Grex Coop10 Conference

Item 72: Validating Institutional Members

Entered by aruba on Fri Jan 23 11:26:22 1998:

I was wondering to what degree people think we ought to validate
institutional memberships.  Right now we simply require that we have
either a corporate check or some person's ID.  That serves the primary
purpose of validation, namely it allows us to find a real person to blame
in case someone does something nasty with the account. 

It occurs to me that the institutional membership class might be used for
something other than what it was originally intended for.  I'm wondering
if people think we should allow this or not.

Suppose user John Smith has two accounts, johns and jsmith, and he wants
both of them to have internet privileges.  Could he pay for a regular
membership for johns and an institutional membership for jsmith, using
some creative institution name, like "John Smith Enterprises, Inc.", and
using a personal ID as validation for both?

In other words, should the treasurer make an effort to insure that the
institution behind an institutional account acually has some legal
existence?
96 responses total.

#1 of 96 by rcurl on Fri Jan 23 18:16:04 1998:

Is there a problem with a user controlling a number of accounts with
internet access, but not voting privileges?

I would hope that Institutional membership would be of interest to
unincorporated clubs, too. If a sewing circle is willing to support grex,
is there a reason to demand incorporation?

With 14,000 users but only 100 members paying the bills, I think grex
should want to accept donations from both individuals and groups willing
to support us, so long as "one person one vote" is maintained.



#2 of 96 by cmcgee on Fri Jan 23 19:23:25 1998:

That hasn't been the case up until now.  As far as I know, when I asked about
paying for two internet access accounts, I was told that I could have *one*
paying membership, but not two, and that only a membership would allow the
account to have internet access.  

This has come up several times in the past.  And I think we would be remiss
in allowing me to get a McGee and Associates institutional membership with
internet access, just because I am (and have been) in business for myself for
over 15 years.  

The camel's nose is pushing up the edge of the tent, folks.  


#3 of 96 by rcurl on Fri Jan 23 19:29:28 1998:

Nonsense. What harm would your having two accounts, paid for, with
internet access, do to grex? (At the time you asked about having two
internet access accounts, wasn't there only one way to do that, with an
individual membership?) 

I would be pleased if McGee and Associates joined grex as an institutional
member. Another $60 donation. Thanks!


#4 of 96 by scott on Fri Jan 23 19:36:22 1998:

I wouldn't have a problem with that.  After all, Grex di decide at one point
that allowing validated acces to the Internet would be OK, but that we
currently didn't have the resources.


#5 of 96 by valerie on Fri Jan 23 21:45:21 1998:

This response has been erased.



#6 of 96 by mary on Sat Jan 24 00:23:02 1998:

I agree with both Rane and Valerie and would hope that
any institution or corporation that wanted a membership
would be granted a single membership.  No matter if they
were incorporated or not, non-profit or for profit, the KKK
or Save the Nerds.


#7 of 96 by lilmo on Sat Jan 24 01:36:49 1998:

Re #5():  Say you live in a tent, and your pet camel is staked outside, but
wants inside.  So, he sticks his nose under the edge of the tent, to see if
that is a problem.  Then the rest of the head, then the neck, etc, until your
camel is sharing the tent with you.  Have you ever tried to move a camel where
it doesn't want to go?  Basically, you don't.  So now, the camel lives there.

Eh?


#8 of 96 by rcurl on Sat Jan 24 07:37:45 1998:

Would someone having a problem with Institutional members please describe
the camel?


#9 of 96 by davel on Sat Jan 24 13:45:47 1998:

What Rane said.  I understood the allusion, but not what it was supposed to
apply to.  (And I'm not saying I won't agree once something's pointed out.
I just don't know what future problem you see.)


#10 of 96 by aruba on Sat Jan 24 19:15:41 1998:

Maybe I wasn't clear in #0.  There's no question that Colleen may have an
institutional membership in the name of McGee and Associates, a company
which has existed for 15 years.  We already have a situation like that,
where one human pays for both a personal membership and an institutional
membership, and provides ID for both.  You'll recall that that was what
started the whole fuss which culminated, last July, in the Institutional
Membership Amendment to legitimize the situation. 

