Has anyone else noticed the B[xxxx] accounts?

[Rowan Amore]

27 minutes ago, Lyric Demina said:

This website and its avatar search provides information to the public that is not otherwise public knowledge.  Whether an account is premium, or is premium plus, for example.  That is a violation of privacy.  It is none of anybody's business and it is between the Resident and Linden Lab. 

There is a privacy policy that says Linden Lab may share our information with third parties for various reasons, but hosting a rez day board isn't one of them.  Is there a good reason Bonniebots.com is sharing with the public private financial information associated with Second Life avatars?  How would Bonniebots.com even get that information?  And what information is it tied to that isn't necessarily reflected on the public website?

You can probably tell who is premium or premium plus by the number of groups they have.  That's not exactly private info but also an estimate from gathered info.  As my profile doesn't show all of my groups, I'd appear to be a basic member.  If one looks at owners of land on mainland, you'd know they are premium as would checking Linden homes.  It's all guess work and no way for them to actually KNOW the information.

Edited January 17, 2023 by Rowan Amore

[Lyric Demina]

2 hours ago, Rowan Amore said:

You can probably tell who is premium or premium plus by the number of groups they have.  That's not exactly private info but also an estimate from gathered info. 

edit:  it's possible to not have to guess, as Frionil demonstrates below.  I still have concerns, as mentioned below.

 

Edited January 17, 2023 by Lyric Demina

[Frionil Fang]

8 minutes ago, Lyric Demina said:

There is nobody who asked me deliberately what my subscription level is; and yet there is the information posted on the website without my consent.  Information that is not, I repeat not, public knowledge.

Whether good or not, it actually is public information.

https://wiki.secondlife.com/wiki/LlGetObjectDetails will tell you the account level for anyone, and any info that can be gleaned via basic script functions should be considered public.

[belindacarson]

What exactly, is "public knowledge"? your RL info, which is not published by LL on these forums or inworld.  Anything else is public information (albeit anonymised stuff) so there's nothing RL wise publically disclosed?

 

Please feel free to correct me here, but your RL info is nice, safe, and secure (unless you have chosen to share it/disclose it within SL of course, which is your right).

 

Personally, I don't see any issue in another avi seeing my avi's age.

[Lyric Demina]

56 minutes ago, Frionil Fang said:

Whether good or not, it actually is public information.

https://wiki.secondlife.com/wiki/LlGetObjectDetails will tell you the account level for anyone, and any info that can be gleaned via basic script functions should be considered public.

Thanks Frionil, that's actually pretty useful and pretty terrible.  I appreciate knowing this information.

24 minutes ago, belindacarson said:

What exactly, is "public knowledge"? your RL info, which is not published by LL on these forums or inworld.  Anything else is public information (albeit anonymised stuff) so there's nothing RL wise publically disclosed?

 

Please feel free to correct me here, but your RL info is nice, safe, and secure (unless you have chosen to share it/disclose it within SL of course, which is your right).

 

Personally, I don't see any issue in another avi seeing my avi's age.

RL info is nice and safe and secure of course, as far as we know.  And I would like to believe that.  At the moment, though, I have my doubts. Perhaps my doubts can be calmed by someone.  But this website is just getting worse the more I examine it.

The big baggy problem of privacy that I was originally concerned about (sparked by a vision of my account level on a page that simply has no business having it) is crystallizing now into a more manageable problem: where did this avatar search page come from at all?  Because it contains avatars, profile pictures, "about" information, that flat-out should not be searchable.  An avatar I have, for example, who has "show in search OFF" is absolutely and wholly searchable in this website's avatar search engine.  So how is that possible?  When I turn off "show in search" I had a reasonable expectation of not being searchable.  Is that naive of me?  I thought I was making use of the tools available to me.

So my original anxiety has not been calmed; there is a way in which this website is getting information that is not publicly searchable.  How are they getting it, and what else have they gotten? 

Is this a Third Party Viewer issue?  Is this a Lab privacy breach?  Is this another mystery that can be solved easily with one of those wiki scripts that Frionil posted above?  This is what my support ticket aims to find out. 

 

[CarlaWetter]

16 minutes ago, Lyric Demina said:

An avatar I have, for example, who has "show in search OFF" is absolutely and wholly searchable in this website's avatar search engine.  So how is that possible?

