New ‘Permissions Exploit’ Uncovered – Drama Ensues on SLX
by Alphaville Herald on 14/02/08 at 5:40 am
by Proper Prim, staff writer
a possible source of drama
For a few days now I have been monitoring a situation on SLX where users have discovered objects being sold that one user described as utilizing ‘a permissions exploit’. What is the nature of this exploit? A script loads an avatar’s profile from the web, parses the html on the page for the link to the profile image displayed, thus retrieving the UUID of the image.
A number of residents are outraged because of this, some of whom began using legal terminology and throwing around phrases like ‘copyright violation’ and so forth. Why would residents be concerned about merchants selling objects that temporarily display customer’s profile images as they walk by?
I was able to catch up with resident Adromor Wierwight for a short interview about the situation. Adromor was ‘warned’ by SLX administrators for being so heated that he apparently violated the SLX “respect” policy by referring to several of the users as ‘whiny and petty’. Here is what Adromor had to say:
Proper Prim: So do you feel that most residents feel as people like Montana Corleone did about your products?
Adromor Wierwight:Not at all, that woman was rediculous. She claimed that another one of her friends was a RL lawyer and that she could sue me,etc,etc. She is obviously a very litigious person throwing around the word Libel a lot. Not just in that thread either but in others. She’s also french and had expressed anti american sentiments
Proper Prim: You believe she is anti-american?
Adromor Wierwight: Absolutely. I have no problem with that though, since I am anti french *laughs*
Adromor Wierwight: My products weren’t the main topic of the thread though. In fact I got the idea from the thread and created my stuff while it was being discussed. A good friend of mine, named Sarah Showboat also sells similiar items. They are Tipboards. Basically tip jars with a new design. When the employee logs in it displays their profile pics. Her slex store is at: http://slexchange.com/modules.php?name=Marketplace&MerchantID=34762 and she sells products out of her sim, Avaron, as well. Mine is at http://slexchange.com/modules.php?name=Marketplace&MerchantID=126019 btw.
Proper Prim: How did SLX staff react to this? Your products are still listed…
Adromor Wierwight: They are. SLX staff said my products do not violate SLX tos and neither does Sarah’s. Sami Tabla in particular was very rude and sarcastic towards me though when it came to discussing the thread where me and about a dozen other people were arguing. I don’t much care for Sami but after speaking with Tigress Stormwind I realized that I cannot blame the entire company because only one person has a bad attitude.
Proper Prim: Since this is being called a permissions exploit doesn’t it violate the LL TOS? Have you spoken to a linden about this?
Adromor Wierwight: I have not, but I am positive that this could not be classed as an exploit of any kind. Displaying someone’s profile image is a trivial thing. There are much worse things happening in the metaverse.
another possible source of drama
Later I contacted Sarah Showboat for an interview on her feelings on the matter. She declined to comment saying that attempts to ‘criminalize’ her products by a few ‘misguided individuals, incapable of being creative and original on their own’ weren’t worth responding to. ‘Suffice it to say, our products are still being distributed. LL nor SLX staff have intervened and asked us to remove them’, Ms. Showboat told us.
Currently there are at least a dozen products for sale in second life that utilize this so called permissions exploit, many in their own unique and innovative fashion. That number is increasing daily as these new products are being popularized. Are claims that said products are illegal valid, just petty jealousy of a few merchants, or an excuse to stir up drama by a handful of individuals with nothing better to do with their time? You decide.
Penance Sautereau
Feb 14th, 2008
I encountered one of those things at one of my friend BlkCobra Shikami’s CobraTech locations. Surprised me for a sec to see my face up on the thing, but I hardly felt exploited or violated. I fail to see why anyone would. It’s a picture, it isn’t like it’s displaying your RL name and address.
Angel
Feb 14th, 2008
Hardly an exploit.
http://www.lslwiki.net/lslwiki/wakka.php?wakka=LibraryDisplayProfilePic
Angel
Feb 14th, 2008
BTW… Learn to spell, or add [sic] to other people’s cock ups please. You are as bad as Penny without the commas.
Sometimes this blog is /ridiculous/.
Uwe
Feb 14th, 2008
the script you can found here:
http://www.lslwiki.net/lslwiki/wakka.php?wakka=LibraryDisplayProfilePic
Princess Ivory
Feb 14th, 2008
I entered a store and saw a cube (the shape and size of your basic plywood box that reezzes when you begin to build). It was just sitting on the floor in the room, as if someone had left it behind. But when I took a closer look, I saw that every surface was covered with the profile picture of of of my friend. My first thought was that someone had captured her image to use as an ad to sell the dress she was wearing. I wondered if she know they were using her picture.
