October 2

Saturday, October 02, 2010 Rissa Bolissima 0 Comments

October 2 2010 on Second Life
Rissa went with Kaylan to Petunia’s for the $60L weekend specials, and after looking around, they purchased a few other items as well.
Rissa then resumed her Bats & Cats Hunt. She finished the Bats Hunt on Friday, so the Cats will be hunted on Saturday!!
Kaylan, Rissa and Venom went dancing for a little while on Saturday afternoon! The contest was for ‘Best in Black’ Kaylan and Venom and one other girl all tied!!
Rissa is thoroughly annoyed with Imprudence viewer. So back to the Third-party viewer directory!!
Rissa crosses her fingers and proceeds to press the ‘download’ button…
While signing in to Second Life with the Emergence Viewer, the 'creator' (??) had a long notice to read about this viewer.. I will put this notice at the end of this post.
Emergence isn’t any better than any of the other viewers… Is there a good SL viewer to be had?

Here is the notice that is available to read while signing in to Second Life with the Emergence Viewer.
  • Past:
I made a thorough post concerning lots of emerald related issues recently, however I feel i need to clue people in on the conclusions I have made based off it, and let you decide whether they are logical.
The recent discoveries have made it very clear to me that certain people find it ok to hide code behind both the developer’s, and the user’s back. Considering the circumstances and evidence that I have already provided, it is apparent that the binaries coming out of emerald can not be trusted regardless of the security methods used to check it. Packet sniffing would not have detected this, as it was encoded inside a normal clothing image already sent to the linden servers. Anti-virus software did not detect this because installed programs are allowed to access a wide range of files (including your saved password file) without any cause for alarm (as most programs use that ability legitimately, and restricting it would cripple nearly every program). Despite this, by some stoke of luck the hidden code in emkdu was discovered after months of it existing; however, considering how long this took to find, it is illogical to assume that other hidden code does not exist or should have been discovered by now. Which also means that simply removing emkdu is not an action that would give you a safe viewer (I apologize if my posts before appeared to be a solution). Code similar and far more malicious could and may be embedded in any binary with an even more cryptic way to hide it, and without going into crazy conspiracy nonsense, it is clear that having an untrusted binary running on your computer is absolutely unacceptable. A new tpv policy will be in place banning encrypted binaries in an attempt to help protect the users, however this is not adequate protection either considering how *hiding* the code had a far greater effect than *encrypting* it. (Hiding this code kept it from exposure for months, encrypting it kept it for weeks)
Also, concerning the latest modsys announcements, it appears to only be a PR stunt, the people involved still are.
  • Present:
Despite being sick of dealing with all of this, I have witnessed too many of my friends in a position where they are hurt. They either loose the features in emerald, or they have their computer placed at risk.
I have decided to do what I can to help, and have created my own private project, the “Emergence Viewer” which is simply a clone of the latest emerald source code I had, compiled and produced in a way where all binaries are either provided from a well known trusted source (such as linden lab or openjpeg), or myself. 
http://code.google.com/p/emergence-viewer/ Because of limited resources available, I will only be able to provide a windows binary. If you learn anything from this whole experience (I have learned numerous), do not ever trust binaries that you do not fully trust the source of! If you do not know me or have a good reason to trust me, do not use this binary! However, since I am the only developer on this project, I can fully promise that emergence will be entirely free of any malware or hidden code of any kind to the very best of my ability. I am happy to be fully responsible for everything in it directly, though I do not take the credit for it, as most of the code is from other generous developers who have given freely of themselves.
I do not plan on updating or making changes to this viewer unless absolutely necessary, this is a last minute salvage operation, nothing more.
  • Future:
I have had my trust broken by too many people who I honestly felt never would, it will take time for me to come to terms and process all of that in a way I can use it, and unfortunately some people who have always been there for me will have to wait for me to understand all of this. More importantly, I try to make it a rule to not make the same mistake twice, which is part of why I really have no plans on further developing emergence or any other third party viewer. I have however, had a great opportunity opened to me, and I plan to spend my time working with the people of Virtual Ability http://virtualability.org , as I really feel that this is a way I can do the greatest good for the greatest number. (It is actually really exciting, they have done some amazing things already (got a linden prize o.o), have been around and stable for a while, and get this. I asked a bunch of people to try and find as much crap/drama/dirt on these people as they could (everyone is evil at least a little bit right?), the contrast to what I was in before is staggering, I even ran into a second hand report (saying they actually do what they say!) It looks like I will be able to continue working on open-source viewer development for second life, just focused in a way make it more accessible to people who really need it. I hope it goes well, if anyone has any information (a first hand story would be epic) please IM me.)
Also, thank you so much to the people who have offered me any sort of support. I felt betrayed and abandoned and your help has really made a difference to me.
(edit: due to current events, I will be either updating emergence, or providing links via the login for a different viewer for people to switch to)
August 22, 2010
Emerald Reassessment
This post is one I have needed to make a long time ago. This is totally in my eyes, my personal perception, as very few things were ever written down.
Emerald is no longer what It was for me, I have been dedicating a ridiculous amount of my time to this project for near two years now, and It’s been difficult to see it go the way it has.
It started off as a joint effort to bring talented people together to make something that people could really appreciate it, something that I could work on and give as a gift to my friends. All sorts of people have worked on it over the time, some people whom I trusted and respected, and some that I took things as they came. The similar thing was that it appeared that we were all working to be productive and helpful, to make an amazing viewer. Trust was never a critical point in the project, as everything that was done was transparent to everyone. Every code change was easily viewable by everyone, including the public, so there was really no issue with worrying about someone adding something nasty. Back when there were questions of the viewers integrity, I personally put my support behind it, promising that I would double and triple check code commits as much as I could to ensure that everyone was secure.
