Anti-Harassment in VR worlds


#1

This thread is an offshoot of the following:

Many topics where laid out including this:

SERVER SECURITY AND ANTI-HARASSMENT

We will work on creating solid controls allowing server operators to regulate their spaces: At the simplest level, we need tools that allow a person running a domain to decide who to allow in, without necessarily needing to know (or caring to know) their username. Formation of groups, and the ability to delegate capabilities will likely be part of this work.

I want to focus on the latter of the two, anti-harassment.

Any virtual world, video game, or even a forum or chat room can bring together people from all over the planet to share, communicate and collaborate. With any mix of people who are communicating, there is the possibility of harassment.

Let’s be clear what I’m talking about. Someone’s intentional or accidental act of which deteriorates someone else’s in-world experience. I’m not talking about “I don’t like your content, it offends me” or copyright issues. I’m talking about when the interaction between two people becomes unpleasant and unavoidable.

In many places online, there is an authoritative presence that can override, ban, modify or otherwise quell disputes. Full disclosure, I’ve participated in Governance for both LL and Blizzard Inc. This presence comes at a huge cost of staffing. In every instance possible, we need to provide people with the tools to self govern their own destiny.

Let’s talk about past efforts for a moment, picking another virtual world totally at random:

As you can see, self-governance is prominent in this video. If you give people the access to tools so that they stay in control of their own experience.

What’s an example of not being in control? Let’s talk about a diamond ring that was so popular.

People love jewelry, free jewelry doubly so. It just so happened that that in this virtual world, free items where available in random shops. The lovely, blingy, and free diamond ring was very popular. You’d click on a box, copy it to your inventory, attach and there you had a shiny new ring on your finger.

What you didn’t know was that scripts in the ring where now pounding some random victim with messages.

The victim could be anywhere in world, proximity was no issue, and they had no way to mute the message nor know where they were coming from.

As easy solution for this was found. With changes to the viewer, message that came from an object also identified the owner of that object. Of course the owner was completely unaware, but could at least be informed that their shiny new ring was a spamming bot.

How else could this have been prevented? There was no way for the unintentional sender of these messages to know that an object was broadcasting out these messages. At first there was no way for the receiver to know where they were coming from without changes to the viewer.

Diagnostics, transparency, and overrides are key to preventing this.

Another famous trick was the invisible noisy object. This was often complicated by giving someone an object that they would rez, which would then self-replicate into objects that now bore the victims name as owner. Being able to counter something is not enough if it can be made so invasive as to overwhelm the tools with which you can clean them up. Sure you can mute an object, but can you mute 100 invisible microscopic ones? The ability to locate, identify, and mute “all the things” becomes key.

While server owners will likely have great control over their sectors, keep in mind that visitors to that same place may not. Sometimes it’s harder to come up with tools for people to control their experiences on other people’s servers.

What are your thoughts on what could happen in High Fidelity that one might see as harassment and what could be done to make sure people have control of their own experience?

Now this is a hot topic so please, let’s keep a cool head here and not turn this forum into an example rather than a set of solutions :slight_smile:


#2

Interestingly, when I originally saw the thread title. I was expecting a discussion on things like how to discourage Drama and the like, i.e. to defuse before it happens the situation where someone gets in someone’s face and demands, say, that they choose a different avatar than the one they usually prefer to wear, or leave immediately, because THAT person thinks that avatar type is an abomination before God or something. oO Nevermind that the avatar is something completely harmless and innocuous.

On SL they have a resident-run program called “Safe Place,” in which certain sims have designated themselves as a safe place to go (and have signs posted out showing it as such), where you don’t have to worry about verbal abuse, or discrimination based on avatar or religion or whatnot, or anything else where someone might make you feel uncomfortable just because you exist in this world and someone else wishes you didn’t. oO

Yes, it’s a really good idea to design into the system as many ways as possible to prevent technological-based harassment (i.e. the chat-spammer devices, the indiscriminate screaming-prims, the tracking/spying devices, etc, etc.), but unfortunately we’re also going to have to deal with the existence of loudmouthed-busybodies, and also the Social Justice Warrior types, and the astroturfers, and… well… various other organized bodies who’ll do everything in their power to try to force society down the path they think it should go down, and may well try to hijack large swaths of the Metaverse because there’s no central governing body who could tell them to go pound sand. But, then, this also goes the other way, too: There’s no central governing body that could get bamboozled by a few well placed appeals-to-emotion arguments into photon torpedoing a whole class of people or activities right on out of the Metaverse via a simple stroke of the pen simply because SOMEone out there gets their undies in a wad over it.

