Knee jerk reactions

My friend Chav Paderborn often has some funny, dorky or eclectic ideas. Her new dabbling is taking a below-the-belt swing against the latest fashion of breedable pets. In a humorous way she built a stall selling breedable prims, along with outrageous food bills and the promise of super rare items. Everybody who has heard about breedable pets - even hardcore breeders I talked to - could not help but chuckle about this piece of art.

Except my landlord.

Less than 24 hours after I have set up the stall on my land, it got returned to me without any comment. After inquiring, I got the one-liner "breedables are not allowed on our estates" back.

Mind you, Chav's creation does not actually breed. Nor does it actually sell anything. It only includes one script at all, reacting to touch, and giving you one of the plywood cubes shown on the image.

Yet my landlord saw "breedable", and in best established shoot-first-ask-later fashion, returned the object.

Sometimes, actually LOOKING and READING first, and if in doubt, ASKING next, would do the trick.

Oh well...

Are immersionists an endangered species?

Sometimes I use the store-alt to "get away", and go exploring without the burden of a very full contact list. The store alt is a female avatar with a beautiful green skin - without being a pixie or a faery or another mythological creature. Immersionist that I am, when using the store-alt for exploring, it is easy to slip into the character, to be her, to feel like her.

Yesterday I explored a sim from the Showcase, when a 5 day old "Resident" account approached me.

Newb: Your skin is green.

Me: Well spotted.

Newb: I have to ask, why did you make your skin green?

Me: I was born that way.

Newb: rofl. You have a dryad avatar then. Or an Ent avatar?

Me: I am a human. Born with green skin. Don't tell me you have never seen a green skinned human before?

Newb: lololol

This person has probably never heard about immersionists and augmentists before. he was cracking up, thinking I was some kind of nutcase. But the conversation left me baffled. For me, it is natural to BE one with the avatar. When I take the green Lady out, I AM the green Lady. For him, it's like a clothing layer. Today I use the Dryad avatar, tomorrow the robot avatar, and for the weekend I take a bodybuilder.

I wonder hwo had the nicer experience? The green girl, walking wide eyed through a beautiful, futuristic and enchanted landscape? Or the guy who tries out this funny video game where you can meet nutters from all over.

Of course I am biased. For me, SL is about the immersion. SL is a magical country, and enchanted realm. I know it is not for many others. It's a game with lame graphics and no specific goal. Is there a right, or a wrong?

It makes me wonder if immersionists are an endangered species. In my early SL days I barely heard questions for one's age or location. These days it seems one of the first questions new contacts ask. The ASL-question defines you in the real world. Why do we need this RL anchor in a virtual environment? What benefit do I have from knowing that the person I am speaking with is 38 and from New Hampshire, when I am far more fascinated with the detailed mechanics of her android shape.

Are these the ramblings of an outdated oldbie? Or are we losing the magic?

Of voids

Do I still have readers after more than 2 months of silence? Two months of silence. Almost 10 weeks of not blogging. That seemed unthinkable a while ago. But I was not only lazy with blogging; I was barely online in SL as well. Having been reliably online daily for the better part of 3 years, nowadays I can only been found in-world once or twice a week. So what happened?

What happened is that I have a new RL job.

"Oh!", you may think now, "This new job keeps you busy and you have to impress your new boss with loads of overtime and 140% commitment!"

No, that is not it. Of course the job keeps me busy, but it does not come with an extra investment in time. What happened however is that this job fills a void that previously got filled by SL.

Regular readers of my ramblings might remember that I often mentioned a certain hardship in my RL. A close family member suffers from a medical condition - which overshadows my life. In addition to that, my (old) RL job has turned into a nightmare during the past three years. I was trapped between a rock and a hard place, and before I found SL I was pretty much depressive. I was on a bad path, and I lacked many, many things in my RL. Respect. Appreciation. Peace. Success. Financial freedom. Companionship. Trust. Tenderness. Love.

I got all this from SL. And plenty of it.

