Open letter to Linden Lab: Enforcing policies?

[Ceka Cianci]

1 minute ago, Love Zhaoying said:

Didn't Casper say earlier that those sales figures are not accurate? I trust his statement.

I don't know how they could be without looking at the transaction history.. from what I seen in one of the other threads it sounds like it's just refreshing the screen on whats selling now.. That is on the homepage I believe where that shows up. you don't need to log in for that.

[Love Zhaoying]

3 minutes ago, Phil Deakins said:

They don't have a policy on bots gaming traffic. They have a policy on gaming traffic by whatever means, and another policy on bots though

 

I started to give you a "laugh" reaction, but was afraid you'd interpret it as a "scorn laugh"!

[Coffee Pancake]

This is absolutely a privacy issue at heart.

Even if, and I this is not my position at all, even if, profiles in SL were always 100% public domain. 

There as always been the expectation that they weren't.

Failure to enforce is now a breach of trust.

 

LL have been saying loudly for years that they don't sell our data. The implication being they see they value we place in our data and resect that.

To allow wholesale scraping, they are in fact saying "we don't give a rats" about your data, or you, and maybe the only reason we made a point of saying we don't sell it is because we think it (and by extension you) is actually worthless.

 

Just so were clear, when sites like facebook sell your data. They aren't selling just your name and phone number. They are selling everything else - the personally identifiable stuff tends to get stripped out by data brokers because it's junk. If a company wants your phone number there used to be a book for that.

Edited January 24, 2023 by Coffee Pancake

[Innula Zenovka]

46 minutes ago, Maitimo said:

That script is only "public" due to an exploit.

What's the exploit?   

LL recently added the flag OBJECT_ACCOUNT_LEVEL to llGetObjectDetails   and published this fact in the Wiki, along with a description of what it does.   It's of particular use, I think, to the LDPW Moles, who have to maintain vendors to give out Premium Gifts, and premium tokens for the Winter Wonderland.  Hitherto they've been able to do only by placing them on Premium sandboxes, but now they can place the  vendor anywhere and test for membership level when someone tries to use it.

I don't really really see why anyone else needs it other than to create drama, but it took me less than five minutes to write a simple script that scans for all the agents on a region every 5 seconds and lists them in hovertext, along with the Account Level (none, Premium or Premium Plus -- it doesn't seem to have heard of simple Plus yet).  

I thought of posting it here, but decided against it since I don't want to upset people, but I really don't see what "exploit" is supposed to be involved in using a regular LSL function to do exactly what it's supposed to -- return information on people's payment level.     

 

[Rowan Amore]

10 minutes ago, Phil Deakins said:

They don't have a policy on bots gaming traffic. They have a policy on gaming traffic by whatever means, and another policy on bots though

 

Well, this is on the bot page...

Forbidden usage

According to Linden Lab Terms of Service usage of scripted agents is forbidden for:

increasing the parcel traffic by camping ("gaming" traffic);

And this is on the bot policy page...

Bots per se, are allowed and have legitimate uses, but inappropriate uses are violations of this policy.

Therefore:

Using bots to "game" traffic is not allowed

You may not attempt to gain an unfair advantage in search results through the use of bots to inflate the traffic for a parcel. This policy applies to both mainland and private estates since both are represented in search.

Edited January 24, 2023 by Rowan Amore

[Ceka Cianci]

4 minutes ago, Coffee Pancake said:

This is absolutely a privacy issue at heart.

Even if, and I this is not my position at all, even if, profiles in SL were always 100% public domain. 

There as always been the expectation that they weren't.

Failure to enforce is now a breach of trust.

 

LL have been saying loudly for years that they don't sell our data. The implication being they see they value we place in our data and resect that.

To allow wholesale scraping, they are in fact saying "we don't give a rats" about your data, or you, and maybe the only reason we made a point of saying we don't sell it is because we think it (and by extension you) is actually worthless.

 

Just so were clean, when sites like facebook sell you data. They aren't selling just your name and phone number. They are selling everything else - the personally identifiable stuff tends to get stripped out by data brokers because it's junk. If a company wants your phone number there used to be a book for that.

I seen a post from @Maitimo in another thread, where they said they went to the site and the profiles are not there now..

I went to look for mine and it said something like No response or no information or something.. So they aren't up anymore.. Maybe they are changing them to have less information on them or they are gone off there for good..

Either way, from what it looks like, they heard people and are adjusting from the looks of it now.

Edited January 24, 2023 by Ceka Cianci

[Phil Deakins]

7 minutes ago, Love Zhaoying said:

I started to give you a "laugh" reaction, but was afraid you'd interpret it as a "scorn laugh"!

I don't think I would, but you never know lol.

[Phil Deakins]

7 minutes ago, Coffee Pancake said:

they are in fact saying "we don't give a rats" about your data, or you,

Nothing new there, then.

