Open letter to Linden Lab: Enforcing policies?

[Love Zhaoying]

4 minutes ago, Coffee Pancake said:

Getting the rent price via a bot would be easy - the bot just requests the pay dialog.

So, you suppose the bots (some of them at least) are literally "scraping" information from Windows dialogs, such as is done with tools like "uiPath"? Wow!

("Wow, that's interesting!". Not "Wow, I disagree".)

[Istelathis]

23 minutes ago, Qie Niangao said:

I just have a hard time taking any of this SL stuff as a "privacy" matter. It's like worrying that people can see the leader board at the video arcade. Anybody who used their RL social insurance number and date of birth to register their scores kinda had it coming.

At some point, I imagine you will not need to even provide your personal information to link every post you have made on the web.  But that is neither here or there, it is just a dystopian future where the source of all of your posts can be easily traced just by your style of writing.  At which point, even the anonymity of 4chan will not protect others, and a lot of people are going to be left with a lot of 'splaining to do.

 

 

In a volatile world, where the rules are ever changing, and technology advances at an ever increasing rate, it creates uncertainty which almost certainly makes a lot of people feel more anxious.  Even in one where AI is not sorting through the web, looking for matches to your writing style and creating a personalized profile of you.  People are starting to place a higher emphasis on their privacy.

What matters, is that people feel secure in SL.  If they want more privacy, and feel violated due to bots stripping their profile feeds and using it in any number of ways, it doesn't really matter what you or I think, it matters how they react to it.  If it is enough to make them feel uncomfortable to be in SL then that has an impact on SL and LL should try to make people feel more safe to participate in their platform, rather than give bots more tools that make them feel uncomfortable.  

[Theresa Tennyson]

58 minutes ago, Sid Nagy said:

Example of abuse of "public" data:
My first bot collects how many sims landbaron A has.
The second bot collects the percentage of land occupied on their sims.
My backbone computer software calculates how much cash is going trough the Landbaron A account on a daily, weekly, monthly, yearly basis.

Same goes with harvesting the "what is selling at the moment" data on the marketplace.

As a peanut merchant I don't care if the world finds out that I make just enough on the marketplace to have a 4096 parcel for free and to buy some stuff at the happy weekend sales, but if I were a merchant or land baron making serious money with second life, I would not be dancing the happy dance if that information was spread around. 2FA or not.

Some of those who would actually be affected would seem to disagree with you:

https://money.cnn.com/blogs/legalpad/2006/11/anshe-chung-first-virtual-millionaire.html

[Silent Mistwalker]

7 hours ago, Maitimo said:

In any case it appears to be moot now anyway, since the Bs website has taken all the avatar profiles down.

Thank you for saying this. 

And also thank you to the owner for taking it down. All I've ever really asked for is a little understanding and compassion.

[EliseAnne85]

1 hour ago, Istelathis said:

In a volatile world, where the rules are ever changing, and technology advances at an ever increasing rate, it creates uncertainty which almost certainly makes a lot of people feel more anxious.  Even in one where AI is not sorting through the web, looking for matches to your writing style and creating a personalized profile of you.  People are starting to place a higher emphasis on their privacy.

The Privacy Policy for Second Life and to give another example, Facebook, are something akin to "roll up for The Magical Mystery Tour".  The writing style is stone age and it's, frankly, just poorly written.

I searched 'how to write a good privacy policy' and found that an interesting search and read.  Twitter apparently has a privacy policy that is easy to understand.  Gaining people's confidence can start with writing privacy policies that just simply spell it out.  Writing in modern style is considered the best way to go.   See part of Twitter's Privacy Policy and how it's written below.  

2. How We Use Information

Breaking down how we use the information we collect is not simple because of the way the systems that bring our services to you work. For example, the same piece of information may be used differently for different purposes to ultimately deliver a single service. We think it’s most useful to describe the five main ways we use information and if you have questions that are not answered, you can always contact us. Here we go:

Expand dropdowns for more information:

Edited January 24, 2023 by EliseAnne85

[Sid Nagy]

17 minutes ago, Theresa Tennyson said:

Some of those who would actually be affected would seem to disagree with you:

https://money.cnn.com/blogs/legalpad/2006/11/anshe-chung-first-virtual-millionaire.html

Of course there is a huge difference between self chosen publicity and seeing your financial whereabouts published on the Internet without being asked if you agree with that.

