://www.cooley.com/files/tbl_s24News%5CPDFUpload152%5C927%5CALERT-Cal_OPPA.pdf
now for the law itself:
http://www.leginfo.ca.gov/cgi-bin/displaycode?section=bpc&group=17001-18000&file=17200-17210
in the article you should note that no enforcement provisions are provided however BPC22575-22579 defines acts by zfire with his redzone utility to be illegal and note that violation of it in accordance with the cooley.com article explaining BPC17200-17210 does note that violations can be enforced through BPC17200-17210 with that said in the cooley article you should pay particular attention to the section that is titled Consequences of Noncompliance with that said any violation of BPC22575-22579 legally constitutes a violation of BPC17200-17209
under the recommendations section zfire xue has not followed through with paragraphs marked by the bulleted paragraphs I will review here below before reviewing the law and where the violations are defined. do keep in mind when reading personally identifiable information in the cooley link it is defined by BPC22575-22579 as any information that can be used to contact an individual online or in person, as usernames in the secondlife service enable you to message a person these fall under that category.
Cooley.com recommends that a person operating an online service must determine whether or not they are collecting personally identifiable information, on the redzone website they say they consider this information not to be private, when it is Protected under BPC22575-22579. Cooley.com also recommends creation of an accurate privacy policy, this is not the case, their policy is deceptive as it states users will be notified before information collection, but no such notification takes place, it is also recommended the privacy policy be conspicuously posted, there are several ways to do this within secondlife the best way is to make use of the annoying scripting command LLDialogue, cooley also recommends that audits of the website take place to be sure the privacy policy still accurately reflects, actually the privacy policy regarding redzone has never been accurate. cooley also recomends that you keep in mind that several states are passing laws like this and you should be mindful that there may be many privacy laws you must adhere to in an online service it is also recommended that you insure there is adequate security for the information collected, in the case of redzone, there is no security as that information is given away to its users, dont believe me? lets reference the a blogpost of someone who recently commented in my blog and posted a screenshot in theirs http://forcemesilverspar.blogspot.com/2010/09/zf-redzone.html you can examine the screenshot there for yourself, and yet again cooley recommends creating internal procedures to prevent your service from being used to cause a privacy breach, but zf redzone alt detection in itself is a privacy breach. all these recommendations proposed by cooley.com are things recommended that would bring a service up to code. zf redzone does none of them
You should bear the phrasing in the cooley article with a grain of salt as most the phrasing pertains to web where as the law itself is in references to online services but lets take a look at the law which I linked above from here on in.
First Off lets take a look at section 17200:
"17200. As used in this chapter, unfair competition shall mean and include any unlawful, unfair or fraudulent business act or practice and unfair, deceptive, untrue or misleading advertising and any act prohibited by Chapter 1 (commencing with Section 17500) of Part 3 of Division 7 of the Business and Professions Code."
In my previous article linked at the top of this article we have established that zf redzone is unlawful as it collects information outside of the compliance of BPC22575-22579 and provided information as to how so, we have also exposed it as fraudulent by exposing weakness in its accuracy vs the ridiculous 120% accurate claim by its author and pointing out their willingness to violate the privacy policy and Terms of the service they operate with by falsifying by quoting it in part it is deceptive as it operates without notice to the user, and users supposedly reach an agreement through passing it by which actually has no legal binding, and the content of the privacy policy which you never get to see regarding it differs from how the system does thus further proving its deceptive
17201 pretty much defines how terminology will be used in the law, meaning person may refer to company yadda yadda yadda, 17204 pretty much states people may make claims on each-others behalf, so I guess this means class action lawsuits can be filed against companies and individuals who violate BPC22575-22579 which puts them in violation of BPC17200 as stated above in line 17200 any business that engages in unlawful business practice may be found in unfair competition so a violation of BPC22575-22579 constitutes a violation of BPC17200-17210
section 17202 pretty much defines that relief may be payed to competitors of the company that engages in unfair competition, since zf redzone is a security orb product this pretty much defines everyone who produces and sells any form of security orb within the secondlife service or any other land security utility or any sort of copybot protection system or for that matter any tool that has a feature which may put it in competition can make a claim and try to get a relief payment to aid their lost business
"17202. Notwithstanding Section 3369 of the Civil Code, specific or preventive relief may be granted to enforce a penalty, forfeiture, or penal law in a case of unfair competition."
17203 I wont quote here as its pretty long but as with anything I write regarding law the links provided and you can read it by following the link for yourself and interpret it yourself to verify it but pretty much it states court may take action against anyone who has engaged in unfair competition(so even if zfire xue was to quit committing these violations he could be charged with those hes already committed), anyone who is doing so, like he is doing now, or anyone who proposes to do so thus meaning if he proposes to create any more products outlawed by BPC22575-22579 he can be charged with a violation for the proposition of creating such a product.
we should also take a look at section 17206 of the law a bit lengthy to post here but you can read it at:
http://www.leginfo.ca.gov/cgi-bin/displaycode?section=bpc&group=17001-18000&file=17200-17210
pretty much this states the penalty for entering into unfair competition is a maximum of 2500 but per violation as well, each of those 2500+ zf redzone locations, is an individual violation in itself also in court, this law states what shall be taken into account is the seriousness of the conduct, yeah its pretty serious silent privacy violations and persistence of misconduct, yep the creator of redzone has been informed, and has obviously read my article(as they commented on it, and left themselves quite a weak defense) so they are quite persistent in conducting this illegal activity also if each instance of violation can cost the operator 2500 each then that indicates that each $20-30 sale of this system can potentially end up costing its author $2500 but there's more on that which I will get into later
section 17206.1 pertains to an additional fine of $2500 if the act is perpetrated against senior citizens or the disabled, and really isn't too important as this does not target those groups, however in the event of a class action lawsuit regarding this the age and disability status may now of those who had information collected on them by this system may play a role in the author of this system being charged with additional fines should charges come to pass and I'm sure SL has plenty of disabled users and even a few elderly users. so that knocks the fine up to a total $5000 per orb that has uncovered information regarding a senior or a disabled person.
