Firestorm 4.4.0 blocking to commence

Posted on by Inara Pey

firestorm-logoThe Firestorm team have announced that version 4.4.0.33720 of the Firestorm viewer will be blocked from accessing Second Life and OpenSim starting on Thursday April 10th.

According to statistics from Linden Lab, there are some 5,500 people still using Firestorm 4.4.0.33720, which lacks support for many significant features, including Sever-side Appearance, Materials Processing and Fitted Mesh. Nor does it include support for many of the server / viewer improvements released over the course of the last year, including interest list updates and HTTP improvements.

Those people still running 4.4.0 are being strongly urged to update their Firestorm viewer to 4.4.2 or later prior to the block commencing on Thursday (no actual time is given in the blog post). Those already running 4.4.2 or later need not take any action – this does not affect you.

The block is being implemented as a part of Firestorm’s policy to, as far as is possible, only have three active versions of the viewer accessing Second Life at any given time. Unfortunately, OpenSim is also affected as the team do not currently have the means to selectively block older versions of the viewer from accessing individual grids at this time. However, this is expected to change when the time comes to block another release in the future.

 

Published by Inara Pey

Eclectic virtual world blogger with a focus on Second Life, VR, virtual environments and technology.

28 thoughts on “Firestorm 4.4.0 blocking to commence”

  1. I surely hope that they don’t block 4.4.2 soon… because of the Cocoa issues on all the Mac viewers released after that, which are a long way to get fixed, this would mean effectively pushing me out of Second Life forever.

    Like

    2. Rest assured, 4.4.2 isn’t going to be blocked as yet – or potentially with the next Firestorm release. Here’s what Jessica said about the Mac issues and blocking at the March 15th Firestorm meeting / Q&A:

      I did state during the [TPV Developer] meeting with Oz that we’re not going to block 4.4.2 until these major Cocoa issues are addressed. The unfortunate thing about that is doesn’t really solve much for you Mac folks, because you’re still not going to see Fitted Mesh, which I think will become popular over time, you’re not going to see Materials and whatever else is in the pipeline in the future. It’s not going to be an ideal thing, but I can tell you we’re not going to block 4.4.2 until the major issues with Mac are dealt with.

      Like

    1. It’s the Lab’s grid.

      As it is, this is a reasonable solution. to uses of multiple (and badly outdated) viewers accessing Second Life. It means that Firestorm users are able to run a choice of 3 versions of the viewer, so they can always roll back to a prior version should they encounter problems with the latest and it means that the Firestorm support team are able to focus their efforts on keeping-up with new releases and providing support to Firestorm users without having to carry the knowledge from A,B C, viewers as well as X,Y,Z viewers around in their heads forever.

      Like

  4. I can block certain versions and viewers from my grids, but if Firestorm team implements some kind of backdoor to prevent/disable older versions from accessing opensim, it would be forever goodbye to firestorm!

    Like

    1. It’s not a backdoor. What it means is that Firestorm didn’t have the ability to activate blocks for specific grids until the newer versions. The newer versions do have this ability, thus enabling the Firestorm team to block access to the Second Life grid specifically, rather than block the use of outdated viewers altogether.

      Like

      1. So they are increasing the control they have through their “backdoor” by being able to dictate which grid i can and cannot login to. Is there something I accepted in my downloading of their viewer which grants them the authorization to do so? Am I the only one who has warning bells ringing over this? Doesn’t this smack of the very sort of thing that Firestorm’s ancestor met its demise through?
        The soot of emeralds burning is still adhering to the “new and improved” team.

        Like

        2. There is no “backdoor”. Nothing is routed via the Firestorm server, as I’ve explained further down in reply to another of your comments relating to this mythological “backdoor”.

          It’s not about dictating what grid you can log-in to. It’s about keeping the number of versions of Firestorm able to access Second Life to a maximum of three (the current release and the two versions immediately preceeding it). Right now, this cannot be done without also blocking an older version of Firestorm from accessing any OpenSim grid as well as SL. In the future, the blocking (which is handled entirely within the viewer and does not in any way compromise your log-in credentials) will ensure that older versions of Firestorm are only blocked from accessing Second Life. Opensim users will remain free to use older versions to access their OS grids if they so wish.