[Silent Mistwalker]

5 hours ago, Chaser Zaks said:

ever try Googling your real name?

In my state alone there are at least 4 people with my name, both first and last names. There's a celeb in England that has my name, both first and last names. There are lots of people in the US with my name, both first and last names. Which one is me? 😁

[Stephanie Misfit]

4 minutes ago, Silent Mistwalker said:

In my state alone there are at least 4 people with my name, both first and last names. There's a celeb in England that has my name, both first and last names. There are lots of people in the US with my name, both first and last names. Which one is me? 😁

I am the only person in the world with my first and last name, as far as I can tell. I have to be very careful with my online presence because it is obvious that it is me. Stores want me to leave a review for something I just bought online from them? No chance.

[Love Zhaoying]

4 minutes ago, Stephanie Misfit said:

I am the only person in the world with my first and last name, as far as I can tell. I have to be very careful with my online presence because it is obvious that it is me. Stores want me to leave a review for something I just bought online from them? No chance.

I googled me, and first hit was me, second hit was my dad. Interesting.

[Prokofy Neva]

2 hours ago, Scylla Rhiadra said:

The theory floated by @Prokofy Neva (and I can't think of a better) is that they are scooping the data from the recent purchases feature on the MP. In which case it is obviously very incomplete.

It is "public" in the sense that someone with the know-how can scrape it. It would be like someone watching how much I am charged every time I go grocery shopping by looking at the register over my shoulder, and then publishing my weekly grocery expenses without my permission. The individual bits of data are "public," but . . .

The "What Customers are Buying" window on the MP typically has 8 items. When you refresh the page, it has a new set of items. But I can't believe that you get "real time purchases" from that window, even if you have G/M/A checked off (a lot of it is NSFW). I think the stream of purchases would have to move faster than the human eye (which is 360 frames per minute or whatever), and even given the figures we see on the top merchants' list, this can't be even accurate for total MP sales.

Still, given the history of this data, and the way it used to be published and then got removed, it's interesting. It comes at a price.

So it's one source of info but I wonder if the Casper Vendor data, now in the Lindens' hands, would be a more accurate one -- and of course that would include inworld purchases as well as MP -- not everyone buys on the MP. It wouldn't capture purchases made at events, many but not all of which are on Casper. 

I personally make my own "consumer basket" (LOL) when I tot up my books at the end of the month. Land is a big expense, and I don't often get it -- I was forced to "buy the view" near existing properties -- I usually only buy abandoned.

It's interesting to me always how you say "oh, it's only a weekend sale and I'm only spending 60L" but it sure adds up. I would start a separate thread just on this economics issue but since they're being closed, meh. So I'm distinguishing what I'm buying at events, versus what I am buying in a merchant's store versus on the MP. This one actually isn't complete as I'm too lazy to work it now but you get the idea. 

Edited January 24, 2023 by Prokofy Neva

[Sid Nagy]

Please, not 10,023 reaction posts about the outcome of googling your RL name.
If we go off topic so that LL can close this thread, please with something of importance or really funny to read.
Thanks.

Edited January 24, 2023 by Sid Nagy

[Silent Mistwalker]

5 hours ago, Innula Zenovka said:

As a scripter, I would disagree with this.

Both LSL scripts and the SL viewer are able to exchange information with the simulator and SL's servers, and to send various instructions to the simulator and servers.   Some things you can do either by script or with the viewer, some things you can do only with scripts, and some things you can do only with the viewer.

Bots are a way of automating tasks that cannot be performed by LSL scripts on their own. 

For example, while an LSL script can easily collect data about all the avatars on a region, it can't make the object containing the script teleport rapidly teleport from region to region, collecting data about all of them as it goes.      Similarly, while a script can detect when someone enters a parcel and can send them an IM inviting them to click a link to join a group, it can't directly send them a group invitation --- for that you need either someone behind the keyboard, or a bot.   Nor can a script can't monitor group chat and try to moderate it in the way a bot can.

So I would say completely the opposite  -- the point about bots is that they can do things that scripts can't do, at least not on their own.

I would expect scripters to disagree. I'm not the one that defined bots as scripted agents. We all know what a scripted object is, but how is agent defined? Is it restricted to just avatars or is it also applied to objects? 