What I'm trying to point out in this item is that anyone who wants two
*personal* accounts with internet access can now have them simply by
fabricating an institution name.  In fact, anyone can have 5 such accounts
by fabricating 4 institution names. 

This doesn't violate the one-vote-per-person rule.  It could result in
more money for Grex.  But it's not what we had in mind when we approved
institutional memberships.  (At least it's not what *I* had in mind.)  I'm
trying to establish whether we should: 

    a) Disallow memberships for fictional institutions, and require some
       proof of an institution's existence, such as a corprate check.

    b) Disallow memberships for fictional institutions, but take a "Don't
       ask, don't tell" attitude toward institutional existence.

    c) Allow memberships for fictional institutions, and actively
       encourage people who want multiple personal memberships to make up
       institution names for all but one of them.

Approach 'a' may be a problem if an institution is a (real) club which has
no bank account or legal paperwork.  Maybe we could agree to accept a
membership list as ID, or something like that.  But this is getting a bit
sticky. 

The U.S. military has kindly tested approach 'b' for us and found a lot of
problems with it.  For instance, we'd have to decide what to do if we had
it proved to us (or confessed to us) that an institution which held a
membership was fictional.  Plus it encourages a degree of tight-lippedness
between Grex members and the Grex board and staff, which is not something
we have ever wanted.

Approach 'c' will probably result in the most money for Grex, but it makes
me a little uncomfortable.  If we're going to allow people to have
multiple personal memberships, I wish we could allow them to do it without
subterfuge.


#11 of 96 by aruba on Sat Jan 24 19:22:32 1998:

BTW in case anyone's wondering, there have been at least 3 people, as far as
I know, who've asked about having multiple accounts with internet access.

And Rane, please don't harangue me for saying "multiple personal memberships"
in the last paragrah of #10.  I should have said "multiple accounts with
internet access".  Mea culpa.


#12 of 96 by mary on Sat Jan 24 19:29:22 1998:

A whole lot about Grex depends on users doing the right thing by the
system on an honor system.  Individual membership asks for some proof of
identity but we've kept it so easy that if anyone wanted to take out false
memberships it would be extremely easy to do.  Instead of focusing on how
we can make it hard to cheat the system we've put our efforts into
recruiting users who respect what Grex is about and trusting each other. 

Why don't we just extend the same trust to organizational memberships. 
Make it clear the idea is one membership per organization, encourage
organizations to jump on in by making it easy to do so, and trust they'll
do the right thing. 

Should we ever find this trust thing doesn't work then address the
specific problem.  But so far it's worked real well and is a big
part of what makes Grex special.


#13 of 96 by aruba on Sat Jan 24 21:30:47 1998:

That doesn't really address my problem, Mary, which is: what do I tell people
who ask about having multiple accounts with internet access?


#14 of 96 by rcurl on Sat Jan 24 22:43:35 1998:

You tell them it is not permitted. One account per person, or per
organization. Just as you ask for individual identification, ask for
equally valid organization identification. In the case of an organization,
a letterhead is often accepted, although nowadays they can be created
instantaneously - but I wouldn't worry about it. I agree with Mary that we
should work on trust, until we know it has been violated. 



#15 of 96 by srw on Sun Jan 25 06:10:42 1998:

I think it is too bad that we called them "institutional" accounts. We
should have called them "non-voting" accounts. Then we wouldn't care if it
was an intitution or an individual who had it. 

I for one don't care. Let an individual have an innstitutional account if he
or she wants. There's no harm. Just don't let an institution have a voting
account, because it flies in the face on one-person, one-vote principle.


#16 of 96 by rcurl on Sun Jan 25 06:53:47 1998:

I care, because I have (had..) hopes that attracting organizations to
support grex would be helpful. I've even gotten a few organizations that
use grex to join as institutional members. If the name is dropped, there
is less specific identification of these community-supportive organizations,
and I expect grex would get fewer. I certainly would no longer try to
get organizations to join, if they are mixed in with just a "non-voting"
category. That's doesn't seem to give much recognition to a class of
supporters.