          Like

          1. I invite you to read the top 10 results for the terms “backdoor software” or “phone home software” as I did before posting here. Most of it boils down to code built into a program by the developer to bypass security protocols, ie: firewalls, passwords, antivirus etc, to gain control of the program and compromise it (not necessarily username/passwords) in a way that may be against the wishes of the user. As such I am well within my rights to consider it a backdoor as it fits the definition.

            I have been a vocal fan of Emerald/Phoenix/Firestorm viewers since the day i started to use emerald in 2009 in spite of all the drama, hassles and forced upgrades but to my mind this last stunt is one too many. I will point out that in spite of the FS team trying to lay the blame for the last 2 forced upgrades at the feet of LL, the reality is that not one other TPV has had to do this. I can still login to S/L with 3 year old Singularities, CoolViewers and Kokuahs etc. without problem. Can you understand why I am a little skeptical that this new forced upgrade for both S/L and Opensim is because of Linden’s threats?

            Like

            1. “A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing illegal remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. ” – Wikipedia.

              If you can find any evidence that Firestorm is doing the above, or that it is gathering data from you, or is attempting to bypass your firewall, your anti-virus or passwords in order to gain control of any part of your computer, then I invite you to publish it. The Firestorm code repositories, as with all other listed TPVs, are open to inspection by all.

              Yes, they are limiting your ability to use any version of Firestorm to access Second Life – but they are doing so without in any way compromising your computer’s security or compromising your SL log-in credentials.

              Nor is this being done maliciously. They have done so as a means of limiting the number of older, unsupported versions of Firestorm accessing Second Life while providing sufficient choice to Firestorm users that, should they have issues with the very latest release, they have two other versions they can try.

              You may not like the fact that Firestorm are limiting choice. That is entirely your prerogative. However, limiting choice is not the same as committing a security breach within your computer or otherwise compromising it as you persist in claiming.

              Like

              1. “A backdoor is a means of access to a computer program that bypasses security mechanisms. A programmer may sometimes install a backdoor so that the program can be accessed for troubleshooting or other purposes…..Whether installed as an administrative tool or a means of attack, a backdoor is a security risk, because there are always crackers out there looking for any vulnerability to exploit.
                http://computersecurity.wikia.com/wiki/Backdoor

                A network administrator (NA) may intentionally create or install a backdoor program for troubleshooting or other official use.
                http://www.techopedia.com/definition/3743/backdoor

                It is easy to assume that backdoors are illegal. Backdoor programs, however, often provide architects or administrators of a large system quick access to it in case something does go wrong. This saves a lot of time, since the backdoor bypasses the time-consuming checks that are in place. Thus backdoors also sometimes have legitimate uses. ;… For this reason, backdoors are not classified as illegal, but are frowned upon by some software engineering practitioners.
                http://www.mysecurecyberspace.com/encyclopedia/index/backdoor.html

                The internet is full of reports of Big “trusted” companies putting backdoors into their software like: Microsoft, Sony, Ubisoft,

                The difference between whether the backdoor is considered benign or malicious often depends on what side of the door we are on.

                Like

                1. You have persistently insinuated that the Friestorm team have invoked a means of compromising either the security of you computer / your gree log-in credentials.

                  So, I’ll repeat my invitation to you:

                  If you can find any evidence that Firestorm is doing any of what you claim, please go ahead and publish it. This should not be hard to achieve, as the Firestorm code repositories, as with all other listed TPVs, are open to inspection by all. Otherwise, it is pointless continuing this conversation.

                  Like

                2. You still just don’t get it. The viewer having being coded to read a simple text file for blocked releases on the Firestorm website and then allow or deny the user from logging in based on what it found in the file is not a backdoor.

                  Like

    1. Only 4.4.0 and older are affected.

      4.4.2, 4.5.1 and 4.6.1 are not affected. You can carry on using them.

      Like

  6. As I understand it, the Firestorm team was given the option of controlling the block on old versions themselves or allowing LL to do it through the system they use with the official viewer.
    If LL did it, ONLY the most recent version would be allowed to log in. The Firestorm team decided to handle it themselves and allow only the 3 most recent versions.
    Obviously the fact that that effects the ability to use older versions on other grids was unintended and it is my understanding is it will be fixed.

