• All submissions to this site are governed by Second Life Project Contribution Agreement. By submitting patches and other information using this site, you acknowledge that you have read, understood, and agreed to those terms.
Issue Details (XML | Word | Printable)

Key: VWR-3313
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Major Major
Assignee: Unassigned
Reporter: Siro Mfume
Votes: 1
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
1. Second Life Viewer - VWR

Need Permissions on the viewer for various permissions

Created: 19/Nov/07 06:50 AM   Updated: 28/Mar/08 06:25 PM
Return to search
Component/s: Permissions, Scripting, User Interface
Affects Version/s: None
Fix Version/s: None

Issue Links:
Relates


 Description  « Hide
The current fix proposed and internally implemented fix in VWR-2502 will not fully address the problem. The current grief scripts that request permissions do so constantly. Throttling them or limiting them won't entirely prevent the script from achieving its goals. Users will still have as many permission requests as the throttled script can spit out from as many different sources as the griefer can muster. It should be possible to completely or partially deny permissions of the various types at the viewer level on an individual basis by causing them to silently fail (not even displayed to the user).

Effectively, there needs to be at least 3 levels of permissions for requesting permission.

1. Full ability to receive permission requests at the throttled level of VWR-2502. Effectively the same behavior after throttling becomes a reality in the main grid.
2. Silent auto-denial of any request not coming from a 'friend' or something to that effect (if possible).
3. Silent auto-denial of any permission request not coming from yourself. Thus it would still be possible to spam yourself with objects you own.

I'd be fairly happy with 1 and 3, as they should require little modification to implement as either a checked item on a menu or a slider or checkbox somewhere in the preferences, or even as an external file. I imagine 2 will require a little more filtering/discrimination, but I anticipate people requesting it.

Alternatively, the behavior of permissions could be changed such that if a pending request is open, all subsequent requests from the same owner fail silently. If the request is denied, further requests will be automatically denied unless there is a minimum time (at least 10 seconds, possibly more) inbetween requests. If the request is granted, there won't be a delay against subsequent requests by that owner.

This alternative solution wouldn't require adding a preference setting. Nor would it unnecessarily throttle requests that a user might want. And it would accomplish the goal of preventing permission request spam.



 All   Comments   Change History      Sort Order: Ascending order - Click to sort in descending order
Gigs Taggart added a comment - 28/Mar/08 06:25 PM
I'm going to tentatively resolve this fixed, it seems that between muting and throttling, these sorts of attacks are non-existent these days. I don't see a need to put anymore countermeasures in.