Even though were able to sell only two of the first ten reduced-price Funzones, we’ve gone ahead and reduced the price on over 100 more Zones, effectively immediately.
If you already hold the deed for a zone, the new pricing applies to you, too. We’re sorry, but no, it’s not retroactive.
We’ll be putting the deeds for the un-rented zones up for auction, a few at a time, over the next few weeks. Since some zones will be in high demand, we think this is the best way to decide “who gets it”.
Sooo, keep your eyes open for the Zone you’ve always wanted! With these new prices, you can’t afford to wait, because we’re sure someone else has their eyes on it too!
As an experiment, we’ve repriced some FunZones!
- Mogul Mounds, was 80K, changed to 40K
- Ash Field was 70K, repriced to 35K
- Banded Rock was 70K, repriced to 35K
- Blue Vista was 70K, repriced to 35K
- Boulder Terrace was 70K, repriced to 35K
- Burning Rock was 45K, reduced to 22K
- Camp Stage was 65K, repriced to 32K
- Chasm Stage was 65K, repriced to 32K RENTED!
- Cluckie’s Hideaway was 45K, repriced to 22K
- Dry Wind was 80K, reduced to 40K RENTED!
- Dust Devil was 80K, reduced to 40K RENTED!
- Passae Beach was 33K, now 22K RENTED!
As you can see, two are already gone! Get ‘em while they’re…er, hot!
Two more rented! Only eight left!
Through the magic of Stripe, you can now pay for Therebucks or There subscriptions even if you don’t have a PayPal Account.
This also means that many of you who couldn’t pay due to your locale (Egypt, for example) may now be able to pay.
There’s one little hitch – if you’re still running Internet Explorer 7, you won’t see the Stripe options. This is because Stripe uses relatively modern browser features which Internet Explorer 7 lacks (by “modern” I mean “modern like running water in your home” modern – IE 7’s not exactly the latest and greatest itself).
One other hitch – if you want to purchase a developer item using the “Real Money” option you still need to use PayPal. This is because only PayPal offers the cool digital / micropayment options which make small purchases even worthwhile.
We hope you like this new payment option, and, if you know anyone who hasn’t joined There because they needed another option, please let them know!
Recently, we’ve had a spat of “Griefing”, “near-Griefing”, and other annoying events. As annoying as they are to you, they’re a real problem for There because we (SamSyn, Bruce, and I) end up spending time on them.
There are lots of tools in world you can use to avoid Griefers, people you don’t like much, or just people in general:
- You can ignore them, which not only makes it impossible for them to talk to you, it also hides their name (they become “Ignored”), and their clothing.
- You can teleport away from them. Given that you have an entire Virtual World at your disposal, this is always a good option.
- You can buy or rent a neighborhood or neighborhood lot, and exercise as little or as much privacy as you feel like today.
- If someone is shooting you with a paint gun, you can use your Force Field to protect yourself.
- You can turn on “Buddies Only Voice” to ensure you only hear the voices you want (including the ones in your head) (If they’re on your buddy list, that is).
By far, however, the best tools you have are your own maturity. Whatever tools we come up with, Griefers, who apparently have nothing better to do with their time, will come up with a way to get around them.
But what griefer’s can’t do is make you react.
We know that when a Griefer (who has problem run of of flies to pull the wings off of) makes an Avatar with a name that disturbs you, it’s bothersome. Even if you can’t see it (since you cleverly ignored them), it bothers you that others can.
Well, first, remember that just about everyone else will recognize the name as having being created by a Cretin (that’s a fancy word for Griefer). It’s not like someone going to see an avatar name “MichaelWilsonKillsKittens”, and immediately call the SPCA. Seriously. Think about it.
Second, if you do react, all you’ve done is stimulated what is probably a pre-teen who’s been grounded for not cleaning their room into griefing you some more. Like a tick on the butt of a diseased rat chewing on the carcass of a hyena, as long as it gets blood, the griefer will keep sucking. As soon as you cut off it’s food, it dies.
So, don’t react. Of course, you can ask us to ban them, and we’ll be happy to do that, but all that does it get them all excited.
You can also have fun with them. If they make a shirt, say “MichaelWilson’s Drunk”, I’d make one that said “But a least tomorrow I’ll be sober, and you’ll still be a fool“.
We’re all adults here. Most Griefers, aren’t, at least mentally. If you act like an adult, then they’ll get bored, and go back to puzzling out how to tie their shoes.
We’ve had lots of suggestions, which were rejected for handling griefers. Here are a few:
- SamSyn, Bruce, and I will take 8 hour shifts, 7 days a week, to stay in world and instantly pounce on any Griefers who appear. If we did this, we wouldn’t get anything else done.