Unfortunately, I do not feel confident enough to support it any more, for a number of reasons. I did not realize at the time that emkdu was added, that it could be used to add in code I was not able to see. These things were done behind my back, it was found out by others that code was placed in that braodcasted your viewers title bar and executable path in a obfuscated manner. This was addressed, promised to be fixed, and (luckily) people broke through the now encrypted layer to find out that it was not. Of-course, it has been promised to be fixed a third time, but now with an encryption level too high to be broken. Although replacing or deleting emkdu would resolve this issue, I also have to consider that this was hidden in the code for months without anyone knowing..
Regardless of the intentions of those who placed this code there, It has made one thing inescapably clear. I am not able to double check everything any more. I tried to find a solution to resolve this matter, but it appears that most people do not care about this to the level that I do. I made sure the other emerald devs were aware of what is going on viathis. As mentioned there, closed source, hidden designs and single developer licenses have no place in emerald. People can make mistakes, but it is important that others can double check without having to break through encryption. Nothing has changed however. This issue of being able to transparently check up on everyone is only to get worse in my opinion, as all new builds are planned to be done from a central build server, where access is cut off from the other developers. I consider trust issues with any binary of the highest importance, as even small library like this can have access to every file or memory on the computer, the same care must be taken with them as everything else.
Furthermore, there has been a issue with money, donations, advertisement profit, that has not been resolved how I felt that it should. Instead of the money being treated as a group project, and used appropriately (transparently to the other devs), it has been handled privately instead.
Additionally there has been some playful talk by a few developers to add services to emerald that would be used to profit certain developers. I have always felt that emerald should be a free project, both speech and beer, and that adding ways to make money off others free work was wrong in some way. Though, this is my personal opinion, and it is most defiantly not part of the GPL.
There have also been issues with public appearance and ignorant association. Although most intelligent people understand that the people who work on emerald do so separately, and that for the most part it is the only thing they work on together, this is not always clear, and there have been numerous times when I have had to fight to make it clear who participates in what, even on our own website. Before hand I could point out that what other devs have/are/will do is unrelated to me, but now even emerald now is moving in the direction they want it, to the extent that I feel it is important to distinguish myself from it.
I have had a few people ask me why I did not do something about this, something sooner, and the reason is that this is not my project more than it is all of the other developers, in my opinion. I have done my part to make sure that they are aware of this, but their decisions are their own. I would have said something sooner, but I was trying my hardest to get this resolved internally.
This seems to have mostly been a misunderstanding on my part. I had assumed emerald was what I wanted it to be, when now it is very clear that it is not on a number of issues. Therefore I feel that it is my responsibility to make a few points clear from now on.
  • Emerald is beyond my ability to verify the integrity of the code involved. For people concerned      about spy-ware, adware, backdoors, etc, I strongly encore you to do your own research, as you should with every program you install, and make this decision yourself. I am aware of two instances of what I consider bad code in emkdu, and have given instructions on how to remove this part from emerald, however in the future even that will not be enough. A decent solution is to compile the viewer yourself, and only include components that you trust.
  • The money made by emerald has not, and will not ever go to me. It has always been important to me that my work has been completely for free on this project.
  • The actions behind emerald, and other developers other projects, and any implied moral implications have nothing to do with me. I personally disagree with the points in emerald that I have mentioned here, and for projects that I am unrelated in (like onyx, cds) I don’t have anything to do with them!
Furthermore, as you can probably guess, my involvement in emerald will be much less in the future, unless something is done to address these issues. I would still love to help people as I always have with emerald support, and I will still be adding any features I think would help people out to emerald (though i think a good patch for other viewers will also be provided), but as far as the direction emerald is going, I am out of it.
It is very distressful to have to sever some ties to a project I have put so much dedication and time behind.. it has postponed this decision for a long while, but there is a time for everything, and I think I can find new ways to be productive better than working on emerald.
To the people who have took my word on emerald’s credibility, I apologize deeply for my claims.
It’s been fun, I have learned allot from people who code better than I probably ever will be able to, and there are times when it has been great, thank you very much to all the other developers, and supporters. I hope you understand.
(edit: no, i really don’t feel like forking or doing my own builds or taking anyone’s money to do so, im quite sick of emerald right now, if one were to do so, the code you can see in the svn is clean last i checked, the rest, i don’t know)
(edit: for the people who believe that I am doing this to cause drama, or that I am trying to destroy emerald, please reconsider. This post was made to clear my conscience and bring the truth as best as I saw it to people who were relying on me. I wish no harm on anyone, I am sorry that things came to this, but it was all stuff I could have fixed long ago, I do not hate anyone. Please beware of people misquoting me or adding on to what I have said here, I have made this long an thorough for a reason, I do not need drama people corrupting it)
(edit: to be extremely clear, most devs in emerald do not have anything to do with emkdu. The code was for a single developer, and it was passed around to no more than 3 devs that I am aware of, the rest of them are all in a similar boat as me afaik)
(edit: so apparently someone got my access removed from the svn and a few other things for posting this, sorry to the people who have pointed out the few last minute things I should have fixed, looks like they will have to wait)
(edit: to the other developers who feel like I have betrayed you and was foolish by making this public, I am very affected and would please ask you to consider my position. I have tried every way I know of to get this resolved before hand, but I have been left in a position where I have people relying on my public words on this, keeping this to myself or trying to whisper it to all of them would have been betraying the rest of these people, and there wasn’t any other way to correct this)


