Credit Card privacy concerns

Some time ago, LL opted to shift their method of accepting foreign payments away from PayPal. A deal was struck with Dragonfish – which in a sort-of bizarre twist, given LL’s attitude towards gambling – is operated by 888 Holdings the, er, online gambling giants.

There have been numerous issues with the payments system (which also appears to be linked to Cassava Enterprises, another subsidiary of 888 Holdings, registered in the tax haven we call Gibraltar). Now it appears as those woes might be growing.

As reported on the official forum, members in Europe using the payment system towards the end of last year are finding themselves subjected to directed mail shots to the e-mail accounts that they have specifically set-up for use with Second Life. What is more worrying is that in at least one instance, the mail sent to the SL-related mail account has called the recipient by their real first name. Elsewhere, another use who has used a partner’s Credit Card to make payments to LL via Dragonfish has found themselves receiving directed e-mail to their SL-related e-mail account addressing the card holder by name.

Frank Ambrose (FJ Linden) has attempted to pour oil on troubled waters by suggesting that those affected have been victims of malware  / spyware on their own computers, and that no data has been leaked via Linden Lab or their “third-party” operative (Dragonfish). However, an increasing number of people are doubting this explanation, due to the number of coincidences concerned, perhaps the biggest of which is that the directed e-mails (mis-named “spam” in the forum posts) are from – wait for it – another on-line gambling organisation.

In other words, someone possibly in competition with 888 Holdings.

As Que Niangao points out in the thread, while it in not entirely above the realms of possibility, for FJ’s explanation to hold, the compromised computers used by those receiving the e-mail need to have been infected by some very elaborate spyware / trojan / key-logging system. However, a more reasonable explanation might be that the issue lies at the other end of the pipe and that while no-one is accusing 888 / Dragonfish / Cassava of deliberately passing on user information, it is possible that their own systems have or were compromised at some point.

Either way, it would seem that a more involved investigation is warranted – and neither Linden Lab nor 888 have anything to lose by ensuring the matter is fully and properly checked.

There is a danger in issuing what can be read as trite / suspicious and almost throw-away explanations (as some on both the forum and on Twitter are treating FJ’s response). That is that is deepens the belief that Linden Lab does little more than pay lip service to matters of privacy. This feeling has been rife among the user base for a good while now, and has been exacerbated by recent events around RedZone.

While no-one expects LL or 888 to hold a hand up and admit the specifics of any leak (should one have occurred), one does expect them to work fully and properly to ensure that all fears and concerns that their might be a leak are properly alleviated, and evidence given that customers’ data is in fact secure. If there has been a breach that is not connected to customers’ own computers, then it is also in LL’s best interests to ensure they understand what has occurred and when so they can inform users of the appropriate actions they need to take, if any.

A “Thanks but not our problem,” response – which is how FJ’s reply tends to read – doesn’t really help anyone.

Search Project Viewer released

Linden Lab have released a new Viewer Project to sit alongside their exiting Mesh-enabled Alternative Viewer. This is the Search Project Viewer, which is promising to deliver a new and better Search experience in Viewer 2.

Given that Search has long been a contention where Viewer 2 is concerned – where it initially started out as a massive step backwards in so many respects – the fact that LL have moved it to a dedicated Viewer should be welcome news, in that it gives people the opportunity to properly test the new features, provide feedback and for LL to finally ensure that Search is providing what the user community wants and expects.

I’m not going to go into a long review of the new engine – Ciaran Laval has already done that, and I see no reason to repeat the work he’s done. Certainly the new Search looks very promising, although some of the more irritating problems with the engine remain – such as the number of steps you have to go through simply to be able to see the information you want to get to, regardless of the fact that the Search engine can finally now locate it.

What is interesting to note is that Linden Lab state in the blog post that:

New search will soon be available to you in the official SL Viewer and we will not be implementing it for the 1.23 Viewer. To be clear, you can still use the 1.23 Viewer, but search functionality will be impaired once new search is released into general availability, after the test period. 