- Get rid of free trials. This is probably not a good solution.
- “Free Trial” accounts will be restricted to standing silently in Zona until they become premium members. While this would cut down on griefing, and give us another nice statue gardern, it wouldn’t entice new members to join up.
I know this isn’t a pleasant subject, but I think it’s worth bringing up from time to time. With all the bad things going on in the world right now, it seems like people could focus on being nicer to each other, instead of finding new ways to torment ourselves.
Thanks to the There Games Committee and the There Community, we’ve has another amazing There Summer Games.
And, as you can see, this year’s winner is…Pink! Followed, by Peach, and Red.
Head over here for one of the many, many nice sets of pics from the Games closing party.
And, finally thanks to uh, someone on Facebook for the excellent photo at the top of this post. Of course, once I’d gotten it, I couldn’t find it again, so I can’t provide proper attribution. I’m sure someone will be able to help me out (or, report me for copyright violation).
As you know, unlike the “old” There, we no long process credit cards ourselves, but instead use PayPal as our payment processor. We do this because by accepting, or “vaulting”, credit cards, we need to be what’s known as “PCI Compliant“.
Not only did this take considerable manpower, it was also expensive, as we had to pay external organizations to “verify” that we were PCI compliant.
Given all the expense and hassle, it made much more sense for us to use a payment processor like PayPal to handle credit cards for us. Among other things, PayPal (at the time) was one of the few processors who handled subscriptions, and is the only processor which handles micropayments.
Though most people can handle PayPal just fine (after all, they do serve millions of customers quite successfully), some people either can’t use PayPal, or, for their own reasons, don’t want to.
Today, we’re happy to announce that we’ll soon be adding Stripe as a payment option for subscriptions and Therebucks purchases.
(We won’t be supporting Stripe for “Real Money Purchases” of developer items. The reason for this is that Stripe doesn’t support “micropayments” – charging a much smaller fee for small purchases than they normally would. We could use Stripe for this, but their fees (which are typical for the industry) would eat up almost all of the purchase price).
We hope you’re as excited about this as we are, and will be letting you know as we get closer to release.
Every once in a while, we get an email which is so…special that we just have to share.
Without further ado, here it is:
I think it speaks for itself.
By now I’m sure you’re all aware of Edward Snowden and his revelations about the NSA, GCHQ (Great Britain’s version of the NSA), and just about every other government’s intelligence gathering organization.
In fact, there’s also a rumor that the NSA “used” the HeartBleed bug to extract things like passwords and private keys from servers for years before it was discovered “in the wild”.
But I think Snowden’s revelations and HeartBleed are actually much more broadly connected than the NSA’s alleged use of it (which they of course denied).
And, I believe that the HeartBleed incident is actually far more dangerous than Snowden’s revelations, and, ultimately, what we should really be worrying about.
And, that both issues – the Government’s eavesdropping, and Heartbleed, are our fault.
First the NSA issue. Like most people, I think most of us already assumed that the Government, or the Companies that provide internet services, or irresponsible employees of either of these entities, were probably accessing our data anyway.
While it may not have been something we fretted about on a daily basis, we took common sense precautions, like having good passwords, not sharing passwords between sites, taking care not to email sensitive information like passwords, SSNs, and the like, etc.
And, if we did something illegal, we were probably smart enough not to transmit it via the internet or even the phone.
In this regard, we owe one to the conspiracy theorists for at least making us think about these things.
The sad fact is, most of us weren’t careful enough with our personal information anyway to have the NSA revelations make any difference. For everything you’re probably concerned about the NSA doing – spying on what products you buy, your credit card #s, what you send in emails, what web sites you visit – someone else was probably doing it already.
Think I’m kidding?
- Reading your Mail. We already know Google scans your mail (Gmail) to give you helpful advertising.
- Credit Card Numbers. You give your credit card to a stranger, who disappears into a back room with it, every time you charge your dinner in a restaurant.
- Buying Habits. Let’s just forget Amazon. Use one of those handy Supermarket, Best Buy, or simaler reward cards? What do you think they’re doing with your data?
- Bank Card Pins? Try buying a metro card in New York.
- Your Location? Apart from just owning a phone which tracked your location, many Android Users actually paid for an application which tracked their location while pretending to be a flashlight
It goes on and on. No, the NSA isn’t doing anything different the someone else has been doing for years, legally, or illegally.