and onto my favorite part as to why I called zfire xue's comment in my blog enlightening, obviously we have established knowledgeable and willful violation with that comment and within the article of BPC22575-22579 willful violation for this law as established under section 22576 from BPC22575-22579 which can be found here http://www.leginfo.ca.gov/cgi-bin/displaycode?section=bpc&group=22001-23000&file=22575-22579 knowledgeable and willful violation or non compliance after 30 days of notice constitutes a violation, with zfire xues comment in my blog we have established knowledgeable and willful violation which means a 30 day wait to come up to compliance is no longer required but now lets take a look at section 17207 of BPC17200-17210 I like the first paragraph which I will quote here:
17207. (a) Any person who intentionally violates any injunction prohibiting unfair competition issued pursuant to Section 17203 shall be liable for a civil penalty not to exceed six thousand dollars ($6,000) for each violation. Where the conduct constituting a violation is of a continuing nature, each day of that conduct is a separate and distinct violation. In determining the amount of the civil penalty, the court shall consider all relevant circumstances, including, but not limited to, the extent of the harm caused by the conduct constituting a violation, the nature and persistence of that conduct, the length of time over which the conduct occurred, the assets, liabilities, and net worth of the person, whether corporate or individual, and any corrective action taken by the defendant.
so lets see here we've established that each instance of zf redzone is its each own unique violation with 2500+ violations but this part of the law states there is a civil penalty of $6000 for each violation, and for each violation each day the conduct occurs is to be considered a unique violation in itself, so with 2500+ zf redzone locations this constitutes zfire xue having committed 2500+ violations against this law a day with each violation carrying a civil fine of up to $6000, with that said if you view the related xstreet page(aw drat he deleted more of the item discussion) we can establish with a comment " Posted By: TheBoris Gothly at 2010-05-04 00:41:19 (item owner) " that this tool has been around since at least the time of the time-stamp, still all the the same I remember a 2009 post and its likely Linden Labs for legal reasons such as this and request of the court keeps records as to how long an item has been listed and probably records as to deleted text within the item discussion meaning it may be possible to prove these violations have been going on longer.
section B of 17207 refers where this shall be taken to court too and makes reference to relation to which county the violation took place in Linden Labs being a San Francisco based company and this system zf redzone being implemented on their servers establishes the location of the violation at a central point section C details who collects the fines
section 17208:
17208. Any action to enforce any cause of action pursuant to this chapter shall be commenced within four years after the cause of action accrued. No cause of action barred under existing law on the effective date of this section shall be revived by its enactment.
simply put if someone is found guilty of a violation of this code the courts may wait up to 4 years to take action and action must be taken within those 4 years, and that the person may not be charged with the particular violations again, but as established above, each new day is a new violation so if zfire xue was charged under this law the courts could impose the fines anytime within 4 years, and the violations addressed may not be addressed again(sort of like double jeopardy) but as said each day the violation occurs is a new violation meaning if zf redzone was not immediately done away with though the fines may or may not immediately take place new charges may be brought for a new day of violations(or however long this goes on after initial charges), however the days of violations addressed may not be charged again
17209 defines that if you shall take action against a party when the rest of your paperwork is due, big deal, I wanted to mostly look at fines related to this and with the link above you can read this for yourself if you so wish
section 17210 pertains to additional ways to violate this clause but pertains to information outside of internet business practices such as hotels and the such and covers nothing I found of any importance in writing this article.
Tuesday, September 7, 2010
Wednesday, September 1, 2010
Imprudence as an Emerald alternative
Well today emerald team has announced their final release and discontinuation of their viewer, There will likely eventually be a fork of this viewer but users may be looking to continue the use of its features through another viewer, I heard someone recommend Kirstens viewer in its place, I tried this and was displeased with Kirstens as an alternative you can find the announcement regarding the discontinuation here:
http://blog.modularsystems.sl/2010/09/01/the-end/
anyhow Emerald development ceases with this final release, there will likely be other viewers that are built from emerald and a fork of such, but nonesuch have registered for the TPV List yet however there is a viewer inclusive of some features from emerald which can be seen here:
http://imprudenceviewer.org/wiki/Features
I've used Imprudence before and tried it and hated the abysmal performance, tried it using the latest Release Candidate, Loved it. The performance of the latest release candidate on my system(Imprudence 1.3.0 RC2) was excellent and it can be found here:
http://imprudenceviewer.org/wiki/Downloads
Also its on the third party viewer directory which means it has been approved by Linden Labs and has not done anything to lose that approval which can be found here:
http://viewerdirectory.secondlife.com/
If performance with this viewer however is an issue for you they do provide a solution, as their not licensed to distribute llkdu libraries they use the Slower OpenJPEG libraries instead, however I have not tried this as of yet but will be doing so soon, but they say you can use the LLKDU library yourself you will just need to install and copy it, they mention the solution here:
http://imprudenceviewer.org/2010/08/28/an-update-from-mccabe/
Many emerald users are hooked on Emerald for The built in AO that does not impose on SL's scripting Engine where as scripted AO's need to constantly check the avatar state in the sim thus creating lag, or are hooked on the math features for build or the breast physics all that such can be used in Imprudence
You can find information on building using math expressions here:
http://imprudenceviewer.org/wiki/Build_Math_Expressions
as for the AO yes its there too, mind you it doesn't have the latest check-box that allows you to stop the timer within it, but that's fine cause you can just set the timer high to stop cycling the AO can be found under "View > Animation ovetrider" but I cant help but notice the Hotkey listed for it is the same as the Object occlusion hotkey under the advanced menu.