#17 of 96 by cmcgee on Sun Jan 25 17:00:54 1998:

Well, I for one, am NOT going to pay for a second, non-voting membership with
internet access, which I want for personal use, and tell Grex that it is my
business account.  This is exactly the issue I'm concerned about.  

Why is is ok for me to do that, but not honestly to tell you folks that the
second $60 is for a second personal account?

I do want two personal accounts with internet access.  Apparently there are
other people who want that too.  If the concept is ok as long as I pretend
that the account is for business or an institution, I as owner of a business,
and the president of a not-for-profit with 3 members (legal and viable, but
very limited in membership), could legitimately ask for 3 separate
memberships.

So I can legitimately have 3 accounts if I use my business name, and my
not-for-profit name, but not if I use my own name.  *Shrug*  So the current
deal is that I can have 3 accounts, and no one will check my email to see how
I'm using them, 'cause you don't want to know whether I've lied?

Seems like a weird way to run an "open" system. 

It appears we have let the camel (multiple personal accounts with internet
access) into the tent after all.  
 


#18 of 96 by scg on Sun Jan 25 17:04:18 1998:

This issue is one of the many reasons I've never been comfortable with Grex
comining membership and selling Internet access.


#19 of 96 by valerie on Sun Jan 25 17:23:36 1998:

This response has been erased.



#20 of 96 by mary on Sun Jan 25 17:38:35 1998:

Know if you do that you'll be encouraging a policy which gives
those who can afford it more perks.  I'd much rather we said
something like, we really appreciate your *donating* to a good
cause, knowing your *gift* will allow others who maybe can't
afford it to be part of our community.  

We should do what we can to de-emphasize the feeling of 
members buying specific services.


My 2 cents.


#21 of 96 by remmers on Sun Jan 25 18:12:36 1998:

Right, the camel here is the concept of "more perks for more
money", which is something we've always tried strenuously to
avoid.

Re #18: The concept of tying internet access to membership was
ratified by the members (an official proposal vote) several years
ago. I've never been comfortable with it either and voted
against the proposal at the time.

That said, I'm having a little trouble seeing what substance is
at stake on this particular issue. What can a person do with
five personal accounts with internet access that they couldn't
do with just one?


#22 of 96 by rcurl on Sun Jan 25 18:40:18 1998:

Re #17: I don't see the problem. So what if you want multiple personal
accounts with internet access (for whatever reason). Grex does not offer
them. If you want to pretend you are just managing accounts for a lot
of fake organizations - well, there are many ways to screw this system,
but I just about don't mind because you would be supporting the system
more than those 14,000 non-supporters, and you would have to live with
the fiction. 

I'm interested also in the answer to remmer's question in #21.


#23 of 96 by other on Sun Jan 25 23:13:18 1998:

One person can only reasonably use one account at a time, unless they have
multiple computers with separate phone lines, or a large screen with several
windows and something layers software.

Theoretically, one person could create several accounts and login on separate
ttys and tie up the system preventing other users from access, but they don't
need outgoing internet access to do that, or to pay any money.

What then, is the problem?  If someone wants to pay for full membership and/or
internet access for multiple accounts, what possible problem could we have
with that so long as the 1p1v is maintained?

Resource use can't be the issue, because the resources can be used much more
extensively by creation of numerous non-member accounts.  At least with member
accounts there is additional money coming in to Grex.

The whole thing boils down to the value of a non-voting membership.  What is
that value, aside from the internet access?  And why do we care if someone
pays for multiple representations of that value.  It's not like they can be
used cumulatively, so nobody really has "more" access just because they have
more memberships...  Am I missing something here?


#24 of 96 by valerie on Sun Jan 25 23:34:32 1998:

This response has been erased.



