• All submissions to this site are governed by Second Life Project Contribution Agreement. By submitting patches and other information using this site, you acknowledge that you have read, understood, and agreed to those terms.
Issue Details (XML | Word | Printable)

Key: SVC-3514
Type: New Feature New Feature
Status: Open Open
Priority: Normal Normal
Assignee: Unassigned
Reporter: darling brody
Votes: 34
Watchers: 5
Operations

If you were logged in you would be able to see more operations.
2. Second Life Service - SVC

llLoadUrl (and other LLMessageBox-generating functions) should be per-agent throttled, not delayed

Created: 11/Dec/08 07:50 AM   Updated: 19/Sep/09 05:47 PM
Return to search
Component/s: Scripts
Affects Version/s: 1.25 Server, 1.26 Server
Fix Version/s: None

Issue Links:
Duplicate
 
Relates

Last Triaged: 10/Jun/09 08:22 AM
Linden Lab Issue ID: DEV-33710


 Description  « Hide
Changed topic, was: llLoadURL(llGetOwner(),....) should not delay the script. – Soft

FACTS:-

Functions like llLoadURL and llEmail have a very long delay after them that was added to prevent spamming.

Other functions like llInstantMessage have had a throttle added to them to prevent spamming.

PROBLEM:-

The delay after functions like llLoadURL and llEmail are imposed on the script even if they script only calls them once!
This forces scripters to add slave scripts to call these functions, resulting in higher server memeory usage.

Throttles like those found in llInstantMessage drop information without the script knowing, even when that information is being sent to the script's owner.

Scripts created before the implementation of the throttles and delays suffer from undesiable behaviour, while scripts created after are using memory hungry slaves scripts.

Throttles result in data lose and broken behaviour, while delays result in memory being used on slave scripts that lag regions.

SOLUTION:-

A delay is unnessisary when the function is used once or with a reasonably long space between calls.

Both throttles and delays have their good a bad points. I propose we take the best of both and apply them uniformly to all affected functions that currently have delays or throttles imposed on them.

1) All functions currently with a delay will be switched to a throttle.
2) All throttles will impose a delay on the script instead of igoring the function call.
3) Exception to the rule is that anything sent to the owner is not counted by the throttle.
ie. llInstantMessage(llGetOwner(),"Throttles and delays sux when used on yourself");

EXAMPLE:-

llEmail can be called once every 20 seconds without triggering the throttle and without any delay. If it is called faster than once every 20 seconds it will be delayed the remainder of the 20 seconds to enforce once every 20 seconds.

llLoadURL can be called once ever xx seconds without triggering the throttle and without any delay. If it is called faster than once every xx seconds it will be delayed the remainder of the xx seconds to enforce once every xx seconds.

llSetPos can be called once every 0.2 of a second without triggering the throttle and without any delay. If it is called faster than once every 0.2 of a second it will be delayed the remainder of the 0.2 of a second to enforce once every 0.2 of a second.

llInstantMessage can be called once ever xx seconds without triggering the throttle and without any delay. If it is called faster than once every xx seconds it will be delayed the remainder of the xx seconds to enforce once every xx seconds.

llHTTPRequest can be called 25 times ever 20 seconds without triggering the throttle and without any delay. If it is called faster than 25 times in 20 seconds it will be delayed the remainder of the xx seconds to enforce 25 times in 20 seconds.

CONCLUSION;-

Looking at these examples it would appear the well behaved scripts can run without delay, while spammy scripts will be delayed just as they were before, while functions that previously throttled and droped information will still get the information there at a slower rate.

I think this has some serious advantages for things like llHTTPRequest where a lost request can result in all kinds of troubles for vending machines.

Chat relays and long diagnostic data dumps that could have previously lost information due to the throttle on llInstantMessage will still get it to you at a slower rate.

Best of all this kind of throttle/delay combination can be added to new functions without having to worry about breaking content as even the badly writen scripts will still get there job done, just at the slower more acceptable rate.

Spamming as a griefer tool will be broken when the throttle kicks in and applys the delay. Some griefer tools already send data below the existing throttles which is why we have the MUTE button. ... but that is an issue for the other linked JIRA issues that deal with the viewer's MUTE abilities. So lets not get bogged down in that here.



 All   Comments   Change History      Sort Order: Ascending order - Click to sort in descending order
automatic borkotron added a comment - 11/Dec/08 10:30 PM
Universally delaying it is such an amateur hack to the code.
Duh.

darling brody added a comment - 08/Apr/09 02:25 AM - edited
@Alexa Linden

Thank you for taking an interest in this JIRA.