If You liked Emeralds version of "show look at" and how it named the camera points so you could get an idea who may be camming into your skybox the same modification for "show look at" exists within imprudence it just hasn't been moved, it exists in its old location in the advanced menu "advanced > character > show look at". it does pop up a warning that you shouldn't rely on this for privacy, there's several reasons for this, viewers don't always accurately receive this information and sometimes can show different look at points between viewers(a net packet gets dropped and someone that gave you cam focus hours ago may appear to still be doing so), viewers can disable broadcasting of this(imprudence can too but disables this if you do) and also people can always cam in from other sources.
Also there is the breast physics, mind you I did not find options related to this in imprudence unlike emerald(not saying their not there, but the imprudence team intended it be a subtle thing it appears) however the options still exist within the debug menu under advanced and their settings are under the entries:
EmeraldBoobFriction
EmeraldBoobHardnes
EmeraldBoobMass
EmeraldBoobVelMax
EmeraldBoobVelMin
EmeraldBoobXYInfluence
EmeraldBreastPhysicsToggle
EmeraldBreastSportsBra
the settings seem to be the same as emeralds and follow emeralds defaults so if you adjusted this you can copy the debug entries here and make it the same I guess, I'm not going to mess with the settings myself though.
Extended Edit: well another worth mention feature I forgot to mention that was mentioned to me by a friend is the radar feature, both imprudence and emerald have this but use different implementation. emeralds radar has a longer range, the one in imprudence has a range setting and is built into the minimap with a drop down arrow marker, it however is limited to 512m where as the emerald one apparently had a much longer range than that but still if you need a radar both viewers have it built in, just the emerald one is superior, however, it is available in imprudence nonetheless, another worth mention feature I forgot to mention is imprudence does have an implementation of area search which allows you to search the area much the way emerald does with its area search feature,you can search an area by name, by owner, by group or by description, Both viewers have this however I noticed when using this in emerald I would get a drastic frame rate drop, imprudence this feature seems to run smoothly, whatever the case, its good for finding parcels that have implemented zf redzone which should be avoided like the plague, something I think would make a cool edition to this feature though, is the ability to search by object creator, but still nonetheless a greatly useful feature that exists in both viewers
http://blog.modularsystems.sl/2010/09/01/the-end/
anyhow Emerald development ceases with this final release, there will likely be other viewers that are built from emerald and a fork of such, but nonesuch have registered for the TPV List yet however there is a viewer inclusive of some features from emerald which can be seen here:
http://imprudenceviewer.org/wiki/Features
I've used Imprudence before and tried it and hated the abysmal performance, tried it using the latest Release Candidate, Loved it. The performance of the latest release candidate on my system(Imprudence 1.3.0 RC2) was excellent and it can be found here:
http://imprudenceviewer.org/wiki/Downloads
Also its on the third party viewer directory which means it has been approved by Linden Labs and has not done anything to lose that approval which can be found here:
http://viewerdirectory.secondlife.com/
If performance with this viewer however is an issue for you they do provide a solution, as their not licensed to distribute llkdu libraries they use the Slower OpenJPEG libraries instead, however I have not tried this as of yet but will be doing so soon, but they say you can use the LLKDU library yourself you will just need to install and copy it, they mention the solution here:
http://imprudenceviewer.org/2010/08/28/an-update-from-mccabe/
Many emerald users are hooked on Emerald for The built in AO that does not impose on SL's scripting Engine where as scripted AO's need to constantly check the avatar state in the sim thus creating lag, or are hooked on the math features for build or the breast physics all that such can be used in Imprudence
You can find information on building using math expressions here:
http://imprudenceviewer.org/wiki/Build_Math_Expressions
as for the AO yes its there too, mind you it doesn't have the latest check-box that allows you to stop the timer within it, but that's fine cause you can just set the timer high to stop cycling the AO can be found under "View > Animation ovetrider" but I cant help but notice the Hotkey listed for it is the same as the Object occlusion hotkey under the advanced menu.
If You liked Emeralds version of "show look at" and how it named the camera points so you could get an idea who may be camming into your skybox the same modification for "show look at" exists within imprudence it just hasn't been moved, it exists in its old location in the advanced menu "advanced > character > show look at". it does pop up a warning that you shouldn't rely on this for privacy, there's several reasons for this, viewers don't always accurately receive this information and sometimes can show different look at points between viewers(a net packet gets dropped and someone that gave you cam focus hours ago may appear to still be doing so), viewers can disable broadcasting of this(imprudence can too but disables this if you do) and also people can always cam in from other sources.
Also there is the breast physics, mind you I did not find options related to this in imprudence unlike emerald(not saying their not there, but the imprudence team intended it be a subtle thing it appears) however the options still exist within the debug menu under advanced and their settings are under the entries:
EmeraldBoobFriction
EmeraldBoobHardnes
EmeraldBoobMass
EmeraldBoobVelMax
EmeraldBoobVelMin
EmeraldBoobXYInfluence
EmeraldBreastPhysicsToggle
EmeraldBreastSportsBra
the settings seem to be the same as emeralds and follow emeralds defaults so if you adjusted this you can copy the debug entries here and make it the same I guess, I'm not going to mess with the settings myself though.