#25 of 96 by aruba on Mon Jan 26 04:22:45 1998:

Re #23:  "What then, is the problem?"  Well, the problem is this.  If we
allow people to pay for internet access on as many personal accounts as
they want, I don't think there's any way we can pretend we're not "selling
internet service".  Up to now, we call membership fees "donations", and
internet privileges "membership perks".  I don't see how we can extend
that to a situation where people can buy access for as many accounts as
they'd like. 

I don't think we should be in the business of selling internet service.
For one thing, I think we'd have to charge sales tax on those extra
accounts.  And for another, if our attitude shifts away from the
donations/perks model toward the sales model, people may start to treat us
the way customers treat a provider.  That's not what Grex has been like up
to now.


#26 of 96 by scg on Mon Jan 26 06:37:39 1998:

I agree with Mark.


#27 of 96 by rcurl on Mon Jan 26 06:58:32 1998:

Nobody is proposing what Mark describes in #25. The policy is one internet
access per member, individual or institutional. I recommend keeping that
policy.

I'm a case in point, I guess. I maintain four accounts for non-profit
organizations (all MI corporations and 3 501(c)3)  in addition to my (one) 
personal account. Three of those organizations are institutional members
and the fourth one will be soon. They all use the internet - but only for
e-mail, web pages, and ftp from outside, which are all allowed non-members
anyway. None use party or a lot of other resources.

Am I a camel's nose?    8^}

(I just noticed that we already provide *everyone* with most of the
internet "perqs" that people might want - add lynx to the list above -
....the additional member internet "perqs" don't amount to much.)



#28 of 96 by remmers on Mon Jan 26 11:09:27 1998:

I agree with Mark also.


#29 of 96 by albaugh on Mon Jan 26 16:46:54 1998:

This doesn't help with institutional users, but is there a way we could use
Unix group membership etc. to do the following:  Allow a user to establish
a "primary" account that would be internet-enabled and vote-enabled given the
$ and verification.  If that same user wanted internet access as another user,
then he'd send staff or whoever an e-mail from his primary account, to add
the secondary account to the group of the primary user.  That would allow the
secondary account to have internet access under the umbrella of the primary
account.  The downside would be a person who pays for his primary account,
then gets secondary accounts for his buddies to use without paying.  But if
we're supposed to operate in an atmosphere of trust...


#30 of 96 by aruba on Mon Jan 26 17:34:51 1998:

Yes, we could do that, and we wouldn't even need to use UNIX groups to
accomplish it.  The member could just write to me and I'd add the pseudo to
the internet group, and keep track of it in my database, so I know to delete
it if the membership expires.

I confess to being worried about the "add my friends" problem.  (We ought to
at least put a cap - say 3 - on the number of additional accounts with
internet access, and make the member state that the accounts are indeed his.)

Re #27:  Rane, I think several people were proposing that we allow people to
"pay more and get more", which is what I was reacting to.  If anyone wants to
know exactly what internet privileges we're talking about here, this is what I
tell people when they ask me (courtesy of srw):

Non-members are forbidden all internet access except via these protocols:
finger, gopher, talk, and http.  All other internet protocols (such as
telnet, ftp, irc, and many more) are reserved for members only.  So that's
what you gain by being in the internet group.


#31 of 96 by remmers on Mon Jan 26 18:55:11 1998:

What Kevin proposes in #29 sounds reasonable; my reservation would
be that it's yet another drain on staff time, which is in scarce
supply to begin with.


#32 of 96 by rcurl on Mon Jan 26 19:02:09 1998:

Add to the allowed protocols e-mail and ftp from a remote site. 

So, why don't you just verify organizations like you verify individuals?
The 'proofs' may be a little different, but we decided what was acceptable
for individuals, and we can do the same for organizations.