I would think that they collect the profile data from everyone they see in a region they haunt. That's in no way affected by any "show in search" toggle anywhere. Obviously they are not guided by any other consideration than "because I can do this".

Quick test, an alt of me that has not been online for a good while longer than these bots are around is searchable in the regular SL search functions but unknown to the bot site. So yes, they collect everything they can grab from dropping into a region with people.

While one may maintain the view that it's all just public information collected, I still think the sheer mass of collected information about avatars and their whereabouts is ethically highly questionable and while probably not literally against TOS yet, I would very much hope that LL would for a change do something against this mass data aggregation.

And not just aggregating this data but publishing it as well in a searchable database unaffected from such peculiarities like some users expressed wish not to be found in search is everything but being excellent to another.

[Candide LeMay]

It's neither a TPV issue nor a privacy breach. I can type your name into the inworld (or web) search and if I get no result back I can assume you have show in search turned off. It's as simple as that.

[Lyric Demina]

3 minutes ago, CarlaWetter said:

I would think that they collect the profile data from everyone they see in a region they haunt. That's in no way affected by any "show in search" toggle anywhere. Obviously they are not guided by any other consideration than "because I can do this".

Quick test, an alt of me that has not been online for a good while longer than these bots are around is searchable in the regular SL search functions but unknown to the bot site. So yes, they collect everything they can grab from dropping into a region with people.

While one may maintain the view that it's all just public information collected, I still think the sheer mass of collected information about avatars and their whereabouts is ethically highly questionable and while probably not literally against TOS yet, I would very much hope that LL would for a change do something against this mass data aggregation.

And not just aggregating this data but publishing it as well in a searchable database unaffected from such peculiarities like some users expressed wish not to be found in search is everything but being excellent to another.

Thanks for your response; and yeah I performed that test too with a similar result.

And agreed; it's absolutely not being excellent at all.

[Solar Legion]

Toggling off Show in Search only disabled this for Linden Lab's own, in house system. It does not prevent someone from bringing up your information while in the same region as you are nor from within the same groups. Some TPVs even have a nifty radar function and you're not blocked from those either.

Your Profile remains visible. It remains able to be viewed by anyone. You have simply removed the easiest method to view it. It is not and has never been possible to make it "private".

[CarlaWetter]

I believe the technical side has been figured out. It obviously is possible to brute force such a bot based surveillance. I'm much more interested in the question if running such a mass surveillance system is ethically acceptable. As a typical European in that regard I have very great doubts.

The system they run is implemented to circumvent perceived shortcomings in the data made available by LL. That's ethically questionable to the extreme for a laughable result in their published data. A mass surveillance giving us a bunch of regions with a double digit visitor number (and I don't really mind them putting Sirens Isle in a high spot), that's about as useful to know as how many Lel teeth you'll meet out there, statistically. It's not better than Destinations, only more intrusive by orders of magnitude.

And the 'data' published is necessarily only the tip of the iceberg. Why should we trust some nameless bunch of scripties with a data collection containing the whereabouts of our avatars, their online times and attachments?

Again, it's not the legality of any single data point collected, it's the aggregation of the data where the whole operation goes beyond the pale. This special horde is singled out now because they make their aggregated data in part available which does not help their legitimacy much. But it again puts suspicion on other bot hordes that shy away from publishing anything about their activities.

Of the 136 roaming bots I've logged as active over the last 12 months there are TWO with a well known, documented purpose, run in an open and ethical way. What's with the rest?

[Lyric Demina]

53 minutes ago, CarlaWetter said:

I believe the technical side has been figured out. It obviously is possible to brute force such a bot based surveillance. I'm much more interested in the question if running such a mass surveillance system is ethically acceptable. As a typical European in that regard I have very great doubts.

The system they run is implemented to circumvent perceived shortcomings in the data made available by LL. That's ethically questionable to the extreme for a laughable result in their published data. A mass surveillance giving us a bunch of regions with a double digit visitor number (and I don't really mind them putting Sirens Isle in a high spot), that's about as useful to know as how many Lel teeth you'll meet out there, statistically. It's not better than Destinations, only more intrusive by orders of magnitude.

And the 'data' published is necessarily only the tip of the iceberg. Why should we trust some nameless bunch of scripties with a data collection containing the whereabouts of our avatars, their online times and attachments?

Again, it's not the legality of any single data point collected, it's the aggregation of the data where the whole operation goes beyond the pale. This special horde is singled out now because they make their aggregated data in part available which does not help their legitimacy much. But it again puts suspicion on other bot hordes that shy away from publishing anything about their activities.