Extended Edit: well another worth mention feature I forgot to mention that was mentioned to me by a friend is the radar feature, both imprudence and emerald have this but use different implementation. emeralds radar has a longer range, the one in imprudence has a range setting and is built into the minimap with a drop down arrow marker, it however is limited to 512m where as the emerald one apparently had a much longer range than that but still if you need a radar both viewers have it built in, just the emerald one is superior, however, it is available in imprudence nonetheless, another worth mention feature I forgot to mention is imprudence does have an implementation of area search which allows you to search the area much the way emerald does with its area search feature,you can search an area by name, by owner, by group or by description, Both viewers have this however I noticed when using this in emerald I would get a drastic frame rate drop, imprudence this feature seems to run smoothly, whatever the case, its good for finding parcels that have implemented zf redzone which should be avoided like the plague, something I think would make a cool edition to this feature though, is the ability to search by object creator, but still nonetheless a greatly useful feature that exists in both viewers
Monday, July 26, 2010
Custom Color Tags in emerald.... Yuck
today I went to a club, and I saw a bunch of emerald users, an LGG Proxy(malicious viewer) user, a couple imprudence users a few sl2.0 users .... or did I?
actually everyone there was Emerald users with the exception of some 2.0 users.... apparently now you can set the color your name tag appears to other emerald users, after they established a color coded system where viewers could be identified by the color of name-tag, I'm used to malicious viewers being marked red, there was a guy at the club with his name marked red cause he set a custom color with his viewer, I don't like this. So far since I've started using emerald since my ex-mate tugged me into it with the introduction of boob jiggle version1.23.5.950? and so far, in all my time here, and I get around, I've only seen one Malicious viewer, and one unknown which brings me to a question. does anybody out there know what Moymix is? I googled it and cant find any useful information, one person seems to suspect its a viewer that allows free uploads, I dunno, but I remember seeing it marked in pink, much like viewer 2.0 is before this custom color tagging, aside from that Ive seen a viewer marked "LGG Proxy" one time a while back(googling it revealed it was a malicious viewer) and it was marked as red, so I'm used to the idea of red meaning its a bad viewer. now since people can set their tags to red on their own, I'm kinda thrown way off.
actually everyone there was Emerald users with the exception of some 2.0 users.... apparently now you can set the color your name tag appears to other emerald users, after they established a color coded system where viewers could be identified by the color of name-tag, I'm used to malicious viewers being marked red, there was a guy at the club with his name marked red cause he set a custom color with his viewer, I don't like this. So far since I've started using emerald since my ex-mate tugged me into it with the introduction of boob jiggle version1.23.5.950? and so far, in all my time here, and I get around, I've only seen one Malicious viewer, and one unknown which brings me to a question. does anybody out there know what Moymix is? I googled it and cant find any useful information, one person seems to suspect its a viewer that allows free uploads, I dunno, but I remember seeing it marked in pink, much like viewer 2.0 is before this custom color tagging, aside from that Ive seen a viewer marked "LGG Proxy" one time a while back(googling it revealed it was a malicious viewer) and it was marked as red, so I'm used to the idea of red meaning its a bad viewer. now since people can set their tags to red on their own, I'm kinda thrown way off.
Saturday, July 24, 2010
Item Discussion for zf Redzone Censored
So Today I was filing my usual reports against the zf redzone system visited the xstreet page and of course got the stupid message saying a report already exists for this item, also filed an AR against its location in vsevolod, but I noticed something, every negative comment about it in the Item discussion has been deleted, last I checked it was 103 posts now whittled down to 72 posts, obviously there's a lot of negative to be said about it. I don't know whether the Lindens deleted the comments due to complaint of the seller, or if the seller decided to go back and delete them, I haven't used xstreet in forever so I don't know if you can moderate your item discussion, but it sure seems like to me the creator wants to censor every little bit that says what he is doing violates the ToS and is illegal, so with that his replies against the users should stand on their own if not the case, but why would he need to delete it? obviously someone hit the nail right on the head, probably he had the comments deleted because they can be used to show that he is in knowledgeable violation of BPC22575-22579. either way I'm going to continue to report this to the Lindens, as his utility is a serious threat to those who have multiple accounts regardless of reason for those, and as with found with the previous statement and comments, those who compile their own viewer(so most the developer community)
you can see the item discussion here:
https://www.xstreetsl.com/modules.php?name=Marketplace&file=discussions&ItemID=1175807
Take notice to all the gaps in the conversation
you can see the item discussion here:
https://www.xstreetsl.com/modules.php?name=Marketplace&file=discussions&ItemID=1175807
Take notice to all the gaps in the conversation
Saturday, July 17, 2010
secondlife Relay For Life, Relay today
At the relay for Life event at secondlife showing my support, Right now its the survivors lap so I'm off the track showing my support for those who are living with cancer, My teams campsite is at http://slurl.com/secondlife/RFL%20Hope/115/77/24/ come pay us a visit show your support and light a luminary for someone you know, I'm sure you know someone that's been afflicted by this horrible disease, come show your support for them.
Friday, July 16, 2010
Gathering Hardware and viewer statistics on SL users
Today in Avatar Makers Guild group chat Just a bit ago I got this group notice from a user called Stickman Ingmann:
I made a Jira requesting LL collect and expose useful information for inworld developers.
Oz Linden mentioned that there's internal discussion about a script function to test the viewer for certain capabilities (avatar alpha support, multiwearables, etc), but knowing what the average user can do would help us design products.
Have a read. If you agree, give it a vote. If you don't, leave a comment with feedback if you'd like. Thanks!
http://jira.secondlife.com/browse/MISC-4405
I have to highly recommend voting for anonymous statistics collection. It's a way to get software developers that write viewers to make secondlife suitable for common hardware and exposes statistical information for content creators who make graphically intensive stuff(such as hair with the Max Prim count, all Flexi, and glow...nothing lags a video-card like that) and to top it off unlike that zf redzone I mentioned in a previous post, It don't violate anyone's privacy, Sounds to me like this anonymous statistic collection will make a great alternative to a totally idiotic unthoughtful scripting function used to gather information on another users viewer capabilities, I mean such a scripting function, paired with the media system, to gather information, on a specific users viewer, can be used for vulnerability assessment purposes, this is definitely not a good thing. so if your a secondlife user reading this blog post, vote for that Jira article, and leave a comment, tell them you don't want a scripted function that can do this, and you would much rather see what Stickman Ingmann suggested than such a scripted function.
