Interview with Baba Yamamoto about CopyBot

You may have recently heard about the CopyBot in Second Life. It essentially allows users to copy anything into their inventory with full permissions applied, or at least that is how the story goes. The CopyBot is causing mass panic among vendors in Second Life, who are worried individuals will use the CopyBot to copy their creations that took them many hours to develop and then resell them for almost nothing.

Well, my boss Ricardo Sprocket asked me to look into CopyBot today, and find out what exactly it could and couldn’t do. So I went to the source. I talked to Baba Yamato who administers the libsecondlife.org website. Libsecondlife is a code library that makes it easier for programmers to access what is going on under the hood with the communications protocol that Linden Lab uses to communicate between Second Life servers and the Second Life user client program. All code developed with libsecondlife is licensed under the open source BSD license agreement, so it is accessible and modifiable to a wide array of developers. CopyBot, a program that allows its users to copy any object in Second Life regardless of who created it and what the permissions are, makes use libsecondlife. Baba stated that the original creator of the CopyBot code never sold it in Second Life, but because the code is open source someone in-game has exploited the code to create their own version of the CopyBot which is now being sold in-game. Baba is familiar with how CopyBot works and tested out a version created by the original developer. I decided to interview him and see what his thoughts were on CopyBot. Here are a few things I learned from our discussion. And if you scroll further down you can read the entire transcript of our interview.

1) By analyzing and copying data from communications that go the Second Life client program back the the Second Life servers, you can copy anything, even entire sims. CopyBot can’t really copy an entire sim now, but the underlying way it copies objects could be used to do so. Even worse, there is no real solution for this without Linden reworking the entire protocol and essentially rewriting large chunks of Second Life. The metaphor here is similar to HTML and the web. People freaked about how you could view source on a web page and see the underlying HTML. Similarly by understanding how the Second Life communications protocol works you can view the code that describes objects and copy them, just like you can copy source HTML from web page.

2) You cannot copy scripts by intercepting communications between the SL client and SL servers. LSL scripts are never communicated to the client other then when they are being authored or modified and then only to the specific user’s client that is modifying them. Some good news.

3) The original CopyBot that someone created and is selling in game runs a script with a built in listener that listens for the command to quit. So you will start seeing in many areas quit commands showing up in the chat window all the time. This will work against the current CopyBot that some users own, but expect to see other versions that will ignore the quit command.

4) Part of the reason why the permissions on copied objects were lost was not a deliberate hack, but apparently the meta data about an object’s creator and owner is hard if not impossible to recreate by analyzing the communications between the server and the client.

Remember, when CopyBot copies things (as least as CopyBot exits right now) you are essentially copying prims and textures. There are already other programs that do similar things like Open GL intercept, so a lot of bad press that the libsecondlife is getting is unjustified. If it wasn’t the libsecondlife group that discovered how to do copy in-game objects it would have been another group. Linden Lab has known about this possibility for a long time. Baba and the rest of the developers for libsecondlife have been very open about what they have discovered and thought the SL community at large should know what they have discovered with CopyBot. The libsecondlife group has even pulled the CopyBot code from the latest code forks in their project listings on their website. Unfortunately there are other ways of going about finding the CopyBot code. And regardless, the Second Life protocol is there for anyone to look at and hack.

So what does this mean for Second Life? Well, it ultimately means that simple objects are going to be copied. Complex, scripted objects will remain viable objects to sell in the virtual world. A three prim couch maybe not so much. Is this a problem? Yes, just like it was a problem with initial web development where creators created something cool in HTML and Javascript, only to see their creations copied across the web.

Transcript.