But as I approached the cube, suddenly the pictures changed, and it was covered with the profile pic from my own profile. Talk about an unexpected and disturbing experience. I hightailed it out of that store, and I will not be going back to it again. So they have lost my business. In my case, the store was harmless in terms of content, but what if I’d gone into a sex shop? Would I want the next people to come in to see my picture, and know I’d been there? That would be very embarrassing. I don’t want my shopping habits visibly broadcast to any who looks. They might as well post of board of all my purchases in their store, too.
The technology may make it possible, and the Linden exploit may allow you to do it, but that doesn’t mean it is right to do it. It makes me feel invaded, like cameras are recording my every move. Visitor counters can feel invasive enough, but at least they are reasonably private, and for the use of the business owner to track traffic to his store. I unerstand the need for those. Other that the sheer titilation factor, I fail to see the need for these objects that broadcast our images to the next shoppers in the store.
Witness X
Feb 14th, 2008
Holy fuck, somebody is using a public object to display items that are public record? We’re fucking screwed!
Ari Blackthorne
Feb 14th, 2008
Heh – I own a lot of Sarah Showboats’ stuff. Damned, I’ll have to go shop her store for new toys! Sounds like I’ve gotta get me one of these >:)
SqueezeOne Pow
Feb 14th, 2008
What exploit? It’s not like this is something you couldn’t see if you looked at someone’s profile or checked “friends online” at secondlife.com and looked at the pictures. Big deal.
I think it’s just a sign of how pathetic the average (I’d say below average) SL resident has become. I’ve seen a definite decline in the quality of people using SL over the last couple years. It used to be people that wanted to enjoy themselves and find different games to play and everything. More and more it’s turned into desperate people with social disabilites that can only feel any sense of self-worth when they rain on someone else’s parade through drama and rapid fire accusations.
I guess this is the result of SL being so frustrating to use by the casual user. Honestly the only thing that really keeps me coming back these days is the ability to build just about anything I could ever want to see and sharing in experiencing others’ creativity.
I can’t say I like talking to very many people in there these days, though!
Once again, decently written article on a completely uninteresting subject. I guess 1 out of 2 ain’t bad!
Penance Sautereau
Feb 14th, 2008
@Angel – No one’s as bad as me. Well, except you. I at least am liked on occasion in spite of how “bad” I am.
Darien Caldwell
Feb 14th, 2008
The term Exploit doesn’t even apply here. Exploit means someone found a way to do something they otherwise shouldn’t be able to do. Even before Linden Lab created the HTTP interface to their databases, you could get peoples profile pictures from, you guessed it, their profiles. So much talk about nothing.
Just Me
Feb 14th, 2008
If you don’t want to be “seen” inside a store, why don’t you hide behind some bushes outside and use your camera controls to browse inside and buy those ‘naughty’ products? Added bonus: it will give you practice using your mouse too ! LOL
prude
Feb 14th, 2008
I don’t want to go into a store and have my profile pick all of a sudden be part of your decor.
If you want to put my picture up, ask me. I don’t need you showing off who I am if I browse your store.
This is going to be turned in to a harassment issue in some types of sims. I can’t wait to see Prokofy surround every lot he has with them, big 20m wide ones. to show off anyone who is “snooping around” his property. Put it in a shop, and aim it into a different room, to get laughs out of the people coming to check out some of the sick shit that’s on display. Take picture of them in “inconvenient” situations, with a big profile pic behind them, and grief with that.
This toy has some interesting legitimate uses, but also some interesting illegitimate uses.
If you want to put my picture on something, ask me. Period.
Greefin Oh
Feb 14th, 2008
Oh ho ho ho! lol. I have the script, I have the know how. This isn’t new at all. Man you boys are late.
Tenshi Vielle
Feb 14th, 2008
What a stupid thing to argue over.
anonymous
Feb 14th, 2008
God damn, will you people stop finding something to get all worked up over? IT’S STUPID.
If it isnt griefers and linden labs being utter shitheads (which many of you will turn around and defend in the same breath)
It’s e-rape, harmless things, small animals, and scripts using public data that’s been around for ages. Hell, I can see a map of your private sim if I want to as well.
