[Opensim-users] Retaining correct creator/owner when moving OARs between stand-alone simulators.

[Justin Clark-Casey]

On 09/09/11 03:44, Cider Jack wrote:
> This makes perfect sense to me. No reason for the creator to be the
> owner when the creator might not even exist on the new grid. Also
> keeps the permissions functional, as mentioned.
>
> On a related note though, I'm a bit concerned whether I'm reading this right:
> "2. Otherwise, if a user with the same *name* as the creator exists then that
> user's UUID is used."
>
> I'm reading this to mean that if an avatar name of "John Jones"
> creates an object on SoaS, then someone uploads the oar/iar to
> something like OSGrid, ReactionGrid, whathaveyou, where there is a
> completely random/unrelated avatar on that grid named "John Jones".
> This means that the second John Jones is shown as creator, even though
> they have nothing to do with it?
>
> This might be a concern not only for the original creator potentially
> losing credit, but it seems it might open a simple exploit for
> griefing purposes. Say that John Jones on OSGrid has nothing to do
> with an obscene/illegal item that was imported. They could be held
> accountable for something they have absolutely nothing to do with.
> Even if their name is cleared with the grid manager (shouldn't take
> much investigation, as the object's owner name would be a good place
> to start), their wider reputation on (and off) that grid could be
> irreparably damaged. For avatars using RL names this could potentially
> impact their RL.
>
> But then again, perhaps I haven't properly grasped how this works.

The name lookup used to happen and still will with old OARs that use a different resolution method (OSPA).  I think this 
was last used back in 0.6.9.  For recent opensim, only a UUID lookup is done - if a simple string creator name is used 
then there's no attempt to reassociate it with a user account.

I think overly trusting user names on grids is a mistake - after all, anybody person could create an account with that 
name and associate bad content with it.  And to be honest, the SL mechanisms were never designed with this kind of 
content transfer to third party grids in mind.

-- 
Justin Clark-Casey (justincc)
http://justincc.org/blog
http://twitter.com/justincc