Just in case of editing by any party here is the Jira Article as it stands at time of posting this Blog Entry:
Having more information about what hardware and capabilities the average users of Second Life have would greatly aid in the designing and marketing of products.
Steam conducts a monthly hardware survey, asking random members of the community if they'd be willing to divulge hardware information to Valve. http://store.steampowered.com/hwsurvey The survey is made public to aid not only game developers in planning and spotting trends, but to aid community awareness on what types of systems people are using.
Gathering and distributing similar anonymous information from the Second Life community would be not only aid Linden Lab in its development choices, but would aid the inworld developers and standard users. As an example, if glow is only enabled by 20% of the users, it may be beneficial for LL to figure out why, and would be beneficial for inworld developers not to rely entirely on it. It would also let the standard user realize that the glow they are emitting may not be visible by everyone.
Besides the information contained on the Steam survey, the follow information specific to Second Life would be useful:
* Feature Support
o Glow/Shader Support
o Transparent Avatar Support
o Media-on-a-prim Support
o Multiwearables Support
o Restricted Life Support
o Etc
* Second Life Resolution
* Second Life Fullscreen/windowed status
* FPS
* Texture Memory
* Viewer Brand/Version
* Viewer Diversity (if people use more than one client or are loyal to just one)
Information also available on the Steam survey that could be gathered includes:
* Operating System and version
* System RAM
* CPU Count and Speed
* Video Card Identifier
* Video RAM
* Display Resolution
* Multimonitor status
* Microphone (not detected, asked)
* Language
* Free/Total HD space (not immediately useful, may be useful if the cache is improved)
* Network Speed
Edit:
you may wish to tell Oz Linden it's a bad idea to implement a scripting function to gather viewer information as it can be used for vulnerability assessments when paired with gathering information via media functions, you can find his office hours here: http://wiki.secondlife.com/wiki/User:Oz_Linden and please if you do say something to Oz please link him to the above mentioned Jira article here: http://jira.secondlife.com/browse/MISC-4405 tell him its a much better solution without all the nasty drawbacks of having such a scripting function.
I made a Jira requesting LL collect and expose useful information for inworld developers.
Oz Linden mentioned that there's internal discussion about a script function to test the viewer for certain capabilities (avatar alpha support, multiwearables, etc), but knowing what the average user can do would help us design products.
Have a read. If you agree, give it a vote. If you don't, leave a comment with feedback if you'd like. Thanks!
http://jira.secondlife.com/browse/MISC-4405
I have to highly recommend voting for anonymous statistics collection. It's a way to get software developers that write viewers to make secondlife suitable for common hardware and exposes statistical information for content creators who make graphically intensive stuff(such as hair with the Max Prim count, all Flexi, and glow...nothing lags a video-card like that) and to top it off unlike that zf redzone I mentioned in a previous post, It don't violate anyone's privacy, Sounds to me like this anonymous statistic collection will make a great alternative to a totally idiotic unthoughtful scripting function used to gather information on another users viewer capabilities, I mean such a scripting function, paired with the media system, to gather information, on a specific users viewer, can be used for vulnerability assessment purposes, this is definitely not a good thing. so if your a secondlife user reading this blog post, vote for that Jira article, and leave a comment, tell them you don't want a scripted function that can do this, and you would much rather see what Stickman Ingmann suggested than such a scripted function.
Just in case of editing by any party here is the Jira Article as it stands at time of posting this Blog Entry:
Having more information about what hardware and capabilities the average users of Second Life have would greatly aid in the designing and marketing of products.
Steam conducts a monthly hardware survey, asking random members of the community if they'd be willing to divulge hardware information to Valve. http://store.steampowered.com/hwsurvey The survey is made public to aid not only game developers in planning and spotting trends, but to aid community awareness on what types of systems people are using.
Gathering and distributing similar anonymous information from the Second Life community would be not only aid Linden Lab in its development choices, but would aid the inworld developers and standard users. As an example, if glow is only enabled by 20% of the users, it may be beneficial for LL to figure out why, and would be beneficial for inworld developers not to rely entirely on it. It would also let the standard user realize that the glow they are emitting may not be visible by everyone.
Besides the information contained on the Steam survey, the follow information specific to Second Life would be useful:
* Feature Support
o Glow/Shader Support
o Transparent Avatar Support
o Media-on-a-prim Support
o Multiwearables Support
o Restricted Life Support
o Etc
* Second Life Resolution
* Second Life Fullscreen/windowed status
* FPS
* Texture Memory
* Viewer Brand/Version
* Viewer Diversity (if people use more than one client or are loyal to just one)
Information also available on the Steam survey that could be gathered includes:
* Operating System and version
* System RAM
* CPU Count and Speed
* Video Card Identifier
* Video RAM
* Display Resolution
* Multimonitor status
* Microphone (not detected, asked)
* Language
* Free/Total HD space (not immediately useful, may be useful if the cache is improved)
* Network Speed
Edit:
you may wish to tell Oz Linden it's a bad idea to implement a scripting function to gather viewer information as it can be used for vulnerability assessments when paired with gathering information via media functions, you can find his office hours here: http://wiki.secondlife.com/wiki/User:Oz_Linden and please if you do say something to Oz please link him to the above mentioned Jira article here: http://jira.secondlife.com/browse/MISC-4405 tell him its a much better solution without all the nasty drawbacks of having such a scripting function.
Copybot... Users going too far to defeat it
Warning:as with previous post, more bad grammar ahead.
This post isn't going to be about zf redzone as I think I covered it pretty well in my previous post, but really those who have their content copy botted, really should see my links to the IC3(FBI) and the FTC in my previous article, and should learn how to file a DMCA complaint with Linden Labs, while they don't give prompt action, it don't make you just as guilty as the person that is illegally copying and republishing your content with the permissions released.
