OpenSimWorld is the directory of 3D Virtual Worlds based on OpenSimulator and connected through the HyperGrid. Learn More
New Members
Muneebjutt, KaoruSlade, Thalya, SpookyKid, Ezarhon, V9bettel, Windows VPS Cheap, EllenOptinett, RavenIce, ToquiNovic, Dionnem, SkyeArabella, Aladdin, Jun88law, GayNation2024, JaviBoi, Germangrid, Jonjb2024, Kieran Brookes, Hairton_EarnshawLikes
For better or worse, I am sharing things I have done for online safety in Opensim, as the reader you can decide for yourself which actions to take. If you can learn from your own mistakes, you are pretty smart but if you can learn from SOMEONE ELSE'S mistakes, you are a genius!
After reading a number of posts on Opensimworld, it is apparent that some hobbyists of unaware of protections they have available when running Opensimulator for the first time. Some tinkerers may opt for running a simulator on their spare computer at home and connecting the region to an OPEN grid like OSgrid or Zetaworlds. Nothing beats the excitement of having your own land for the first time. You spend hours designing your city, giving it a theme, placing sit targets on all of your furniture; everything is 'ponies and rainbows' until some jerk comes in and decides to populate your territory with questionable objects in the hopes they can READ YOUR COMPLAINTS HERE ON OPENSIMWORLD while they are fondling their (ahem - your favorite depiction here) ego at your ire.
THE BEST RESPONSE TO TROLLS IS NO RESPONSE. When you ignore them, they move on to someone else who will make some noise... They are like vampires feeding off of negative energy.
The screenshot above illustrates things you can do to protect your simulators. In 'about land, options' section I un-check the Everyone boxes. Only Group users may use those features. You can also define who may enter, in 'about land, access' you can restrict access to a group or only certain individuals. Now some of you will say "Stop right there, my visitor's AO will not work or they cannot use their custom dance huds". The good news is that if your visitors are using the AO built into their viewer, that is not a problem, they will have their own custom animations or dances and will not need to run scripts. If the visitor is someone you can trust, you can allow them into the group... If you are having a party, you can temporarily enable script access to guests while you are present. When you are running the region it is up to YOU to POLICE IT. You have options for blocking hostiles in your built-in configuration files. There are also scripted solutions for traffic control where you can banish individual users, entire grids or IP ranges in real-time. You are free to seek out any technology which keeps your world safe. I strongly advise that you examine the code before employing these security devices.
For Hypergrid users: Enjoying a LAG-FREE experience is not the HOST's responsibility. IT IS YOURS.
As computers get more powerful each year, region operators WILL populate their sims with content that could bring many CPUs and display adapters to their knees. Lets face it, not everyone can afford to buy a new computer every year with all of the latest bells and whistles. When traveling you want to make sure your PC is optimized for controlling client side lag. Luckily, your viewer has features available to combat these issues. Reducing draw distance, particles, LOD and avatar complexity will give you better frame rates at the expense of reduced visual quality.
Other ways to protect yourself when traveling include: Making sure your SUITCASE IS EMPTY - the more junk you have in there, the more BLOAT that follows you as you travel. You can also make a lightweight hypergrid avatar. The screenshot above shows my actual inventory window. Instead of carrying everything on my person, I have everything rezzed on land in a hidden region on my grid that only I can access. Less inventory means less orange smoke at login. I have been told that some shady grid owners can use rogue simulator code see what is in your suitcase and copy it. I have also heard of grid operators cloning visitors via collision scripted objects - it is easy to copy stuff a cloned avatar is wearing. I always say "Never wear anything when traveling that you do not want some simpleton to copy". I have seen some nasty OSSL code that will crash the sim of the person who cloned you without permission. Trolling the trolls can be fun BUT I digress, TWO WRONGS DO NOT MAKE IT RIGHT.
Opensim does not have to be the 'WILD WILD WEST' - protect yourselves & protect your regions. You and your guests can enjoy the best of Opensimulator.
As always, feel free to share this article when needed.
