The Art Galleries of SL List is available at http://sasun.info/ArtGalleriesOfSL.htm.

New visitors, please read: About This Blog

Tuesday, September 15, 2009

Accusations of Starax forgery

Recently some accusations of Starax sculpture forgeries surfaced surrounding the AngelGate show. I heard these third hand so, take it with a grain of salt. I don't know who, but either way it was a legit concern. So I volunteered to do some investigation on whether it's technically possible to do a perfect clone of an object in SL. The copybot and variants circulating today to NOT allow you to specify an arbitrary creator name/ID and creation date. They ALWAYS show the bot's name and the actual date when the copy was made.

Using the built-in Inspect command on the SL viewer pie menu, one can easily scan a list of every single prim any object is made of, with the prim creation date and name of the prim creator right there. So spotting typical copybot forgeries of anything is rediculously simple, since 99% of the prims will NOT be who you expect it to be and the creation dates will all be wrong (and most likely all very very close to the same time since copybot creates all the prims in the copy linkset very quickly). What a forger would typically do is link in a single legit Starax prim (from one of Starax's full-perm objects that are easy to obtain) as the ROOT of the linkset, and that gives the entire object what appears to be a legit creator name and creation date. But Inspect will always show the real story!

Now in the process of learning C# and Asp.Net lately, which has kept me very busy, I spent a lot of time learning the OpenMetaverse libraries (formerly "libsecondlife" or "libsl") so that I could built my own bot, for the fun of it. So I'm fairly familiar with the basics of building a working bot and what is possible and what is not. So I dug into the OpenMetaverse sources and looked for a way to specify a prim creator ID and date. At first glance it appears that there is away to do that when you create a prim, but it turns out all those properties are ignored when you actually rez a prim using the library calls in a bot. Only the critical prim geometry is used to creat the prim, then the client makes a few more function calls to set other properties.

Currently there is no built-in way in the existing libraries to set the creator ID and creation date on a newly rezzed prim like you can other prim properties. In addition I checked the actual network packet definitions and there IS NO network packet defined for setting those properties.

The possibility always exists that there is a very well hidden exploit that lets you set these properties, but there IS NO way to do that with the OpenMetaverse libs today and not even a network packet type defined for that that someone could use to add additional functionality to the libs to allow that. So my conclusion is that this a VERY VERY tiny possibility that it's at all possible and unless someone can prove that there is such an exploit (and report it asap, omg) then the validity of any theoretical copybot variant that can set arbitrary creator IDs and dates on a prim is just not true.

Therefore, if all the prims in a Starax sculpture were made by him, then it's legit and anyone claiming otherwise needs to show some proof that the above exploit is real and then take immediate action to report it so LL can clost that hole in a hurry.

One last note, I have seen Starax scuptures where some of the prims were not made by him. In particular, his Achilles scupture contains prims created by Jeffrey Gomez. It appears he simply used some of Jeffrey's prims in this particular piece, and the bulk of the prims were created by Starax. This was from a reputable source (my Starax wand) so it's definitely legit.


  1. I know that Starax used to call you "the prettiest scripter in SL"... May I dare to correct the master? I would call you "the prettiest AND the smartest scripter in SL" ;)

  2. Hello Sasun!,

    You're right, there's no way to copy an object with copybot whilst preserving the creator's name.

    But it's possible to recreate a model with another creator's name if you can find some of their prims with modify enabled. Then using Jeffrey Gomez's mirror tool it's possible to replicate a copybotted object in another persons name.

    My advice:

    The truth is in the prim dates. Always inspect the prim dates of an object to see if they look suspicious. For example - do the prim dates match any of the prim dates of a modify enabled object that's previously been released by the creator. Another common sign is that all the prim dates within an object may be identical, this often suggests that an object had been created through an automated/scripted process (Again, using a creator's prim).

    Im summary - Never trust the creator name. And never release freebie items with modify enabled.

    The truth is out there!

  3. Ooo. That's really good I didn't think of that. Thank you for your insight, I stand corrected, you can't trust the creator name. I know Starax in particular does have full-perm freebies he's given away.

  4. Thanks for the comment, Starax. And thanks for the sharp eyes of the collectors who originally spotted the copies. The truth is indeed out there!

  5. The only way to copy while retaining the creators name is to use so called "dupe exploits", several of which unscrupulous folk have discovered over time. Most of these have been patched. Duplication exploits usually involve placing the objects then crashing the sim somehow - if everything is worked out perfectly one ends up with two version of the object - repeat for 4, 8 etc. This produces perfect copies with creator and all perms intact. At various times folk have exploited problems with the linden system to do this. Usually it gets patched soon after.

    Fortunately to avoid copying it is impossible to spoof creator reliably in a way that survives inspection. It is possible however (though I won't go into how). Several prominent SL creators have fallen foul of the practice (eg http://gwynethllewelyn.net/2009/08/07/spammers-are-disseminating-a-new-illegal-sl-client-under-my-name/ ).

    Unfortunately inspection is not a reliable enough indicator of provenence anyway. A majority of the work I have done over the last few years has been touched by multiple hands. I have also been a beta tester for a copying and backup system during that time. Of course we would love to make a system that obeyed SL's provenance system but we have found that it is full of holes. Due to quirks in the SL inventory database we have found that it produces far from a reliable audit of the creation of an item.

    The lesson here is to use extreme caution when using inspection to judge the provenance of items. When folk have nothing to hide, often as not it will tell the truth. You can be sure though that anyone who has gone to the difficulty of messing with this information probably knows of a few of the exploits which can be used to mess with it.

  6. While I think you are correct in observing that there is no way to set the prim creator and time, this alone does not prove copying!

    With the appalling state of the LindeLabs asset database reliability these fields get reset quite frequently.

    I had an inventorty "crash" a few weeks ago and when items were restored EVERY ITEM in my inventory ended up with the same creation date and time. Many items (but not all!) showed me as both owner and creator.

    Several items that I had purchased long ago were now "full perms" as well.

    So all you can really say is that having a "strange" creation date and creator looks suspicious it does not "prove" anything!

  7. Wow that's crazy. I've never heard of that happening before, thank you for educating us. What a frightening state of affairs. Wow all it would take is ONE of these instances of this happening to an unscrupulous person and full-perm copies of things could leak out, even scripted items. This is a horrifying thought :\