Specifically, searches using the ALL and GROUP tabs of the 1.23.x Search will be impaired. So, where does this leave existing 1.x-based Viewers? Again the blog post provides a part of the answer:

 (We cannot speak to which Third-Party Viewers will adopt the new search technology.) All of our development efforts are focused on making SL Viewer with Basic and Advanced modes exceptional for all Residents–new and seasoned. 

In other words, as far as the “official” version of Viewer 1, already frozen in development in many respects, this pretty much marks the end of the road, and it will by up to TPV developers themselves to overcome any functional impairments in search by adopting the new “search 2”. How easy / difficult this might be remains to be seen, but it would certainly seem to add to the burden 1.x TPV developers are having to carry in their attempts to keep things going.

Given that many are already producing Viewer 2 alternatives (Dolphin 2, Firestorm, Kokua, Kirstenlee’s S21, to name but four), this might push them towards making a full and final switch to Viewer 2-based development and allowing any 1.x Viewer offerings they have depreciate.  This many not be a popular move among the wider user community should it happen, but the fact is – and Oz Linden has pointed out – there is a lot coming down the tracks in terms of new functionality within the Viewer that trying to maintain two code bases, or simply trying to backport functionality into the older code, may simply reach a point where it is no longer viable.

If you wish to try out the Project Search alternative Viewer, you can fins the downloads on the Alternative Viewer wiki page.

Web Profiles – privacy leak?

Tateru Nino posts on a privacy issues surrounding SL web Profiles – or more particularly, the “old” profile API utilised by 1.x Viewers and the likes of Firestorm.

Although there is an issue here, I’m not entirely with her on her take on the situation, or in the options she provides as potential solutions.

Essentially, the problem lies in the fact that people seem to be under the impression that setting the privacy options on a web Profile via my.secondlife.com will “hide” the selected parts of the Profile from being viewed in-world. For example: if Groups to be viewed by Friends in my.secondlife.com, people take it to mean only Friends can view the Groups information when viewing the Profile in-world.

While this is the case for those people using the official Viewer 2, it is not true for anyone using 1.x-based Viewers or some TPVs based on Viewer 2. For these people, your entire Profile remains fully visible, regardless of the Privacy settings active on mt.secondlife.com.

This is because 1.x-based Viewers (and Viewers such as Firestorm) use the “old” 1.x Profile API, which has no privacy settings associated with it, and it simply doesn’t care what has been set via my.secondlife.com.

As such, and while acknowledging the situation, I’m hard-pressed to call it a “privacy” issue in its truest sense; the behaviour exhibited by the API is exactly what it has always been – no more, no less. In that regard, it’s certainly incorrect to describe the resultant situation as a bug with the 1.x Profile API.

Rather than being a matter of “privacy” with regards what is viewable on Profiles in-world, I’d actually suggest that this problem is actually an unfortunate outcome of another poorly worded communique from Linden Lab coupled with taking the “easiest” route to providing a solution.

Let’s put matters in perspective. The privacy settings on my.secondlife.com came about not to limit the viewability of Profiles in-world, but rather to address users’ concerns that my.secondlife.com initially made it far too easy for non-SL users casually browsing the web to see people’s avatar Profiles. Unfortunately, when LL moved to fix the matter (and very clumsily so, in the first pass), Q Linden issued a blog post that unintentionally linked the web aspects of privacy with the in-world viewing of Profiles; something that was possibly exacerbated by the clumsy manner in which “privacy” was first invoked.   As a result, some people have become confused.

Unless LL unequivocally state it is their intention to enable the blocking of certain parts of a person’s Profile from in-world viewing (and there are actually valid arguments for this), then I’d dispute Tateru’s view on how to resolve this matter.

