response 15 of 264:

Dec 1 01:20 UTC 1998

What's a fork bomb?

response 17 of 264:

Dec 1 04:19 UTC 1998

   A fork bomb does what Dave said, by splitting off a copy ("forking")
itself, which wakes up and makes copies of itself, too.  A form of
cybernetic cancer I suppose.  Eventually, the system becomes so bogged
down that little else happens.

   Here on Grex, we've changed some things such that no one person
can grab "everything".  Thus today when the load average was at 77,
things were rather miserable but things still ran, however slowly.

   ...Still trying to contact the system administrators of the site
in question.

response 19 of 264:

Dec 1 06:25 UTC 1998

I don't see what the possible presence of a paying member has to do with
anything.  Members don't "contract" for services.  They "donate" to
support grex.  The fact that a paying member *might* be using an
incompetent ISP who doesn't care about vandals isn't and shouldn't be
our responsibility.  Giving a refund in this case would be like giving a
refund because the member's computer broke.  It should be the member's
responsibility, and it's certainly in the member's best interests, to
find another ISP that does a better job of handling vandals.

Something to keep in mind with all this, is that dealing with these
incidents is already incredibly time-consuming on the part of staff.  It
can take hours to go through the system logs, pull together all the
information available about the vandal's activities on grex, where they
came from, and how to get in touch with the places they came from, then
to compose a message pulling together all the various log entries and to
send it off.  (This is even *with* the canned boiler plate fork bomb
template.) After this, it's a matter of waiting, first for the site to
respond (it often takes 24 hours, or sometimes several days, before a
site will respond, and some sites never respond.)  In the cases were we
end up blocking things, this process often repeats itself, which means a
whole new mail message has to be composed, with the new log file
entries.  This process can in some cases take months to resolve.

response 21 of 264:

Dec 1 16:41 UTC 1998

At risk of drift, I will throw out an old proposal of mine:  it is time 
to consider making shell access available via application only.
 
The argument that we need to provide exposure to a Unix programming 
environment is greatly lessened with the rise of the free PC unixes such
as Linux.  And if anyone still wants to work on programming issues
on grex: well, they can apply for the shell account.
 
Balanced against this is the enormous amount of staff time sucked up 
dealing with malicious users.  The Internet puts us in a different 
situation in term of open access, and we're too attractive to vandals.
 

response 23 of 264:

Dec 1 19:55 UTC 1998

We currently have one member in India, and that is sisiro.  Judging from the
wtmp file he logs in from a number of different IP addresses, so I don't know
how to tell if he has been blocked by cutting off this site.  (His last login
was 11/20).  Perhaps someone who knows the name of the site that was blocked
should write to him and ask?  I see that his mail is being forwarded to 
hotmail.com.

response 25 of 264:

Dec 1 21:23 UTC 1998

How many users are coming from this site?  If this is what I think it
is, it is not a small technical college but a very large (and reputable)
university.  If this is inconveniencing a large number of legitimate
users, then we should not leave it in place long.

response 27 of 264:

Dec 1 22:37 UTC 1998

We should leave the block in place until responsible people at the site have
agreed to keep their problem users from causing trouble on the Internet.

response 29 of 264:

Dec 1 23:24 UTC 1998

Perhaps it would have been useful to put something in
the MOTD stating that (the named) site would be banned
soon unless the problem stopped or at least the system
administrators took an active roll it trying to control
the sabotage.  That way when all these users suddenly
found themselves unable to reach Grex they'd at least
know what the problem is and maybe help put pressure on
to resolve the situation.

response 31 of 264:

Dec 2 04:01 UTC 1998

Good move, Steve.  I think you did the right thing.  I totally disagree with
Richard that we "owe" members access through any specific ISP.  Members of
this organization make donations to keep _our_ system up and functioning. 
They haven't contracted with us to buy anything, especially not access
through a particular other system.  

  So there is no way that we "owe" them refunds.  If, in a case like this, a
member lets us know she now has a problem reaching us, we should give them
information that lets them 1)  solve the problem at the banned site, or 2)
find another ISP to use to reach us. 

response 33 of 264:

Dec 2 11:44 UTC 1998

Re resp:29 and resp:30 - Whether it would have made any difference or
not to notify in advance via the motd, it would have been an appropriate
gesture, and *might* have been helpful in getting users from that site
to pressure site administrators. So I think that's how we should handle
any similar situations in the future.

I also feel that if we *do* get a positive response from system
administrators pledging to correct the problem, we should restore the
site's access, regardless of what the "popular sentiment" might be.

response 35 of 264:

Dec 2 13:40 UTC 1998

Also re the advance notification issue: I'm trying to put myself in the
position of a legitimate, non-trouble-making user from that site (of
which there are no doubt many) who suddenly finds that he and all his
friends have been cut off, and who may be totally unaware that there is
a serious vandal problem to which the site administrators have been
unresponsive. These users are left guessing as to what Grex's motives
were for the cutoff, and I am more than a bit uncomfortable with what
the guesses might be.

Although I think site banning may be a necessary last resort, I think
that some advance notification should always be given, so that the
motives are clear. We don't want to foster false impressions of what
we're up to.

response 37 of 264:

Dec 2 14:45 UTC 1998

Another reason for a warning: It would give users from the site an
opportunity to download mail and other files, knowing that their access
might be cut off. As it is, they didn't have a chance.

Other folks might not feel the same way, but if I were making a decision
at this point, I would restore access now and put a short message in the
MOTD explaining why the action was taken, and that a cutoff will occur
again if problems recur and site administrators are unresponsive. That
way, innocent parties from that site can take preventive measures and,
hopefully, pressure the administrators.

response 39 of 264:

Dec 2 15:12 UTC 1998

   No response as yet from the administrator I talked to about this
incident.  In his defense, I think he is the admin of a main site
that acts as an ISP to other educational institutions, so we may
have an extra level of people to deal with in this case.

   John, I understand exactly what you are saying, and this has
bothered me enough that I've had dreams about this whole thing.
I've never done this before, and I hope to never do so again.
Marcus is right--we've banned sites before, but as far as I know
they've been small places with one user--a nasty vandal--and
shutting them down didn't affect Grex much.

   This case is different: a LOT of people come in from this
site, but also, a significant number of problems have come in.
When I made the decision to ban this place, I'd already found a
backup account for the vandal, complete with another copy of the
fork bomb.  (Hand typed with the same strange spacing as the one
I killed that started all this).

   Let me as you this, John (and others who think this was the
wrong thing to do): in a situation where Grex is getting harmed
from activity (ie, a fork bomb, not unpleasant people) repeatedly,
don't we have a responsibility to take care of Grex, first?  That
in the final analysis what keeps the system running for all must
take precedence?

   I'll point out that I sent out more than 110 pieces of mail
to various people about their actions here, and have had hundreds
(and I do mean hundreds) of conversations with people from that site
asking them not to do certain things and to ask them to tell their
friends about Grex's limitations.

   Do you think that putting a notice in the MOTD would have been
as noticed as what I did, prior to my banning this site?  I think
not.