|
Grex > Coop11 > #49: Reasons to not allow verified non-members net access | |
|
| Author |
Message |
| 25 new of 57 responses total. |
krj
|
|
response 14 of 57:
| 
Dec 3 05:30 UTC 1998 |
I had another thought or two.
First, what is the intersection of this proposed policy -- to allow
local dialin users to use outbound IP services -- with
another proposed policy, to allow local dialin users to use PPP to
access Grex services. Does the logical combination of these two
policies lead to free, full PPP access to the Internet for all verified
users? At that point, Grex becomes a free, full-featured ISP, and
that probably has implications for our community-building functions,
and the demand on our resources.
Second: I can imagine one quick scenario where the demand for outbound
telnet puts a significant demand on Grex's modem capacity. This would
be the scenario where M-net slashes all (or almost all) of its dialins
in a cost-cutting move. I'm not saying this is inherently a bad thing,
but we want to think it through.
|
scg
|
|
response 15 of 57:
|
Dec 3 06:46 UTC 1998 |
My impression is that there are relatively few people at this point who want
to dial up somewhere with a terminal and telnet out, although I suppose the
worst case scenario, in which we open up outbound telnet for free, and then
everybody within a local phone call to Ann Arbor who wants to do that starts
using us instead of an ISP, would leave us pretty swamped. I'm also not sure,
given how cheap commercial Internet access is at this point, that it makes
sense for us to be providing outbound Internet services at all, since it makes
more sense for us to spend our resources on the things that are still only
done by Grex, but that's another argument that I really don't want to get into
right now.
From the dial-up PPP standpoint, we can provide as much or as little access
as we want there, but that has to be uniform. We can't provide full PPP
access to one user without providing it to everybody who dials up. The reason
for this is that our Chase IOLan terminal servers are stupid and don't support
Radius or any other sort of standard authentication protocol that allow us
to change settings for individual users. Doing a packet filter in our router
to allow only telnet to the outside world, or only telnet to a specific set
of sites, or no outbound access whatsoever, is easy, as a global thing. But,
without Radius or something similar, there's no good way to allow access for
one user that we don't allow for another. If somebody wants to donate a
terminal server that supports Radius, that situation will change.
Taht's not to say that we couldn't allow certain PPP dial-up users to telnet
out. They would just have to telnet to Grex and then telnet out from Grex,
rather than telnetting directly.
Anyhow, I really don't think Grex should get into giving out full dial-up PPP
accounts. That's being done reasonably well by a large number of other
companies, at very low prices. There are better things for Grex to use its
resources for.
|
remmers
|
|
response 16 of 57:
|
Dec 3 11:22 UTC 1998 |
Re the question of who would do validating: A long time ago, the Board
authorized the creation of a "validator" staff position. It's in the
minutes somewhere, probably 1993 or 1994.
|
steve
|
|
response 17 of 57:
|
Dec 3 15:13 UTC 1998 |
Yes, I remember that.
Right, I agree with scg that we don't want to give out PPP access. If
we offer PPP access on the dialins, its for the grex universe only.
|
remmers
|
|
response 18 of 57:
|
Dec 3 18:24 UTC 1998 |
Could somebody with a good memory or the patience to search
the records recount the sequence of policy decisions over the
years? A long while back, the members voted to restrict outbound
internet access to members, with the exception of a small number of
specific protocols (and specifically not including telnet). Later,
the policy was liberalized, again by member vote, to make some
protocols available to all users (most significantly, http)
and perhaps others to validated users. But I think not telnet.
So, would it require a member vote to authorize this policy?
|
janc
|
|
response 19 of 57:
|
Dec 3 18:41 UTC 1998 |
I think that vote predates me, or almost. I don't remember the details.
I think it was flexible on whether ftp and telnet were enabled to
validated users, but suggested that that was the default, if we didn't
feel there were significant security problems with it.
I don't believe opening this up would lead to a large amount of abuse.
First, few problem users are going to be willing to send ID, even fake
ID. If a validated user causes any problems with their internet access,
then we can revoke that net access. So yeah, I think there will be some
abuse here, but very little. I'd be surprised to see more than a
handful of incidents a year.