[Love Zhaoying]

7 minutes ago, Coffee Pancake said:

Just so were clear, when sites like facebook sell your data. They aren't selling just your name and phone number. They are selling everything else - the personally identifiable stuff tends to get stripped out by data brokers because it's junk. If a company wants your phone number there used to be a book for that.

I assume you are not suggesting that LL is selling our data..

[Arielle Popstar]

Just now, Love Zhaoying said:

I assume you are not suggesting that LL is selling our data..

Maybe not but they are instituting tools whereby it can be scraped, collated and then sold by others.

[Sid Nagy]

24 minutes ago, Istelathis said:

Making people feel more secure in SL is almost a given, if people start feeling too paranoid to even log into SL, that is going to be a problem.  Now that the ball is rolling, and people are expressing a concern for their privacy, LL is going to need to address this and fairly soon.

100% that, and rightfully so IMHO.

[Coffee Pancake]

6 minutes ago, Ceka Cianci said:

Either way, from what it looks like, they heard people and are adjusting from the looks of it now.

B could just have screwed up and broken the page accidentally or temporarily to avoid criticism.

At this point I want a clear statement from @Linden Lab @Alexa Lindenand ideally, stated policy covering data scraping inside SL. What's considered public information and what isn't, and should that include profiles some warning be placed in the viewer on the 1st life tab to inform people.

 

[belindacarson]

2 minutes ago, Coffee Pancake said:

B could just have screwed up and broken the page accidentally or temporarily to avoid criticism.

At this point I want a clear statement from @Linden Lab @Alexa Lindenand ideally, stated policy covering data scraping inside SL. What's considered public information and what isn't, and should that include profiles some warning be placed in the viewer on the 1st life tab to inform people.

 

Keira, Volo, and Tommy already answered this over what's public.

[Coffee Pancake]

8 minutes ago, Love Zhaoying said:

I assume you are not suggesting that LL is selling our data..

They have been unequivocal that they aren't and don't and won't.

But that's meaningless if they just don't actually care and anyone can just come harvest it with a minimum amount of effort.

At that point I would rather they were selling it and using the income to offset region fees!

Just now, belindacarson said:

Keira, Volo, and Tommy already answered this over what's public.

In this matter thread locked posts are insufficient and do not constitute a clear clarification of policy.

[Love Zhaoying]

15 minutes ago, Coffee Pancake said:

At this point I want a clear statement from @Linden Lab @Alexa Lindenand ideally, stated policy covering data scraping inside SL. What's considered public information and what isn't, and should that include profiles some warning be placed in the viewer on the 1st life tab to inform people.

I will be surprised based on previous statements if we are told anything.

[EliseAnne85]

The Privacy Policy itself is way too long.  They need to condense their Privacy Policy way down, imo.  It's poorly written, it's ridiculous.  

[Theresa Tennyson]

1 hour ago, TimKoul said:

Needing to use a script just to see that information doesn't make it "public", just means it's accessible to those who know how to get it. If it's so public as claimed, but there's no option to display it anywhere, it's not public but instead hidden.

I looked up my RL name in some "people search" sites. They have a lot of information about me. Most of it's pretty accurate. It's also public information, apparently, if you know where to find it.

However, my RL full name is somewhat unusual, and I know quite a bit about myself when you come right down to it. I noticed a couple of things - I've somehow acquired a doppelganger who shares some of my correct information but is apparently a different age, and some of the information in my profile is apparently wrong. I didn't actually pay for the report, mind you, and that's the whole reason these sites exist. I wouldn't be at all surprised for them to intentionally inject incorrect information on the public-facing free report to inspire people to think, "Wow, that's wrong! What's going on? I better buy this junk..."

I've also looked for my RL Sworn Enemy online in similar sites and was apparently able to find information on them. However, I also know a fair amount about my Sworn Enemy so I can filter out the noise. Without that I'd have very little assurance that I even had the right person, and also have no guarantee that the information I don't already know is accurate.

Other people I've looked for without as much information? Honestly, got no clue about if I've found them or not.

There's a lot of information out there about you; there's also a lot of information out there about everyone else. Realistically, a few free-floating information points are basically meaningless.

 

 

 

 

[Qie Niangao]

I just have a hard time taking any of this SL stuff as a "privacy" matter. It's like worrying that people can see the leader board at the video arcade. Anybody who used their RL social insurance number and date of birth to register their scores kinda had it coming.

Maybe it's in the Lab's interest to cater to folks who want to role play "privacy" with SL data, and if there's a real business case for that, fine.

Personally, though, I'd much prefer the Lab spend the money making sure my RL credit card and personal data is kept safe, rather than how much some lame page-scraper thinks I make on Marketplace.

And if anybody here claims a privacy concern and hasn't yet switched over completely to 2FA, what are you even thinking?

[Ceka Cianci]

41 minutes ago, Coffee Pancake said:

B could just have screwed up and broken the page accidentally or temporarily to avoid criticism.