Of the 136 roaming bots I've logged as active over the last 12 months there are TWO with a well known, documented purpose, run in an open and ethical way. What's with the rest?

Gosh I wish I could have said it so well in my support ticket.  Thank you for putting the right words to this issue.

[Solar Legion]

So many words to excuse paranoia ...

[Love Zhaoying]

4 minutes ago, Solar Legion said:

So many words to excuse paranoia ...

They should require Bots to all look like Cybermen, or possibly Daleks!

[CarlaWetter]

12 minutes ago, Solar Legion said:

So many words to excuse paranoia

Thank you for your highly appreciated and doubtlessly well qualified diagnosis. Too bad that it does not address the topic.

[Solar Legion]

What topic?

Oh - you mean the bots whose data is right there for you to see?

Yeah .. Nothing to discuss there until actual evidence of anything more is presented.

Have a good day.

[CarlaWetter]

4 minutes ago, Solar Legion said:

Nothing to discuss there until actual evidence of anything more is presented.

That's of course factually wrong and you are in a position to know it. The data presented by the bot herders can only be collected as an aggregate associating avatars, worn attachments, locations and time of collection. Now my so called paranoia is that I point these facts out. Nowhere is an assurance that their data is only used to the 'published' purposes. And we know for a fact that they happily use the collected profile informations for a searchable database of avatars, by name, group associations and interests regardless of an avatar would want to be searched in such a way. If they have not considered abusing their data, good on them but there's no such assurance out.

At other social networks such datamining outfits have gotten in legal hot water. Of course now you'll say that an avatar isn't as such a protected personal identificator, which on the face of things is probably correct, but from that does not follow that datamining the heck out of SL is legally the same and especially not that it is ethical to do. In my opinion it isn't. If that allows a clinical analysis of my mindstate is better left to accepted experts in that matter

So if you have only handwaving and ... ahem ... psychological expertises about me or others to contribute,  don't waste my time.

Ah, don't waste my time anyway.

[Solar Legion]

That's nice.

You're assuming the data presented is not the only data collected and assuming there is some other purpose/unstated purpose.

The data presented being collected is the fact. All else is conjecture. Period.

You have no evidence beyond your musings.

As for the "clinical analysis" ... None has been given. A statement of what has been presented and what it appears to be however - has. There is a difference.

Find and present evidence. Until then, don't pretend that your musings are facts.

[Love Zhaoying]

It's nice to see people discuss a topic so..politely!

 

[CarlaWetter]

15 minutes ago, Solar Legion said:

You're assuming the data presented is not the only data collected and assuming there is some other purpose/unstated purpose.

No, I point out that it's technically impossible NOT to collect the data without the datapoints given. I have NOT claimed that there is more data collected and that's therefore not an issue currently. You tore own a strawman there, sorry. Calling that conjecture fails the actual matter entirely that you still won't address. It's conjecture that the data has been thoroughly deaggregated through the operators. That it has been collected still is a fact.

But be it as it is. You've invested yourself in the defense of that operation and attack the messenger instead of discussing the message. I'm not entirely surprised. But mainly I'm no longer interested in wasting time on this. I've said what I think about that operation and calling it paranoid is no way to change my mind. And actual arguments are not forthcoming and no longer expected.

 

[Ardy Lay]

How long does it take to visit each region in Second Life with 100 "bots" teleporting around in a coordinated effort?

Hmm, I'll drop some numbers here.

27631 regions searched by 100 scripted agents is at most 277 regions per agent.

In testing I could, myself, teleport 6 times a minute.  I will assume a scripted agent can do at least as well.

277 regions to visit at 6 regions per minute might take 46 minutes 10 seconds.  Round that up a little to avoid occasionally triggering a limit and say it takes 47 minutes for each of 100 scripted agents to cover their share of the Second Life Grid.

Does collecting data about each agent in a region slow the process any?  I would assume it does, but, as I have seen in previous demonstrations, not by much.

Is this collected data a marketable resource?  Seems likely.  Who owns this data?  Looks to me like 100% of it is owned by Linden Research, Inc.  That ToS is a beast.

If the scripted agent operator wishes to always know where a particular Second Life Resident's agent is on the Second Life Grid at any given time, and they have 100 scripted agents referring to a database and teleporting in search of this Resident, how quickly could they likely find them?  Assume stored observations are used to seed a search pattern to prioritize locations where this Resident has been previously observed.