Of course, the advent of Social Media has only made this worse. Think about it: If the NSA really wanted to know where you’d been do you think they’d start by trawling through petabytes of data to find out? They’d probably start by looking at your Facebook, Instagram, or public Twitter postings, in which you probably blithely reported your location, what you were doing, who you were with, and what you were wearing.
Of course, that doesn’t make it right. Especially when it’s your elected government, and it could possibly be used in ways you don’t expect. Especially if the government, or someone important to the government is unhappy with you.
But does anyone actually expect this to stop? Sure, we can express indignation, demand action from Congress, even pass laws. But, in my opinion, all that means is that we’ll drive their efforts back underground. In the Government their will always be people who view the laws as guidelines, more than actual rules.
Even worse, whatever changes we can institute in our own government, it does nothing to impact what other people, companies, and countries will do illegally.
As a little “P.S.” to the NSA, it doesn’t matter what else we learn from Snowden, or, in fact anything beyond one fact: You Did It. You went as far as you could go, and beyond. You broke the trust of your citizens. You broke the trust of your citizen’s companies. You broke the trust of our allies. Nothing you can do will undo that, and we will always know you will do it.
No, the real problem is us. Beyond the fact that we’ve elected and enabled a Government which does this, the fact is that most of us don’t manage our privacy in a way we’d expect others to respect it.
That – and this is where we get to HeartBleed – is where the real problem is.
We found out last week that even if we did all the right things to protect (most) of our data, the tools we were (implicitly) trusting we horribly, horribly broken.
And that’s our fault, too.
The HeartBleed bug is roughly the equivalent of finding out:
- Seat belts, if fastened while the back right passenger door open, will spontaneously fly open in the case of an accident
- Electrical outlets will stand a 10% chance of shooting out bolts of high voltage electricity if you plug something in while standing on one foot.
- If you take aspirin while drinking milk from a cow with a black spot on it’s forehead, will make you break out in hives for a week.
- All door locks and alarm systems made in the last two years have a defect such that your house can be easily entered by someone carrying a cat.
So you’re probably saying “Well, those are ridiculous examples! Those things could never happen?”.
Why is that?
Because, all of those things – seat belts, electrical outlets, etc, are surrounded by systems – regulatory, commercial, or social – that makes it very difficult for broken products to survive. We all know what would happen if seat belts started failing that way, or people started to get shocked by their outlets, or people broke out in red spots. There would be outrage. There would be congressional hearings. There would be lawsuits.
And there would even be reform. It might be something as important as UL (Underwriter’s Laboratories), or an “Evil Government Agency” like the NTSB (I don’t think they’re evil), or even a semi-evil organization like the FDA (I don’t think they’re evil either, just a little misguided sometimes).
The point is, we have now learned that the systems – regulatory, social, or commercial – to protect the internet, our use of it, and the safety of our data on it – are non-existent.
OpenSSL, which is the software impacted by HeartBleed, is maintained by a group of less than a dozen individuals who rely on donations (and a few corporate contracts) to maintain a piece of software which is central to our security on the Internet. And, apparently, only one of those volunteers work on the product on a full-time basis – the rest of them have “day jobs” which may not even be security related.
Let’s put this in perspective. The next time you get on an airplane, how you would feel if you learned the airplane’s collision avoidance systems was maintained by 12 volunteers who didn’t get paid, and only worked on the systems part time, because they to support themselves with day jobs as accountants, construction workers, and cooks?
And oh, one more thing. There are no formal test systems for the Collision Avoidance System. The volunteers do an amazing job of reviewing each other’s work, but since they are stretched so thin, they haven’t had the time to produce a rigorous set of tests for the software.
That’s the case with OpenSSL, so Heartbleed is really no surprise to anyone. In fact, I think people in the industry are still in shock as to how bad it is, and not quite sure what do other than patch up the current hole (Thank goodness the folks at OpenBSD have at least started a major clean-up).
But OpenSSL is just part of the problem (oh, by the way, in case you thought HeatBleed impacting your Android phone was bad enough, it’s not just things like sign-ins to your Bank Account that are impacted. It’s every website that uses OpenSSL for security, including, potentially, power plants, hospitals, chemical plants, oil refineries, train control systems).
Let’s say you decide “Ok, I’m now going to be a safe, responsible internet user, and encrypt my sensitive emails”. Assuming you’re a “normal” person, this will prove to be an enormous pain, and you’ll probably end up giving up or doing it wrong.
“But, but”, you say, “how is this my fault?”. Ok, you didn’t do it deliberately. But what we have done is the equivalent of spending the last 10 years riding in cars with unregulated seat belts, 90% reliable electrical sockets, mostly good cow’s milk, and doors for mostly trustworthy dog-lovers. Certainly not a disaster. Yet.
