LL needs to implement a way to detect bots via script - urgently

[Sid Nagy]

Wut? I was just to the point, that's all.

[Scylla Rhiadra]

7 hours ago, Love Zhaoying said:

Next, they'll make "Impersonating a Bot / Bot company rep" against TOS.

I exchanged IMs last night and this morning with the spokesperson for said bot collective, and they tell me that they've identified between 10 and 15 "impersonators," whom they've ARed. Apparently LL has done nothing however.

I get that this is a fuzzy case in some ways, as the "impersonation" is not of an individual per se, but the profiles I've seen are absolutely clear intents to deceive. And this kind of thing is not merely abusive, but also sure to increase hostility to and unnecessary paranoia about bots. LL really needs to move on this.

[Love Zhaoying]

41 minutes ago, Scylla Rhiadra said:

I exchanged IMs last night and this morning with the spokesperson for said bot collective, and they tell me that they've identified between 10 and 15 "impersonators," whom they've ARed. Apparently LL has done nothing however.

I get that this is a fuzzy case in some ways, as the "impersonation" is not of an individual per se, but the profiles I've seen are absolutely clear intents to deceive. And this kind of thing is not merely abusive, but also sure to increase hostility to and unnecessary paranoia about bots. LL really needs to move on this.

How is this different than other cases where it is residents pretending to be others (using display names), and/or defaming others? Doesn't LL generally see those as "Resident-to-Resident Disputes"?

[Paul Hexem]

On 3/15/2023 at 12:30 PM, Scylla Rhiadra said:

I am reviving this topic briefly because there is some (good) news of which many may be unaware: LL is actively testing a new estate tool that would allow estate owners to restrict the access of scripted agents.

This was briefly referenced in Lab Gab (and in our discussions about that), but it's not unimportant that this actually seems to be happening, and will (hopefully) be implemented soonish.

You can check out what Inara says here.

Thanks as always to @Inara Pey and @panterapolnocy for their much-valued work in keeping us up-to-date!

Of course, my immediate thought is that the bad actors are just not going to mark their bots as bots anymore.

And for people like me with extra accounts I use to test things with, that I marked as bots just to be sure I was compliant of the rules, they'll be banned from places they don't need to be, which will make me want to remove their bot status.

Really wish LL would focus on the actual rule about marking bots as bots before they start making more rules and functions that depend on it.

[Scylla Rhiadra]

8 minutes ago, Love Zhaoying said:

How is this different than other cases where it is residents pretending to be others (using display names), and/or defaming others? Doesn't LL generally see those as "Resident-to-Resident Disputes"?

I think that is how LL probably does view it.

The implications and effects here are different, though, because it's not merely an individual but an entire operation that is being "defamed." A closer analogy in that regard would be someone opening a store that spoofs an existing and established one, and that deliberately defrauds customers in order to smear its target.

It's also different in that wariness about bot operations generally, and this collective in particular is, right at this moment, pretty high across the grid. If an individual is pretending to be another individual, that fraud is likely to impact only a relatively small community. What these imposters are doing can potentially have more far reaching effects.

One of the points of the new estate tool being implemented is, I'm sure, to address the anti-bot sentiment by giving at least some people a means of addressing bots, and giving them some sense of control over the situation. This kind of thing is undercutting that effort.

Edited March 19, 2023 by Scylla Rhiadra

[Love Zhaoying]

3 minutes ago, Scylla Rhiadra said:

The implications and effects here are different, though, because it's not merely an individual but an entire operation that is being "defamed."

But, why is that necessarily "worse"? If so, priorities are definitely backwards. It's literally like the slippery slope of, "Corporations are People" - then all of a sudden they have protections that non-Corporations do not have. 
 

 

6 minutes ago, Scylla Rhiadra said:

A closer analogy in that regard would be someone opening a store that spoofs an existing and established one, and that deliberately defrauds customers in order to smear its target.

..my previous response applies even more. The individual's rights are more important.

[Love Zhaoying]

8 minutes ago, Scylla Rhiadra said:

This kind of thing is undercutting that effort.

On this point, I agree. Interesting that some people can be "fooled" who are familiar with the issues. 

[Scylla Rhiadra]

Just now, Love Zhaoying said:

But, why is that necessarily "worse"? If so, priorities are definitely backwards. It's literally like the slippery slope of, "Corporations are People" - then all of a sudden they have protections that non-Corporations do not have. 
 

 

..my previous response applies even more. The individual's rights are more important.

I don't disagree in general. I'm not especially interested in doing PR work for bot operations myself.

But the effects of spoofing an operation rather than an individual are much more widespread: they impact upon more people, and that impact is more profound because it concerns how people view scripted agents in general, which is a not unimportant kind of function within SL. No one would think of producing a new estate tool to deal with MrImposter.Resident who is harassing an individual or small community. That they are producing a tool to better govern the behaviours of scripted agents shows that LL recognizes that these play a valuable role across all SL.