 

[Myra Loveless]

I've been on SL for nearly 19 years. I rarely pop my head up anymore because of nonsense like what's going on in this thread... So rarely do I pop my head up that this is my first post since this particular version of the forums was created. It says I "joined" in 2010, but look up my profile on Second Life. You won't find me on BonnieBots.com because I rarely ever log in to Second Life anymore, and when I do it's generally sims that are group restricted. Not that I care.

You people are freaking out entirely too much over a network of land survey and census bots. The only non-anonymized information it's collecting is your profile which is already public.

Yes it's collecting the data about the attachments you wear, but it's only taking a census of the attachments, not going "so and so wears this or that attachment." So if you wear scripted diapers, your secret won't be exposed by the Bonnies. I'm using that as an example because I can't understand why anyone would be concerned about the knowledge that they wear a Maitreya avatar.

Oh no, a name popped up in the sim I'm in. Oh no, the same or similar name popped up again in the sim I'm in. If the Bonnie bots all used entirely different names you wouldn't even know they exist. Nefarious bots would not draw attention to their existence. They'd operate in the shadows using such a large variety of names that you'd never know the names occasionally popping up are associated with each other.

And nobody's being stalked by them. Seriously, if we change Bonnie Bot to Amazon delivery van and Sim to Neighborhood, would you take someone seriously if they were saying Amazon delivery vans were stalking them because everywhere they go, there's a high chance of seeing one?

I get that you're unnerved. I get that you're panicking. These feelings are valid and understandable. They are however misapplied here.

One of two possibilities.

Either the person running them named them all the same because they're a troll and delight in seeing people panic over nothing, or the bots are named all the same in an effort to be transparent about who is popping up every once in a while in various sims. Given the fact that they have the webpage and it shows useful information like popular sims, abandoned land you can claim, and it provides a better way of searching profiles than Linden Lab provides, I'd say transparency is the answer here.

Go to the Bonnie webpage's profile search. Don't search for a name. Search for a concept. Search for "role play" search for "motorcycle" etc. Now do that with the Linden Lab search. Now stop panicing over someone trying to improve Second Life by providing features Linden Lab refuses to provide themselves.

As for llGetObjectDetails being "terrible"... Why? Oh no, someone can use a script to tell that you have subscribed to Second Life. Wow, what are they going to do with THAT information?

Remember how I said I've been on Second Life for almost 19 years? I paid $10 for my account. See that name there? It says Myra Loveless? Yeah, I paid $10 for that. How much money did you pay to join Second Life?

Why does this matter? Because I remember when accounts went totally free. The number of griefers skyrocketed because it became free to get a totally new account after being banned. Or just to make a throw away account to grief someone with. A griefer who's serious about it would even create a large number accounts and let them age so that the low age wouldn't set off anybody's alarm bells.

So, Linden Lab implemented that feature in llGetObjectDetails. That way you could tell who has invested real world money into Second Life. That makes the individual less likely to be willing to just throw their account away to grief someone. That's why llGetObjectDetails has that feature, so security orbs and whatnot can be set up to restrict land to people who have a vested interest in not getting banned, or notify a region's staff of people who don't.

Edited January 18, 2023 by Myra Loveless

[Myra Loveless]

Quote

Is this collected data a marketable resource?  Seems likely.

No, actually, it's not. There's no targeted advertising services in SL at all. None. There's also no way to tie the information gathered to data gathered about you by targeted advertising services outside of SL, at least not if you don't go and put your email address in your profile.

I get that data collection is generally done for marketing, but... seriously, someone wearing leutka teeth in second life... Oooh, wow, what now? Does that mean Google now knows that. um. what? That you bought a Leutka head, took it off, but forgot to remove the teeth? How is that marketable? Seriously, I find that bit of the bonnie bots webpage to be the most interesting. It's downright hilarious even. That's what I infer from it, that more people who buy a Leutka head stop wearing it and forget to remove every part of it.

 

Quote

Of course now you'll say that an avatar isn't as such a protected personal identificato

If you don't want your avatar's data being transmitted to anyone, don't log in. The only way anyone can see your avatar in Second Life is if it's transmitted to other avatars. You aren't a Linden, you don't get to lurk and be invisible.