Happy October!

Friday, October 01, 2010 Rissa Bolissima 0 Comments

Oct 1 2010 on Second Life
Rissa set up her little skybox (still has no furniture) with a movie screen and the movie ‘Letters To Juliette’
Then caught up with her dear friend Lestat whom she hadn’t talked to in a very long time.
Rissa continued her quest on the Miracles of Autumn Hunt (the pesky little snails).
The snails move at Cat’s Eye Design!!
Then Phoenix viewr crashed major.. so trying Imprudence viewer
We will see how this one works!! Phoenix was just awful and kept crashing and wouldn’t let me upload pictures!! Well.. phoenix would let me take pictures as jpeg in second life.. only PNG images with imprudence!
Got majorly sidetracked at USC Texture Tomb… Rissa going into a texture shop… is like a child going into a candy store!!
And I finished the Miracles of Autumn Hunt.. no more hunting snails for Rissa!!
Rissa took some pictures of her adventures on Second Life today. They are posted on flickr. You can see them at:

Have a super terrific weekend!!


Think Pink Hunt

Monday, September 27, 2010 Rissa Bolissima 0 Comments

Phew! I finally finished sorting all the cool gifts I received in the Think Pink Hunt. I have uploaded pictures of the prizes to flickr and if you can see them at http://www.flickr.com/photos/33951869@N03/sets/72157624890475161/ if you are interested.



Thursday, September 23, 2010 Rissa Bolissima 0 Comments

Today, Rissa, Venom and Kaylan went to Oracle to look at and purchase new animations for their AOs.
Rissa says it is quite entertaining to try the ‘falling’ animation..

Here is a picture of Rissa trying one of the jump animations...