I don't agree that it is a new feature.

The fix for URL spam did not intend to delay scripts giving URLs to the avatar wearing the script. (ie. owner). The fix for the URL spam intended to block one person from overloading someone else with URL spam.

As the delay to the owner of the script was not required for the anti-spam fix, and breaks previously documented behaviour, I say this is a bug resulting from the fix applied to block URL spam.

I have not returned this JIRA to a bug status, however I encorage you to do so.

I hope it gets fixed soon. I use URLs for popping up help pages and the delay is very anoying!

Once again, thank you for looking at this JIRA.

Darling Brody


Tomarus Lednev added a comment - 05/May/09 12:33 PM
I would clearly classify this as a bug. The whole llLoadURL delay should not only take in account it's owner, but also the object key imho. Why in the whole virtual universe should my scripts have to delay 5 seconds when sending one single url? This is not an anti-griefing, or anti spam effect. This is a bug in the anti-grief and anti-spam identification process, because a single llLoadURL invocation should not trigger such an anti-grief or anti-spam process at all. Please look at this.

Harleen Gretzky added a comment - 10/May/09 09:48 PM
If this is removed for the owner, wouldn't those wanting to use this for griefing just include it in a freebie object, so the victim would be the owner?

darling brody added a comment - 11/May/09 01:25 AM

Right now, without needing any permissions at all, an attached object can delete all the objects on your land, totaly mess up all your land heights too, launch a self replicating attack over all the neighbours regions that continues to stread to the regions next to them, and attacks everyone in the current region and all the neighbouring ones, and.. and..and... they are just the things i am comfetable talking about in public.... don't want to give people ideas! End result, the person who put on that object will be banned if you didnt quickly file an AR against the perosn who gave them the object.

Now to talk abotu this function only....

If you put on an object that spammed you, you will take it off and report the person who gave it to you. This is not the same as an object owned by someone else that you cant stop.

Make it nice and simple. If object is attached to the avatar it is giving the dialog to, it will not sleep afterwards. Then you dont have to worry abotu a gag object rezzing a second object to send the spam.


Harleen Gretzky added a comment - 11/May/09 05:54 AM
Yes, but without a delay, could not the said freebie possibly overload your viewer and crash you before you are able to remove or delete (if rezzed) it, as in VWR-3561?

Tomarus Lednev added a comment - 11/May/09 06:11 AM
It's not really a question of with or without delay. It's a question on when those delays are occuring and now long they are. A delay after X dialogs in Y seconds targeted at user Z is perfectly valid. But a 5 second script delay after every single popup is rediculous. Also, if there are client problems occuring, as talked about in VWR-3561 then that specific effect is a client issue, not a server issue. I don't think sending 60 popups in 2 seconds will have very high network impact.

Harleen Gretzky added a comment - 11/May/09 06:35 AM
I agree I would much rather have throttles and get rid of the delays and I have voted for this JIRA. I do not know what fix was put in for VWR-3561 for llLoadURL that is talked about, if it is a throttle then there is already no issue. And the llLoadURL delay is 10 seconds, has been since it was implemented in version 1.6 of the viewer.

Soft Linden added a comment - 11/May/09 12:19 PM
Throttles are tough to code around for things that legitimately send URLs to multiple people - silently failing or even halting is bad. Removing the delay for just the owner would make it tougher to test objects that are meant to be used by multiple other avatars. Perhaps it should only delay when used multiple times in quick succession.

Alexa Linden added a comment - 11/May/09 01:28 PM
Moved to Feature Request as decided in Triage.

darling brody added a comment - 11/May/09 03:18 PM - edited
@ Soft & Alexa Linden

Anything that lets us send a URL to the owner without delaying the script would be great.

If the delay is 10 seconds then why not a throttle of 6 per minute? That would retain the same max speed without delaying the script.

One of the ways people work around these built in delays is by using extra scripts, which only adds to current problems of memory use on the servers running the regions.

Functions like llLoadURL and llEmail with these huge delays are often compensated for by having 10-20 slave scripts. Clearly sleeping a script is not effective and leads to workarounds that waste the regions resources.

Do you think the overhead in throtteling will have a big impact when you take into account the benefits of being able to remove all the slave scripts running that people currently use?