Far from there only being two options open to LL (backport the privacy controls to the 1.x API or to shut down that API entirely), there is actually a third. It’s this: add the necessary clarification to the privacy settings page on my.secondlife.com. It’s around 10-15 minutes work at most. The wording itself is pretty simple:

“Please note: These privacy settings apply to how your profile is seen at my.secondlife.com or by residents using the official Viewer 2. Residents using older Viewers and third-party Viewers may be able to see your full profile in-world, regardless of the settings made here. Please ensure you only supply information you wish to be made “public” within Second Life, and ensure your profile remains within our Community Standards guidelines.”

Facebook wipes Second Life

I’m going to go out on something of a limb here. Just why are people getting so worked up about having their “SL Accounts” on Facebook deleted?

Over the last 24 hours, FB have been mass deleting accounts linked to SL avatars (and no doubt other accounts that are “not linked” to “real information”), and people have been shouting about it across blogs, Twitter and Plurk as if it is so kind of outrage.

Well, sorry, it isn’t. I’m not Facebook fan; I wouldn’t even use it – but the Facebook Terms and Conditions of use are clear: only “real life” account information should be used on Facebook accounts. Quote:

“Registration and Account Security

Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account:

  1. You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.
  2. You will not create more than one personal profile.

However fond we are of our Avatars, the fact remains that they don’t fall under the classification of “real names and information”; ergo, however much it hurts, creating a Facebook account using avatar information has always been a recipe for disaster. Given this, it’s hard to see how anyone can be outraged when Facebook seek to enforce their rules; it is their playground, after all.

I appreciate this may come across as a cold reaction, especially to those who have invested many hours in developing their Facebook presence, but it is honestly hard to be anything else. Had it been a case of FB suddenly changing their policy and wiping out accounts as a result, it would be a very different matter, one that would call for more sympathy for those affected by the move.

But it is not. As quoted above, the rules are clear. Foolish is the person who gambles against the house odds in matter like this.

However, there is another side to this situation. Leave us not forget that for well over a year now Linden Lab have been actively encouraging people to flip over to Facebook and join things over there. For example, we’ve had:

  • The 2010 Valentine scavenger hunt, the top prize for which could only be won by those registering with Facebook
  • The 2010 advertising campaign that (at the least) required SL users to connect their Avatars with their RL identity on Facebook
  • Wallace Linden’s heavy-handed FB push that marked his one (and only?) attempt to “start a conversation”
  • Amanda’s Linden’s own clumsy juxtaposition of announcing a forthcoming new “community platform” for “better communications” while at the same time telling people that “the” place to find out about SL is….Facebook…

While it might be argued that few / none of these initiatives have required people to sign-up to Facebook using their Avatar details, such arguments entirely miss the point. Facebook and Second Life are – for the vast majority of SL users – simply a bad fit, precisely because of FB’s “no ‘fake’ information policy.

Of course, there are those who don’t mind linking RL and SL identities: those operating a RL business with SL ties; those working in education in RL and SL, those operating non-profits, etc., may have few qualms in linking one to the other – and are excellently placed to use the likes of FB and services such as LindedIn to help promote themselves and their activities.

But for the vast majority of SL users, making FB a bedfellow has not been in our interests. Some at Linden Lab (/me waves to Amanda) have been using a form marketing kung-fu that can only be described as kicking oneself in the head, in that they seem to be of the opinion that pushing SL users to FB will be reciprocated in a flow of FB users to SL. This clearly is flawed in so many ways, it’s not worth rehashing all the reasons why, especially given they’ve been pointed out time and again by so many SL bloggers.

Hopefully, this latest move from Facebook will convince TPTB at the Lab that it really isn’t in their best interests to be so cosy with FB. In the meantime, for those who want an SL-related social network, why not give 2ndhub a try?


Breaking the Viewers

As Tateru Nino points out, Oz Linden issued a stark warning yesterday when commenting on third-party Viewers (TPVs): “[A]ny Viewer that isn’t being actively maintained is going to start having fairly serious problems over the next months. We’re making a lot of changes… if viewers don’t keep up, things will break.” 