But, we have to understand, as the public, that it’s a problem, and have the will to fix it. Hopefully, it won’t take something like defective ignition switches killing people to get everyone’s attention, but I have my doubts.
Then, we need to find a way treat these things like what they are : Public Utilities, or vital parts of Public Utilities, which require the appropriate level of care and trust.
Let’s be clear here – like, say, the public water utility – just because we choose to protect a given variant of software doesn’t mean you have to use it – just like you don’t have to drink tap water. If you think tap water isn’t protected well enough, or you don’t like it because you don’t like your water company, then you don’t have to use it.
What examples of these sorts of systems exist? Lots of models come to mind.
- U.S. Government systems, like the NTSB, or FDA
- Independent systems, like the Underwriters Laboratory
- International Organizations, like the ACM, IEEE
- Trusted private organizations, like Consumer Reports
- Stewardship by private or public organizations, like Google, or Symantec, etc. Note I didn’t use the word “Trusted”
- Form Private companies which will produce their own versions of SSL which are in turn certified by independent parties and sold, like enterprise software.
Some of these systems are regulatory, some provide objective reviews, and some do actual development. It’s likely that this problem needs some combination of all three.
You’ll notice I didn’t mention “Open Source”. This doesn’t mean that I don’t think these components shouldn’t be Open Source – they have to be to be trusted – it means that we can no longer rely on the current system of “Let’s hope we get enough donations to maintain this well”.
Some Open Source products are amazingly well funded and maintained, and some, like OpenSSL, are starved for resources and funding. So, I think the “Open Source” system is a part of the solution, but clearly not all of it.
So what do we do now?
If you’re an ordinary citizen, you can:
- Make sure you are treating yours and your family’s information responsibly. Remember, for all intents and purposes, once you put information on social media, it’s out of your control and it’s forever. That should be enough to give anyone pause.
- Use safe password practices. Consider using a tool like 1Password to generate and store good passwords. (By the way, Agile Bits, the people who make 1Password, have an amazing blog which talks about HeartBleed and you).
- Do you best to understand other security issues like “SSL” and “Encryption”. You don’t need to be an expert, but, like your car, even knowing a little bit more is helpful
- Support political candidates that take your rights to privacy seriously. Resist the urge to get partisan about this – both parties have been violating those rights, both have continued to violate them, and both will continue to, if given the chance.
- See below. Maybe you can do more!
If you work in Technology, or are even more interested, there’s lots more that you can do!
- Understand the efforts of the OpenSSL group, and, where possible, how you might be able to help. For example, I’ve noticed there been a hue and cry over the lack of automated tests for SSL, but no one has stepped up even offer to define them, much less build them.
- Understand the efforts of the OpenBSD Group, which, as previously mentioned, is trying to improve the OpenSSL situation. The OpenBSD group has an excellent track record for security, and are generally highly regarded.
- Donate money to wherever you feel it will work best: The OpenSSL Group, The OpenBSD Group, etc. If you really want to impact personal security in a broad way you can do what the guy who found the HeartBleed bug did – donate to the Freedom of the Press Foundation (follow the link to see why this makes sense).
- If you’re a real geek, consider contributing to any one of these projects – OpenSSL, OpenBSD, or one of the Freedom of the Press Projects. But if you do so, understand what’s needed – in my view, OpenSSL needs a lot of good old grunt-work – not super cool groundbreaking stuff, but good old things like…test cases.
Finally, if you’re good at organizing, help think about what I wrote above about systemic improvements. I will be. Maybe I’ll even try and do something.
I can’t believe I have to post this, but what not to do about HeartBleed.
Also Android phones may not be susceptible to HeartBleed, but it’s very hard to tell.
There: The only place where even the Weekends have Trailers:
And, not only THAT, there’s a ”contest” for the best Trailer. So, not only is it Free, you can ”’Win Prizes”’! Learn more here!
Camping Around The World
Who needs the Game of Thrones, when you have There.com? Thrones, Schromes, we’ve got something event better!
I’m happy to help spread the word about a truly unique event in World this Month: Camping around the World. And, to help promote it, I found this amazing video!
And, just when you thought it couldn’t get any better, we’ll be holding our next Free There Weekend (FTW), starting Friday, April 11th at 6 PM PST (9PM EST) and ending Sunday, April 13th at 11:59PM, PST. So tell your friends, tell your Facebook, tell your Twitter!
(We’ll be running some Google advertising to this affect over the next week or so, and, of course, posting on our Facebook Page).