mail abuse and membership

Oct 19 03:36 UTC 1995

Generally when someone gets tons and tons of mail on Grex, to the point that
it's starting to fill up the mail spool that we all share, I or another
staffer will move their mail to their home directory.  The partition with
the home directories has a lot more free space than the mail spool does.
When I move people's mail, I also send them a message explaining what I did,
how they can read the mail that I moved, and saying that if they make a
habit of leaving these vast amounts of mail in Grex's mail spool (ie. if it
happens more than 2 or 3 times) their account will be deleted for mail
abuse.  Accounts get deleted this way fairly regularly, usually because the
account's owner subscribed to an active mailing list and then forgot that
the account existed.

Recently, for the first time, a member reached this threshhold where her
account would have been deleted for mail abuse.  I went ahead and deleted
her account, just like I'd do with any other account, member or not.

Did I do the right thing?
Should members have special consideration for account deletion?

response 2 of 72:

Oct 19 05:33 UTC 1995

Grex should have set limits on the use of limited resources, which
apply to members and nonmembers alike, and which are made so that they
cannot be violated. These limits should be known by all. If this
were the case here, no mail spool could exceed the agreed upon limit,
and further mail would be automatically refused. The user that reaches
limits should reasonably be warned before the limit is reached, but I
see no reason not to enforce the limit when it is reached. However I
do not see that account deletion is the appropriate "punishment" for
exceeding an unpublished limit. I recommend that necessary limits
on resources be established and enforced equitably and with due process.
(And that provisions be made for exceptions in justifiable cases.)

response 4 of 72:

Oct 19 13:56 UTC 1995

Right: Deleting the account is a very efficient way for Grex not to have to
process their mail anymore.  This saves mail spool space, internet link
bandwidth, and staff time for dealing with the person's mail the next 17 times
it grows to gargantuan proportions.  It's not meant so much as a punishment,
but rather it's a very efficient way of unsubscribing the person from their
mailing lists, and otherwise getting their attention.

Also, most people who accumulate tons of unread mail have already stopped
using Grex for whatever reason (lost password, lost net access, etc.), and
won't at all miss their account if it is reaped.

response 6 of 72:

Oct 19 16:50 UTC 1995

If attemps were made to contact the person in question over a period of
time without results, I feel you did the right thing considering the 
situation.  Put a policy in place now so that there will be no feeling
of guilt in the future.

response 8 of 72:

Oct 19 18:28 UTC 1995

Whose account was reaped?  I'll find out!  >:)
  
I think it was a good call.  That sort of problem is usually caused by
ignorance, not maliciousness, but account removal was practical, not
punitive.  If the user recreates an account and proves their identity,
the account should be relisted as a member's.
 
Curious: was the person was no longer logging on, logging in but not
reading mail, or reading mail but ignoring requests sent to them?
 
Reaping seems easiest, but a non-reap alternative might be reading the
member's mail to find the mailing list sources, and unsubscribing them.
Is that too invasive, or does staff sometimes do that to active accounts?
Better yet would be automatic mail spool quotas...some day!  :-)

response 10 of 72:

Oct 19 19:45 UTC 1995

Perhaps what is needed here is not a "reap" per-se, but making the
account invisible to incoming mail by, say, renaming it. The owner
should be informed of this, and the reason. I can see some problems
in doing this. Can an account be made invisible to external mail
while permitting the transmission of internal mail?

response 12 of 72:

Oct 19 22:38 UTC 1995

Could you just enter a system alias redirecting their mail to
"no_such_account"?  This would cause their mail to bounce just as nicely as
nuking them, I think.

response 14 of 72:

Oct 20 03:55 UTC 1995

(Selena's point in #5 was that it says the above in newuser, but does
not say "except if you're a member," so members should obey newuser's
request as well.  Seems reasonable.)

response 16 of 72:

Oct 21 23:38 UTC 1995

I don't think reaping accounts is a very good way to deal with mail
abuses.  Actually, I've put a fair amount of work into teaching the mail
software about a better way to deal with this, in a largely automated
manner.  Currently, sendmail is capable of refusing mail that is on a
special list of "mailbox full" people.  I have a version of "mail.local"
that is capable of detecting "mailbox full" conditions, and posting
people to the list when this happens.  The part that's missing is stuff
to tell people their mailbox is full, and a method of allowing them to
get themselves off the list after they've cleaned up their mailbox.

Finishing this up got queued up behind dealing with other issues
including httpd & the sun-4.  But I hope to get around to finishing it
up sooner or later...

response 18 of 72:

Oct 22 12:17 UTC 1995

         I mean, a patio's great marcus, but what's wrong with the
umbrella, for keep rain off our backs, ntil the patio is complete?

response 20 of 72:

Oct 23 10:40 UTC 1995

That last includes people who don't understand how to remove mail from
their in boxes, sometimes eventually complaining about how long it takes
to get to their new mail, I think.  X=exit, right?

response 22 of 72:

Oct 25 19:53 UTC 1995

Is there any way to automate moving mail from the spool to personal
directories?

response 24 of 72:

Oct 26 19:35 UTC 1995

        A point of curiosity- how many megs?