Peace & Love
Spax
After reading a number of posts on Opensimworld, it is apparent that some hobbyists of unaware of protections they have available when running Opensimulator for the first time. Some tinkerers may opt for running a simulator on their spare computer at home and connecting the region to an OPEN grid like OSgrid or Zetaworlds. Nothing beats the excitement of having your own land for the first time. You spend hours designing your city, giving it a theme, placing sit targets on all of your furniture; everything is 'ponies and rainbows' until some jerk comes in and decides to populate your territory with questionable objects in the hopes they can READ YOUR COMPLAINTS HERE ON OPENSIMWORLD while they are fondling their (ahem - your favorite depiction here) ego at your ire.
THE BEST RESPONSE TO TROLLS IS NO RESPONSE. When you ignore them, they move on to someone else who will make some noise... They are like vampires feeding off of negative energy.
The screenshot above illustrates things you can do to protect your simulators. In 'about land, options' section I un-check the Everyone boxes. Only Group users may use those features. You can also define who may enter, in 'about land, access' you can restrict access to a group or only certain individuals. Now some of you will say "Stop right there, my visitor's AO will not work or they cannot use their custom dance huds". The good news is that if your visitors are using the AO built into their viewer, that is not a problem, they will have their own custom animations or dances and will not need to run scripts. If the visitor is someone you can trust, you can allow them into the group... If you are having a party, you can temporarily enable script access to guests while you are present. When you are running the region it is up to YOU to POLICE IT. You have options for blocking hostiles in your built-in configuration files. There are also scripted solutions for traffic control where you can banish individual users, entire grids or IP ranges in real-time. You are free to seek out any technology which keeps your world safe. I strongly advise that you examine the code before employing these security devices.
For Hypergrid users: Enjoying a LAG-FREE experience is not the HOST's responsibility. IT IS YOURS.
As computers get more powerful each year, region operators WILL populate their sims with content that could bring many CPUs and display adapters to their knees. Lets face it, not everyone can afford to buy a new computer every year with all of the latest bells and whistles. When traveling you want to make sure your PC is optimized for controlling client side lag. Luckily, your viewer has features available to combat these issues. Reducing draw distance, particles, LOD and avatar complexity will give you better frame rates at the expense of reduced visual quality.
Other ways to protect yourself when traveling include: Making sure your SUITCASE IS EMPTY - the more junk you have in there, the more BLOAT that follows you as you travel. You can also make a lightweight hypergrid avatar. The screenshot above shows my actual inventory window. Instead of carrying everything on my person, I have everything rezzed on land in a hidden region on my grid that only I can access. Less inventory means less orange smoke at login. I have been told that some shady grid owners can use rogue simulator code see what is in your suitcase and copy it. I have also heard of grid operators cloning visitors via collision scripted objects - it is easy to copy stuff a cloned avatar is wearing. I always say "Never wear anything when traveling that you do not want some simpleton to copy". I have seen some nasty OSSL code that will crash the sim of the person who cloned you without permission. Trolling the trolls can be fun BUT I digress, TWO WRONGS DO NOT MAKE IT RIGHT.
Opensim does not have to be the 'WILD WILD WEST' - protect yourselves & protect your regions. You and your guests can enjoy the best of Opensimulator.
As always, feel free to share this article when needed.
Peace & Love
Spax
Liked by: 
Comments
One more.... will say only once.
Years ago one of oldtimers here show me how connect to IP port 8003 with linux terminal and direct send SQL commands.
Priscilla use this hole and BASH SCRIPT yes, linux bash with direct SQL command to replace assets with example on...... shhhhhhht....
.... are you read and understand what i say?
like(1)
Years ago one of oldtimers here show me how connect to IP port 8003 with linux terminal and direct send SQL commands.
Priscilla use this hole and BASH SCRIPT yes, linux bash with direct SQL command to replace assets with example on...... shhhhhhht....
.... are you read and understand what i say?
Use firewall, hardware or iptables on linux but ALWAYS HIDE your serwer behind firewall:
https://opensimworld.com/post/95832
and always DROP any trafic to UDP ports 123 and 1900.
like(1)
https://opensimworld.com/post/95832
and always DROP any trafic to UDP ports 123 and 1900.
I appreciate all of the feedback. If you guys have any additional security tips to share, feel free to add them here. =D
like(0)
As far as avatar scripts are concerned, I can only confirm what Pagane said.