A while back I was in a group chat with a group known as "Avatar Maker's Guild", and a user known as "KK Mode" said he had the solution to copybot, a Prim tool known to crash copybot clients. While it has the right objective in mind, to disrupt copybot viewers export capability, it is severely misguided, however I must tout while I do not endorse the solution it is a hell of a lot less corrupt on spying on people, reason I don't endorse the solution? it crashes copybot and the standard viewer all the same.
KK Mode when initiating the group chat said he had something you could link to your creations that would disrupt the export process of a copybot viewer and crash it, and was handing them out free, he then said he was giving out this tool for free for anyone to make use of and to protect their content with, I of course inquired about this tool in a private IM with him as not to spam the group chat, he said this object is set to an invalid material type and would crash any viewer acquiring the information on that specific prim since its not going to be the root prim and that makes it safe for use, I asked what about editing linked parts and he stated it was safe for people that edited their avatars cause there was no way to select it, and it was more than just invisible, I asked him if he would send me one and he did so, I then asked you know there are some people that modify their avatars and may unlink them to do stuff like remove the ears to mod the ears for ear twitch features, and gave him a number of possibilities about how this could disrupt service for a normal user and isn't exactly a safe tool, his response over my concern? he got his nasty attitude on about a lot of the concerns as I stated it could take linden labs a long time to fix something like this, and that it may only take a copybot creator a week to discover why its crashing their viewer, and less than an hour to patch such an issue do you really want to put something like this out there? and this lead to a full blown argument, if not for ToS section 8.3 which I uphold and preach in my previous post, community standards and other issues, I would post the chat log right here. but I cant, All I can do is talk about it as im not allowed to make a direct copy of the text, but anyhow, the conversation eventually lead to him saying something to the tune of, Modding your avatar is like modding your PC's hard drive by putting a screw driver through it and complaining to the manufacturer it don't work(ironically I later vented with my Secondlife sister Mira and which stated she was as yiff lounge and standing right next to him, and went on to describe that he had a Kani avatar with the all too common fox modification where as you add an aventity fox nose to the Prims in the Kani) , I muted him for being an idiot and filed an abuse report with Linden Labs describing the malware content as it also violates ToS 8.3 like redzone, just the section that says you shall not impede normal function of the viewer(in the AR I said I would hold onto the content up until a certain date for their investigation but would delete it after a certain date as I dont like to hold onto dangerous content):
from: http://secondlife.com/corporate/tos.php
"8.3 You agree that you will not post or transmit Content or code that may be harmful, impede other users' functionality, invade other users' privacy, or surreptitiously or negatively impact any system or network."
impeding functionality right there with that tool. I would like to see copybot defeated just as much as any other creator, I have my own business there which copybot negatively impacts, in the case of This and redzone, the ends do not justify the means, as both are harmful to the general userbase more so than just copybot users.
anyhow with this said both methods to defeating copybot are both crossing the line, and are easily defeated by copybot users, the method described above can be defeated with a minor recode of copybot to ignore that information field, or just simply not lookup the names for the addressed invalid material types, or just simply a Hex editor that locks all addresses defining prim types under that variable to Wood or a material of choice, redzone can be defeated as with any content someone would want to steal, its generally virally spread across the grid, all you need to do is find it in a location where its not protected by redzone, or simply turn off media.
If you are thinking of Implementing either method of to protect your content, as ive heard some user say, copybot users generally aren't too bright in coding their viewers, its just simply modifications to circumvent the permission system and oftentimes they circumvent the UUID system so they don't have to pay to re-upload textures from content their stealing which can give away who was the original creator with lesser known creators who have content stolen from them, however no doubt their bright enough to figure out a scanning system and stay clear of it(just as normal and copybot user would want to do alike) with this said, the method that does more to protect your stolen content is KK Modes method and Not zfire xues method, reviewing the method which he uses the excuse his associates or alts make, I think zfire xue just simply uses copybot in mind as an excuse to do what hes doing, while I do honestly think KK Mode created his method in an honest attempt to defeat copybot, However, I do think KK mode needs to reconsider his methods due to lack of situational consideration(as with said him using a modded avatar he didn't even consider his own situation in this), so in saying this, his method sticks with your content, redzone does not, kk mode while both methods violate the ToS, is not only the lesser criminal in this situation, but is also the greater defender while I do not endorse the method of either and strongly oppose both methods, my opposition to redzone is much greater,if your going to do something in violation of the ToS kk modes method does not come with a legal violation as well unlike redzone(or at least I haven't found any laws that outlaw it at this point), I condemn both methods, but I stress, if your going to put them to use, use KK Modes method, it does much more to protect your content, and a minor viewer crash is a lot less damaging to an individual than a major Privacy violation and is more likely to prevent your content from becoming copybotted.
Please people, lets come up with a means to defeat this copybot system that does not violate the Lindens ToS, that is both Legal and Ethical.
