1. If, as Cristiano posted to the "to report or not to report" thread comments, he didn't actually give instructions on how to repeat the bug, then this seems very unfair. I had assumed that he did give them, but the posts were hidden or destroyed before I followed the links.

Just reporting that a bug is as reported doesn't seem worthy of a 3 day ban.

Maybe the Lindens didn't read the thread properly before they binned it.

Posted at 7:56PM on Jul 25th 2006 by Caliandris

2. I sent the following to abuse-manager, but the account is legendary for being a black hole of no response, so I doubt it will do much good. The notice I received from Linden Lab did not indicate it was a forum only suspension:

Hello,

I so believe that this matter has not been adequately examined. I did not post the details of how to take advantage of the exploit, which required very specific steps to execute. You had to sit on an item, go into Edit on an attachment, click Edit Linked Parts, and resize and reposition the root prim and then hit undo twice. Nowhere in my post did I explain how to do this. Additionally, the flaw was already being exploited and builds were being damaged. Considering that Linden Lab still does not treat SL as a 7 day a week operation, something occurring in the middle of the night Saturday night was serious to warrant warning users to protect their builds. Please, by all means, show me where I allegedly disclosed how to exploit the vulnerability - simply saying it is exists is not an exploit disclosure. If you cannot do that, then you cannot in good faith provide me with a 3 day suspension, considering I have never even had a warning before and did not disclose the exploit details.

Cristiano Diaz

Posted at 8:24PM on Jul 25th 2006 by Cristiano Midnight

3. Geez, LL should get it over and just hire Cristiano, its obvious! :)

Posted at 9:11PM on Jul 25th 2006 by Octal Khan

4. I think I know what the next Secondcast will be about!

Posted at 9:43PM on Jul 25th 2006 by Akela Talamasca

5. I beat Cristiano. I got suspended for seven days for quoting a post that described an exploit. I tried to perform both the texture stealing exploit and the sit and make vanish exploit based on the information available to me, including whatever it was that I quoted in the post that got me suspended, but was unable to do either one.

Posted at 12:19AM on Jul 26th 2006 by SuezanneC Baskerville

6. So there's no response from LL about what the right way to do is with such bugs and how to make sure these get actually fixed (except posting in the forums)?

If not, opportunity missed..

Posted at 1:06AM on Jul 26th 2006 by Tao Takashi

7. This doesn't prove there's no FIC. Don't be ridiculous. It may only prove that Cristiano's FIC credentials are getting a bit tattered, and he needs to work his Linden pipelines more, that's all.

Posted at 1:16AM on Jul 26th 2006 by Prokofy Neva

8. I remember when they came out with a new patch a few months ago, there was also a major bug with it. It was one that let anyone sit on anyone's object, and if you had a slave collar set to pull you, the object they were sitting on would go physical. The Linden on duty seemed kind of in disbelief. So, I made a whole infohub physical, and took a picture. They seemed shocked, and went to the infohub to fix it. During further testing I found that I could also pick up the obejcts that were made physical, that is how I got a full permission Linden Sandbox sign. I immediately Bug reported this and contacted a Liaison that was on duty. It was over 3 days that they then contacted me to ask more about how the bug was done. After that, it was about a week until the mini-patch came out and stealth nerfed it. I don't think cristiano should have been punished for forcing LL to work overtime.

Posted at 3:21AM on Jul 26th 2006 by Nimrod Yaffle

9. Color me new, but I would have to say that the punishment does not fit the crime, if there really is a crime. I think that the fact that LL responded in record time to correct the bug so that the actions could not be duplicated should be good enough the leave things be.
I guess it is my LL naivete' that doesn't allow me to understand how attempting to fix or improve something can get you banned for 3 days. All I know is now I will think twice before I report anything as a bug.

Posted at 7:13AM on Jul 26th 2006 by Dani F.

10. Dani,
Just to clarify, the suspension didn't happen because Cristiano submitted a bug report to Linden Lab (something we should all feel 100% comfortable doing!) It happened because he posted about the existence of the exploit in the SL forums.

I would like to emphasize that I (and everybody I have spoken to) agrees that publishing "how-to" information on an exploit deserves account action or worse. The major debate here is the fact that Cristiano did NOT post the "how-to" on this exploit, only a warning to the population that it existed.

People seem to be divided (about 50-50) as to the wisdom of publishing non-specific information about an exploit.
Some say Cristiano shouldn't have started a panic and instead should have trusted Linden Lab to handle the problem descreetly. Others feel that Cristiano's suspension had less to do with maintaining order and more to do with intimidating those who might share embarrassing information about Linden Lab.

But if we are to look at this disciplinary action to the letter of the law, I think the word that makes Cristiano's sentence invalid is "intended." I know deciphering intent is a difficult task, but Cristiano's post not only avoided specific how-to information, it was also clear that his post could in no way be interpreted as INTENDING to "damage, detrimentally interfere with, surreptitiously intercept or expropriate any system, data, content or personal information." In fact the very opposite was obviously true.