Sure, there are people who come to parties with 40+ visitors wearing enough stuff for several dozen running scripts. Sure, bans on scripts will relieve your grid server of the workload that comes with dozens of avatars wearing ZHAO AO attachments (because many people are still too lazy to put their AO into their viewer, and next to nobody has ever heard of khAOs).
But most mesh bodies depend on avatar scripts being allowed to run, some more, some less.
This starts with alpha HUDs. They're always script-based. Let's say you go to a party in your usual black leather jacket + long blue denim jeans + sneakers. It isn't before you arrive that you see it's a beach party, and everyone is wearing swimwear. So you change into your swim trunks. But you have to make all those body chunks visible again that you've switched off so that they don't clip through your jacket and jeans. And you can't do that because the ban on scripts renders your HUD useless. Essentially, you'll have to teleport to an entirely different sim where avatar scripts work to close those ugly holes in your body.
Or let's assume you have an Athena or Decadence-HG or the like. One of the bodies where you can use the HUD to select a foot position that corresponds to your shoes. Let's assume you're wearing 4" heels like 99% of all avatars on the Hypergrid do all the time. Let's assume you want to take them off, but you don't want to run around on tip toes. You want to switch your feet back to flat. Guess what, doesn't work, scripts required for that but blocked.
Granted, this can occur with all these bodies regardless of whether scripts are allowed or not. You only have to teleport onto any sim with an ever-so-slightly different OpenSim version, and your body doesn't react upon any orders from your HUD anymore. If scripts are allowed, a possible solution would be to detach and re-attach both the body and the HUD, but those typical bodies have a tendency of blowing up in your face to the point of having to be replaced if you do that. Still.
It's different with Ruth2 v4 and Roth2 v2. The former doesn't require a HUD to change foot positions; you simply replace the feet. And both don't have traditional, fine-grained alpha HUDs. But this also means that both rely on alpha masks. And in order for alpha masks to work, the alpha mode of the body has to be correct, ideally alpha masking, but alpha blending works, too. You can actually switch between these two alpha modes using the HUD. But this requires scripts to work again.
And this function can be essential. The reason is because it sometimes happens that you teleport onto another sim (same grid or different grid), and your alpha mode switches to none. All of a sudden, your alpha masks don't work anymore, and your body clips through your clothes. You can fix this by attaching your HUD and switching back and forth between the two alpha modes. If that doesn't work, detach the body (these bodies WON'T blow up if you do that), re-attach it and, if necessary, do the alpha mode switching trick once more.
If scripts aren't allowed, however, you can't do that. There's no safe way for you to fix that clipping. Worse yet: You can't teleport back home, fix the problem, teleport back to where you went in the first place and hope the problem won't re-occur. You have to be able to fix it right where you are. Editing the surfaces of your attached body and changing the alpha mode manually is an ugly kludge, and not everyone who has such a body knows that trick.
Another unique feature of Ruth2 v4 and Roth2 v2 is that you can use the HUD to actually switch BoM off and back on again. Separately for the body (+ head, if attached separately, + feet in Ruth2 v4's case + elf ears), the eyes, the fingernails and the toenails. However, detached body parts remember whether BoM was on or off when you detach them.
So if you replace your feet and toenails because you want to change from sneakers to pumps, and you discover that your medium-height feet and their matching toenails still have BoM switched off from a party on an Arriba-based grid, and you also discover that you can't switch BoM back on because avatar scripts are blocked, you have a problem.
All this, by the way, is why it's a terrible idea to block scripts on homestead sims. If people can't change how their avatars look because the scripts they need for that are blocked, a major use case for a home on a homestead is rendered impossible.
like(1)
Sure, there are people who come to parties with 40+ visitors wearing enough stuff for several dozen running scripts. Sure, bans on scripts will relieve your grid server of the workload that comes with dozens of avatars wearing ZHAO AO attachments (because many people are still too lazy to put their AO into their viewer, and next to nobody has ever heard of khAOs).
But most mesh bodies depend on avatar scripts being allowed to run, some more, some less.
This starts with alpha HUDs. They're always script-based. Let's say you go to a party in your usual black leather jacket + long blue denim jeans + sneakers. It isn't before you arrive that you see it's a beach party, and everyone is wearing swimwear. So you change into your swim trunks. But you have to make all those body chunks visible again that you've switched off so that they don't clip through your jacket and jeans. And you can't do that because the ban on scripts renders your HUD useless. Essentially, you'll have to teleport to an entirely different sim where avatar scripts work to close those ugly holes in your body.