The validation procedure would be for someone to E-mail something that
looks like ID to our PO box. We implement some command that the
validator can run that works like "validate someguy". Since the
treasurer checks the PO box, probably it doesn't make sense for anyone
other than the treasurer to do it.
That's not hard.
Yes, the account deletion commands would have to be fixed to delete the
group file entry too. So?
Yes, this would likely lose us a few members.
But I'd feel much better about Grex if we did this - if all our services
really were available for free, and there wasn't this one small
exception to that. I don't think the problems with this are anywhere
near large enough to justify making them the only service we offer only
to paying users.
|
aruba
|
|
response 20 of 57:
|
Dec 3 18:48 UTC 1998 |
Re #13: Here is a list of places we have received cash and/or money orders
from over the last 5 years:
91.25 Amstelveen The Netherlands
5.00 Bresso Italy
6.00 Singapore
1.00 Orlando FL
2868.04 Ann Arbor MI
6.00 Baroda MI
18.00 Chelsea MI
60.00 Croswell MI
35.00 Gaylord MI
145.05 Jackson MI
76.00 Kalamazoo MI
5.00 Lansing MI
36.00 Milan MI
43.00 Scio Township MI
68.00 Southfield MI
780.09 Ypsilanti MI
6.00 Durham NC
100.00 Parlin NJ
15.00 Columbus OH
120.00 Toronto ON
60.00 Nacogdoches TX
35.00 Whitley Bay UK
18.00 Laramie WY
So while local people are not the only ones who don't pay by check, they do
account for the bulk of the money we get that way.
|
mary
|
|
response 21 of 57:
|
Dec 3 23:13 UTC 1998 |
I would like to see this tried. If the sky falls then
we go back to current access policies. I tend to think
it will work and we will come all that much closer to
doing what we (or at least some of us) started out to do.
|
steve
|
|
response 22 of 57:
|
Dec 3 23:26 UTC 1998 |
Tried which way? For anyone to be allowed outbound IP access
if they send in identification, or for local users?
Given that we've always allowed email to anyone, and for quite
a while have allowed Lynx access to anyone, I think Grex *has*
lived up to its lofty goals of providing access to cyberspace to
anyone and everyone. We allowed the single more important part
of the net (email) forever, and what is now arguably the most
important component, web access. If you disagree with that Mary,
please list the number of sites in the world that are as open as
we are, and as liberal with our resources as we are.
I don't think its possible to come up with more than a few.
|
mary
|
|
response 23 of 57:
|
Dec 3 23:52 UTC 1998 |
I'd always hoped Grex could offer the same access to everyone without
concern to whether they paid money or not. That was a big issue for me
from day one. No tiered access.
I'd open access (on a trial basis) to all validated users. But if most
folks would rather take it in steps and open it up to dialin users,
evaluate that change, then open it up to all validated users, fine.
|
steve
|
|
response 24 of 57:
|
Dec 4 03:30 UTC 1998 |
Well, I could go for allow local users, but not everyone.
|
aruba
|
|
response 25 of 57:
|
Dec 4 04:02 UTC 1998 |
Re #18: from /usr/local/grexdoc/archives/prvote/prvote01
PROPOSAL:
Cyberspace Communications (Grex) will restrict outgoing
Internet access such that only those who are verified and
paying membership dues will receive this service.
VOTE RESULTS:
Posted on April 6, 1994
32 out of 57 eligible members voted. The tally: Yes 21 No 11
The proposal passed.
from /usr/local/grexdoc/archives/prvote/prvote02
PROPOSAL:
The following internet services enrich the Grex community, do not use
much bandwidth, and do not provide much potential for internet
mischief; therefore they should be made available to all:
Finger
Whois
Ping
Mail (incoming and outgoing)
Incoming Usenet News
Incoming Telnet
Incoming FTP
Incoming Lynx
Talk (and it's various permutations)
Archie
Veronica
WAIS
Gopher (with all Telnet capabilities disabled)
The following services will be restricted to VERIFIED GREX MEMBERS and
VERIFIED GREX USERS (however the board shall define that term) because of
the potential for world-wide mischief:
Outgoing Usenet News
The following services will be restricted to VERIFIED GREX MEMBERS in good
standing, because these services utilize a lot of bandwidth, offer
less of a benefit to the Grex community as a whole, and/or hold the
potential for system cracking and other undesirable activities:
Outgoing FTP
Outgoing Telnet
Outgoing Lynx
Gopher (with telnet capability enabled.)