There are probably a lot of products that could save memory in the servers if their sleeps were converted to throttles. NonPhysicalVehicle scripts come to mind, where 16-24 scripts are used to overcome a 0.2 sleep after a llSetPos/llSetRot.

Food for thought....

Darlign Brody


Adeon Writer added a comment - 10/Jun/09 08:46 AM
Linking two related issues "Muting resident does not stop their dialogs" and "busy mode does not stop dialogs" those two problems in combination with the current uncapped nature make it pretty abusable.

darling brody added a comment - 10/Jun/09 11:45 PM - edited
Adeon Writer, thank you for linking. Keep in mind those other topics are about blocking spam, and this one is about fixing the older broken methods that were created to block spam.

Newer methods to block spam use thottles, while a lot of the older script functions have a delay built in as an anti spam protection. This jira is about fixing the old ones so they still block spam, but dont delay scripts, resulting it people making memory hungry multi script solutions.

Soft Linden's change to the jira description is a good idea. Any function that currently has a delay after sending information should replace the delay with a throttle. BUT there is a problem.....

Current scripts expect the data to get through even if delayed, not be dropped like a throttle does. So how about a hi-breed. when the throttle level is reached, the delay is implemented after each call. This way all information is sent for legacy scripts, while not imposing a delay on well behaved scripts.

The effect will be that all scripts will run as if they dotn have a delay, and if they shoudl send too much information, they will behave as they previously did with the delay.

This will not stop multi script spammers, but this jira is not abotu multi scritp spammers, it is about making the functions work properly and lowing the memory being used in workarounds that involce slave scripts.

Multi script spammers will die with the memory and cpu limitations being implemented this year, and the viewer's better mute abilities will take care of anything else.

IMPORTANT :
llEmail is an exception. It sends information to the live internet and needs to be handled differently. Dropping Email's using a throttle would be devistating to inter region communications! llEmail is a very good candidate for the throttle that turns on the delay. ie. more than one email being sent within 20 seconds will force a delay after the email. However sending only one email will have no delay. This model would work well with all other delay based functiosn too.

EDIT:

I have altered the description of this jira to reflect Soft Linden's idea, and to combine it with one of my own which i think will better sever all situations where we currently have throttles and delays.


Adeon Writer added a comment - 24/Jun/09 07:44 AM - edited
If the throttle is per-agent, do you mean per-sender or per-recipient? Would this be universally respected by all scripts regardless of owner (except for his own), or just that specific owner?

For example, user Joe Avatar is currently getting way too many dialogs at once from a few different sources, all new dialogs from all scripts from all objects from the sender will be delayed until he falls under the throttle?


darling brody added a comment - 24/Jun/09 08:56 AM
per receiver.

Spamming only works if you hit the same receiver person lots of times. therefore a per-receiver-person throttle will stop spamming while still letting scripts fire off non-repeated urls without delay.


Adeon Writer added a comment - 24/Jun/09 11:14 PM - edited
But the limit , while on the receiver, would limit according to the sender, not the URL, which a script could easily randomize. (So that every dialog is a different URL)

Sorry if I'm stating the obvious, here, just clarifying how it would work.


darling brody added a comment - 25/Jun/09 10:27 AM
I think you do not understant.

The throttle should be on the UUID of the person getting the dialog box. So that Darling Brody can only send 1 dialog box every xx seconds to Adeon Writer before the throttle kicks in. But Darling Brody could send one dialog box to 10 different people without a throttle.

So this lets a script send 1 dialog to someone without any delay, but if they script decided to send mroe than one dialog to the same person it will have to send them slowly or else it wille be blocked.

When i say dialog i mean llLoadURL, not menu dialog boxes which should never be blocked or else menu systems will all break.


Adeon Writer added a comment - 26/Jun/09 07:57 PM - edited
There is defiantly legitimate reason to throttle llDialog. One would assume a dialog would only count towards a throttle though, if another is sent when the agent did not respond to the first. So long as a agent is actively responding to their dialogs there would be no reason to throttle it, and every response could zero the throttle. That way dialog spam would still be blocked since in spam the dialogs are not responded to.

I can't think of any use-case scenario where a script would need to send many dialogs to one user at the same time before they had a chance to respond to any of them, so I don't think it would break any currently well-intended menu systems.

That said, a limit of say, 5 unresponded dialogs in one minute would be an effective limit, or in the ballpark thereof, and once hit works like grey goo: They can't send any more until they fall under the limit, further attempts not working but still counting against the throttle.