At this point I'm imagining people getting upset that when they talk to someone on the phone, their voice is reproduced on the other person's phone without permission... That's how silly the "my avatar attachments are protected personal information" argument actually is.

 

Quote

If the scripted agent operator wishes to always know where a particular Second Life Resident's agent is on the Second Life Grid at any given time, and they have 100 scripted agents referring to a database and teleporting in search of this Resident, how quickly could they likely find them?  Assume stored observations are used to seed a search pattern to prioritize locations where this Resident has been previously observed.

Any time a Bonnie is spent trying to locate a specific person instead of surveying the grid is time not spent surveying the grid. Seems to me that targeted stalking is therefore counter productive to the project's apparent goals.

Anything more frequent than the 47 minutes you've calculated could be due to optimization: frequenting more populous sims more frequently, and less populous sims less frequently.

Reading all of this is really quite tiresome.

I get it though...

If you hear a rustling in the bush, and assume it's just the wind when it was really a tiger, you've made a deadly mistake. But if you assume it's a tiger when it's really the wind, it's just an embarrassing mistake. Yet assuming it's a tiger and it's really a tiger, well that gives you a better chance of escaping alive.

So yeah, I get it... your risk assessment instincts are doing exactly what they evolved to do and misidentifying the wind as a tiger.

Edited January 18, 2023 by Myra Loveless

[Solar Legion]

You get what you give out. There is no "argument" being made and your own words earlier contain conjecture of your own concerning the purpose and scope of the data that was collected.

Now you wish to try and claim otherwise - I am not surprised.

I am quite used to such from some.

I am also quite used to some trying to pretend I am "defending" something when I am quite clearly, not. I have little tolerance for what I have seen and reacted to - the use of conjecture as fact.

Simply put: You do not know whatsoever what else may or may not have been collected. At all. You do not know what - if anything - has been done with what has been collected outside of what has been presented. You have made assumptions on all of this. All of it.

Do pardon me for being more than bit *****ly on such - it is quite the red flag to me.

[Myra Loveless]

28 minutes ago, Solar Legion said:

Simply put: You do not know whatsoever what else may or may not have been collected. At all. You do not know what - if anything - has been done with what has been collected outside of what has been presented. You have made assumptions on all of this. All of it.

Oh, yeah, they're totally listening in on your conversations and compiling a list of everybody who wears an open collar so they can black mail people by exposing their kinky SL relationships to their employers. Yeah totally.

Oh wait, they don't stick around long enough to record conversations? There's no way to programmatically connect your avatar to your real world identity? Also, only sticking around on a sim for 20 seconds before disappearing is completely consistent with only gathering the data shown on the webpage?

Well, they're still totally nefarious, because... because... oh look, someone left some cookies on the counter. Oh wait, they have raisins in them. Yuck.

Edited January 18, 2023 by Myra Loveless

[CarlaWetter]

30 minutes ago, Myra Loveless said:

f you don't want your avatar's data being transmitted to anyone, don't log in. The only way anyone can see your avatar in Second Life is if it's transmitted to other avatars.

Dead horse, I know but as you quote me personally, here it's again spelled out: I don't object to the avatar data being available as such, I object to the large scale data collection. Candlelight is different from burning down a barn, even if you may be able to light both up with just the same little matchbox. And I'm quite fed up with all those blanket 'arguments' that if you don't like it, don't log in.

Now some people have chosen for their own personal reasons to not show up in the LL avatar search. Those 'survey bots' can't even know about this for technical reasons, so their avatar search defaults to just make the gathered data available anyway. And not only in the rather meagre way LL search works but with a nice keyword search on top. I actually think such a system isn't altogether that bad, it might perhaps really help to connect people with common interests. But I can't really know why someone choses to not be shown in search and it's not on me to judge the legitimacy of that choice. Neither is that something these data collectors should ignore.

Obviously they can change their ways. So they stopped visiting the region where I happen to live, which would be a remarkable coincidence if it had nothing at all to do with this thread. Seems that someone decided to add a kind of opt out mechanism as it was suggested earlier here. Or may be not, that's not been communicated. So they do change their ways, may be. Well, now there's another thing to think of, a way to honour peoples wish to not be searchable. Not for me personally, I've always been searchable and show my online status to the world as well. For the very simple reason that it's the right thing to do for an operation that calls us to "be excellent to another".

TL;DR: Not everything that technically possible and looks somewhat clever and fun on top is ethically advisable.