IRC
Being that the major objection to open access for the above
services is the lack of available bandwidth on Grex's internet
link, It is understood that any of these services may be made
available to all VERIFIED USERS as well as VERIFIED MEMBERS as soon as Grex
acquires a link of suitable power and robustness.
In order to maintain the integrity of both Grex, and of the Internet as a
whole, the Grex board shall have the power to restrict or deny internet
access to groups or individuals who pose a security risk, or who engage in
inappropriate behavior (as defined by the Grex board).
The board may also make modifications to this proposal without resorting
to a member vote in the case of an emergency situation, or if some
provision of this proposal proves to be technically impossible to implement.
VOTE RESULTS:
Results were posted on Wednesday, August 17, 1994.
49 out of 80 eligible voters cast ballots. The Tally: Yes 36 No 13
The proposal passed.
Hmmm - unless I read that wrong, I don't think our current lynx policy is in
accord with that motion. It says that we could extend access to lynx to
verified users & members when Grex gets a big enough connection, but in fact
we extended it to *all* users. Go figure.
|
rtg
|
|
response 26 of 57:
|
Dec 4 05:43 UTC 1998 |
exactly what is 'incoming lynx'?
|
remmers
|
|
response 27 of 57:
|
Dec 4 10:56 UTC 1998 |
I think the intent of the motions was to define access to protocols,
not particular applications. So replace "lynx" with "http" everywhere
it occurs.
You're right, we've allowed outgoing http to all users for some time
now, and this does appear inconsistent with the voted-on policy. I'm
not sure how that came about. I don't recall any proposals other than
the above two. However, there have been *no problems* that I'm aware
of with allowing outgoing http to unverified users. I'd like to see
open access continue.
|
steve
|
|
response 28 of 57:
|
Dec 4 15:19 UTC 1998 |
Unforunately, there have been problems with allowing unverified
http access. There are several vandal tools, the most popular being
'phf' that try some old tricks to steal things like passwd files. a
couple of times I think its worked, to actaully steal something. I've
also seen a couple of cases of people writing *very* strange code,
hitting on certain files on a server, where it looked very much like
an attempt at a Denial Of Service attack. Both times when I saw this
I asked them what they were doing, and poof, instant log off.
So, yes, there have been some problems with it. The good news is
that a vandal can't do that much--there aren't as many creative ways
to try messing about, so that I know of we've never had a horrid
problem because of this.
I want the open access to continue as well.
|
aruba
|
|
response 29 of 57:
|
Dec 4 15:38 UTC 1998 |
Maybe we should officially change the policy (it would take a member vote, I
think) to allow http access to everyone.
In any case, it's clear that the intention of the second proposal was to
extend full internet access to all verified users when we got a fast enough
link. Do we have a fast enough link now?
|
mta
|
|
response 30 of 57:
|
Dec 4 16:10 UTC 1998 |
Steve, I understand your reluctance to open up outgoing telnet to
everyone...it is potentially *a lot* more woek for staff. But given what Jan
says and given that my instincts say that the sheer amount of time involved
in sending in ID (fake or otherwise) and waiting to be verified will slow down
a major portion of the would-be vandals, I think it's worth a tial run.
Maybe, to make life easier for the folks who have to clean up the mess, if
one results, we should agree about what constitutes an "unfortunate but
acceptable" vandal control problem and what constitutes reason to shut the
trial down...
|
steve
|
|
response 31 of 57:
|
Dec 4 16:24 UTC 1998 |
Thats right: it is potentially a lot more work, and why? It isn't
the case that anyone who comes into Grex remotely doesn't ALREADY have
telnet access. That, coupled with the fact that we allow the more
important interfaces (email, http), why is there is feeling of moral
failing that we don't offer telnet to the masses?
Also, if there is a movement to open telnet to all, then shouldn't
FTP be included in the list? Only, we have an immediate problem--Grex
is not a place to download files from and if we let people FTP, we'd
be giving out yet another mechanism to let people bring over endless
streams of graphical/audio files to Grex.