Ideally, we need to devise a way to have as many Safe Zones as humanly possible, while strongly discouraging discrimination across as broad a swath of the Metaverse as possible.

That said, yes, we need all sorts of anti-griefing mechanisms, too. As much thought needs to go into protection and prevention of that both at the local level and at the Metaverse level as can be devised. Means of containing it, means of preventing griefer-devices from easily spreading beyond the domain or sub-domain they first rezzed on, etc. etc.


#3

I believe in secondlife that allowing griefing and trolling was a design choice .only. Last night I had to report something spamming my land with particles it wasn’t on my land to return. I say design choice because to quote the matrix. Do you think that’s air you’re breathing there is no reason but design that I have to ask someone for assistance . I don’t want to ever have to ask the devs for help in my own domain


#4

BTW, this thread seems to me less about anti-harassment and more about security measures or ‘dangerous’ feature limiting.

One of the reasons I have asked many times about being able to get an immutable token (quite happy if it is opaque in the sense that the only three methods are token = avatar.GetToken, this.avatar == token, and avatar.AddToBackList() is that one can build a decent security system around that. I did that in another grid. The estate security system was nice in that it offers different ways to deal with miscreants. It could be domain operator or managers, or even a large set of residents. Full tracking and accountability, etc. It could even remove all object/entities of the ejected person to ensure they would not grief by proxy. This is why all entities rezzed by a person must be immutably stamped with their avatar opaque token so that they can be identified and dealt with.

Trying to find ways to limit how people can annoy others simply leads to an no-win technology escalation war, or worse, it leads to white-list only domains. Or domans in which no scripts can run unless you are whitelisted to run them. Or, no build whatsoever, etc. In short it quickly devolves to strongly gated communities in which people can at most walk around, chat, and that’s it.

I prefer open places under the assumption that most everyone are decent folks, that only a few people are problem makers and that the best way to deal with them is to get rid of them when they act out. Yes, a nice long post ejection talk is a good thing - people can reform after all, but one needs to be able to deal with problem people decisively, have the means to empower others to do that, and most important, when ejected that the ban applies to the set of other domains owned by the domain operator and perhaps other like minded subscribers.


#5

Yup, one of the interesting things about that SL video, though, which is conspicuous in its difference between how HiFi is going to work, is that it talks a lot about Abuse Reports. Obviously HiFi isn’t going to have any kind of central body to report abuse to, which in many ways that’s a GOOD thing, since it also means there’s not an easy, central place that some one group, by knowing how to push their buttons, has an easy way to get what they want to become the law of the land. But that also makes it that much hard to do away with abusive tactics. Then again,we’re probably better off without the “easy answers” that, say, LL brought us in the form of the option to send Abuse Reports to some central outfit who’d then deal with it… sometimes ineptly.


#6

We should make it more harassment based
Look @Balpien.Hammerer,s going to cry. Do u need a hug from ur momma do baby need a hug
:joy:


#7

When arguments are a matter of opinion, or one imagination pitted against another, you have to solve an imaginary problem with an imaginary solutions.

Thunderdome.


#8

LOL!

Fortunately, the Metaverse doesn’t exactly lend itself very well to the “Two men enter! One man leaves!” approach to disputes. And I guess that’s a good thing. We don’t really want a situation where one party gets to dominate “how things should be.” There’s already been TOO much of that as it is on SL. It is definitely much better to move strongly towards the direction of having no central body that have the power to arbitrarily tilt social matters in one direction or the other. But that also means we’re on our own in dealing with abuse of the social kind AND of the greifing kind.


#9

Two Avatars go in, One Avatar comes out.

Unfortunately thats sorta hard to enforce :slight_smile: since people can always teleport

In anycase, I don’t see this thread about social harrasment which is a problem more than the standard griefing stuff that was experienced in SL for shit and giggles or exploits

I held a Simulator in Second Life for 3 years, and on the first few years I had a leased a parcel on the simulator to a shop keeper. The shop keeper… did some questionable things and I didn’t notice it until the traffic my sim begun to spike and I found out about a Viral Animation Overider that spammed landmarks to the store.

Ofcourse I reported the individual, the object in question, and banned them from the estate and returned all the stuff they had to them for breaking the TOS and the Covenant without Refund.

But the Damage was done. Over the next year I still kept getting lots of random individuals just teleport to the parcel: there were still duplicates of the same Viral AO. Over time it phased out however, and I never saw It again: So yeah, I experienced that.