#33 of 96 by other on Mon Jan 26 23:35:42 1998:

i just didn't see it the way aruba describes it.  that makes a lot of sense
to me, and given that we do not "sell" internet service, and do not want to,
it also makes sense to me to keep the limit we currently have.

perhaps we could have institutional memberships for formally organized groups,
and ask that informal groups register as essentially the personal account of
the contact person/primary user...?   hmmm... i see some potential problems
with that idea.  

i guess then what we are left to struggle with is the perception of what we
provide and what we are.  we could try to authenticate inst'l users, and any
who cannot provide some significant authentication can be asked to assign a
member of their group as "the person responsible and answerable for any use
or abuse of the account."  then we can treat that account, for all intents
and purposes as an inst'l account.  again, we'll have to rely on the good faith
of the contact person who creates the account, but since it's not a voting
account, i think that as long as we continue to maintain the idea that
individual users can only have one account with full access, we don't really
lose anything if occasional people want to deceive us and pay us for more.


#34 of 96 by valerie on Tue Jan 27 16:49:08 1998:

This response has been erased.



#35 of 96 by valerie on Tue Jan 27 16:49:39 1998:

This response has been erased.



#36 of 96 by rcurl on Tue Jan 27 17:22:07 1998:

For what its worth...the IRS makes a distinction between inexpensive premiums,
such as tote bags, and more significant premiums, such as the cost of a
dinner. There is also a distinction between an incidental premium and a
regular premium. You may get a tote bag for joining some organization, but
you do not usually get them for renewing. You can also not usually take
out two memberships for yourself in most non-profit organizatiions in order
to get a double premium ("one to a customer..."). 

In any case, I did not think that Grex was offering internet acess as a
perq to members, but rather limiting it to members in order to manage the
resource.


#37 of 96 by remmers on Tue Jan 27 19:17:42 1998:

That's what I thought too.


#38 of 96 by mary on Tue Jan 27 21:56:27 1998:

Yep.  That's been my understanding of the restriction too.


#39 of 96 by mdw on Wed Jan 28 01:36:21 1998:

There are several reasons we restricted some internet access to members
only.
(0) anti-vandalism.  Vandals like to find anonymous machines to
        use as "jump gates" to hide their actual location, and they
        also like anonymous machines when attacking other machines.
(1) accountability/liability.  If a non-vandal decides to attack
        some other site or person, this allows us to name the person
        and pass the buck in terms of responsibility for the problem.
(2) to limit some kinds of use to a scarce resource.
(3) to be a perk for members.  This was not the *only* reason why
        we did this, but this *was* one of the reasons we originally
        setup this restriction.

I don't see a big problem with institutional access, provided it isn't
abused.  We certainly need to get a good idea of who is responsible for
the use of the organization - for an incorporated business, this is not
hard.  They're registered with some state, and this is something we can
verify - we should also be able to get an address for the principle
office of the organization, & other contact info.

For an unincorporated business, the business itself can't be held
liable; rather, the individual people concerned are completely liable.
So, for an unincorporated business, we need the name(s) of all of the
people who will have access  Since there's no difference between this &
somebody just "buying" 2 accounts (so if we allow unincorporated
businesses, we should also allow people to just plain buy 2 accounts
with no need to make up a business name).

There are certainly ways this could be abused, so we should be careful
about this.  For instance, we certainly don't want to sell accounts to
"bulk mailers".  We don't want institutions to think of grex as a good
place to set up high traffic web sites.  We also want to be up front
about voting rights, so that they are not "surprised" later.  We also
don't want an institution to think of grex as a respository to store or
exchange private data, say, proprietary trade information.


#40 of 96 by davel on Wed Jan 28 01:46:44 1998:

Or, simply, any serious amount of data.


#41 of 96 by dang on Wed Jan 28 03:49:58 1998:

I am strongly against allowing multiple internet-enabled accounts to users.
As long as we are limiting it to one account/vote/internet access per person,
I can justify to myself giving Internet access as a perq. (BTW, it was my
understanding when we voted on this that is *was not* a perq.  It was to limit
the use for resource resons.  I'm against giving it even as a perq.  Even to
the point of not allowing it.)  However, if we start to allow people to buy
as many accounts as they want, then that's selling internet access.  We then
have an implied contract with out customers.  I, personally, don't want to
devote my spare time, what there is of it, to maintaining a system that sells
internet access.  I guess I just have big problems with the idea.  So, I'd
say we need to verify institutions somehow.  I'm not sure how, but to a
similar extent as the personal verification.