[10:30] You: So mass chaos today huh?
[10:30] Baba Yamamoto: crazy
[10:30] Baba Yamamoto: people finally got together and came to our HQ to protest
[10:30] Baba Yamamoto: trying to explain open source to the average joe
[10:31] You: Well, I could act like a journalist if you want, and get your side of the story out. We have a blog at secondcampus.blogspot.com. I could post what we talk about there, and I will allow you to edit anything out that you want.
[10:31] Baba Yamamoto: Muahahaha
[10:31] You: But, that is just the journalist in me, if you would like to keep it on the down low, and just fill me in, that would be cool too.
[10:31] Baba Yamamoto: whatever
[10:32] Baba Yamamoto: i am trying to be as candid as possible about everything we do with libsecondlife
[10:32] You: Mind if I post then, it will elevate me to "SL journalist" status :)
[10:32] Baba Yamamoto: hshs
[10:32] Baba Yamamoto: Muahahaha
[10:33] Baba Yamamoto: whatever
[10:33] Baba Yamamoto: I'm not worried about it :)
[10:33] Baba Yamamoto: so what's your question?
[10:34] You: So, I know a little bit about libsecondlife. A library to reverse engineer the communications between the SL Client and the Servers written in C#.
[10:34] Baba Yamamoto: yes
[10:35] You: From what I understand CopyBot is a class that uses libsecondlife to capture communications to recreate SL objects locally, then upload them back to the server, copying them.
[10:35] You: And in the process, because you are going from unix to windows to Unix again, the copy permissions are lost.
[10:35] Baba Yamamoto: yes, it does this automatically but it's essentially an import and export routine..
[10:36] Baba Yamamoto: with little effort we could write the output to xml or another format and then interpret it again
[10:36] Baba Yamamoto: not even that, it recreates the objects manually
[10:36] Baba Yamamoto: we're not capable of setting the original owner name on the objects
[10:36] Baba Yamamoto: it's hard to retain metadata
[10:37] Baba Yamamoto: there is no system in place for it within the protocol
[10:37] You: So in essence the protocol itself is wide open enough to allow for copying objects, but not open enough to retain the meta data about who built the object and such.
[10:38] Baba Yamamoto: Linden Lab is working on such a system now
[10:38] You: So what do you think about a few sim owners closer down their shops and hiding everything from view so it won't get copied? Is that even really feasible with copybot?
[10:39] You: Or is this just mass panic.
[10:39] Baba Yamamoto: ... the best way to drop their sales to zero
[10:39] You: Yeah, which sucks, and I guess that is why everyone is in an uproar about copybot. I'm just wondering if this is all over blown.
[10:40] Baba Yamamoto: i would say so
[10:40] You: And again, I would look at this as a Linden Lab problem. You guys were just being good programmers and learning how things worked.
[10:41] Baba Yamamoto: I don’t see how a person making an imperfect copy which does not retain scripts or any other object inventory with no name or brand or well known location can outsell an established retailer no matter the discount
[10:43] Baba Yamamoto: they could give away full permission object but ... what good would that do them other than grief and i still doubt it could kill sales as most people are honest
[10:43] Baba Yamamoto: i guess that's my take
[10:44] Baba Yamamoto: and if they gain any notoriety at all, it's instaban
[10:44] You: Yeah, I think all the fears are over blown. I can see how some malicious people will run around trying to copy everything, but all they will get of any use are simple objects that are mostly available for free or easily recreated anyway.
[10:44] You: Yeah, with all the hopla right now.
[10:44] You: So have any of the Lindens approached you about it? I assume they have.
[10:45] Baba Yamamoto: thre is a system in planning now that could scour the grid and compare object signatures to one another
[10:45] Baba Yamamoto: and detect possible infringement
[10:45] Baba Yamamoto: signatures
[10:45] You: That would be one way to deal with things.
[10:45] Baba Yamamoto: but I don’t think the theft will become widespread and destroy incomes
[10:46] Baba Yamamoto: too much hysteria
[10:46] Lola Frederick is Offline
[10:46] You: So how are you doing? People harassing you and protesting all over the place?
[10:47] Baba Yamamoto: i get the odd hateful IM