Or let's assume you have an Athena or Decadence-HG or the like. One of the bodies where you can use the HUD to select a foot position that corresponds to your shoes. Let's assume you're wearing 4" heels like 99% of all avatars on the Hypergrid do all the time. Let's assume you want to take them off, but you don't want to run around on tip toes. You want to switch your feet back to flat. Guess what, doesn't work, scripts required for that but blocked.
Granted, this can occur with all these bodies regardless of whether scripts are allowed or not. You only have to teleport onto any sim with an ever-so-slightly different OpenSim version, and your body doesn't react upon any orders from your HUD anymore. If scripts are allowed, a possible solution would be to detach and re-attach both the body and the HUD, but those typical bodies have a tendency of blowing up in your face to the point of having to be replaced if you do that. Still.
It's different with Ruth2 v4 and Roth2 v2. The former doesn't require a HUD to change foot positions; you simply replace the feet. And both don't have traditional, fine-grained alpha HUDs. But this also means that both rely on alpha masks. And in order for alpha masks to work, the alpha mode of the body has to be correct, ideally alpha masking, but alpha blending works, too. You can actually switch between these two alpha modes using the HUD. But this requires scripts to work again.
And this function can be essential. The reason is because it sometimes happens that you teleport onto another sim (same grid or different grid), and your alpha mode switches to none. All of a sudden, your alpha masks don't work anymore, and your body clips through your clothes. You can fix this by attaching your HUD and switching back and forth between the two alpha modes. If that doesn't work, detach the body (these bodies WON'T blow up if you do that), re-attach it and, if necessary, do the alpha mode switching trick once more.
If scripts aren't allowed, however, you can't do that. There's no safe way for you to fix that clipping. Worse yet: You can't teleport back home, fix the problem, teleport back to where you went in the first place and hope the problem won't re-occur. You have to be able to fix it right where you are. Editing the surfaces of your attached body and changing the alpha mode manually is an ugly kludge, and not everyone who has such a body knows that trick.
Another unique feature of Ruth2 v4 and Roth2 v2 is that you can use the HUD to actually switch BoM off and back on again. Separately for the body (+ head, if attached separately, + feet in Ruth2 v4's case + elf ears), the eyes, the fingernails and the toenails. However, detached body parts remember whether BoM was on or off when you detach them.
So if you replace your feet and toenails because you want to change from sneakers to pumps, and you discover that your medium-height feet and their matching toenails still have BoM switched off from a party on an Arriba-based grid, and you also discover that you can't switch BoM back on because avatar scripts are blocked, you have a problem.
All this, by the way, is why it's a terrible idea to block scripts on homestead sims. If people can't change how their avatars look because the scripts they need for that are blocked, a major use case for a home on a homestead is rendered impossible.
This is why it was suggested that people consider having a lightweight hypergrid avatar. It is up to guests to determine what types of content they will use when visiting foreign grids. The HOST is under no obligation to accommodate them. If you know beforehand that you are visiting a sim where scripts are not allowed you can choose to go someplace else or you can choose to adapt. If I were to use a mesh avatar on hypergrid I would opt for a body where I have the textures and alphas already baked into the mesh without needing any code to maintain appearance... With all of those mesh bodies being given out full perm, it is VERY EASY to fix them so scripts are not needed. I may consider doing a video tutorial demonstrating this in the future. Cheers!
like(1)
My hypergrid avatar consists of the basic skin, hair, shape and eyes. The clothing texture is baked into the skin. Lightweight does not mean 'clothing optional' ...Sorry... I could not resist, I had to chime in on that one =D
like(0)
Well, if I know beforehand that the place I'm travelling to doesn't allow scripts and may cause trouble with Bakes-on-Mesh, I can turn BoM entirely off by selecting a skin referenced by the Roth2 v2 HUD. I've modified the HUD so that I can select my own skin textures, and I have variants of them with alpha cut-outs already included. However, this limits me to wearing only a small selection of clothes because I can't include all alpha cutouts I have into that HUD.
