Ilana Debevec

Loves me some Geddy Lee

Ann Otoole

The Hydra: Privacy Problems Expand as Linden Lab Play Catch-up - Search Engine Watch (SEW)

Only solution i see is let the spyware crap be sold and buyers get banned for being undesirables with a need to consult with a shrink. Same with griefer crap.

Panacea Pangaea

One would probably need to explore the finer nuances of 'Fair Use', but it might be worth considering a case of violation of copyright for the use of profile pictures.

If you made the image yourself, then you retain automatic copyright on it, even if you publish it.

I'm not sure to what extent the concept of Fair Use would cover the systematic collection, storage and distribution of copyright images for financial gain.

To file a DMCA, you'd need to be the copyright holder of the image, and you would need evidence that it was being used in violation of that copyright.

I know if I had made my own profile image, and saw it was being distributed in tables of data and on 'character cards', I would seriously consider that route.

Sling Trebuchet

.

__________________
Violation of your Data Privacy via the SL viewer and in-world objects within LL's control.
Please READ on this issue - It's not over! https://jira.secondlife.com/browse/VWR-24746
Second Life - "Your World, Some Random Nutter's Database."
!quit

VeiledVamp Veranes

Since the topic of beer came up:

__________________
u must b a coffeepotting gleefer! How cn u not c we all r b-ing @tacked bi gleefer alts!!! ~~ Jopsy Pendragon

bronxelf

I thought they got pulled, finally- Sredni posted they were gone the other day.

Are they BACK?

ETA: NM, this got answered a page and a half back. Im awake now. Sort of.

Inara Pey

I really don't see the point in providing people with something to carry around with them.

1. The aim surely is to educate people as to the tools at their disposal: the Media Filter & disabling Media.

2. What is easier, trooping around the Grid with a HUD, or taking required actions to mitigate the problem? Run with the Filter /disable media, problems solved.

3. HUDs aren't going to be able to counter every single new twist and turns some self-proclaimed genius thinks up out there, so you run the risk of hitting a maintenance /update requirement if someone manages to get very clever.

Something like this would work better than, say MoaP (given that currently, the majority of users still are not using Viewer 2, so that solution risks missing a large swathe of the population who might be oblivious to the issue as they can't see MoaP.

If it could be developed, and passed to store owners with a request they put in in the greeting area of their stores / sims (a invisible phantom prim "ring" surrounding the LP that triggers the check as someone walks through it?) & which, if the check reveals a person to be vulnerable, kicks out a "nested" Notecard given instructions on how to fix things.

The check does need to be non-alarmist, and the Notecard concise.

My view is still that things need to be as low-key and as simple as possible, and as passive as possible. HUDs require people to be pro-active (and people are lazy - and a HUD might send out the message to skiddies as being something that needs to be "defeated" and worked-around.

Scylla, no idea if you've been inworld, but I forwarded the nested Notecard idea to you a couple of days go. It's been slightly revised since then, but the version you have is still relevant.

__________________

Sione

I think you guys are thinking too technical with your ideas on how to show people they are vulnerable.

Forget php scripts, IM's and all the RZ like stuff.

All you need is to set the land media texture to an existing texture in the parcel. Someone with media off sees the intended texture and someone exposed sees a webpage saying "WARNING....."

You could even make a sign like that and when they click it they get a notecard. You just need to force the url to the html page on everyone who enters the parcel and thats it. No James Bond stuff there and it's a static webpage.

Inara Pey

I'm all for the simplest solution. Notecards work. At a push, a webpage would work - but where is it to be hosted?

Setting media requires store owners to move away from their preferred music channel (those that have one), no? Might encounter resistance.

No single way is going to cover all the bases. Perhaps a little shopping basket of *low tech* solutions that can be offered to sim / store owners? Let them decide what they'd like?

As long as the message is consistent - does the delivery mechanism matter?

Sione

I haven't tried it but a webserver script might even be enough for a simple plain text message and a sign could self host itself.

It won't effect music streams at all because it's agent targeted media not audio.

Inara Pey

Thanks... I'm not entirely up on all the nuances of media.

Sign hosting itself? As in MoaP?

Cathiee McMillan

You could use flickr i think to post your image warning and put that link in your Land media.

Sione

There is a function in LSL that creates a http server within an object. It's only simple but you should be able to display plain text with it.

Then you just use the same agent targeted methods as redzone to force the persons viewer to display it on the sign.

It could say something like "WARNING! If you can see this you are vulnerable to... For more info please click here for a notecard" or something like that.

EDIT: It won't be as pretty as a proper html page but it will solve your hosting problem.

Inara Pey

OK. Sounds to me like it would work.

I'm all for keeping things in-world, as it tends to encourage people to look and think. While not everyone reads notecards, there is potential for a lot of people to simply bypass anything that requires an actual web page to be viewed (either within the Viewer browser or their primary browser) simply because it takes them "out" of SL.

Think we really do need to the KISS principle, and this sounds like it does .

Sione

Well, it's still a webpage to the viewer. But if someone is going to bypass it they don't really need to see it in the first place.

Qie Niangao

I started on another more detailed reply about this vulnerability-test kiosk thing, but a few quick things now that it seems to be topical:

It is definitely possible to use an http-in script to do all the processing; I demo'd that like a month ago on the old blogorums.