[Love Zhaoying]

2 minutes ago, Scylla Rhiadra said:

I don't disagree in general. I'm not especially interested in doing PR work for bot operations myself.

But the effects of spoofing an operation rather than an individual are much more widespread: they impact upon more people, and that impact is more profound because it concerns how people view scripted agents in general, which is a not unimportant kind of function within SL. No one would think of producing a new estate tool to deal with MrImposter.Resident who is harassing an individual or small community. That they are producing a tool to better govern the behaviours of scripted agents shows that LL recognizes that these play a valuable role across all SL.

Traitor!! Umm..I mean, thank you for supporting the long-term success of Second Life, and in so doing, helping us all.

[Scylla Rhiadra]

11 minutes ago, Love Zhaoying said:

Traitor!!

Well, I'm not actually anti-bot. I'm not even really "anti" the one particular collective that's been causing so much stir. Bots have entirely legitimate uses across the grid. Being against bots would be analogous to opposing the media player in our viewers merely because it was being exploited and misused by RedZone.

What I am "anti" is the irresponsible and nonconsensual collection and/or publication of personal data. Collecting anonymized data on the number of avatars in a region? Well, sure. Attaching account names to those avatars? Not so much.

An unfortunate corollary of the estate tool being developed, and of other proposals such as an LSL function to detect scripted agents is that it is going to impact upon other legitimate uses of bots. It's definitely hammering in a nail with a sledgehammer. But, in the absence of a more active and engaged governance team that might have the time and resources to investigate individual cases, this "solution," as lacking in nuance and granularity as it is, is probably the best we can hope for.

[Scylla Rhiadra]

46 minutes ago, Paul Hexem said:

Of course, my immediate thought is that the bad actors are just not going to mark their bots as bots anymore.

That's an issue and a possibility -- although it reminds me a bit of the "outlaw guns, and only outlaws will have guns" argument. One point, though, is that a bot that is unregistered can be ARed if it is doing the work of a bot, whereas a registered one cannot.

47 minutes ago, Paul Hexem said:

Really wish LL would focus on the actual rule about marking bots as bots before they start making more rules and functions that depend on it.

Agreed; see my point above the lack of resources and time available to LL governance.

This should be something that is developed hand-in-hand with new restrictions on registered scripted agents: harsher penalties for those who are circumventing the rules, and, if at all possible, some means of detecting unregistered bots on the basis of their behaviour and/or use of scripts.

[Love Zhaoying]

12 minutes ago, Scylla Rhiadra said:

Well, I'm not actually anti-bot. I'm not even really "anti" the one particular collective that's been causing so much stir. Bots have entirely legitimate uses across the grid. Being against bots would be analogous to opposing the media player in our viewers merely because it was being exploited and misused by RedZone.

What I am "anti" is the irresponsible and nonconsensual collection and/or publication of personal data. Collecting anonymized data on the number of avatars in a region? Well, sure. Attaching account names to those avatars? Not so much.

An unfortunate corollary of the estate tool being developed, and of other proposals such as an LSL function to detect scripted agents is that it is going to impact upon other legitimate uses of bots. It's definitely hammering in a nail with a sledgehammer. But, in the absence of a more active and engaged governance team that might have the time and resources to investigate individual cases, this "solution," as lacking in nuance and granularity as it is, is probably the best we can hope for.

Understood. Any legitimate tool in can be misused. Like weapons. 

[Scylla Rhiadra]

6 minutes ago, Love Zhaoying said:

Like weapons.

😏

[Love Zhaoying]

4 minutes ago, Scylla Rhiadra said:

😏

Nope, just making a point! Guess it hit home! 

[Love Zhaoying]

I should point out, that "scripted agents" are supposed to be..registered.

[Orwar]

2 hours ago, Love Zhaoying said:

Understood. Any legitimate tool in can be misused. Like weapons. 

   Don't need a handgun to end a life - a hammer, which's legitimate use is unquestionable, will suffice.

   .. Or so I've heard, anyway. 

[Love Zhaoying]

19 minutes ago, Orwar said:

   Don't need a handgun to end a life - a hammer, which's legitimate use is unquestionable, will suffice.

   .. Or so I've heard, anyway. 

Exactly! A legitimate tool, can be misused - like a weapon! Not sure why someone would think I meant something else. Go figure!

[Rick Nightingale]

Cue Gold Five: "Stay on target!"

No that's not a reference to weapons FTGPZS!

