|
|
|
[
Permlink
| « Hide
]
Nadine Nozaki added a comment - 18/Feb/08 07:04 AM
Undo of the UUID hiding, security by obscurity solution
Recommend the Lindens close this one and be done with it.
If you want to steal intellectual property then your going to have to use GLIntercept and upload the texture resulting in a legal breadcrumb trail back to your computer since using GLIntercept will have violated the Secondlife TOS resulting in punitive actions up to and not excluding permanent removal of your account. I won't close it because I object to people closing the jira entries of others. This issue isn't about stealing textures, there are as noted many good ways to do that. Methods the don't leave a track, methods that don't show the original author as the author of the work. Getting the UUID makes it possible to keep the original author as author, as the texture UUID still has to be sent to the client, the client and anyone that likes to be evil ALWAYS have the possibility to get the UUID, and it have to be that way. Disabling the default client will only make people like Ann think they have any kind of protection from the client. Using any way of stealing it is as illegal and breaks the TOS. Why make the easiest way to prove the crime and get the offenders harder to use.
I recommend the linden to take responsibility, not hide there head ion the sand, please don't crapple the UI for a few panicking uses that don't know how vulnerable they are. If this continues, thank god there are responsible third party viewers. [Updated to clarify the issue]
Again no legitimate justification has been presented for reverting this logical step towards eliminating intellectual property theft. If you own the texture you still have access to the texture UUID so your argument remains invalid.
As for your declaration of secondlife belonging to an elite few "geeks" (as you put it) belies your lack of business acumen. Secondlife was not built by you nor does it exist solely for you. Again, if you are a legitimate creator in possession of legitimate textures created by you or licensed for use by you then you have the texture UUIDs. Therefore this jira entry is useless and unnecessary and is certainly justified in being closed. There are two legal and things that the change makes hard to do.
1) Verify that an other object is using your texture, not only something that looks really similar. Funk would had a much harder time proving he been ripped off with out this feature. 2) Working ton group objects make it really hard to change the texture back, unless you can read out the UUID of the texture. Maybe you should be able to get the UUID from all object you have modify on. Personally i would like to see a feature where you can easy copy the texture from one side of an object to the next, that you need to go over the UUID to get this working is actually stupid. Good points Nadine. Stating valid use cases is the correct way to argue in favor of a feature reversal as pointed out by Torely in the associated meta entry.
Point 1: If a creator files a valid DMCA complaint then Linden Labs can verify the texture UUID. If you have an issue with possible content theft then the correct procedure, at this time, is to file a DMCA. There is no other solution to content theft. The UUID may match and it may not match. Either way a DMCA complaint is the correct procedure. DMCA is all we have at this time. lobbying congress for better IP theft laws is the only way this will improve. I.e.; make it a misdemeanor or felony. As i recall there are provisions in the DMCA related to criminal intent. And there do appear to be cases of systematic IP theft in SL that LL should be referring to law enforcement for criminal investigation. But we will never know as LL does not release any DMCA related information. Point 2: Thats a great feature suggestion. Let us know when you enter the jira feature request. to apply textures from one prim face to other prim faces. No UUID would be required. Ann, on the first issue again.
To make an DMCA complaint you need to have quite good on your feets. You can't get anything done until you are starting a RL court process, you need to have hired your lawyers and if you are wrong YOU have to pay the others legal costs, as LL writes on the home page "Please note: The DMCA provides that you may be liable for damages (including costs and attorneys fees) if you falsely claim that an in-world item is infringing your copyrights. We recommend contacting an attorney if you are unsure whether an in-world object is protected by copyright laws." You are risking about $125,000 real life dollars, and you can't verify the UUID before, you have to put that at risk before you collect the evidence for the court process. I would also like for LL to make a much easier and simpler way to deal with copyright violations, making a DMCA court case in the US for an non US citizen is really really hard. That is real problem getting the UUID only solves problems. No, that's a pile of cack Nadine. LL is in California, that's why everyone in the world has to use DMCA. The same UUID is no guarantee that the texture is not stolen, since with full perms textures, like most are, they can be saved and reuploaded. LL can look at the textures anyway on receipt of a DMCA takedown. And it doesn't matter where in the world someone is, their stuff can still be removed by Linden.