One could even go further that user interaction (I touch the object, I might want a menu) could reset the throttle as well. The point here being things you don't interact with shouldn't be able to send you countless dialogs/loadurl's, unless you are responding to them or directly interacting with said object. If you are doing neither, then they should be limited to a strict per-agent throttle.


Phantom Ninetails added a comment - 18/Jul/09 04:50 AM
LL sure gave us a kick in the face on this one. I'm seeing a delay at least 1 second long on EVERY call to llDialog. Even the first call. To myself. From my own objects.

darling brody added a comment - 18/Jul/09 03:08 PM
Yes Phantom, that is because some moron yelled GRIEFER in another jira entry and nobody who scripts using dialogs noticed the jira to point out that the bad-old-dialogs are being used by people to make real products.

now we go into the endless rounds of yelling at LL to make the function usefull for people who are doing the right thing.

And yes. those morons who are yelling griefer dont manke anything, sell anything, or even have a paid membership most of the time.


Fred Rookstown added a comment - 12/Aug/09 11:58 AM
Still getting this issue on server 1.27.2. Can't log in since someone is spamming me from outside of the sim, which SHOULD NOT BE HAPPENING. llDialogs should only work if they are sent from the same sim you are in. I'm receiving them so fast that the circuit times out and I have to relog. The viewer I am running (Emerald-based) has a built-in throttle, but I still get knocked offline.

This must be fixed. I am furious it has not been fixed since 2007, when this bug originally reared its head.


Adeon Writer added a comment - 13/Aug/09 10:52 AM
Fred, do you still have the problem on the current Main or Snowglobe? Problems with Emerald or other third party viewers can't be taken into account here.

Fred Rookstown added a comment - 13/Aug/09 11:37 AM
Adeon: Yes. In fact, it's worse, as I cannot block the dialogs and eventually crash to desktop.

Ezian Ecksol added a comment - 14/Aug/09 02:37 AM - edited
Adeon, sure all people running the normal LL viewer or Snowglobe without any protection are subject of llDialog or llTextBox crashers.

The best solution I had was the Gemini viewer which was able to just block all llDialog dialogs completly when pushed a hotkey. Unfortunetly that viewer did also block dialogs sent by own objects.

Maybe LL should consider not only to throttle dialog spam not only server sided but client sided, too. But therefore they would have to send the sender key with all dialog types. There are some dialogs like llMapDestination that don't even carry the sender's key, so a client cannot decide if this dialog has to be blocked or not. (It's clear that I want all dialog types send by my own objects to be spawned without any delay).


Adeon Writer added a comment - 25/Aug/09 09:43 AM
Throttling it on the client isn't going to do much, the people doing these attacks use custom viewers that don't enforce client-side limitations.

darling brody added a comment - 25/Aug/09 04:23 PM
"Throttling it on the client isn't going to do much, the people doing these attacks use custom viewers that don't enforce client-side limitations. "

It will if it is the victims viewer that is imposing a throttle on incomming packets =)


Ezian Ecksol added a comment - 26/Aug/09 03:13 AM - edited
Adeon, the idea is not to throttle the attacker's viewer. We don't know which viewer the griefer is using, so how we could throttle it?

The idea is to throttle the victim's viewer (as Darling already said). The 3rd party viiewer "Gemini" had this already. "Emerald" has only a weak throttle, that can be easily overrun by dialog crashers. At this point we need the LL engineers to implement a really working throttle.

I don't think throttling is the right idea. Give the viewer an option to block ALL dialogs (except that one's send by own uuid and can be identified).


Adeon Writer added a comment - 26/Aug/09 01:50 PM - edited
My mistake. I was thinking "throttling sending" not "throttling receiving"
Hey hey! Do it do it do it.

And for gosh sakes give my objects the right to spam myself as much as I wish.


Ezian Ecksol added a comment - 19/Sep/09 07:23 AM - edited
Till about 4 hours dialog crashers in Sandbox Newcomb and Sandbox Goguen. That are trojans, means, the original griefer gave some noobs an object named e.g. "1000L$ for free" or similar. So the owner's of the dialog attacks are multiple people, but they are abused by the original griefer.

The viewer slows down so much I even cannot abuse report that.

It's time to do something: Please implement a simple complete dialog blocker that can be toggled on/off by a key combination. Skills Hak had it already in her Gemini viewer. A very efficient solution.