response 25 of 264:

Dec 1 21:23 UTC 1998

How many users are coming from this site?  If this is what I think it
is, it is not a small technical college but a very large (and reputable)
university.  If this is inconveniencing a large number of legitimate
users, then we should not leave it in place long.

response 27 of 264:

Dec 1 22:37 UTC 1998

We should leave the block in place until responsible people at the site have
agreed to keep their problem users from causing trouble on the Internet.

response 29 of 264:

Dec 1 23:24 UTC 1998

Perhaps it would have been useful to put something in
the MOTD stating that (the named) site would be banned
soon unless the problem stopped or at least the system
administrators took an active roll it trying to control
the sabotage.  That way when all these users suddenly
found themselves unable to reach Grex they'd at least
know what the problem is and maybe help put pressure on
to resolve the situation.

response 31 of 264:

Dec 2 04:01 UTC 1998

Good move, Steve.  I think you did the right thing.  I totally disagree with
Richard that we "owe" members access through any specific ISP.  Members of
this organization make donations to keep _our_ system up and functioning. 
They haven't contracted with us to buy anything, especially not access
through a particular other system.  

  So there is no way that we "owe" them refunds.  If, in a case like this, a
member lets us know she now has a problem reaching us, we should give them
information that lets them 1)  solve the problem at the banned site, or 2)
find another ISP to use to reach us. 

response 33 of 264:

Dec 2 11:44 UTC 1998

Re resp:29 and resp:30 - Whether it would have made any difference or
not to notify in advance via the motd, it would have been an appropriate
gesture, and *might* have been helpful in getting users from that site
to pressure site administrators. So I think that's how we should handle
any similar situations in the future.

I also feel that if we *do* get a positive response from system
administrators pledging to correct the problem, we should restore the
site's access, regardless of what the "popular sentiment" might be.

response 35 of 264:

Dec 2 13:40 UTC 1998

Also re the advance notification issue: I'm trying to put myself in the
position of a legitimate, non-trouble-making user from that site (of
which there are no doubt many) who suddenly finds that he and all his
friends have been cut off, and who may be totally unaware that there is
a serious vandal problem to which the site administrators have been
unresponsive. These users are left guessing as to what Grex's motives
were for the cutoff, and I am more than a bit uncomfortable with what
the guesses might be.

Although I think site banning may be a necessary last resort, I think
that some advance notification should always be given, so that the
motives are clear. We don't want to foster false impressions of what
we're up to.

response 37 of 264:

Dec 2 14:45 UTC 1998

Another reason for a warning: It would give users from the site an
opportunity to download mail and other files, knowing that their access
might be cut off. As it is, they didn't have a chance.

Other folks might not feel the same way, but if I were making a decision
at this point, I would restore access now and put a short message in the
MOTD explaining why the action was taken, and that a cutoff will occur
again if problems recur and site administrators are unresponsive. That
way, innocent parties from that site can take preventive measures and,
hopefully, pressure the administrators.

response 39 of 264:

Dec 2 15:12 UTC 1998

   No response as yet from the administrator I talked to about this
incident.  In his defense, I think he is the admin of a main site
that acts as an ISP to other educational institutions, so we may
have an extra level of people to deal with in this case.

   John, I understand exactly what you are saying, and this has
bothered me enough that I've had dreams about this whole thing.
I've never done this before, and I hope to never do so again.
Marcus is right--we've banned sites before, but as far as I know
they've been small places with one user--a nasty vandal--and
shutting them down didn't affect Grex much.

   This case is different: a LOT of people come in from this
site, but also, a significant number of problems have come in.
When I made the decision to ban this place, I'd already found a
backup account for the vandal, complete with another copy of the
fork bomb.  (Hand typed with the same strange spacing as the one
I killed that started all this).

   Let me as you this, John (and others who think this was the
wrong thing to do): in a situation where Grex is getting harmed
from activity (ie, a fork bomb, not unpleasant people) repeatedly,
don't we have a responsibility to take care of Grex, first?  That
in the final analysis what keeps the system running for all must
take precedence?

   I'll point out that I sent out more than 110 pieces of mail
to various people about their actions here, and have had hundreds
(and I do mean hundreds) of conversations with people from that site
asking them not to do certain things and to ask them to tell their
friends about Grex's limitations.

   Do you think that putting a notice in the MOTD would have been
as noticed as what I did, prior to my banning this site?  I think
not.

response 41 of 264:

Dec 2 15:49 UTC 1998

   Thanks.  Maybe I'm reading things incorrectly.  I find myself being
stressed over this more than I thought I would.

   Another question: if we don't get any responce from the site, what
do we do?  I'm trying to figure out now if any of the accounts that
came in from that site have other access, but I don't think many will.
I don't think we've received a single piece of mail asking why they
can't get in.

response 43 of 264:

Dec 2 16:24 UTC 1998

Are the ids from that site identifiable now? Could they all be sent e-mail
explaining (briefly) why the site was banned, and saying that they will
have access again after some date, but if vandalism continues, the ban
will go into effect permanently? Perhaps also explain how they can help
prevent this from happening by asking their administrators to take some
action against vandals. Yes, I know there could be a thousand or so,
but the mail could be sent over several days. 

response 45 of 264:

Dec 2 17:18 UTC 1998

Good point - it is even easier just to send them all mail *here*. 

response 49 of 264:

Dec 2 20:12 UTC 1998

   Rane, I think cmcgee is right.  Or, they may have other mail like
hotmail but use Grex as the vehicle to get to it.  I'll check on that.
I have a list of all the users.