Now with High Fidelity:

Ownership is definitely something I want to have associated with scripts and Entities.
However we also have to remember that since anyone can edit any object currently, there also comes the question of who placed that script in the entity. There would need to be hard rules on it, but that is difficult to enforce when the system is built from the ground up now to take ownership or original creators into account.

The Second issue is the fact that every single script is run on the local client. This means all the scripts are not executed by the server, but in fact are executed by the client, unless the script in question is run in an assignment-client.

Those update timer loops and connections mean every single agent that is in that loop is updating the same objects if the entity ids happen to align.

This technically means you can easilly make a script that orbits anyone who loads the script on a timer, or spawn a really annoying sound loop at every agent location, that keeps following them, from anywhere within the domain where, only amplified by the amount of users in the domain, at the same time while forcing the avatar to play an animation without the users consent.

Now about messages. There currently is no default chat system. There is the Messaging API, which is more of protocol for scripts to communicate with each other. Scripts can tap into this and read or transmit throughout the domain server. they are not currently associated with an object, instead being associated with the client that triggers the message (because again, scripts are run by the client, which then manipulates the apis).

Locking down a domain would probably be the only defense we have as of the moment: not allowing anyone but authorized content creators to put down content. There should probably also be a permissions for attaching scripts to domain entities.

Another way would to improve the createEntity call so that the server knows who called it, and force life times on objects created by non authorised users , and allows only specific scripts to run on it, or as @philip put it during the last meeting “curated” scripts.

Avatar Entities are more identifiable, as those do have an owner that they follow around, but those would have the main issue of being only running for the creator. They also havent been released yet.


In anycase,
There is alot of Open-ended stuff that need some security, but it might require some massive architectural refactoring to get workign properly.


#10

At the moment a domain can be open or closed to everyone but the white list which is fair enough.
Users can be visible or invisible which is again fair enough
What bugs me tho is that I can have an invisible person in my domain that I have no way to locate.


#11

@Judas

Ill probably even improve it to point to the nearest avatar too.


#12

Cool but a dead link, unless thats what you want me to think 0.o


#13

Oh wow, it is dead. Ill fix it in a sec, need to check why it is dead o.o it shouldnt be.

I Kicked the server back online. Apparently my firewall configs were a tad bit to tight.


#14

:cry: :persevere: :rage: :bow_and_arrow: BLAM 20Megaton push arrow :computer: ban :relieved:


#15

First order of protection

  • Ability to declare who can rez entities - Done
  • Ability to declare who can run scripts (whitelist) or who cannot run scripts (blacklist)
  • All rezzed entities are tagged with owner token (cannot be changed)
  • Prevent anyone else from modifying an unowned entity in any way.
  • Add capability to have owner be able to set modify override permission [x]anyone [x] group
  • Add ability to get avatar opaque token
  • Add ability to blacklist avatar from domain via token (not session ID) (list must minimally handle several hundred).
  • Add ability for domain script to read the blacklist (get tokens only).
  • Add ability to FindEntitiesByToken

#16

I really love all the ideas and discussion here. Especially glad to see it all kept on a practical level.

I don’t mean to pick on Second Life when I show examples, the fact is it was so unique for so long that it really was a proving ground for many new ideas. Many things worked really well, it’s just that the moments when imaginations and ideas overlapped that things went sour.

Take the example of what was called Encroachment .

Encroachment was when someone elses objects overlapped onto someone else’s land. This was so that two people on two lands could aethetically combine their builds. However, it usually resulted in overlap between two uncooperative neighbors, or worse, two people actively trying to harass each other.

On a technical level, an object could only be stopped once its center-point reach the border. So a 50m prim could overlap another’s land by 25m. With the way HF is set up, more like portals to worlds rather than achres of flat land, this problem may be non-existant in that one “area” will tend to be owned and controled by one group or person. However it does bring up the point that if something can be used to harass, it generally will.

It’s seems though that social issues might be very different in HF and I support the idea of “if you don’t like it, go elsewhere or make your own space”. The idea of “public land” and shared spaces was more a kindergarten of “mine! mine!” than a utopian shared space. I don’t want to see HF fill with problems, (nor the tools to “fix” them) that could be better solved by avoiding them completely. It’s like the difference between dividing a room in half with tape and just moving out and getting your own place.

I sincerely hope that anti-harassment in HF will revolve around permissions, controls, and filters because G-team is long gone. Long live G-team.


#17

Of note. we are specifically planning on implementing exactly this feature. The notion of “temporary” objects that can only be created with a maximum lifetime specified by the domain operator. This would allow domain operators to give some users the right to create regular objects (that can be long lived) and other (more) users the right to only create temporary short lived objects.