So that actually removes your reason 1. As for group modding, yes, that's a possibility, but it has been suggested that such use is allowed, either by LL perms or copyright license. The arguments not to overturn this are far greater than to do so. What we really need is a total revamp of the perms system to stamp out this theft, plus hard action from LL instead of ignoring it. As for geeks, well, yes, there are some Lindens, and a handful of open sourcers fixing the bugs for free, but most of SL was developed by content creators, who have a legal right to have their work protected. Failure to implement proper systems in their software could make LL accessories, much like Napster. If people expect SL to be the next internet, it needs better protections and performance, or else it will remain as a niche game for the rich and geeky. You have to ask yourself why 23 out of every 24 people that have tried SL have left. I'm sure it's because of the performance issues that never get fixed, scams and frauds, copyright theft and expense, rather than lack of new shinies. Maybe LL should survey some of those who left and find out for sure. The other option is for governments to adopt what the UK is thinking of doing, and will be implemented globally if we don't get rid of this "rip off is okay" mentality: http://news.bbc.co.uk/2/hi/business/7240234.stm To be honest Montana, i can't understand your arguing at all. Before starting a legal process with lawyers across the world in a different legal system than my own I really like to have as solid profs as possible. That' it's much harder for a non US citizen to win in US court have been shown many times. Yes there are many forms of copyright violations that change the UUID. If my texture isn't full perm and the item used the same UUID that is prof that it's stolen, if i give out my texture to people the same UUID can hardly prove stealing something. This change does not protect content against this violations, it does not protect against the UUID version of taking the texture. If it aims to be he new internet I have to figure out how to live by the limitations that exists, not to fool people into stuff in forms of protections that can't exists actually exists. The new UK rules are stupid by many reasons, but that discussion definitely have nothing to to with the bug/feature requests. LL Can't make it impossible to steal textures, anything you can see can be copied, anything you can hear can be copied, it's a social problem technical barriers can't solve it the problem exists some ware else. What needed is an easy quick way to resolve the problems, perfectly with out going to RL court in the US. For me i rather take someone selling all my items that risking that. I encourage each and every person in favor of making it easier to steal content to come on in here and vote for it and express thinly vieled excuses and regurgitate the cory chants (cory is gone. history. poof).
We all really do want you to expose who you are. Texture theft and breach of copyright is not a 'legitimate feature'. People using GLintercept to rip textures should not have their lives made easier - they should be permabanned for theft.
No copyright breach is not a "legitimate feature", this functions however doesn't have anything with this to do, probably because there are some much better ways to steal the textures. Way that also work for the expensive textures as skins and clothes.
To combat and change this problem real solutions are needed, some way of quick and easy get a in sl, legal process, this however will need real involvement for the LL's. Put me down as a "no" vote for this one.
coco In regards to Secondlife, the concepts of "texture theft and breach of copyright" do not seem to be supported by much if any legal precedent, furthermore sections 3.2-3.4 of the TOS seem to outline just the opposite.
To paraphrase, Linden Labs reserves expressed rights to all uploaded data (environmental content) which is in turn made available to anyone with an active account to be used as in world content. A proprietary client running on secure protocols would allow enforcement of new copyright "legislation" (TOS amendments) as well as significantly enhance communication and information security. Although IMHO proprietarization is not inline with the current open source model and is well beyond the point and scope of this feature reinstatement request. ***** I believe removal of this feature was a "cutting off the nose to spite the face" solution and was not appropriate from a programmatic point of view (although it could have been far worse). "Piracy paranoia" does not justify loose obfuscation of the standardized UUID protocols which were set in place by the Open Software Foundation (OSF) as part of the Distributed Computing Environment (DCE). I understand the concerns and desire for a secure in-game economic structure with a tangible real world value, but the non-secure open-source technologies currently implemented in the Secondlife client were not designed as such. Plain and simple. Looking at the larger picture, attempting to use the current protocols in a secure manner by method of random innovation will only open the door to far more serious issues down the road. --------------------------------------------------------------------------------- If this version 1.19 was a forced upgrade, this change would have severely impacted my ability to build. I use this feature often; ON MY OWN OBJECTS. With version 1.19 I can't even do that (this isn't the only reason I am sticking with 1.18.5 and the 3rd party community though). Besides using it for my own objects though, I do sometimes use it for other peoples' objects, as I am a sandbox goer and it is nice to have a variety of "no selling" textures to choose from. Using the same no selling texture all the time would make it start to get boring and possibly even annoying.