Also, my god, I can see your fucking shitty profile pic if I right click on you. ZOMG INVASION OF PRIVACY.
Seriously, get a fucking grip, especially the SLX faggots.
Angel
Feb 15th, 2008
You know I love you Penny, I wouldn’t pick on you if I didn’t.
I don’t do it for the lulz, I do it for the <3′s
Happy Valentine’s day hun.
Debbie Trilling
Feb 15th, 2008
I orginally posted the ‘Random Profile Projector’ script on the SL ‘Scripting Library’ Forum in November 2007
I have made it available for free on the LSL Wiki at http://wiki.secondlife.com/wiki/User:Debbie_Trilling
and anyone can pick up a copy of the script, and use or adapt it as they wish.
The vast majority of feedback has been positive. Some have adapted the script in innovative and creative ways. For me, this is the essence of why I play SL.
Some small but vocal minority do not like the product, and have spoken of being “violated”, “invaded”, “exploited” etc. Still others talk in pseudo-legal terms about “copyright infringments” and “contacting my RL lawyer”. On the occasions that these contact me, usually adopting a indignant and self-rightous tone, I explain how the toy works and offer them a free copy. In *every* case without exception they have always said “Yes please!”. This leads me to conclude that underneath the veener of “hurt feelings” is actually a motivation to get-something-for-nothing, a kind of “I wonder if I can get some compensation for this” mentality. I’m sure that this doesn’t apply to everyone in every case, but I have yet to come across such a case.
So, with that in mind, I’ll continue to develop the script/product and make it avaliable for free to anyone who wants it
Debbie Trilling
Feb 15th, 2008
It seems that my post has been erroneously posted under the name of “Angel” (February 15, 2008 at 01:19 AM), rather than “Debbie Trilling” (February 15, 2008 at 04:50 AM)
I would be grateful if this could be corrected.
Many thanks
Pierce Kronos
Feb 15th, 2008
Actually, according to Linden Lab’s Governance Team, such scripted devices are ARable as a violation of the ToS. Most likely initial ARs will result in a warning with subsequent reports of abuse resulting in suspensions. The creator, of course, is not ARable — just the device and its owner when used in such a manner as to display your image or whatever without your permission.
Folks can whine and cry, curse and call names at this if they like or at those who choose to follow such actions, However, such histrionics won’t negate the facts.
- Pierce Kronos
Penance Sautereau
Feb 15th, 2008
You know I’ve never quite grasped the concept that teasing and irritating someone could be construed as a sign of affection. Maybe I do have a stick up my ass but I hate when Fran picks on me either.
Angel
Feb 15th, 2008
@ Debbie, You must be new here hun. Like a letter, your name goes at the end not the start.
Don’t feel bad, everyone makes that mistake… once. Must be that dotted line or something.
@ Pierce, It’s only a TOS violation if it is without permission. The script listed on the LSLWiki asks permission, the two listed in this article are for groups you belong to and for tip photos, ie: your employees, who would no doubt give permission.
Debbie’s projector though is one that does not ask permission but picks random people from a llSensor() sweep, that is certainly against TOS; but she gives it away free in source code form not on SLX, so that argument is moot.
Debbie Trilling
Feb 15th, 2008
@ Angel: “your name goes at the end not the start” Oh yeah! lol
The script I posted on LLab Forums & LSL Wiki was intended as example code for other scripters & for me to pass a few hours on a cold, miserable UK Sunday morning. It was never originally intended as a polished and completed product.
It has evolved somewhat over the last few months and provides good examples of using a number of important LSL techniques and functions. At some point I’ll also implement a permissions system, just because it has become a kind of pet project of mine.
As a matter of interest and FWIW, I have always made the code available as Open Source and have not myself financially benefited from it, nor sold it.
I do, however, encourage others to use the script creatively, innovatively and to enjoy it. And sell it even, if people are prepared to pay for it.
MPD
Feb 17th, 2008
Debbie/Angel: Would you make up your mind as to which name you want to use? You admit your post went up under a different name, and the posts keep alternating between the two names in question. Make up your damn mind.
Archie Lukas
Feb 20th, 2008
Sorry
But this is a non-issue
Storm in a teacup
Cure for insomnia
(your choice)
Trillium Bing
Feb 20th, 2008
I am a purveyor of these fine gadgets, so I have first hand experience with the general opinion of SL residents. They love it! At least 99.9998% of them. As Debbie stated above, the few who do initially have a problem with the product quickly change their minds once they understand how the script works. Then, of course, there have been the one or two legal office clerks who toss around the terms “copyright”, “privacy”, etc. For the vast majority, this product is a must have in the world of Second Life. It is just so freakin’ cool!