If I worked for Linden Labs and developed their software I would probably create some software that works from the background and verifies that you are using a Linden Approved viewer, much like punkbuster, and verifies that the viewer, is running in an unmodified state, and that no unapproved applications outside the viewer were reading from it, that held a definition list much like an anti-virus to contain known viewers the background software would also acquire checksums on applications reading from the viewer, and verify those are running in an unmodified state if their known to the lindens, and submits checksums and definitions to the Lindens to identify unknown apps reading information and variables and so that these unknown applications can be disallowed, all viewers that don't verify properly are automatically and immediately disconnected, and also all viewers can have a closed source program that reads from them, collects various unspecified data used to verify whether the viewer is not and engages in encrypted communication with Linden servers whereas a new encryption system can be setup, of course this closed source program should be distributable and contain an API for working with so those who wish to make third party viewers can do so., of course no personally identifiable information of course. Hell even one of the third party viewer writers could start developement on this, submit their code to Linden Lab, and push in the Jira to get it Implemented in the regular viewer. the Only problem with this method suggested here? it takes time to do. but still no doubt it will be a goal completely worth working towards. also while absolutely disgusted with the technology behind it because it's a system that companies pay into to have their software developed and cause it can do what this background application I suggested would do quite readily without the need for additional software, there is always *shudders in disgust with it cause its really quite harmful to Open source and all that is good in computing*.... ... ... The disgusting evil, of coding your software, to work with the evils of the TPM(Trusted Platform Module) for those of you that dont know what this is, Its a hardware based system that enforces Copyright of software and other materials and verifies their running in a correct state, and can defeat viruses through the system, simply Its a chip on your motherboard that monitors your systems memory and watches over things when enabled, software can be compiled to only work if its present and enabled and it overviews a database of software(((which companies must pay to make an entry in which is harmful for opensource due to limited funding of some opensource projects and also harmful because a company can dispute the state of another program with it and close down another competing and free project that competes with a commercial project so you can see why I'm so disgusted with it as its a system of who registers first, totally backed by money, its also partially backed by Microsoft the leader in poorly designed operating systems that funded SCO's illegitimate lawsuit Where as some code contributed by SCO to the linux Kernal was claimed to be stolen but beside the point of this article, it just goes to show why im disgusted with TPM, but its nonetheless an option available to LL to defeat copybot))), this chip simply put can make sure your running a Linden Approved third party viewer or the Linden viewer itself, and can automatically close and shutdown unapproved viewers. as it Runs and performs its Operation at the hardware level, utilizes network to verify and discontinues failed verifications and runs over the OS level, a simple copybot user, would find such hardware extremely tough to defeat as it runs over a level which they have control of. Im against TPM though and think copybot could be controlled with the previous software method, and I have another reason I disagree with TPM, it would take a lot of users to upgrade to modern hardware that supports it in order to implement it so would require all secondlife users to use hardware that supports it, thus putting a lot of users out of luck. Simply Put, a piece of extra software that's freely downloadable and closed source that implements a verification system that's encrypted and simply verifies your client is in the state its supposed to be in and communicates with the Linden servers via encrypted means to keep its responses only predictable by Linden Servers, would be the best solution, if a response is invalid the user simply is disconnected by the Linden servers, this would probably even make it impossible to finish connecting if you were going to bot, while there are means of even defeating this method their method, it would force copybotters to do some work to achieve these means, thus then making them a lot more rare. which also in turns makes Linden Enforcement on DMCA issues more responsive, this can be defeated. but, everyone's going the wrong way, if your a talented programmer. Don't make spyware or malware, make a viewer and submit it to the Lindens, It could get implemented in their viewer and improve the experience for everyone without harming it and become a requirement of the system some day. All at the same, defeating copybot for the most part.
This post isn't going to be about zf redzone as I think I covered it pretty well in my previous post, but really those who have their content copy botted, really should see my links to the IC3(FBI) and the FTC in my previous article, and should learn how to file a DMCA complaint with Linden Labs, while they don't give prompt action, it don't make you just as guilty as the person that is illegally copying and republishing your content with the permissions released.
A while back I was in a group chat with a group known as "Avatar Maker's Guild", and a user known as "KK Mode" said he had the solution to copybot, a Prim tool known to crash copybot clients. While it has the right objective in mind, to disrupt copybot viewers export capability, it is severely misguided, however I must tout while I do not endorse the solution it is a hell of a lot less corrupt on spying on people, reason I don't endorse the solution? it crashes copybot and the standard viewer all the same.
KK Mode when initiating the group chat said he had something you could link to your creations that would disrupt the export process of a copybot viewer and crash it, and was handing them out free, he then said he was giving out this tool for free for anyone to make use of and to protect their content with, I of course inquired about this tool in a private IM with him as not to spam the group chat, he said this object is set to an invalid material type and would crash any viewer acquiring the information on that specific prim since its not going to be the root prim and that makes it safe for use, I asked what about editing linked parts and he stated it was safe for people that edited their avatars cause there was no way to select it, and it was more than just invisible, I asked him if he would send me one and he did so, I then asked you know there are some people that modify their avatars and may unlink them to do stuff like remove the ears to mod the ears for ear twitch features, and gave him a number of possibilities about how this could disrupt service for a normal user and isn't exactly a safe tool, his response over my concern? he got his nasty attitude on about a lot of the concerns as I stated it could take linden labs a long time to fix something like this, and that it may only take a copybot creator a week to discover why its crashing their viewer, and less than an hour to patch such an issue do you really want to put something like this out there? and this lead to a full blown argument, if not for ToS section 8.3 which I uphold and preach in my previous post, community standards and other issues, I would post the chat log right here. but I cant, All I can do is talk about it as im not allowed to make a direct copy of the text, but anyhow, the conversation eventually lead to him saying something to the tune of, Modding your avatar is like modding your PC's hard drive by putting a screw driver through it and complaining to the manufacturer it don't work(ironically I later vented with my Secondlife sister Mira and which stated she was as yiff lounge and standing right next to him, and went on to describe that he had a Kani avatar with the all too common fox modification where as you add an aventity fox nose to the Prims in the Kani) , I muted him for being an idiot and filed an abuse report with Linden Labs describing the malware content as it also violates ToS 8.3 like redzone, just the section that says you shall not impede normal function of the viewer(in the AR I said I would hold onto the content up until a certain date for their investigation but would delete it after a certain date as I dont like to hold onto dangerous content):
from: http://secondlife.com/corporate/tos.php
"8.3 You agree that you will not post or transmit Content or code that may be harmful, impede other users' functionality, invade other users' privacy, or surreptitiously or negatively impact any system or network."
impeding functionality right there with that tool. I would like to see copybot defeated just as much as any other creator, I have my own business there which copybot negatively impacts, in the case of This and redzone, the ends do not justify the means, as both are harmful to the general userbase more so than just copybot users.
anyhow with this said both methods to defeating copybot are both crossing the line, and are easily defeated by copybot users, the method described above can be defeated with a minor recode of copybot to ignore that information field, or just simply not lookup the names for the addressed invalid material types, or just simply a Hex editor that locks all addresses defining prim types under that variable to Wood or a material of choice, redzone can be defeated as with any content someone would want to steal, its generally virally spread across the grid, all you need to do is find it in a location where its not protected by redzone, or simply turn off media.