I'm sorry Misti, but this doesn't buy Grex anything. We're already
generous in what we offer, and what we don't isn't nearly as important
as what we currently do.
Why is there this feeling that we should do things that only cause
us more work, *have real security problems*, and aren't nearly important
now as they were back when we first started Grex? Time moves on and
technology changes. That which was once important is less so, now.
Lastly, there are several vandal sites that have very good details
on how to create fake IDs. I can just about guarantee that no one on
Grex has the ability to detect them.
|
danr
|
|
response 32 of 57:
|
Dec 4 16:40 UTC 1998 |
Interesting item. I'd be inclined to offer outgoing telnet to dial-in users who
have sent in id. In fact, I'd be inclined to limit it to folks for whom a call
to Grex is a local call. This would make the work load mangeable and yet still
provide a real community service.
Maybe I missed it, but I don't see any reason to allow people who telnet in
from telnetting back out.
|
aruba
|
|
response 33 of 57:
|
Dec 4 17:40 UTC 1998 |
I guess I don't see any reason for that either. Is it technically feasible
to modify the kernel blocks to check not only whether someone is in the
internet group, but whether they are dialed in?
Re #31: I think that granting telnet/irc/ftp rights to local users is a
charitable venture, and I think it would benefit the greater Ann Arbor
community. It may not be as important as it was a few years ago (though
there is a lot more to see on the net than there was then), but it is still
important to people who have no other access than Grex.
Maybe the best compromise is to only validate users who have a local address
and show some ID that we can check locally. If that goes OK, we could talk
about expansion later. If some local kid trashes whitehouse.gov from Grex,
we can send STeve around to his house to read him the riot act. :)
|
steve
|
|
response 34 of 57:
|
Dec 4 18:15 UTC 1998 |
Sure, we could keep track of those coming in from the terminal server. I
think we'd have to modify login perhaps, but regardless we could do something.
That comment about allowing IRC scares me, however. I could see a whole
lot of people discovering that Grex was a free IRC portal, and being jammed.
|
krj
|
|
response 35 of 57:
|
Dec 4 18:34 UTC 1998 |
In other words, Grex can only offer services no one wants. :/
I feel another item coming on. :)
|
steve
|
|
response 36 of 57:
|
Dec 4 18:39 UTC 1998 |
IRC is a really interesting thing to deal with. People who administrate
systems hate it, and a lot of users LOVE it. IRC uses a tremendous amount
of bandwidth. Not CPU or disk unorunately, but bandwidth: it ties up dial
in modei for hours at a time, and many universities have had problems with
IRC taking up significant amounts of bandwidth. Today part of the IRC
"problem" has been solved by sites that are specifically set up for IRC
servers, and most users have ISPs from whom they get a small PPP pipe and
can do whatever they want.
But back when I used to watch people at the AA public library use the
six systems on the third floor, there were always people using real-time
chat systems, IRC being quite popular.
|
cmcgee
|
|
response 37 of 57:
|
Dec 4 21:05 UTC 1998 |
#4 of 36: by John Ellis Perry Jr. (jep) on Wed, Dec 2, 1998 (17:05):
I see no reason why we offer telnet at all, to anyone. I'll bet there
isn't one user on Grex who depends on it; who wants to be able to telnet
(or use ftp) but doesn't have other, better resources available.
Gosh, I hope you bet lots and lots of money! You owe it all to me. (I'm
willing to share with others who depend on it _and_ doesn't have other, better
resources available).
#4 of 36: by John Ellis Perry Jr. (jep) on Wed, Dec 2, 1998 (17:05):
I see no reason why we offer telnet at all, to anyone. I'll bet there
isn't one user on Grex who depends on it; who wants to be able to telnet
(or use ftp) but doesn't have other, better resources available.
Gosh I hope you bet lots and lots of money! You owe it all to me. (I'm
willing to share with others who depend on it _and_ don't have other, better
resources available.)
|
jep
|
|
response 38 of 57:
|
Dec 4 22:32 UTC 1998 |
I really don't care, personally, if telnet is offered or not offered,
but I agree with Mary's preference that it be offered regardless of
money sent.
|