I exclusively use UUIDs in code for setting images via scripts on my objects REGARDLESS of whether I have the image in my inventory (to put in the object for it to use) or not. It is very handy to be able to fetch the UUID straight from my object without having to go into my inventory (if I have the image there). You people would be seeing alot more of George Bush in the sandboxes if I didn't have a variety of textures to choose from. Just for the heck of it (well, for those poor souls who updated to 1.19), I am going to put the texture UUID used in the description of many of my textured objects. Blacklist me as a villainous texture pirate if you want, I don't care. It's not like I'm selling your textures. It's LL's plan to make 1.19 mandatory in about a months time to lower the versions needing support.
I do have to agree that this is not going to make any effective difference in texture stealing if people so choose. In fact, I wouldn't be surprised if this change accelerates the creation of a branch of the SL viewer that brings this capability back in, but perhaps in a more powerful manner. (Right click to save any texture anybody?)
I'm not encouraging the theft of textures, but it has to be understood and expected that some assets are vulnerable to theft and thus blocking one mechanism that is used for texture theft while leaving all others wide open is a total false sense of security. In addition, it's impact on legitimate building is certainly an issue. To test.. I took a texture I uploaded earlier today and tested this.. I'm now entirely unable to view the texture UUID from my own object of my own texture. Wonderful. Though I don't seek alternate clients, perhaps I need one that restores some of this artificially blocked information to streamline building? Agreed, hiding UUID info doesn't do anything useful.
Encrypted textures is the only way I see that may help here. One thing to keep in mind; That may reduce the number of thieves but it won't reduce the amount of thievery. Hopefully it will create a bottleneck that will make it easier to deal with them. The downside is of course that even if it works it will also make the remaining thieves wealthier so it is still a double-edged sword. Another agree to fix.
As has already been pointed out: there's a multitude of ways for people to content steal. This 'fix' by blocking the UUID on non-full permed textures achieves nothing except causing another roadblock for people that have legitimate uses for it. Get off your mighty high horse and stop smighting people that like this because not everyone in favor of this is a content thief. If the sole use of this function was content theft, why did Linden ever put it there in the first place?? MY needs for this? Another example of use: MY justification for my actions? What I do is make myself look good with other people's products, which is exactly why they sell them in the first place, regardless of 'permissions'. If people ask me for copies, I refuse them. I flat out tell people I refuse to give away or resell other people's work. I hand them the LM that came with the product or tell them to look up the creator's profile. I provide free advertising for these people, because people like my style and ask me for tips. Yes, returning the use of this will give thieves one of thier tools back. People, as is human nature, will find ways to make things work in a way that was not originally intended. Don't make those with legitimate uses for this suffer cause some jerks out there have the ethics of a roach. breathes i've watched people copybot my work. some are affiliated with people commenting here. no need for useless drama so i won't go into details.
my basic point is that i have given up on this issue concept. the new copybot makes everything moot. the solution will come from LL making forensic analysis queries accessible to creators and when evidence is provided the offending accounts are deleted forever. Overall though... LL does not care. Its all moot. @rhin.. yes folks i have given up. LL is unconcerned with IP theft. LL needs to be concerned with things like SL being unstable, basically down on sundays and mondays (apparently because there are no DBAs manually dealing with db logs), how the new search filters out NPIOF accounts, and the increasing problem of sellers accounts not being credited with money from sales. i bet someone at LL is scraping a hefty chunk of pizza and beer cash off sl. no means of auditing means no means to prove it isn't happening. @Ann
Thank you for understanding what I have been trying to say, the issue with stealing contents can only be solved in the "political", "psychological" way. One way would be to add the possibility for customers to verify what they pay for. In game if might be possible to add something like the identify menu to items in the "buy" menu, with full info on stuff like textures on the object. Giving the customer a possibility to verify who made the item. I tried to make an issue about this MISC-962. When i wrote that i didn't understand how bad the DMCA process today worked, reading about Sculptypaint, make one really angry. People who get only a little bit inside can still grab the texture key by using third party clients.