Now, Oz isn’t the most diplomatic of individuals, it has to be said; but a lot of people seem to be getting unnecessarily bent out of shape in response to his comments, apparently reading them as “You must swap to Viewer 2!” – which is certainly not what is being said.

Rather, he is pointing to the fact that with all that is coming down the line, there is a risk that some Viewer devs (particularly those working with the Viewer 1 / Snowglobe code who have to backport everything) may find their Viewers becoming obsolete. And his comment may well have merit.

While it is true that much of what has been developed for Viewer 2 has been backported to Viewer 1 TPVs (Display Names, multiple clothing layers, Avatar Physics, etc.), it is by no means certain that this will be possible going forward. for example, LL have already stated that Mesh objects will not render in Viewer 1, so it’s by no means clear if the code required to enable meshes to be visible can be integrated into the older Viewers. Similarly, they’ve also stated that the “Search 1” used by Viewer 1 is to be turned off at some point this year – leaving TPVs based on the code either without a search engine or needing to try to integrate with the Search used by Viewer 2. Therefore, there is a risk associated in staying with the Viewer 1 code base.

The Popularity Stakes

In the same meeting, Oz went on to say, “[T]that being said, we’re looking hard at what motivates people to stay on a 1.x viewer so that we can try to address those issues too,” a comment that was also met with a certain amount of derision, with people pointing to things like “usability”, performance and features as the major reasons why Viewer 2 “isn’t working”.

Much has been made of the Viewer 2 UI being “unusable”. At the risk of offending some, I think it fair to say this view is more reflective of people’s unwillingness to accept Viewer 2’s UI than it is of the usability of the interface.

Yes, there are quirks, annoyances, and things within the UI that could be a better than currently implemented – but none of them render the UI “unusable”. The fact is that *if* the Viewer 2 UI had been the de facto  UI for the last 4 or 5 years, and was now being replaced by the Viewer 1.x UI, many of those decrying the Viewer 2 UI to be “unusable” would be making the very same claim against the “new” V1 interface. I’m not being snide in saying this: I’m simply pointing to a reality of human nature; Viewer 1 is in our comfort zone, and it is naturally more attractive.

Performance has been an issue with Viewer 2. Many report tremendous downturns in performance when swapping to it; I’ve experienced it myself in the past. However, today I carried out a couple of (admittedly simple) tests*, measuring FPS rates and rezzing times for the four Viewers I routinely use together with the “official” Viewer 2 and the Kokua development viewer (more out of curiosity with the latter than an attempt to measure its actual performance). The results were surprising, as this table on average frame rates on sims occupied by 2 avatars and 12 avatars respectively demonstrates:

Viewer frame rates on sims occupied by 2 and 12 avatars respectively

In terms of rezzing (using a mall as my baseline), Viewer 2 again performed well. The fastest Viewer for rezzing was, unsurprisingly, Kirstenlee’s S21 (The KLee Viewers have always preformed pretty well on my PC), with Viewer 2 running it a close second. Again, given the use of the JPG2000 library with the official Viewer, this might not be so surprising, but it does perhaps point to Viewer 2 not being as slouchy as its reputation suggests.

Obviously, the test is entirely subjective; what works for me, may not work for you. But its interesting that the overall performance of the Viewer 2 is not so much an issue as it may have been just a few releases ago (when things like frame rates did have me grinding my teeth in frustration).

Giving People What They Want

Truth be told, if Oz wants to understand why people stick with Viewer 1.23.5-based Viewers (or for that matter prefer the likes of Firestorm over Viewer 2), then he only need to really consider one thing: features.

Firestorm in-world Profile display: fast, easy, fun

simply put: TPV developers give users the tools they want: client-side AOs, radar, massive improvements to the Windlight engine and sharable presets, and so on. All these have served to keep Viewer 1-based Viewers at the forefront of popularity.

In the Viewer 2 department, TPV developers are being as equally accommodating, providing features and options users are requesting while LL turn a deaf ear: in-world Profile viewing that avoids the use of the Web Profiles, inclusion of the Media Filter, options to replace the context menus with pie menus, and so on.