#42 of 96 by janc on Wed Jan 28 04:29:15 1998:

If we are limiting internet to members primarily for accountability reasons,
then it makes sense to allow members to have extra internet-enabled accounts
*for personal use* for no extra fee.

If we are also trying to limit use of scarce resources, that means we don't
want to allow people to give extra accounts away to friends, even if they are
willing to take responsibility for the use of the account, because that would
unbalance our rather delicate resource equation.

Note that if we did this, any user would be able to tell that one particular
account had member status but no voting status, so they'd know that it was
either a corporate account or a pseudo.  It would probably not be a matter
of public record which member a pseudo-member account was associated with.
I don't know if this would be all that interesting to all that many people.

We should not give sell pseudo-member accounts for the full membership price
because they don't include what is formally the main "perk" of membership -
a vote.

We could sell them for some lower price - $6 a year or something.  But I don't
really feel like that is worth the trouble.

I'd be OK with no-extra-charge, for-personal-use-only spare member accounts.
I'm not sure if the demand for them would be large enough to be worth the
effort of offering them, and the small possiblity of abuse, or the large
headaches when we start suspecting that xyz1, xyz2, and xyz3 are actually
being used by different people.


#43 of 96 by mary on Wed Jan 28 04:41:23 1998:

Me thinks someone should just go back and repost the original
items where this was discussed so our memories could be
refreshed.

Security isn't tied to $6 a month but rather to validation.


#44 of 96 by mary on Wed Jan 28 05:31:03 1998:

The following is the text of the membership vote which restricted
specific services to members only.  A number of reasons for limiting
access are mentioned but I don't see any reference to using these
restrictions as an incentive for folks to send in membership dues.

                ***************************************

 PROPOSAL:
 
 The following internet services enrich the Grex community, do not use
 much bandwidth, and do not provide much potential for internet
 mischief; therefore they should be made available to all:
 
  Finger
  Whois
  Ping 
  Mail (incoming and outgoing)
  Incoming Usenet News
  Incoming Telnet
  Incoming FTP
  Incoming Lynx
  Talk (and it's various permutations)
  Archie
  Veronica
  WAIS
  Gopher (with all Telnet capabilities disabled)
 

 The following services will be restricted to VERIFIED GREX MEMBERS and
 VERIFIED GREX USERS (however the board shall define that term) because of
 the potential for world-wide mischief:
 
  Outgoing Usenet News
 
 
 The following services will be restricted to VERIFIED GREX MEMBERS in good
 standing, because these services utilize a lot of bandwidth, offer
 less of a benefit to the Grex community as a whole, and/or hold the
 potential for system cracking and other undesirable activities:
 
  Outgoing FTP
  Outgoing Telnet
  Outgoing Lynx
  Gopher (with telnet capability enabled.)  
  IRC
 
 
 Being that the major objection to open access for the above
 services is the lack of available bandwidth on Grex's internet
 link,  It is understood that any of these services may be made
 available to all VERIFIED USERS as well as VERIFIED MEMBERS as soon as Grex
 acquires a link of suitable power and robustness.
 
 In order to maintain the integrity of both Grex, and of the Internet as a 
 whole, the Grex board shall have the power to restrict or deny internet
 access to groups or individuals who pose a security risk, or who engage in
 inappropriate behavior (as defined by the Grex board).
 
 The board may also make modifications to this proposal without resorting
 to a member vote in the case of an emergency situation, or if some
 provision of this proposal proves to be technically impossible to implement.
 

VOTE RESULTS:

Results were posted on Wednesday, August 17, 1994.   
49 out of 80 eligible voters cast ballots.  The Tally:  Yes 36  No 13
The proposal passed.