If you are thinking of Implementing either method of to protect your content, as ive heard some user say, copybot users generally aren't too bright in coding their viewers, its just simply modifications to circumvent the permission system and oftentimes they circumvent the UUID system so they don't have to pay to re-upload textures from content their stealing which can give away who was the original creator with lesser known creators who have content stolen from them, however no doubt their bright enough to figure out a scanning system and stay clear of it(just as normal and copybot user would want to do alike) with this said, the method that does more to protect your stolen content is KK Modes method and Not zfire xues method, reviewing the method which he uses the excuse his associates or alts make, I think zfire xue just simply uses copybot in mind as an excuse to do what hes doing, while I do honestly think KK Mode created his method in an honest attempt to defeat copybot, However, I do think KK mode needs to reconsider his methods due to lack of situational consideration(as with said him using a modded avatar he didn't even consider his own situation in this), so in saying this, his method sticks with your content, redzone does not, kk mode while both methods violate the ToS, is not only the lesser criminal in this situation, but is also the greater defender while I do not endorse the method of either and strongly oppose both methods, my opposition to redzone is much greater,if your going to do something in violation of the ToS kk modes method does not come with a legal violation as well unlike redzone(or at least I haven't found any laws that outlaw it at this point), I condemn both methods, but I stress, if your going to put them to use, use KK Modes method, it does much more to protect your content, and a minor viewer crash is a lot less damaging to an individual than a major Privacy violation and is more likely to prevent your content from becoming copybotted.
Please people, lets come up with a means to defeat this copybot system that does not violate the Lindens ToS, that is both Legal and Ethical.
If I worked for Linden Labs and developed their software I would probably create some software that works from the background and verifies that you are using a Linden Approved viewer, much like punkbuster, and verifies that the viewer, is running in an unmodified state, and that no unapproved applications outside the viewer were reading from it, that held a definition list much like an anti-virus to contain known viewers the background software would also acquire checksums on applications reading from the viewer, and verify those are running in an unmodified state if their known to the lindens, and submits checksums and definitions to the Lindens to identify unknown apps reading information and variables and so that these unknown applications can be disallowed, all viewers that don't verify properly are automatically and immediately disconnected, and also all viewers can have a closed source program that reads from them, collects various unspecified data used to verify whether the viewer is not and engages in encrypted communication with Linden servers whereas a new encryption system can be setup, of course this closed source program should be distributable and contain an API for working with so those who wish to make third party viewers can do so., of course no personally identifiable information of course. Hell even one of the third party viewer writers could start developement on this, submit their code to Linden Lab, and push in the Jira to get it Implemented in the regular viewer. the Only problem with this method suggested here? it takes time to do. but still no doubt it will be a goal completely worth working towards. also while absolutely disgusted with the technology behind it because it's a system that companies pay into to have their software developed and cause it can do what this background application I suggested would do quite readily without the need for additional software, there is always *shudders in disgust with it cause its really quite harmful to Open source and all that is good in computing*.... ... ... The disgusting evil, of coding your software, to work with the evils of the TPM(Trusted Platform Module) for those of you that dont know what this is, Its a hardware based system that enforces Copyright of software and other materials and verifies their running in a correct state, and can defeat viruses through the system, simply Its a chip on your motherboard that monitors your systems memory and watches over things when enabled, software can be compiled to only work if its present and enabled and it overviews a database of software(((which companies must pay to make an entry in which is harmful for opensource due to limited funding of some opensource projects and also harmful because a company can dispute the state of another program with it and close down another competing and free project that competes with a commercial project so you can see why I'm so disgusted with it as its a system of who registers first, totally backed by money, its also partially backed by Microsoft the leader in poorly designed operating systems that funded SCO's illegitimate lawsuit Where as some code contributed by SCO to the linux Kernal was claimed to be stolen but beside the point of this article, it just goes to show why im disgusted with TPM, but its nonetheless an option available to LL to defeat copybot))), this chip simply put can make sure your running a Linden Approved third party viewer or the Linden viewer itself, and can automatically close and shutdown unapproved viewers. as it Runs and performs its Operation at the hardware level, utilizes network to verify and discontinues failed verifications and runs over the OS level, a simple copybot user, would find such hardware extremely tough to defeat as it runs over a level which they have control of. Im against TPM though and think copybot could be controlled with the previous software method, and I have another reason I disagree with TPM, it would take a lot of users to upgrade to modern hardware that supports it in order to implement it so would require all secondlife users to use hardware that supports it, thus putting a lot of users out of luck. Simply Put, a piece of extra software that's freely downloadable and closed source that implements a verification system that's encrypted and simply verifies your client is in the state its supposed to be in and communicates with the Linden servers via encrypted means to keep its responses only predictable by Linden Servers, would be the best solution, if a response is invalid the user simply is disconnected by the Linden servers, this would probably even make it impossible to finish connecting if you were going to bot, while there are means of even defeating this method their method, it would force copybotters to do some work to achieve these means, thus then making them a lot more rare. which also in turns makes Linden Enforcement on DMCA issues more responsive, this can be defeated. but, everyone's going the wrong way, if your a talented programmer. Don't make spyware or malware, make a viewer and submit it to the Lindens, It could get implemented in their viewer and improve the experience for everyone without harming it and become a requirement of the system some day. All at the same, defeating copybot for the most part.
Subscribe to:
Posts (Atom)