<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Now that Melanie has started work on the temp attachments on the
master branch, I've changed how osForceAttachToOtherAvatar works, so
it's always temporary.<br>
<br>
~ Marv.<br>
<br>
<div class="moz-cite-prefix">On 11/08/2012 12:12, SignpostMarv
Martin wrote:<br>
</div>
<blockquote cite="mid:50263E0A.3080409@signpostmarv.name"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<br>
<div class="moz-cite-prefix">On 10/08/2012 22:34, dz wrote:<br>
</div>
<blockquote
cite="mid:CADyQTWoQoz=L_doZ=8mx441V-r7ddzddWYL=CO=DTVRf01HqoA@mail.gmail.com"
type="cite">I'll bite...<br>
<br>
Lets focus on one of the patches.... new feature: attaching
objects to non-owner <a moz-do-not-send="true"
href="http://opensimulator.org/mantis/view.php?id=6133"
target="_blank">http://opensimulator.org/mantis/view.php?id=6133</a>
...<br>
<br>
First problem with this patch... It replicates the <b><span
class="comment">osForceAttachToOtherAvatarFromInventory</span></b>
function<br>
documented here -> <a moz-do-not-send="true"
href="http://opensimulator.org/wiki/OsForceAttachToOtherAvatarFromInventory">http://opensimulator.org/wiki/OsForceAttachToOtherAvatarFromInventory</a>
.. as you can see from the history of that page it was
created almost a month before your patch was submitted...<br>
</blockquote>
It doesn't replicate osForceAttachToOtherAvatarFromInventory(), it
"replicates" llAttachToAvatar() <a moz-do-not-send="true"
href="http://wiki.secondlife.com/wiki/LlAttachToAvatar">http://wiki.secondlife.com/wiki/LlAttachToAvatar</a><br>
<br>
osForceAttachToOtherAvatarFromInventory() is for adding an
attachment from the object's inventory to a specified avatar,
llAttachToAvatar() is for adding the rezzed host object to the
object owner.<br>
The patch I've attached is for attaching the host object to the
specified avatar, the sole difference to llAttachToAvatar() being
the specification of the avatar.<br>
<br>
<br>
<blockquote
cite="mid:CADyQTWoQoz=L_doZ=8mx441V-r7ddzddWYL=CO=DTVRf01HqoA@mail.gmail.com"
type="cite"> Second problem with this function... and one i
added to the talk page on the wiki...<br>
<div style="margin-left:40px">Unless that object is unscripted
OR is removed when the avatar exits the region or
disconnects, <br>
this sounds like a heap of griefer trouble...<br>
<br>
What happens when I visit a region where an object scans me,
attach a malicious package to me,<br>
and then take advantage of the fact that attached objects
don't require permissions to<br>
teleport me to a random region and have the object spew
200,000 prims into someones else space??? <br>
Is MY fault I didnt check all of my attachments before and
after i TP'd???<br>
<br>
</div>
There are so many reasons why asking for permissions works, and
owning the objects that are attached to you makes sense..<br>
The ONLY valid reason I have ever come across for someone
wanting to attach something to me without me owning it is <br>
DEMO prim/mesh clothing/accessories That functionality IS
supported in SL via <a moz-do-not-send="true"
href="http://wiki.secondlife.com/wiki/LlAttachToAvatarTemp">lAttachToAvatarTemp</a>...
and ASKS.<br>
</blockquote>
There are two functions in the patch. One asks, one doesn't. Your
sole concern seems to be the potential for griefing with the
osForceAttachToOtherAvatar() function and not
osAttachToOtherAvatar(), a concern that would seem to be addressed
by either raising the threat level of
osForceAttachToOtherAvatar(), or just not including it.<br>
<br>
<br>
<blockquote
cite="mid:CADyQTWoQoz=L_doZ=8mx441V-r7ddzddWYL=CO=DTVRf01HqoA@mail.gmail.com"
type="cite"> <br>
Like I said above.. making this functionality accessable to NPC
bots who cannot leave the region, and currently cannot grant
permissions, MIGHT be a use case.. But since you make no
distinctions...<br>
</blockquote>
I could implement another pair of functions designed for NPCs if
you'd like, that's fairly trivial.<br>
<br>
<blockquote
cite="mid:CADyQTWoQoz=L_doZ=8mx441V-r7ddzddWYL=CO=DTVRf01HqoA@mail.gmail.com"
type="cite"><br>
...<br>
<br>
I guess the bottom line is... there's some code there, yes...
but even if it is functional, it is going to take more than
filing a mantis to get it worked on and reviewed... Part of
that work is defining and communicating the NEED for the
function so it can be balanced against the implications of
implementing it. <br>
</blockquote>
At work I needed to attach a wheelbarrow (and in future, other
tools & equipment) to the user without<br>
a) transferring ownership<br>
b) constantly interrupting them with permissions dialogs- as is
required by llAttachToAvatar()<br>
c) performing the ungraceful hack that one would do in Second Life
with many attachments that remain attached to the avatar but are
invisible until needed, or one that is invisible and changes
appearance as needed.<br>
<br>
This scenario is accompanied by a function that permits
script-triggered dropping of attachments (in both perms and
non-perms flavours) <a moz-do-not-send="true"
href="http://opensimulator.org/mantis/view.php?id=6118">http://opensimulator.org/mantis/view.php?id=6118</a><br>
<br>
<br>
~ Marv.<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Opensim-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opensim-dev@lists.berlios.de">Opensim-dev@lists.berlios.de</a>
<a class="moz-txt-link-freetext" href="https://lists.berlios.de/mailman/listinfo/opensim-dev">https://lists.berlios.de/mailman/listinfo/opensim-dev</a></pre>
</blockquote>
<br>
</body>
</html>