You might think this is pathetic. I tend to think it saved my life one way or the other. For a few hours each day I found what I was craving for. I found peace. I found respect. I enjoyed success and financial freedom. At the same time that my abusive RL boss tried psychological warfare on me and told me how much I suck at what I do - I established and built the leading text service provider in SL. While I got told that the work I did the last 10 years was a piece of shit, that I suck at marketing, that I suck at selling, that I suck at networking - nonetheless I became a boss in SL myself, a business partner of some of the biggest names in SL, got a certain public exposure, got nominated as social butterfly, got nominated twice as Entrepreneur of the Year, became a SL Solution Provider.

Cynics might suggest that I had better invested this energy on my RL job. And maybe they are right. But talk is cheap, and I had the impression I was fighting a losing battle anyways - which got confirmed by friends and family. People, who had no reason to lie to me.

After a specifically abusive incident in late summer 2009 I finally had enough and started looking for a new job. My family situation made me reluctant to give up the security of my old job (as bad as it might have been - it seemed secure). Getting my CV in order and browsing job listings gave me new energy. I became bolder in job applications; I became less intimidated in my old job. And finally I found a new job.

And then something unexpected happened. The significance SL had for my life dropped overnight.

I started my new job - and did not log into SL for almost a week. I was so energized for my new job, and I was so stunned (in a positive way) of the new tasks, the new projects, and the new challenges.... I sat on my couch in the evening, totally exhausted (in a good way), and read, watched TV or played Open Transport Tycoon Deluxe - a vintage computer game.

To be honest, I feared I was addicted to SL. It was both a relieving as well as a strange realization that I am not addicted at all!

Recent research suggests that there is no such thing as addiction. That it is only stimulation and fulfillment of needs, and as soon as the needs get fulfilled in another way, the addiction vanishes. I am a prime example for this. I had the need for a respectful, appreciative environment. I did not get it in my RL, but found it in SL. So I became addicted to SL. Now I work for a company that WANTS me, that CHOSE me out of countless applicants, that NEEDS my skills, that WANTS my creativity, that gives me freedom, recognition and trust - and by this fills the void that SL used to fill.

No, don't worry, this is not another of those "I am leaving SL" posts.

I have no intention to leave SL. I like SL. It is still an environment in which I want to relax (and yes, running two businesses IS relaxing for me) , in which I have friends. However I need to reassess my time - and plan it better. Right now I am thinking of setting aside one evening for my SL-businesses, and another evening for fun, meeting friends, exploring. There are lots of things to do: I want to relocate Babel and create a small creative plaza with my friends Nissa and Ivanova. I want to pick up photography again, and - having worked with digital video some years ago - finally try machinima in SL. I neglected my social life, and I want to WIN Entrepreneur of the Year this time.

It is actually a nice feeling. Now that the subtle pressure of filling a void is gone, I can look at SL from a new angle. SL gave me a lot over the past 3 years, now it is a new chapter in my relationship with SL, and I look forward what it can give me at this stage.

Tagged - Step 2

Tagged - Step 2, originally uploaded by Peter Stindberg.

Crystal tagged me, and since I did not do a meme this year, so here we go...

Handle with care

1. I am very shy. It takes long before I speak to someone, a little less in SL, more so in RL.

2. I have self-esteem issues, can't accept praise easily, don't think highly of my achievements, and generally think I can't really live up to expectations.

3. (Self-)doubt and fear are constant companyons. Fear of loss, fear to annoy.

4. I try to avoid people with the same nationality I have, try to avoid talking my native tongue in SL. There are very few people in SL with whom I talk in my mother tongue. The tought of sharing intimacies in that language is horrible.

5. If you get to know me and earn my trust I will be one of your most loyal and caring friends.

6. I prefer jeans over skirts, short hair over long hair, small breasts over large busts and generally am attracted more to the tomboyish/androgynous women.

7. SL helped me to discover and embrace my bisexuality.

8. My musical taste is extremely broad, but my love is with celtic folkrock, celtic fusion and celtic crossover. I tried to learn Gaelic once.

Maybe I tage you, maybe I don't....

Fashion notices:
- Hair: Truth Peta
- Jacket: Elixir
- Suit: Graves
- Shoulderpads: Oralune
- Shoes:
- Bangles:
- Glasses

Good hair day

[Safety advisory: those of my readers who are faint of heart - especially the female ones - are advised to be safely seated before proceeding with this post. Please keep a telephone handy for emergency calls. If you need something to calm your nerves - like a glass of eggnog - please take it as a precautionary measure.]