Still, I don't have to sacrifice the flexibility that comes with BoM by throwing every last script out of my body and firmly baking one static skin onto it like onto a newly-rezzed prim cube. If I take all combinations of alpha masks which I need day-by-day into consideration, I'd need several dozen separate mesh bodies just for the alpha cutouts. Add several variants of each one of them on top for baked-on socks.
This flexibility is even more important for my in-world sister Juno and all the other Ruth2 v4-based avatars: They absolutely require BoM to be able to wear underwear, swimwear, hosiery, make-up etc. and alpha masks on top. Without BoM and without scripts, Juno would literally need SEVERAL THOUSAND variants (!!!) of her body to have the same flexibility she has now with BoM. And each one of these variants would require up to three textures being edited in GIMP, exported and manually baked onto the body.
Most of the time, however, I don't know beforehand whether or not my destination has blocked scripts. I don't always have the time to visit it before an event. And some places treat avatars differently, depending on whether said avatar is alone or has arrived when there are already 20 other avatars present. So I have to be able to react when I'm there.
like(0)
Still, I don't have to sacrifice the flexibility that comes with BoM by throwing every last script out of my body and firmly baking one static skin onto it like onto a newly-rezzed prim cube. If I take all combinations of alpha masks which I need day-by-day into consideration, I'd need several dozen separate mesh bodies just for the alpha cutouts. Add several variants of each one of them on top for baked-on socks.
This flexibility is even more important for my in-world sister Juno and all the other Ruth2 v4-based avatars: They absolutely require BoM to be able to wear underwear, swimwear, hosiery, make-up etc. and alpha masks on top. Without BoM and without scripts, Juno would literally need SEVERAL THOUSAND variants (!!!) of her body to have the same flexibility she has now with BoM. And each one of these variants would require up to three textures being edited in GIMP, exported and manually baked onto the body.
Most of the time, however, I don't know beforehand whether or not my destination has blocked scripts. I don't always have the time to visit it before an event. And some places treat avatars differently, depending on whether said avatar is alone or has arrived when there are already 20 other avatars present. So I have to be able to react when I'm there.
Very good manual.
Only why to disable fly?! Your assets cannot fly out when someone fly around:)
Disable scripts absolute and tottaly kill Athena, Ruth and all Mesh and BOM avatars! In store region this is good, but in dance club is...... same as dance club without sound and light! Better check your osslEnable.ini file.
About server who delete your assets from inventory........ Try to delete some when you is in other grid (GRID! not sim!!!) If you really delete and emty trash - STOP SERVER and start to check config!
And most important:
Allow to group to build in small grid hosted on home PC, with one only owner....... What groups you dream?! Awake!!! This is NOT osgrid or kitely!!! NO GROUPS BUILD FOR WINDOWS HOSTED HOME SIM WITHOUT CUSTOMERS!!! (Visitors is not customers!)
If you is not true qualified server admin, better allow god acces to 1-2 close friends than to open giant "groups hole"......
like(1)
Only why to disable fly?! Your assets cannot fly out when someone fly around:)
Disable scripts absolute and tottaly kill Athena, Ruth and all Mesh and BOM avatars! In store region this is good, but in dance club is...... same as dance club without sound and light! Better check your osslEnable.ini file.
About server who delete your assets from inventory........ Try to delete some when you is in other grid (GRID! not sim!!!) If you really delete and emty trash - STOP SERVER and start to check config!
And most important:
Allow to group to build in small grid hosted on home PC, with one only owner....... What groups you dream?! Awake!!! This is NOT osgrid or kitely!!! NO GROUPS BUILD FOR WINDOWS HOSTED HOME SIM WITHOUT CUSTOMERS!!! (Visitors is not customers!)
If you is not true qualified server admin, better allow god acces to 1-2 close friends than to open giant "groups hole"......
Good question. The reason I turn off the FLY option is because some of my regions are heavily themed. Having avatars fly around breaks immersion or established lore in your sim. Disabling flight is OPTIONAL and does not provide any security, moreover some legal viewers can override this setting. I have seen sim owners in SL and OS banish users for flying where it is not permitted.
like(1)
Correct: I have scripts which will activate upon permission change and will destroy the object and it's contents. This does not stop someone from using a "no scrip zone" to godmode the item and look at the scripts inside.
like(2)
From the OPENSIM wiki: Actively Malicious Hosts
The new security threat introduced by openness, one that does not exist in closed grids, is the possibility of a user to visit a region that is running malicious code. In the current state of opensim, a malicious host can do serious damage to the user's assets. Let's see how.