Well, it sort of is. We have a weapon here... I don't mean a script function or an estate management checkbox. I mean the momentum of the whole thing. When I started this, with a limited idea (although a genuinely useful one that we should have) it was to, let's say, encourage action in a way that we could get behind without falling foul of the rules. Just in case that wasn't obvious from the start

It's great that there is now movement to add estate level controls to our tool bag (it needs whitelist capability too). Parcel level controls would be better, and hopefully something that will come with time if we keep it in the sights. And of course the script function to easily differentiate a bot from a 'human' (or whatever sentient (or not, I guess, it is SL) species one is today). Just for my own simple experience scripting on my land that will be useful to save resources.

It's not perfect. It's not a solution in itself and is open to abuse. That though is LL's department to deal with, if/when it happens that unregistered bots or even fauxbots proliferate. I'm sure such things have been are are being considered now, along with how residents feel about it all (well, I am in an optimistic mood aren't I?). If LL needs a bladerunner, I'm available for hire for a nominal fee that includes noodles.

Whatever... it's a start. It means someone out there is listening and acting on it. That was the whole point.

Edit: That's the sort of waffly post I make after a full bottle of red and need a break from UV mapping in Blender.

Edited March 19, 2023 by Rick Nightingale

[EliseAnne85]

On 3/19/2023 at 11:48 AM, Scylla Rhiadra said:

But the effects of spoofing an operation rather than an individual are much more widespread: they impact upon more people, and that impact is more profound because it concerns how people view scripted agents in general

I haven't caught up to the whole thread yet...(and what I'm about to say is off topic - so just read and ignore, basically). 

Regarding bots and spoofing in real life, I was astonished this morning filling out a government rebate form on the internet today and was absolutely frightened that it had me check I AM NOT A BOT twice.  I couldn't hardly believe it.  If bots get into that real life government rebate, it's hugely problematic for a whole country.  It was scary.  There has to be a way people can think of to identify bots as a whole, whether rl or sl. 

It upset me greatly thinking bots could steal from a government agency, and I just wanted to share this info. And, so I'll take a deep breath y'all and try to stay calm, of course, but with many bot situations it's just not okay.  We better get this "bot" thing together and under control.  Perhaps it needs to be law that all bots are registered or something...?  

Edited March 20, 2023 by EliseAnne85

[Innula Zenovka]

1 hour ago, EliseAnne85 said:

I haven't caught up to the whole thread yet...(and what I'm about to say is off topic - so just read and ignore, basically). 

Regarding bots and spoofing in real life, I was astonished this morning filling out a government rebate form on the internet today and was absolutely frightened that it had me check I AM NOT A BOT twice.  I couldn't hardly believe it.  If bots get into that real life government rebate, it's hugely problematic for a whole country.  It was scary.  There has to be a way people can think of to identify bots as a whole, whether rl or sl. 

It upset me greatly thinking bots could steal from a government agency, and I just wanted to share this info. And, so I'll take a deep breath y'all and try to stay calm, of course, but with many bot situations it's just not okay.  We better get this "bot" thing together and under control.  Perhaps it needs to be law that all bots are registered or something...?  

I suspect the government website's anti-bot checks may have been there to prevent DDOS attacks rather than fraud.

[Love Zhaoying]

10 minutes ago, Innula Zenovka said:

I suspect the government website's anti-bot checks may have been there to prevent DDOS attacks rather than fraud.

Saw a news item that an AI bot was able to hire a human to defeat bot detectors / captchas for it (as a challenge / task the AI was given), without the human knowing.

[EliseAnne85]

39 minutes ago, Innula Zenovka said:

I suspect the government website's anti-bot checks may have been there to prevent DDOS attacks rather than fraud.

It was the first time I've ever been asked to check I AM NOT A BOT twice.  The asking wasn't done one right after the other.  The second time was a bit into filling out the form.  It just made me wonder why asking once isn't sufficient.   However, I don't visit too many .gov sites. If I have been asked twice before to check that box, I don't recall it.

[Innula Zenovka]

2 minutes ago, EliseAnne85 said:

It was the first time I've ever been asked to check I AM NOT A BOT twice.  The asking wasn't done one right after the other.  The second time was a bit into filling out the form.  It just made me wonder why asking once isn't sufficient.   However, I don't visit too many .gov sites. If I have been asked twice before to check that box, I don't recall it.

As I understand it, there are two distinct types of "I am not a bot" checkbox.   One type works because it's invisible to bots (don't ask me how) and the other because it is visible, but it detects bots because they check it immediately the page loads, while humans take a moment or two to read it and check it.   So maybe the website was taking a belt-and-braces approach, on the assumption that bots might be able to detect one or the other type of captcha but not both?

[Love Zhaoying]

13 hours ago, EliseAnne85 said:

it had me check I AM NOT A BOT twice

Congratulations! You're not a bot!

[Rick Nightingale]

I've just noticed that the wiki page for llGetAgentInfo now has Agent_Automated as a parameter. It's in red... not sure what that means and I don't have a bot handy to point the function at to see if it works. Even if it's not active yet, it clearly is going to be now.