I love my hair! My first hair ever after my newbie hair was "Spike Brown" by Adam'n'Eve, and it took me many weeks until I settled on "Luth" from Elikapeka Tiramisu Designs (ETD). My budget was tight back then, and I only bought a pack of 3 browns, but it was exactly the style I wanted. Short, a little bit messy, youthful. A great style - and it did not bother me that it was marketed for women. No, I actually enjoyed it that it set me apart a bit, being probably the only male avatar wearing it. ETD's "Luth" defined the way my avatar looked since I bought it, and with very few exceptions I wore it all the time since December 2007!

I'm sorry, Ladies, yes, I wear the same hairstyle for 27 months straight

Recently my friends Faerie Hax and Dunan Wilder suggested to me in a kind and subtle (cough) way that my hair is outdated, and as a consequence dragged me through countless hair stores, among others Find Ash, Zero Style, Sadistic Hacker, Truth, Exile, Little Heaven, Novocaine, Tiny Bird and Tukinowagima - I ended up with 27 demos that were considered as finalists! Alas, while there were many nice styles among them, none of them "clicked", and ruefully and under the disapproving gaze of Faerie I returned to ETD's "Luth".

And then, a few days ago, I saw the advert for Truth Hawks' new style "Peta". (As a sidenote, don't ever try to google for "peta truth" - it gets hundreds of results - none of which is relevant to SL hairstyles). "Peta" immediately clicked. I could immediately see me wearing it and got the demo. I wore the demo for two days, and asked my friends what they think of it. All of them loved it. All of them said it is the right successor for my old hair - similar in style, but more modern in appearance. So finally, after more than two years, I changed my hair.

Copybutt

I experience weird graphics card glitches quite often, and seeing part of my body-texture plastered all across my body in a WRONG way is not unusual. But seeing my eyeballs on my lower body was actually the weirdest and grossest glitch so far.

So, yeah, it's my copybutt :-)

Shared Media poses huge privacy risk

The blogposts of the past week are full of praise for the new "shared media" option introduced in Viewer 2.0 (and surely being retrofitted soon into 3rd party viewers). On the surface, this shiny new functionality adds a lot of benefits which have been discussed at length already. Under the surface, however, this new technology gives everybody the tools to melt away your privacy and anonymity!

How does shared media work?

With the new shared media function you can put a webpage on the face of a prim. This webpage can contain all sorts of content, up to full fledged Flash animations and sound. The prim-face assigned with shared media acts like a web browser. The webpages in question get requested from your own PC - not from a central server at Linden Lab.

How does this affect my privacy?

Whenever you request a webpage, your IP address is transmitted to the web server. Most web servers store this address in their logfiles. IP-addresses are considered personal information in many countries, especially since more and more refined techniques of IP-Geolocation allow to pinpoint the geographic location of a user with increasing accuracy. Try it yourself - click this link to have yourself IP-geolocated and let me know in the comments how accurate it was (no, I don't see the actual results).

With the shared media, a webpage on a prim loads as soon as you look at it - probably even as soon as you are in the vicinity - thus transmitting the IP address of your PC to the remote server. This is not an opt-in process! It happens automatically, and without giving you the option to accept or deny. There might be an opt-out, but it would disable all shared media for you.

Now imagine the website on a shared media prim is not a general website, but a specific website, tailored to gather specifically YOUR IP-address and related data. Would you like that?

OK, but where is the difference to requesting a website?

The holy grail for web marketers for years was to identify individual users. All sorts of more or less unethical tricks where thought of, to identify recurring visits, and to gather data about a user. Web-surfers are sensitized to the topic by now, and most users know their IP data gets logged. Privacy concerns have led to legislation in many countries. In my country, for example, collecting the IP-addresses in server logfiles is illegal in most cases now.

In Second Life however, the level of expectation is different. Second Life is NOT a webpage. While it is common knowledge that Linden Lab tracks certain parameters like your IP-address, nobody expects that any other resident is able to get this information. On top of that, shared media allows you to create exact avatar-name-to-IP-address matches.

