Dave's Bit Bucket

Dave Walker's jottings - mostly pertaining to security


20061115 Wednesday November 15, 2006

Contemplating Second Life

Whatever your opinion of Second Life - and given the huge range of opinion I've seen in the press, ranging from "it's the future of the Internet" to "it's a complete waste of time" I suspect that you, dear reader, have an opinion and cleave to it fairly strongly - I'm rapidly reaching the conclusion that "ignoring it is probably a Bad Idea, and it's time I found out more about it".

The fact that we have our own pavilion on our own island, and that illuminati of the likes of John Gage, Tim Bray, Simon Phipps and Chris Melissinos have presided over conferences there, suggests that Sun sees some mileage in having a Second Life presence. There's also a growing list of Sun employees who have "incognito" avatars (ie ones with names which are not associated either with their own real-world names or with Sun); I've heard that one or two geographically-dispersed groups have even held team meetings there.

Further, from my perspective, the sanctioned crossover and exchange between the Linden dollar and the US dollar means that, not only can folk make a real-world living from virtual-world work, but if there are any security holes in the system which allow Linden dollars to be either transferred in an unauthorised manner or created from thin air in an unauthorised manner, someone could be on to a small fortune by nefarious means and Linden would be in serious trouble. I'd rather like to find out more about security in Second Life (not to exploit any holes I might find, of course - I'm a good boy really :-) ).

Second Life has a few barriers to entry. First of all, you need a fairly seriously-equipped box to run the client software on - and there isn't a Solaris client yet (although as there's a Mac OS X client available I could cope, even though my box is only at the specified entry level). Second, you need a reasonable pipe to the net at large, in terms of bandwidth; I don't have Internet connectivity at home, and Sun's external gateway blocks a bunch of ports that Second Life traffic flows over (SL requires UDP and TCP connections, inbound and outbound, on network ports 443 and 12020 to 13050, inclusive - the need for inbound connection initiation surprises me, I'd have hoped they'd be more firewall-friendly), so I'd have to get DSL installed at home (which is something I'm not hugely inclined to do, to be honest).

Finally, you need a name. This is more of an issue than is perhaps necessary; Linden only expose a small subset of possible surnames, and to get one which reflects your real-life affiliation (Chris Melissinos, for example, managed to get "ChrisMelissinos SunMicrosystems" as his SL name, all Linden employees have Linden as the surname of their SL avatars, and when Reuters set up their in-world bureau, "Adam Reuters" was created to head it up) involves a mechanism I don't know about yet. Pinging Linden tech support resulted in no useful feedback, but (provided you don't mind believing some things you read in the press) there's an article here which suggests that Linden may start selling names outside of their free-registration choices. The naming scheme from "Jennifer Government" appears to be coming to SL :-).

Also, I hear that the user interface isn't the world's easiest to drive - getting your avatar to walk, even, is a skill which needs to be acquired. When it comes to making arm gestures, at least, I wonder who'll be the first to splice together an interface which allows the controllers from Nintendo's Wii console to be used in an SL environment - maybe a Second Life client for Wii will happen at some point?

Update:

Well, synchronicity happens from time to time - here's me musing about the possibility of security holes in SL upsetting the Linden economy with real-world repercussions, and now I find out that someone has produced "CopyBot", a tool which can clone any in-world object and change its declared ownership to that of the CopyBot user. See the "SL Insider"'s view on the problem here...

Further Update:

It gets worse - now SL has had a brief period offline so that an in-world object which self-replicated when interacted with (effectively, an application-level fork bomb) could be cleaned-up. "Hello, nice folk at Linden, would you be interested in engaging the services of a bunch of security geeks to review your application design?"

(2006-11-15 08:33:26.0) Permalink Comments [1]

Calendar

« November 2006 »
MonTueWedThuFriSatSun
  
1
2
3
4
5
6
7
10
11
12
13
14
17
18
19
20
21
23
24
25
26
27
28
   
       
Today

RSS Feeds

XML
All
/Cooking
/General
/Java
/Networking
/Security

Search

Links

Innovate on OpenSolaris

  Read via bloglines :
British Blog Directory.


Navigation



Referers

Today's Page Hits: 657