This has been an ugly week. Somebody wake me up on Monday :(

Posted at 8:06AM on Jul 26th 2006 by Aimee Weber

11. Wow, how totally assy... and Prokofy, you're a real dick.

Posted at 8:39AM on Jul 26th 2006 by FlipperPA

12. Full disclosure is the only responsible action, when a support organization has shown no interest what so ever in dealing with bugs before features (see your earlier post).

While the Lindens certainly don't need to be happy about it, I sure am. It got a prompt and effective response out of them, and enabled everyone who saw it to take measures to protect their builds (shutting down sims, restricting access) until the Lindens could be bothered to fix things.

I hope Cristiano Midnight enjoys his Linden-sponsored vacation. I'm sending him L$100 in spending money now, in support of his efforts, and I'm asking others who appreciate full disclosure to do the same. ^_^

Posted at 8:55AM on Jul 26th 2006 by Seonaid Barrett

13. That's not a bad idea at all Seonaid. I'll be sending Christiano 100L as well.

Posted at 10:08AM on Jul 26th 2006 by Dolmere

14. LL's overreaction doesnt surprise me, and it's such a misdirected lashing out. My first message is to Cris...the LL action was wrong, and we all know it. Heavy handed censorship is the first solution grabbed by LL to address a problem, and sadly at times the only solution. I certainly did not get any details from Cris' post that would allow me to duplicate the bug, in fact, that information came from another member's post.

Cris' letter to LL pointing out that he had not supplied that information will be disregarded because actual guilt matters not to Daniel once a sanction has been handed out. I know sanctions are dished out without investigation since that happened to me about one year ago when I was sanctioned for something Nyna Slate did. I know that AR was not really investigated because if LL had checked logs as they claim they do, they would have seen who the real offender was.

Appeal? I sure did. Result? LL doesnt care about facts, Cris, so it matters not that you did not expose details of the exploit....as long as you show up and your name is seen, you are quilty as alleged!

Posted at 10:13AM on Jul 26th 2006 by katykiwi Moonflower

15. Wow - I'm a bit disappointed in Linden Labs reaction here. Cristiano DID the right thing. He did not explain how the exploit works, he just explained that there was a major exploit in the game. Lets be honest here, if Cristiano would have reported this bug to Linden Lab, would they have fixed the bug this fast? This way, Linden Lab had no choice but the fix this bug ASAP. No doubt that Cristiano wasn't the only one who knew this bug, he's just the one who reported it. Next time Cristiano, simply create a NEW account (no verification necessary these days) and report it in the forums. I believe that is the message Linden Lab is trying to shout out! Right?

Posted at 11:44AM on Jul 26th 2006 by Johan

16. Unfortunately this appears to be a case of "Look out for _____" being mistaken for "Hey cool everyone go do ____ while you still can!". I agree with what Christiano did, and a 3 day suspension is a small price to pay to have avoided the damage that could have happened, but a price he shouldn't have to pick up the tab for.
The post probably provoked a "Uh oh, it's on the forums, everyone knows, time to get our asses in gear" response, which isn't as favourable as an "Uh oh, we messed up, time to get our asses in gear" response, but you've got to take what you can get. The bug was complicated enough that mentioning its existence wouldn't instantly unlock how to reproduce it. A suspension is a warning, and a temporary dam to stop dangerous posters. Christiano's post was not out of malice, or to incite anything other than resolution to protect the hard work of his fellow residents, so punishing him makes no sense, other than to encourage players to lose their desire to protect the community's welfare instead of just their own.

Posted at 11:59AM on Jul 26th 2006 by Iris Ophelia

17. I cannot deny that I am shocked and dismayed by the suspending of my friend and colleague Cristiano Midnight from SL for reporting a bug on the forums.
I will skip over the obvious carrying on about Thieves and Robbers being able to carry on freely within the walls of our world and go right to the heart of the matter.

It is my belief that our friends at LL simply do not care to have obvious GIANT bloopers pointed out them especially in such a public way. I would doubt that someone like Cris would ever be interested in doing this strictly to hurt or embarrass anyone, but rather to entice someone into quick action.

The exploit had the potential for major damage to so many, and I truly believe that the forums do get a lot of reaction. Cris worries for SL first, never for himself or any personal gain. I have known him long time, and this has always been his MO.

Bravo Cris, please don't take this to heart!

Posted at 12:34PM on Jul 26th 2006 by Baccara Rhodes

18. I must agree with the general consensus that this is utter bullshit. The end.

(and nice writeup, Aimee!)

Posted at 1:01PM on Jul 26th 2006 by Taco Rubio

19. This is the sort of thing that the phrase "travesty of justice" was coined for. Cristiano did NOT post details about how to reproduce the exploit, merely the fact that the exploit existed. In doing so, he acted in the best interests of Residents, builders, and the Grid as a whole. Far from suspending him, LL should be giving him a freaking MEDAL. (In fact, I may have to sit down and build him one, seeing as how it looks like he's literally sacrificed himself for the greater good of SL...)

Posted at 1:03PM on Jul 26th 2006 by Erbo Evans

20. Cristiano Midnight is a gentleman and a scholar of the top degree. The Linden team are nothing more than a bunch of kids who got caught by their own self worship and foolish mistakes.

Posted at 1:40PM on Jul 26th 2006 by Donald Philips