Assume you have your assets in your hypergrided-standalone opensim, and you go visit another opensim that happens to be running malicious code. Here is a non-exhaustive list of vulnerabilities that you are exposed to:
The host has your session id, so it can request your inventory items on your behalf and store copies in its local asset server. To add insult to injury, a malicious host could simply wipe out your inventory after having copied it.
Even if the malicious host doesn't access your items by itself, every time you access items in your inventory while you are in that region, those items are cached in the region's local cache, and can be stored persistently by the malicious host.
Malicious hosts can do a lot more damage, but those two are enough to illustrate this new kind of vulnerability affecting open grids. Note that this affects all open grids, i.e. those where arbitrary people can plug-in their opensims, and not just the hypergrid.
like(0)
The new security threat introduced by openness, one that does not exist in closed grids, is the possibility of a user to visit a region that is running malicious code. In the current state of opensim, a malicious host can do serious damage to the user's assets. Let's see how.
Assume you have your assets in your hypergrided-standalone opensim, and you go visit another opensim that happens to be running malicious code. Here is a non-exhaustive list of vulnerabilities that you are exposed to:
The host has your session id, so it can request your inventory items on your behalf and store copies in its local asset server. To add insult to injury, a malicious host could simply wipe out your inventory after having copied it.
Even if the malicious host doesn't access your items by itself, every time you access items in your inventory while you are in that region, those items are cached in the region's local cache, and can be stored persistently by the malicious host.
Malicious hosts can do a lot more damage, but those two are enough to illustrate this new kind of vulnerability affecting open grids. Note that this affects all open grids, i.e. those where arbitrary people can plug-in their opensims, and not just the hypergrid.
Thanks! Yup... need to reduce the stuffing in my suitcases soon. My Kitely one might be approaching semi ginormous level... better keep an eye on my new one at AMV. My OSgrid account lacks this function, no wonder I'm screwed with that avi (+ my alts there) sometimes when I travel elsewhere in the HG.
like(2)
The suitcase is a temporary storage folder where content is stored when traveling on foreign grids. Once you return home, you can move the content to your regular inventory folder. You only want items in your suitcase that you plan on using when traveling outside of your grid. The less items in there, the quicker those items will load when you attempt to use them.
like(3)
Just finished weeding out the suitcases in my AMV and Kitely accounts. Took the better part of an hour. 2 main avis, and three alts! Thankfully not as bad (or as massive) as managing my SL inventories, that's taking forever and a day...
like(1)
It took me about a year to get my SL inventory under control. I still have too much stuff I should get rid of. Cheers!
like(1)
So you delete my comments which is the truth so here’s another comment….
well Duh, they clone you. so what.. Your avatar only is in a file they can use in dance balls, NPCs etc
It can be collision items, touch items, just opening a door can hold that script with it.
if you are that scared, close your grid off!
2nd
Dont just go to any grid/region you see.. Would you go to Detroit and just pop into any building or house that has a sign, come on in?
Have a brain and do a little research before you just pop into some ones region/grid
like(1)
well Duh, they clone you. so what.. Your avatar only is in a file they can use in dance balls, NPCs etc
It can be collision items, touch items, just opening a door can hold that script with it.
if you are that scared, close your grid off!
2nd
Dont just go to any grid/region you see.. Would you go to Detroit and just pop into any building or house that has a sign, come on in?
Have a brain and do a little research before you just pop into some ones region/grid
I encountered the same bug... some of my replies are not posting either... I have reported the problem.
like(2)
I have not deleted any comments and WILL NOT delete comments. I DO NOT believe in censoring opposing views.
I am well versed in the creation of NPCs. I can tell you that the appearance notecards are INSECURE. If you are wearing your inventory in a prim when you are cloned, the owner of the generated appearance card has access to anything you are wearing and the CONTENTS within it.
like(2)
I am well versed in the creation of NPCs. I can tell you that the appearance notecards are INSECURE. If you are wearing your inventory in a prim when you are cloned, the owner of the generated appearance card has access to anything you are wearing and the CONTENTS within it.