As TPVs based on the Viewer 2 / Snowstorm code base mature and inherit features from Viewer 1 TPVs, people will migrate to them and overcome their bias towards the UI.

When that happens, perhaps the only question that will be asked within Linden Lab will be, “Why is Viewer 2 still the minority Viewer?”  In reply to which, I can only say “check back here guys, and read that last few paragraphs…”

* Test information:

  • Hardware: Intel Q6600 Quad Core CPU, 2.6MHz, 4Gb RAM 320 GB hard drive @ 7200rpm
  • Graphics: GeForce Ge9800GT with 1Gb.
  • Viewer settings: Bandwidth 1500kbps; cache size 1024Mb; Draw distance: 384 metres; multi-threading enabled.
  • Sims used: 2-avatar test: Qiu Xiang; 12-avatar test: Mesmerize Dungeon.

Advertising Beta to end

In December 2010 Nelson Linden announced the Second Life Advertising Beta, a programme by which merchants could, for a fee or two, enjoy wider advertising exposure through various Second Life “properties” (or “websites” as we call them elsewhere) such as the SL Marketplace, the SL Land Auction site, and (I assume, as it came along later) within the advertising spaces of Web Profiles.

Essentially, the programme allowed merchants to target niche markets, thus allowing them to have their products advertised directly to those with a specific interest in that market. So, for example, a merchant selling animals could set-up their ads to appear on SL Marketplace pages displayed to those people searching for animals. Prices were based on a number of impressions per month for the add, the size of the ad itself and a minimum purchase amount of some $10.00 USD.

While payments could initially only be made in USD (i.e. via credit / debit card), the basic idea seemed sound enough, and it seems that a number of merchants did sign-up to the programme.

But not enough, it seems, as the programme has now been cancelled, and will formally close on May 31st.

There has been no official announcement of the programme ending; all that has happened is that merchants who did sign-up received the following e-mail yesterday:

“Hello,

“Thank you for participating in the Second Life Advertising Beta program. Based on our evaluation of the SL Advertising Beta during the last six months, we have decided to discontinue the program on May 31, 2011. Access to advertise.secondlife.com for performance information and data downloads will remain open until June 7, 2011. For those that have active campaigns, we will ensure that all of the impressions that you’ve already paid for are delivered prior to closing the program.

“Thanks to all of the Merchants who have helped us test this display advertising beta and for all of your helpful feedback. Your participation and insights will help us drive our ongoing efforts to help you promote your products and services to Second Life shoppers. We look forward to partnering with you on future promotional endeavors.

“If you have any questions regarding this announcement, please email sladsbeta@lindenlab.com and we’ll get back to you as soon as possible.

“Signed,

“The Second Life Advertising Team”

In addition, if you try to reach the advertising site, you’ll simply get this message.

Precisely why the programme is closing remains unclear. Whether it proved difficult to maintain or whether too few merchants signed-up to make it viable long-term as a revenue generator for LL is simply anyone’s guess. It might even conceivably be because LL are planning to replace it with something more refined – although one would have thought those that had made the effort to participate would be given some indication that this was the case, if so.

As it stands the cancellation of the programme, coupled with what appears to be an attempt to quietly sweep it under the carpet does suggest the performance of the programme was less than stellar. If this is the case, then there is a question as to why it didn’t – and forgive the unintentional pun – make the desired impression.

Certainly those merchants that did participate had a favourable view of the programme and tended to find it did help boost sales. But if we’re honest, it wasn’t exactly the most well-supported initiative where LL is concerned: after the initial launch announcement from Nelson, and the video tutorial from Torley, the programme was never given another mention. During the six months it was operating, LL didn’t seek to promote it, report on it or give any further encouragement for merchants to sign-up.

Which is a shame, as with more participation and the promised means of paying via Linden Dollars, the scheme could have become very popular.