The main hang-up I'm having right now is that, however it's done, it's going to pose a URL to anybody already running a media-filter enabled viewer. Now, that's not necessarily a bad thing, as part of an education campaign, but it will (as I think it was Sione pointed out much earlier) generate a "buzz" in forums, blogs, and everywhere. If we do this thing, we gotta make damn sure it's a *positive* buzz.

And that suggest to me that the thing simply can't be passive. And *that's* a problem for testing what will surely be the next targets in this whack-a-mole: Audio streams and MoaP, because audio streams will be present on the whole parcel, and MoaP leaks all the hell all over when active.

Also, a question about the viewer media filters, and what specifically gets white- / blacklisted: an unsecured in-world script gets a URL that looks like this:

http://sim9839.agni.lindenlab.com:12...0-24abbf0b37ff

If a user approves that in a filter, how much is approved? Is it the domain name part (which corresponds to the sim), or is it specific to the entire URL? If specific, is it specific also to any parameters passed in the URL? (Sorry for needing this basic info; obviously I just haven't been paying close enough attention.)

Sling Trebuchet

The agent-targeted media is the one that gives the databases an unmistakable avatar-IP pair (short of some clever interception by a tiny minority).
It's the most obvious vulnerability until Viewer.2 tech and MoaP becomes the norm.

Parcels hosting a test device would set their own parcel media as normal. The device would simply direct a special stream temporarily at the avatar and restore the normal parcel media for that avatar after the test.

I'm not keen on active tests that chat or IM the avatar uninvited. How many times do we see complaints about store greeters?

I would be in favour of an easily distributed sign that gives notecards and/or does a test on request.
I would resist any temptation to have something backed by a database to record who has requsted/tested what.

A unit that is simple, mod and opensource would be best I think.
That leaves no room for suggestions that the things are secretly collecting data.
It has to be as transparent ( duh!) and squeaky clean as possible.

The suggestion of simple MoaP signs is excellent. People only see 'that' version of the sign if they are open. The display tells them they are seeing it because they are potentially open to intrusion. It invites them to click for more information.

Couldbe Yue

if it can be triggered on touch then it sounds like the way to go. my only concern is that if it's distributed as open source then you can guarantee the pond life will hijack it

__________________

Inara Pey

Don't worry about basic info. Ashamed to say that I've been around SL over 4 years continuously, and a lot of the technical stuff is still a closed book to me; I know the basics of scripting for things like doors, lights, etc., but beyond that "?" - so I consider everything here educational. Just hope dumb questions don't rile people.

All I'm trying to bring to the table *is* the "naive" user's reaction to things. We cannot hope to cover all the bases. People can and will miss the point - they'll simply click away whatever comes up.

Popping up a URL does bother me - for the reasons you and Sione define; it's got to be seen as a "positive" (for want of a better word) "intervention" into people's lives. Then again, Notecards can be as easily ignored with a click as anything else.

The whack-a-mole approach also bothers me; but dealing with things more widely is obviously going to require some willingness from LL to get involved in the broader issues. As such, it's probably best left to a separate discussion.

Otherwise, the first step in eduction, and possibly the easiest, is to agree a common set of Notecards, distribute those through Groups where we can, and contact store / sim owners and request they put out Notices to their clients containing the "top" / "master", whatever you want to call it, Notecard.

If people are willing to follow-through, this could hit a large percentage of the population. Granted, not everyone will read it; some will get duplicates - but it's a one-time "hit" as it were.

Sione

sim9839.agni.lindenlab.com

Qie Niangao

I thought about that a bit. If it's open source and anybody can take a copy, the diligent can compare the source to a reference to make sure it's legit; nobody would do that a priori, but it means bogus installations would be apparent if examined.

That does raise the issue of licensing. I'm thinking that GPL isn't quite right. We really need a "no derivs" license, I think. (Although I've certainly not thought this through enough to be sure about that.)

Sling Trebuchet

The biggest issue is raise awareness of the openness to data harvesting.

Just get people aware of the media filters - why they exist and how to use them.
Things don't really need to be more clever than that.

A demonstration of the process involved would be useful to reinforce the message.

The primary objective has to be to get the basic information in front of maximum eyeballs in all languages.

Community 'thought leaders' ( Aaaaaaaagggh! I just said ...that ) and bloggers with high profiles in various languages would be helpful.
Getting singage out in newbie areas would be good.
Getting signage out in high-traffic places would be good.

Sling Trebuchet

Oops!

Inara Pey

Notecards written. Nested set: 1 overview; 1 each on Media Filter and disabling Media contained within overview card. Simple screen shots also included.

Require translation if they are to be used / widely used.

Qie Niangao

Kinda. I mean, it's a perfectly sensible approach, but problematic for a couple of reasons.

Longer term, one might wish for a "block all in-world media sources" ability. That would totally kill some very nice MoaP-y things, but I think they're pretty much doomed anyway. (Which is actually how I got sucked into this; I had such plans. *sigh*)

And for our current explorations: If one accepts a URL from a test kiosk, it means accepting any URLs originating from the sim. That would be an open invitation to any neighbors of such a kiosk to install alt-data-harvesting devices modelled after the latter version of the Quickware crap.