[10:47] Lola Frederick is Online
[10:47] Baba Yamamoto: More and more i am getting IMs from people who say "i get it"
[10:48] You: Cool. I bet as clever people such as yourself explore SL and how it works there will be times where things like this come up.
[10:48] You: I guess it is just the evolution of how this world will evolve.
[10:49] Baba Yamamoto: It's inevitable
[10:50] Baba Yamamoto: THe reason I felt the news about this had to be spread was because suddenly our library does have the ability to easily copy anything.. This was always possible with Second Life but it's now much more exposed to automation like copybot..
[10:50] Baba Yamamoto: Some people blame us for even trying to understand the protocol because it exposes these things, but I feel that if not now some time later it will happen and maybe worse
[10:51] You: I agree.
[10:51] Baba Yamamoto: The way copybot works it's just not possible to protect against
[10:51] Baba Yamamoto: totally impossible
[10:51] You: Think Linden could do something like add encryption to data streams from the client to the server or anything like that?
[10:51] Baba Yamamoto: no
[10:52] Baba Yamamoto: encryption slows things down and the key has to be available to decode it
[10:52] You: Yeah, SL is slow enough already :)
[10:52] Baba Yamamoto: breaking encryption is a full time job for some folks
[10:52] Baba Yamamoto: there is no safe encryption scheme that could work for Second Life that would not grind it to a halt
[10:53] You: So, at least for now and the foreseeable future, the ability to copy will remain.
[10:53] Baba Yamamoto: as far as I can see.. it's not something that can be fixed.. it's a product of the technology
[10:53] Baba Yamamoto: same as the web
[10:54] Baba Yamamoto: we have to know how to display the content
[10:54] Baba Yamamoto: there were the same fears when people realized that HTML was not hidden on the server
[10:55] You: What about all the quit scripts I am hearing about? How do those work?
[10:55] Baba Yamamoto: the bots were created originally had an IM command to stop the program
[10:55] Baba Yamamoto: the person who sells it never removed it
[10:55] You: Yeah, I've heard the comparison. And it is a good one. Your objects ultimately are XML describing the object coming from a client to a server if I am correct.
[10:56] You: I've got the c# class and libsecondlife, don't have the in-game bot though.
[10:56] Baba Yamamoto: we do not have an xml schema yet
[10:56] Baba Yamamoto: but it would be trivial to write one
[10:57] Baba Yamamoto: we do have an xsd transform to convert from blender format dotprim
[10:58] Baba Yamamoto: any other questions?
[10:58] You: Two quick ones then I will let you go, and again, I totally appreciate this Baba.
[10:59] Baba Yamamoto: we have a new bot template up now called TestBot it's the basic bot which logs in and accepts teleports
[10:59] You: Cool.
[11:00] You: Just for the record, you guys were the ones who made the ability to copy objects with the protocol known so that Linden would understand about this correct?
[11:00] Baba Yamamoto: they knew
[11:00] Baba Yamamoto: linden always knew
[11:00] You: See, again, it is ultimately there problem just waiting to surface.
[11:01] You: er their.
[11:01] Baba Yamamoto: and we always knew... but with this code becoming public or even just having all the proper functions in libsecondlife it becomes a critical issue that the general user needs to know about
[11:02] You: Well, now it is public and known. Might change the way designers build things, buy an object that reses other objects, stuff like that.
[11:02] Baba Yamamoto: well eventually it wont matter.. there is no reason the entire simulator couldn’t be interpreted
[11:03] Baba Yamamoto: anything that is sent to the client can be interpreted
[11:03] You: What about getting at the scripts?
[11:03] Baba Yamamoto: no
[11:03] Baba Yamamoto: never the scripts
[11:03] Baba Yamamoto: If we ever find a vulnerability to access scripts it will not be like copybot.. because that is something that can be fixed
[11:04] Baba Yamamoto: scripts are not to be sent to the client
[11:04] Baba Yamamoto: it's much like PHP on a web page
[11:04] You: Gotcha, just then end result is sent.
[11:04] Baba Yamamoto: exactly
[11:05] You: Thank you Baba. I think I understand the issues with copybot now much better. I appreciate the time. And I owe ya, if ever you need a favor in game.
[11:05] Baba Yamamoto: ;)