A horror scenario

I personally have been blackmailed and RL-threatened by a SL resident who reverse-engineered my RL identity before. My friend Zonja Capalini came up with this horror scenario:

A and B are in SLove and partner. Everything is roses. A while later, the love dies and B resolves the bond, which drives A up the wall. A creates a shared media prim pointing to a specific webpage on a server A controls, and hides it where B - and only B - is about to see it repeatedly. Over the course of a few days A collects enough IP-addresses of B to not only pinpoint the geographic location but also the ISP of B and - because B logged in from work twice - also the fixed IP address of B's employer. A little more digging reveals B's realname, B's work telephone number, the name of B's boss who might be interested that B worked as a virtual stripper, and in consequence B's home phone number and B's Flickr account where B's kids are displayed.

OK, sure, you are right, B should not log in from work. And B should not have lied about about their gender and marital status. So B saw it coming, yeah? So let's look at this:

X is a fashion designer, doing some rather nice designs. Y is a drama blogger and asked X for free samples to blog them. X denies the samples and Y swears revenge. Y manages to place a shared media prim with a specifically tailored spy-webpage where X sees it. No tangible data is found though since X uses a popular ISP and has frequent changing IP addresses. However to Y's huge surprise she also tracks the IP-address of Z, another fashion blogger. And it turns out that Z's address and X's address are identical, even that web-cookies X's browser loaded are already present in Z's browser. Y has now identified an alt-account of X and uses this knowledge to spread drama.

Yeah, sure, X saw it coming. Why does she create a secret alt in the first place?

But that has been possible before!

Yes, it has been possible before. Parcel media stream settings could have been abused this way before. However it required two things: you need a parcel whose media stream you can control, and the victim needs to have media-playing switched on. Plus you need the victim to come to your land, while a shared media prim could even be worn and thus brought into the vicinity of the victim.

A similar exploit uses the webpage tab in profiles. If you have set webpages to auto-load, malicious web addresses could also be used. However this is a pretty broad approach, since you can barely fine-tune it towards one victim only.
What is novel about shared media is that those stalker-tools have been given into the hands of literally every resident. If I am alone with someone, I just need to rez or wear a prim with shared media and a specific webpage and get that person's IP address.

What can I do?

If this concerns you - and to my huge surprise it has not concerned many people I spoke with - your safest approach is to not use Viewer 2.0. Viewers based on 1.x will not display shared media, and you are safe. Of course this also prevents you from using the many new fancy features.

Viewer 2.0 has an "Allow media to autoplay" in the settings. I need to run tests to see if this attributes to shared media as well. If it does, it at least gives you the choice.

Finally there is a "Enable Web Proxy" setting in Viewer 2.0. Again I have not yet tested if this gets used for shared media as well. At least this will be some security against direct pinpointing. Public proxy servers can be found on many lists on the web. For hardcore security fans you can use a TOR-proxy as well, however sacrificing a lot of speed.

Anything Linden Lab can do?

Linden Lab could actually remove this problem at its root by not having the individual viewers request web-content but have it centrally fetched and distributed via the SL network. This would also solve the problem that two watchers of a shared media prim might see two different things. Unfortunately this is not a feasible solution since it would put an immense strain on the LL network and would easily boost the required bandwidth beyond any sensible measure.

Living with the Pandora's Box opened

Shared media was inevitable. Users have been asking for HTML-on-a-prim for years, it is a function not only the educators need urgently, but which will find many, many uses in the coming months and which will change the face of SL in a very literal sense. It's too late to put it back in the box - the aspects of its use are just too large and thrilling.

My goal with this post is to make you aware that your privacy and anonymity has just been diminished further. Many people will applaud this in fact, advocating that avatars should come out of their hiding. Maybe I belong to an endangered species of immersionists, believing in a separation between SL and RL. But as a resident you need to know that you can - and probably will - be tracked by shared media prims.

Welcome to the new world!

Update: There has been a JIRA issue created on that matter, and in the comments there are some sensible suggestions that boil down to some sort of personal firewall inside of SL, where you are a) made aware of media surfaces that want to load and b) can decide on a case-by-case basis if you want to allow the.