      *********************************************


#45 of 96 by janc on Wed Jan 28 16:47:27 1998:

Wow.  Mail is a service that doesn't use much bandwidth?  Well, not on a
per-user basis, normally, I guess.

Also, I note that we do allow "outgoing lynx" to all users.

Anyway, I think the alternatives that have some plausible support are:

  - status quo:  verified members can have one account each.

  - verified members can have extra non-voting accounts with net access
    upon request, but these accounts are for personal use only, not to
    be passed on to other people to use.  There is no charge for such
    accounts.

The above text raises some other issues that probably ought to be treated in
another item.


#46 of 96 by dang on Wed Jan 28 17:21:16 1998:

I like the status quo.


#47 of 96 by rcurl on Wed Jan 28 17:24:22 1998:

Right. The terms of verification of an Institutional membership are still
not clear. Since that is what this is about, I will suggest some acceptable
verifying documents:

1. Proof of incorporation and name/address/phone of resident agent (a copy
of the annual report to the state would provide all of this).

2. Check imprinted with name and address of organization, plus
names/addresses/phones of officers.

3. Copy of minutes of organization meeting showing resolution to join
grex, with names/addresses/phones of board members attached.


#48 of 96 by rcurl on Wed Jan 28 17:24:57 1998:

dang slipped in.


#49 of 96 by other on Wed Jan 28 17:48:09 1998:

How about if we simply restrict institutional memberships to organizations
which are sufficiently formalized to be able to meet our needs for validation.
Any other groups which desire accounts may create, identify and pay for them
under the guise of personal memberships for the contact person.  Other members
of such informal groups could simply create accounts of their own, and the
group could ask the paid member to use their own access resources to provide
for the group's needs.  The individual member would still have a vote (because
it is not an institutional membership).  

This does not seem on close examination to be particularly discriminatory to
informal organizations, especially when we created the inst'l m'ship as just
a way to recognize unusual needs.  Also, I think it is fair to ask that such
informal organizations not hamper Grex's need to maintain its own security
and internet integrity.  What is at issue is what we want to *give* to whom,
and as such, it is within our prudent purview to make those choices.


#50 of 96 by rcurl on Wed Jan 28 21:20:36 1998:

Informal groups may do what you describe without asking and without grex's
knowledge, and I presume they have. 


#51 of 96 by scg on Wed Jan 28 23:15:22 1998:

I'm also ammused by the statement in the voted on policy that ping doesn't
have much potential for abuse.  We in fact aren't allowing anybody to run it,
because it can be abused so easily.


#52 of 96 by gerund on Thu Jan 29 01:29:42 1998:

So then pardon me for asking, since I really have no clue, but isn't that a
violation of the result of the vote?


#53 of 96 by rcurl on Thu Jan 29 08:33:40 1998:

Not really - the policy says those things *should* be made available, not
that they will be. Consequently, access to those services are subject
freedly to staff choice, unless overruled by the board (or by a vote).


#54 of 96 by janc on Thu Jan 29 19:59:18 1998:

I'm going to enter a new item to pick up the thread of discussion about
the 1994 access policy in general.

I don't want to lose the thread of discussion about multiple member accounts
here.


#55 of 96 by janc on Thu Jan 29 20:06:13 1998:

This thread is now in item 72.


#56 of 96 by janc on Thu Jan 29 20:07:00 1998:

Oops, 75.


#57 of 96 by janc on Thu Jan 29 20:07:49 1998:

Oops.  Item 76.  I'm sure this time.


#58 of 96 by gerund on Thu Jan 29 23:55:37 1998:

re #53 - Thanks for clarifying!  :)


#59 of 96 by gibson on Fri Jan 30 05:18:09 1998:

        I don't see the point of a second access, if you already can get on
then what benefit is another access?


#60 of 96 by aruba on Fri Jan 30 08:19:07 1998:

Well, clearly it's not for everyone.  But as I said, at least 3 people have
asked about it in the last year, so clearly some people think it would be
important to them.  I think their motives range from wanting to give more
money to Grex (to which there are no real barriers) to wanting to be able to
maintain two separate identities, both with full Internet access.