I have a few different varieties of the script at my store…some are framed and some are projectors similar to what Debbie and her pals created. The reality of the matter is that the only way that I benefit in any way from displaying the profile pic of an individual is when that individual purchases the product (I call them ‘Magic Mirrors’). So, if someone gets mad and doesn’t buy it, they technically negate the effect of me benefitting in any way from showing their particular profile picture to them. When they leave, the mirror reverts to default and is ready for the next person to arrive so that it can show their picture to them. Not a big deal.
Is it a violation of copyright law or Linden TOS, I really don’t think so. I imagine the judge in a court case saying “OK, let me get this straight…you are suing so and so because they temporarily displayed the picture that you chose to make publicly viewable? And this is all happening in a computer video game? Next please!”
There has been quite a bit of flap around this issue on a couple of different forums. But I think it is just a matter of people getting used to seeing this kind of thing around SL so that they are not shocked or surprised when they TP somewhere and see their pic staring at them. This is a product that, initially at least, invokes an emotional response. But just because someone felt an emotion upon seeing it doesn’t make it a violation of some international law.
Bottom line…it is a wonderful product. It’s just another way to show off the wonderful variety of photos that SL residents have chosen to show to the world as a representation of who they are. The ultimate purpose of a profile picture is for it to be seen, is it not? I can’t imagine that when Linden Lab made SL open source for people to have the opportunity to create new ways of viewing and using SL content that they believed that the profile information should be excluded from this concept of open source. With all the possibilities that open source creates…why should the profile picture only be viewable via the original methods that Linden devised? Doesn’t make sense.
Anyway, thanks to the Herald for the article…and thanks to Adromor, and the other brave souls who have defended these scripts against the legal clerks/debate team captains who want to blow this issue way out of proportion.
**shameless marketing plug coming up**
Don’t forget to stop by Trillium’s Home Store to get your copy of the coolest thing to hit SL since….Philip Linden!
Love,
Trillium
neurosys sin
Feb 22nd, 2008
“I don’t want my shopping habits visibly broadcast to any who looks. They might as well post of board of all my purchases in their store, too.”
If this is an exploit someone should tell this guy about browser cookies…. oooooo hes gonna be pissed!
Tolerance Purchases Freedom, But its a good bargain. Because Freedom, Is Priceless.
Montana Corleone
Mar 8th, 2008
Well Trillium, got news for you. Read Title 17 of the US Code. ie the US Copyright Law. It IS a violation to copy a pic that is on public display, in this case in profile. Public display does NOT mean public domain. It is therefore a breach of copyright to use it without the copyright holder’s consent. Cool or not, doable or not, doesn’t mean it’s legal. Of course the person interviewed, Mr Adromor Wierwight thinks the law doesn’t apply to him either, which must be why he is a member of the REJECTS Intellectual Property group. That’s aside from thinking Freedom of Speech, which he shouts about, applies only to him, and anyone disagreeing with his views should be shouted down, threatened and griefed.
A prime example is the above where he laughs when he says he’s anti-French, but don’t you dare be anti-American. Not that I’m French, I’m British but live in France, as he’d find out if he did any modicum of research, but as a pretend journalist obviously he can’t.
But I’m seeing why this guy is picking on me in multiple reports in this rag. I wasn’t the first to tell him it was a copyright violation. But I did show him he was wrong on every point, and even showed him the law. Furthermore, the RL lawyer on the thread said exactly the same thing. So I guess he doesn’t like getting beaten by a girl. And when he was shown to be wrong by several people, very politely, he then got insulting and accused everybody else of making snide remarks. How childish and pathetic then to continue this. How old are you? One day you’ll grow up and be man enough to admit when you are wrong.
You may not like the law, but you are still breaking it, and when countless people politely pointed it out, YOU got all whiny and petty. Including libelling me by accusing me of ripping off photographs that are my own work. It’s very easy. Read LL’s ToS. Read Title 17 of the US Code, and read the DMCA. Then you’ll know what the law is, what rights you have, and end of story. Any other interpretation is frankly wrong.
You can read the thread here and make your own minds up about behaviour:
http://uncensored.slexchange.com/modules.php?name=Forums&file=viewtopic&t=37733
Oh, and the result? The OP decided to pull her gadget from display.