[opensource-dev] Thank you for updating the Viewer Directory requirements

Henri Beauchamp sldev at free.fr
Wed Apr 28 14:57:29 PDT 2010


On Wed, 28 Apr 2010 21:34:29 +0200, Marine Kelley wrote:

> This is not a choice I made lightly, but many people simply did not
> understand why the RLV was not in the directory, and despite the number of
> times I said it was compliant, people just can't get their heads around the
> fact that TPV policy compliance and Viewer Directory listing are two totally
> different things. So I yielded.

In fact, it probably comes from the fact that Linden Lab uses contradictory
phrases in the TPV policy and in the TPV directory.

Quoting the former:

"Unlike the other sections of this Policy, participation in the Viewer
Directory is currently not a requirement for connecting to Second Life."

And quoting the latter:

"Beware of third-party viewers that are not in the Viewer Directory – they
have either declined to self-certify or been refused for noncompliance
with our policies."

So, registering to the directory is clearly not a requirement to be
considered as TPV-policy compliant, but on the other hand LL suggests that
the viewers which are not in the directory are "dangerous" ones...
This is both unfair and very close to pure diffamation.

Not to mention that being listed in the directory does not represent any
guarantee either, and this time both the TPV policy and the text in the
directory say the same thing: 

"However, because third-party viewers are not our viewers, we cannot
guarantee that they will follow our rules. You are responsible for
evaluating whether you want to use and share information with them."

and:

"The Viewer Directory is a self-certification program. Linden Lab does not
represent or warrant any independent testing or verification of compliance
of any application listed in the Viewer Directory. We disclaim all liability
associated with applications in the Viewer Directory."

I therefore would like to see LL remove that unfair and diffamatory phrase
in the TPV directory...

> Yes in some countries, requiring private RL data is illegal for a company
> that is not a public administration. However these info are already known by
> LL, they didn't require anything more than they already have.

You are wrong: LL doesn't have a clue of my RL address since I pay via
Paypal and only a name and valid email address are needed for this.

I do not see what knowing my snail mail address could bring to LL:
this is clearly and excessive requirement.

Beside, there is a difference between having private data held in a
payment database (which is usually well protected, even though it was
that very database that LL let leak out in 2007...), and having the
same data held in a low grade protection database such as the TPV
directory... Beside the level of data protection involved, there is
also the issue about who, at LL, can access the private data: I don't
see why a random Linden having access to the TPV directory would be
suddenly allowed to know exactly who I am and where I live.

> I gave mine (again) because nothing said that these data were possibly
> going to be published without my consent, at any time (LL has a privacy
> policy which is not rewritten on the directory, so I assume the regular
> one applies). And if my RL data became published one day without my
> consent, I'd have grounds to sue LL for that and I'd win.

Good luck to sue a US company from France (and vice versa) !...

Sorry, but as far as I'm concerned, I won't take the risk and won't trust
LL (or any other company on Internet, even French ones) about being able
to keep my data safe from prying eyes...

> Not that this is my intent in any way, but I'm just saying that it would
> cause damage on both parts if such a thing happened. So I am confident.

Fact is data theft already occured at LL and the only damages were for
their residents...

On Wed, 28 Apr 2010 13:50:11 -0600, Andromeda Quonset wrote:

> That aside, I investigated the application form for the 3rd party viewer.
> It does ask for my real name, but has that already filled-out for me,
> and is marked as something they won't publish.  It asks for age
> verification, which I completed years ago.  They have my payment 
> information on-file already. It also asks for a secondary email address
> to use with my viewer, and that I already publish widely.
> 
> It does NOT ask for the address for where I live.

It does... I just checked again...

Henri.

-----------
Reference email:

> On 28 April 2010 20:40, Henri Beauchamp <sldev at free.fr> wrote:
> 
> > On Wed, 28 Apr 2010 18:02:24 +0200, Marine Kelley wrote:
> >
> > > Hi, I'd like to thank whoever changed the application page on the Viewer
> > > Directory, the RL info fields used to be "publishable" (they had a little
> > > cross next to the little star indicating that they were mandatory), and
> > > that's what was holding me from registering the RLV there. Today I just
> > > noticed that these fields (RL name, address etc) are not "publishable"
> > > anymore, which mostly addresses the concerns I had before, namely having
> > my
> > > RL info published without my agreement. Therefore I have applied to
> > register
> > > the RLV on the Viewer Directory today, we'll see how it goes.
> >
> > This is still *way* beyond what I am ready to provide to LL: it is
> > *illegal*
> > in France to require private data that is not strictly necessary to provide
> > a service. Reference: Law Informatique et Liberté, Article 6, paragraph 3
> > (http://www.cnil.fr/fileadmin/documents/en/Act78-17VA.pdf), citation:
> > "The collected data [...] shall be adequate, relevant, and not excessive
> > in relation to the purpose for which their are obtained and their further
> > processing."
> >
> > Being published in the directory should not be made conditional to the
> > divulgation of my real name and address. All what Linden Lab needs to
> > have is my avatar name and an ISP based email (which they both already
> > got): even in case of a legal issue, this info is sufficient for the
> > police or the justice to identify me.
> >
> > Beside, given LL clearly states that they can modify the TPV policy at any
> > time, how could you be sure that they won't suddenly decide to reveal your
> > private data publicly ?... Another concern is about the security of your
> > data. Linden Lab has already an history with data theft (see:
> > http://www.bit-tech.net/news/gaming/2006/09/12/Second_Life_servers_hacked/1
> > )
> > and this may happen again, particularly with secondary and weakly protected
> > databases such as the TPV directory.
> >
> > Sorry, but I will not endanger my real life by risking to get my real name
> > publicly associated with my SL avatar name.
> > As a French citizen, I will go by the French law which allows me to stay
> > anonymous and preserve my private data.
> >
> > I already raised this concern, but apparently Linden Lab is ignoring it...
> >
> > For this reason and although fully TPV policy compliant, the Cool VL Viewer
> > will not be registered in LL's TPV directory.
> >
> > Henri.
> > _______________________________________________
> > Policies and (un)subscribe information available here:
> > http://wiki.secondlife.com/wiki/OpenSource-Dev
> > Please read the policies before posting to keep unmoderated posting
> > privileges
> >
> 


More information about the opensource-dev mailing list