    Like

  7. Thats very bad the block older viewer version with opensim to. also not see why. LL block the viewer server side. so firestorm dont need to block it at there side. Still not a good sign that firestorm can block viewers remote.

    Think somene need to get the older viewer source and look at the code or kae a new one without the code. dont expect firestorm is going to fix older viewers.

    Like

    1. The problem with Firestorm using LL’s blocking / update process is that potentially, Firestorm users will only be able to use the latest version as it is released. This way, they keep a choice of 3 different versions – and the next time Firestorm block a viewer, it should only affect Second Life, so that people can continue to use any of the available versions on OpenSim.

      Like

  8. I can still and i do use the old imprudence, no mesh, no shit but just reliable one, on OSgrid and open sim and in fact EVEN when needed in SECOND LIFE!
    And being the code open source and any can if with knowledge to compile and make its own SL viewer, i really doubt that LL can in fact block any but their own viewers or per request of developers.
    If Firestorm can block direct acess without LL intervention, then for sure the use of a trojan is in place, if they can even do it on Open sim then its a falacy!

    Like

    1. People are free to use what they wish. Imprudence lacks some features, but works on OpenSim fine. However, if you want to use it on SL and have every avatar around you remain grey and un-rendered (other than attachments and mesh clothing), that’s also your call.

      Firestorm also has open code and people can compile their own versions. That’s one of the reasons why FS has such a large user-base; it is trusted among self-compilers. Their repositories are available for anyone to examine, and thus carry the same level of trust as the repositories for any other TPV which complies with the requirements of the Lab’s TPV Policy.

      Viewers can be blocked via channel number. Doesn’t require a Trojan. The fact that Firestorm uses a single channel number on both the SL and OpenSim variants for the different versions of their viewer is, I believe, the reason why they cannot differentiate between SL and OpenSim at this point in time when a version is to be blocked.

      Like

      1. Call it a backdoor or a phone-home ability, the bottom line is that in either case Firestorm viewer is communicating with Firestorm servers for autorization to login. If it was only needing to communicate with LL servers then that wouldn’t have an affect to logging into Opensim servers. The type of information being transmitted to Firestorm is anyone’s guess as evidenced by Emerald which also was a “trusted” TPV opensource viewer with a large following of users and self compilers.

        Backporting a new channel number to the older Opensim releases really shouldn’t be much trouble judging from how easily other software like Opensim can do that to their older releases for much more complicated changes.

        Like

        1. “Call it a backdoor or a phone-home ability, the bottom line is that in either case Firestorm viewer is communicating with Firestorm servers for autorization to login. If it was only needing to communicate with LL servers then that wouldn’t have an affect to logging into Opensim servers.”

          Incorrect. What happens is this:

          1. Viewer is started locally.
          2. During the initialisation process and before any data is passed anywhere, the viewer requests information from the FS server. This includes things like the MOTD and a list of blocked versions of the viewer
          3. Once the list of blocked versions has been received by the viewer, it checks to see if it is on the list. This is again done before the user even clicks on the LOGIN button.
          4. If the viewer is on the block list, no data is sent anywhere when the user clicks on the LOGIN button. Instead, the viewer displays a message indicating the user needs to update to a more recent version of the viewer.
          5. If the viewer isn’t on the block list, when the user clicks on the LOGIN button, the viewer connects directly to the log-in server of the specified grid. It does not connect to the Firestorm server at all for the purposes of logging you in to any grid.
          6. The user’s log-in is authenticated by the grid.

          So to repeat, absolutely no log-in data passes through the Firestorm server. The reason there is no discrimination between SL and OpenSim at present is purely because the same version version (/channel) number is used to access both SL and OpenSim, and it is this number which is recorded in the block file requested by the viewer from the FS server prior to any contact being made to a grid’s log-in servers.

          ETA: Jessica Lyon has created a Firestorm wiki page to further explain matters in this regard (see her comment further down this page).

          Like

  9. But I don’t believe that the Firestorm team did any of this on purpose.
    And for sure on Sl to get ride of old viewers is a good step, i just hope that does not lead to a time when only LL viewer will be allowed to be used.

    Like

Comments are closed.