At this point I want a clear statement from @Linden Lab @Alexa Lindenand ideally, stated policy covering data scraping inside SL. What's considered public information and what isn't, and should that include profiles some warning be placed in the viewer on the 1st life tab to inform people.

 

I guess we'll find out soon enough. hehehe

[Love Zhaoying]

9 minutes ago, Qie Niangao said:

I just have a hard time taking any of this SL stuff as a "privacy" matter. It's like worrying that people can see the leader board at the video arcade. Anybody who used their RL social insurance number and date of birth to register their scores kinda had it coming.

Maybe it's in the Lab's interest to cater to folks who want to role play "privacy" with SL data, and if there's a real business case for that, fine.

Personally, though, I'd much prefer the Lab spend the money making sure my RL credit card and personal data is kept safe, rather than how much some lame page-scraper thinks I make on Marketplace.

And if anybody here claims a privacy concern and hasn't yet switched over completely to 2FA, what are you even thinking?

Here in the US at least, in my own IT organization, PII usually means stuff like your address, Credit Card number, Social Security number, etc. Not things like "this user is Premium". So..while possibly not "ethical" maybe it's not something most IT firms would "scrub".

[Coffee Pancake]

3 minutes ago, Qie Niangao said:

I just have a hard time taking any of this SL stuff as a "privacy" matter.

The value in your personal data is not your name, your phone number or credit card.

It's the incidental details. Where you go, you interests and associations, purchases and participations. 

But not in isolation. 

Knowing about all of us .. well that is valuable. That's the kind of rich data set that has been literally keeping the internet's lights on since the start. Associate the SL dataset with a dataset from a more RL focus source and that is suddenly very exciting, even if the association is wrong or only demographically correct. That's the kind of dataset that's used to determine things that impact lives.

Data privacy is one of the huge differences between US and EU law. That difference only exists because of intense corporate lobbying.

[Sid Nagy]

33 minutes ago, Qie Niangao said:

I just have a hard time taking any of this SL stuff as a "privacy" matter. It's like worrying that people can see the leader board at the video arcade. Anybody who used their RL social insurance number and date of birth to register their scores kinda had it coming.

Maybe it's in the Lab's interest to cater to folks who want to role play "privacy" with SL data, and if there's a real business case for that, fine.

Personally, though, I'd much prefer the Lab spend the money making sure my RL credit card and personal data is kept safe, rather than how much some lame page-scraper thinks I make on Marketplace.

And if anybody here claims a privacy concern and hasn't yet switched over completely to 2FA, what are you even thinking?

Example of abuse of "public" data:
My first bot collects how many sims landbaron A has.
The second bot collects the percentage of land occupied on their sims.
My backbone computer software calculates how much cash is going trough the Landbaron A account on a daily, weekly, monthly, yearly basis.

Same goes with harvesting the "what is selling at the moment" data on the marketplace.

As a peanut merchant I don't care if the world finds out that I make just enough on the marketplace to have a 4096 parcel for free and to buy some stuff at the happy weekend sales, but if I were a merchant or land baron making serious money with second life, I would not be dancing the happy dance if that information was spread around. 2FA or not.

Edited January 24, 2023 by Sid Nagy

[Innula Zenovka]

2 minutes ago, Sid Nagy said:

Example of abuse of "public" data:
My first bot collects how many sims landbaron A has.
The second bot collects the percentage of land occupied.
My backbone computer software calculates how much cash is going trough the Landbaron A account on a daily, weekly, monthly, yearly basis.

Same goes with harvesting the what is selling at the moment data on the marketplace.

As a peanut merchant I don't care if the world finds out that I make just enough on the marketplace to have a 4096 parcel for free and buy some stuff at the 50 L$ happy weekend sales, but if I were a merchant making serious money with second life, I would not be dancing the happy dance if that information was spread around. 2FA or not.

How do your bots know what rent people are paying for the parcels?     I'm not saying it couldn't be done, assuming you know where the rent boxes are, and have access to them but it wouldn't be trivial by any means.

[Sid Nagy]

10 minutes ago, Innula Zenovka said:

How do your bots know what rent people are paying for the parcels?     I'm not saying it couldn't be done, assuming you know where the rent boxes are, and have access to them but it wouldn't be trivial by any means.

Simple answer (I'm no script- or software engineer): rent doesn't fluctuate that much. Have peek personally at one of land barons A's free lots or on their website and you know enough about where to calculate with. You may be 2 or 3% off in the total calculation, but that is close enough to get a realistic estimate, I guess.

And it happens. See Count Burks replies in one of the closed threads.

Edited January 24, 2023 by Sid Nagy

[Coffee Pancake]

3 minutes ago, Innula Zenovka said:

How do your bots know what rent people are paying for the parcels?     I'm not saying it couldn't be done, assuming you know where the rent boxes are, and have access to them but it wouldn't be trivial by any means.

Getting the rent price via a bot would be easy - the bot just requests the pay dialog.