So it is no solution to close up the possibility in official second life viewer. LL should reopen that possibity so everyone is aware of this situation. Otherwise it's only security by obscurity. I qoute again this statement of Torley form the old jira which shows how senseless it is: Torley Linden - 14/Aug/07 07:03 AM Please DO NOT undo
LL needs to do WHATEVER it can - whether its very effective or not, to combat IP theft. It's really irrelevant if there are other ways to copy the IP. Shutting down one avenue helps. As for commenting about other people's drama regarding copybot and texture copying infringements, I suggest those that have contributed nothing (or close to nothing) to the greater good of SL (ie. those that haven't created any decent content) to shut up. Only when you have spend months creating really decent content and try make some returns on that, and see it sold elsewhere for nothing will you ever understand. So just go on about your businesses as achieving nothing, but at least having the ability to see good content created by hard-working users. AC Pfeffer. While you're at it, you might as well beg them to add DRM software to Second Life that clears our clipboards several times per second so we can't paste anything (and thus can't use a screenshot of your texture). And have the DRM keep watch and make sure people don't run any programs alongside Second Life so nothing can rip the textures. And ask them to switch to DirectX to prevent the use of GLIntercept (also preventing the use of Macs or Linux).
Heck, might as well have them also remove UUIDs altogether, sending the whole texture each and every time a side of the object is requested, which would also remove the usefulness of the client side cache because you're downloading the whole texture every time anyway. They might as well remove the cache altogether. Then, they should make the client closed source again and block access to all old clients and third party clients. Hey, while we're in the spirit of removing potential risks to our original content, we should get the ability to build new things removed! Yay! From now on we should only be allowed to edit existing objects. Or maybe not even that, that could be a risk too! You must be one of those people who think that using Javascript to stop right clicking on a web page will stop people from taking images from your web site. This is exactly the same thing; by removing this you are getting rid of an important piece of functionality for a gain that's not really a gain at all. (By the way, this is easy to work around, disabling Javascript in our browser or going through your html source code.) -.. I am a content creator. I upload images too. I do so fully knowing, and accepting the fact that people will take them. In fact, for my textures, I encourage it. It's just an image, and it is just 10 L$. If you want to talk about elitism... the removal of this information is elitist.
People who use third party clients aren't crippled in this way, clients like CoolSL don't remove this information. Anyone who is a programmer can trivially reverse this change in their own copy of the client in 5 minutes flat. Like gun laws, these stupid measure punish the legitimate users, while the criminals aren't hindered at all. Gigs: I find allowance of gun is the course of the problems of teenage shooting in school. If no one allowed to use gun, only the serious-est criminals would use it, and then you can call in any special force you want upon them.
While it is impossible to prevent criminal to use a gun, it make it harder for noob who know nothing but freebies. This request is DISCOURAGED. until VWR-4970 is reality, this should not be reimplemented. Until uploaders can limit their texture UUIDs to work bearing their own creator tags, they should not be forced to allow people to use their work unless it was expressely allowed to do so. And that is what this is JIRA is proposing to do. Take others work without asking or proper payment. Cast me as a "no" vote. If you want so badly to use someone elses texture without permissions, take your own risks and chances.
I would prefer a little more server side security as VWR-4970 would propose, I can only hope we get that feature one day. Then it won't matter if this is reimplemented as llSetTexture or llSetPrimitiveParams would fail if you haven't got the permissions. Hypatia: No It's not a way to steal textures, I wan't to get the UUID to steal the texture i still need to script, IT'S a WAY to VERIFY for me if this has happened, It's an easy way to change stuff.
Nargus: School shootings happens outside the US in countries with hard weapons laws as well. It's not that simple. As Gigs as is a stupid change making people feel safe like building a paper wall against an incoming typhoon. Looks good until you are hit by the problem, while this is being implemented stuff like the copy but ain't effected at all. the problem is that people are stealing people's textures which were never meant to be used in other people's products, in their own products. By now its so rampant that to stop someone using your own textures in these products, almost necessitates blocking legitimately used textures in your own products. It's impossible to put a general block on these textures without damaging your own products, say in the course of a DMCA.