In AW the Xelagot bots could terraform whole regions without anyone being inworld or online. It was not an account. It was a scripted agent that followed a set of instructions, the same as Tyche's bots. The set of instructions is the script or at least, contained within the script. Yes, the bots had to be logged in but they were not user accounts.

http://www.imatowns.com/xelagot/index.html

[Love Zhaoying]

4 minutes ago, Prokofy Neva said:

The "What Customers are Buying" window on the MP typically has 8 items. When you refresh the page, it has a new set of items. But I can't believe that you get "real time purchases" from that window, even if you have G/M/A checked off (a lot of it is NSFW).

So it's one source of info but I wonder if the Casper Vendor data, now in the Lindens' hands, would be a more accurate one -- and of course that would include inworld purchases as well as MP -- not everyone buys on the MP. It wouldn't capture purchases made at events, many but not all of which are on Casper. 

I personally make my own "consumer basket" (LOL) when I tot up my books at the end of the month. Land is a big expense, and I don't often get it -- I was forced to "buy the view" near existing properties -- I usually only buy abandoned.

It's interesting to me always how you say "oh, it's only a weekend sale and I'm only spending 60L" but it sure adds up. I would start a separate thread just on this economics issue but since they're being closed, meh. So I'm distinguishing what I'm buying at events, versus what I am buying in a merchant's store versus on the MP. This one actually isn't complete as I'm too lazy to work it now but you get the idea. 

Thanks for supporting the Art Community!

[Prokofy Neva]

Just now, Love Zhaoying said:

Thanks for supporting the Art Community!

I hate clothes. My entire budget got thrown off wildly by buying one skin that I don't even have the head for, to make it work and argggh. Art is always good for rental units and my home.

[Love Zhaoying]

I'm seeing a trend of posts in this thread about, "but what does XXX MEAN?".

So, I posit a theory: It is difficult to hold LL to account, for enforcing polices whose meaning are either not understood, or whose meaning are in dispute.

Those wiggly words!

[Theresa Tennyson]

28 minutes ago, Sid Nagy said:

Of course there is a huge difference between self chosen publicity and seeing your financial whereabouts published on the Internet without being asked if you agree with that.

If you're taking in enough Lindens to attract outside attention you shouldn't really keep all your funds in a single account you go to the beach with. You'd be better off using specialized business and banking accounts. Maybe even (wait for it...) bots.

15 minutes ago, Silent Mistwalker said:

I would expect scripters to disagree. I'm not the one that defined bots as scripted agents. We all know what a scripted object is, but how is agent defined? Is it restricted to just avatars or is it also applied to objects? 

I'm not sure but I think all agents in Second Life are user accounts. I don't think the servers really have a way of telling if any given account is run by a human or a Nefarious Bot. That's why "scripted agent" is a flag that has to be set manually.

[Sid Nagy]

11 minutes ago, Love Zhaoying said:

I'm seeing a trend of posts in this thread about, "but what does XXX MEAN?".

So, I posit a theory: It is difficult to hold LL to account, for enforcing polices whose meaning are either not understood, or whose meaning are in dispute.

Those wiggly words!

The enforcement doesn't have to be perfect, but it should not be neglected because it is difficult to define things IMHO.
A best effort will do.

[Sid Nagy]

26 minutes ago, Theresa Tennyson said:

If you're taking in enough Lindens to attract outside attention you shouldn't really keep all your funds in a single account you go to the beach with. You'd be better off using specialized business and banking accounts. Maybe even (wait for it...) bots.

I'm not sure but I think all agents in Second Life are user accounts. I don't think the servers really have a way of telling if any given account is run by a human or a Nefarious Bot. That's why "scripted agent" is a flag that has to be set manually.

Bottom line is, I think that most people who live their Second Live want to live it as uncomplicated as possible, without tiptoeing around, because some script and programming fans try to squeeze out the platform until go no more, just to prove that it is possible or to game it all in their advantage.

And the keys to achieve this lie in the hands of Linden Lab and not in ours. So I and others are asking Linden Lab to rethink/overthink their strategy about the bots that are used for the wrong purposes, meaning not to improve the platform, but to be counter productive, like gaming the systems, land bots, excessive data gathering just because it is possible and publish it (maybe even sell it off to others).