Comparing SL to webservers is apples to oranges in this case because we are dealing with a central database system. In the course of a normal DMCA its easy to block the material on other web servers > its 99.999999 percent likely you're NOT using it in your own sites. That doesn't happen in SL. VERY often its the exact same UUID in your own products. (especially if the theft was carried off through a copybot or by harvesting the UUID through a script) And yes, there are ways to block use of textures on webservers on other sites, happens all the time. I agree that client side checks are no security, what is needed are server side checks. Yes I know this wont stop ripping > that is not the issue. The issue is to stop people using your own UUIDs without permission But I can't see the logic in putting this back in without correspondingly making it more difficult to use textures that were never meant to be used by that scripter. A restricted perm texture should > fail > on llSetTexture and llSetPrimitiveParams, and ideally they should always work with these if the creator of the script == creator of texture. (or to introduce more complexity > permissions of creator == permissions of texture) That way sold items with scripted UUIDs will continue to work with change of owner. I'll continue to say > I'll completely support the reinstitution of this once we have better server side checks on textures. This function is essential to scripting in alot more ways than just stealing other peoples' textures (for example, easily getting the UUIDs of library textures/the default texture/the blank texture). It shouldn't have to wait just because there are other problems. This was something that should never have been removed.
The problem are people that consider SecondLife as a safe platform for e-business / trading with / using of textures.
As Phantom described, making SL so safe would make it unusable. It would be better some people rediscover the playful aspects of Secondlife, than thinking of it in terms of making money, money, money. untrue. I am only suggesting that SL works like the rest of the WWW. You can prevent the linking of files on your webserver by other sites if you so code it. Same here.
they call it leeching. it's an old problem. This is just a new variation on the old theme. If you are going to start removing tools which are legitimately being used by builders, but which might be possible to also use for theft, then you may as well just complete disable all building tools - that would certainly prevent theft!
This change has no impact on the determined thief who will just use a third party viewer with this feature enabled - in any case, many thieves would use OpenGL and re-upload a texture as that is much harder to track that re-using a UUID. On the other hand, it will hinder builders legitimately using this (e.g. for determining UUIDs for scripting; matching textures in collaborative builds, etc.). Theft is real, and it is important to tackle it - but making life harder for legitimate builders whilst not affecting the theives is not the way to do so. i am a content creator myself. i want the uuid hiding reverted because i feel hiding the uuid does not protect me at all.
repeating/rephrasing what was said above: one can get a 3rd party client, or compile a client, etc, to grab a uuid. also, with the ability to grab the uuid, if it is used to steal textures, the original creator of the texture is visible for forensic purposes. a thief will be ok with using, say, the latest linden client for normal use, and switch to an alternative, older, client for a "stealing session", because of the relatively big gain from this. myself i have used the texture uuid feature while building. I see blocking easy access to UUIDs as locking your back yard windows. Now a thief will have to work harder to get in my house, he'll actually have to break a piece of glass. Now mind you, he already is breaking the law by being in my back yard and climbing in a window, and undoubtedly with nefarious intent. Do you think breaking a window is going to be that much of a roadblock to him? He's here to steal and steal he will.
A texture thief is already going to have enough savvy to use the texture which means he's not some random newbie opening a texture store. He's a builder and has access and knowledge of the other tools he can use to capture UUIDs of textures or even copies of the textures from his own system's cache. But why is this UUID useful? Well, for one thing i can tell which texture i used on something i built, if i didn't actually include it in the object (which i generally don't do because i often use textures that i bought and can't distribute except on objects). It makes it easier to go back and add to it or change it later. A lot easier. Now a really useful change would be to add the ability to get the creator of something from it's UUID. Then when i see something i like, i can grab the texture UUID and go BUY the texture. Also any time i'm shoping i can see if the object creator is also the texture creator and make a better buying decision. Here's a use for the UUID display i'm using as i type this. I bought a building, it's brick and no mod. But i want to add a brick fireplace to match it. The builder included credits to the texture creator so i was able to find the texture creator's store. Now one brick texture pretty much looks like the next to me until they are next to each other, but with the UUID I am able to make sure i buy the right one and don't have to keep going back and forth wasting time and lindens getting the texture i need. Am i a texture thief? No! So why do you hesitate allowing me the tools to make our world a better place? I ask you, should crow bars and rocks not be allowed since they can be used to break that glass window in my back yard? |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||