This thread is by no means started to stop the use of all bots, as far as I'm concerned.

Edited January 24, 2023 by Sid Nagy

[Silent Mistwalker]

3 hours ago, Theresa Tennyson said:

Is a telephone number in a phone book "public" or "hidden"? After all, you need to open the book to find it.

Only public numbers were listed in the phonebook. Private numbers weren't listed. 😋

[Paul Hexem]

3 hours ago, Coffee Pancake said:

the only reason we made a point of saying we don't sell it is because we think it (and by extension you) is actually worthless.

That's it right there. That's why they don't sell it.

They absolutely would if the data were worth anything.

[Andred Darwin]

After reading all posts, it's hard for me to see where LL is not following it's policies, the only way to hide info from your profile from SL or public is by setting the options at my.secondlife.com under Settings, Privacy to "Friends"... that would prevent a bot (or anyone) from reading your profile unless they are in your friends list, so if you have it set to SL or Everyone, nothing much could be done.

My 2 cents, and biggest concern about bots, is the amount of resources they are using to scrape all that data... almost 28k regions, several bots visiting them a few times a day, easily in the 6 digits as a number of teleports (not counting “cap” requests), and now, that new one (BBts) scraping the marketplace every x milliseconds, all to display misleading data, that only LL would be able to provide in a way that actually matters...

That can almost be called as a DOS attack. (Denial of Service, overloading systems until they crash...)

We have all noticed the past few weeks systems going down or with temporary issues, how much of that would be caused by crazy bots overloading the system.... the worst would be LL increase prices due to bots usage!

Another 2 cents to reduce issues with bots:

•   Remove the price of the sale from the marketplace front page, and redirect links from products at the front page through an IP filter with max number of requests per hour/minute, making any attempt to scrape it useless.
•   Add abandoned land list/search to the new land store, available to anyone.
•   Add user land for sale list/search to the new land store, also available to anyone.
•   Restrict the use of bots/viewers by max User IP/Region Server to a number that would make sense.
•   Remove traffic from search algorithms completely, keeping its usage for display purposes (Destinations Guide and areas being promoted at login screen.)

[Coffee Pancake]

6 minutes ago, Andred Darwin said:

After reading all posts, it's hard for me to see where LL is not following it's policies, the only way to hide info from your profile from SL or public is by setting the options at my.secondlife.com under Settings, Privacy to "Friends"... that would prevent a bot (or anyone) from reading your profile unless they are in your friends list, so if you have it set to SL or Everyone, nothing much could be done.

Except .. that doesn't do anything and doesn't prevent a bot from scraping it.

Mine was friends only and was still indexed and displayed in full on the B site.

[Andred Darwin]

6 minutes ago, Coffee Pancake said:

Except .. that doesn't do anything and doesn't prevent a bot from scraping it.

Mine was friends only and was still indexed and displayed in full on the B site.

Well... in this case, if yours was set to Friends only... shame on LL, the system is not working as designed. (Friends only has to mean Friends only! Do you know if there is a Jira for it already? )

Edited January 24, 2023 by Andred Darwin

[Ceka Cianci]

24 minutes ago, Andred Darwin said:

After reading all posts, it's hard for me to see where LL is not following it's policies, the only way to hide info from your profile from SL or public is by setting the options at my.secondlife.com under Settings, Privacy to "Friends"... that would prevent a bot (or anyone) from reading your profile unless they are in your friends list, so if you have it set to SL or Everyone, nothing much could be done.

The bots aren't getting the info from the web profiles, they get it from in world Legacy profiles.

ETA: I mean I guess they could  from the in world browser since they are logged in at the time, if bots can even use those..

 

Edited January 24, 2023 by Ceka Cianci

[Solar Legion]

10 minutes ago, Andred Darwin said:

Well... in this case (your profile was set to Friends only), anyone have to agree with you... if yours was set to Friends only... shame on LL, the system is not working as designed. (Friends only has to mean Friends only! Do you know if there is a Jira for it already? )

 

1 minute ago, Ceka Cianci said:

The bots aren't getting the info from the web profiles, they get it from in world Legacy profiles.

 

They get it from Profiles - period. The Web Profiles are being phased out (even the most recent LL Official Viewer no longer uses them - at least not as a default).

Those Web Profile settings are meaningless and have been since their inception.