#61 of 96 by other on Fri Jan 30 13:16:46 1998:

i think the primary cause at issue is if a person is the contact for an
organization which maintains an account, and that person wants a personal
account to which the other members of the organization do not have access.

the discussion arises out of the potential for abuse of that arrangement, say
if a person claims to be the contact for several organizations, and maintains
an account for each.  the limits to potential abuse are few but substantive.
to wit:  for full access, even without a vote, each account must be paid for.
this is a major deterrent to abuse.  we do ask for organizational validation,
and even if the organization is unable to provide it, the fact that we ask
is somewhat of a deterrant for most folks.


#62 of 96 by other on Fri Jan 30 13:17:32 1998:

oops s/deterrant/deterrent


#63 of 96 by rcurl on Fri Jan 30 16:09:46 1998:

I am the contact for four organizations using grex, and I have a personal
account. Am I being abused? Use me as an example - what's the issue?


#64 of 96 by janc on Fri Jan 30 21:32:02 1998:

I don't think there is a problem with a person having a personal membership
and being the contact person for an institutional account.

I think #60 states the motives of the people involved more accurately.


#65 of 96 by aruba on Fri Jan 30 21:55:47 1998:

Yeah, I think you're mistaken in #61, Eric.  We have taken care of legitimate
institutions quite nicely, I think, so that what Rane's doing, for instance,
is more than just OK, it's very welcome.  I think the people we haven't taken 
care of are the ones who want to access the net from multiple personal 
accounts.  Whether they are numerous enough to worry about is certainly a
legitimate question.


#66 of 96 by rcurl on Sat Jan 31 07:27:56 1998:

What is the "worry" about users that *want* to have multiple personal
accounts? That is, is there a real problem to address?


#67 of 96 by valerie on Sat Jan 31 13:59:18 1998:

This response has been erased.



#68 of 96 by mta on Sat Jan 31 16:14:22 1998:

I think we should work on whatever we need to do to allow *all* verified users
to have Internet access.  Then multiple personal accounts becomes a non-issue.


#69 of 96 by dang on Sat Jan 31 16:45:17 1998:

I don't think we will *ever* be to the point where anyone can have internet
access for free.  If we were to do that, I suspect we'd see our wonderful ISDN
fill up so fast it would make our heads spin.


#70 of 96 by scg on Sat Jan 31 17:58:44 1998:

I agree with Dan about the problems it would cause, and I'm also not convinced
that it would make sense even if there were some way to make it work.  When
I first got on Grex several years ago, it was wonderful that Grex was
providing Internet e-mail, because that wasn't something that was generally
available to people who weren't connected to the University.  Now, with much
better Net access than Grex could provide available for around $12 per month,
Internet access really isn't an important service for Grex to provide.  I
would much rather see us do a good job of running a conferencing system, than
a bad job of trying to so something lots of other companies are doing.


#71 of 96 by aruba on Sat Jan 31 20:06:20 1998:

Re #66:  Well, the "worry" is just that there are people who would like us to
provide something we don't.  Maybe we should just tell them they're out of
luck, or maybe not.  That's what I'd like to see this item resolve.

I think at the moment there are 3 options:

a) "status quo":  Members may have only one personal account with Internet
   access.

b) "free pseudos":  Members may tell the treasurer the names of their
   pseudo accounts, and the treasurer will add them to the internet group.

c) "for pay pseudos":  Members may pay extra for each pseudo account that
   they would like to have internet access.

I'm leaning toward option b), though it's a little more work for the
treasurer to keep track of the pseudos, and it doesn't bring in any extra
money for Grex.  Option a) would be OK with me too, but option c) seems
like selling internet access to me.


#72 of 96 by rcurl on Sat Jan 31 21:22:31 1998:

I vote for option a)

I'd word that differently, however. There are now two kinds of members,
individual and institutional, and no definition of a "personal" account.
The status quo is that individual and institutional members may each
have just one account with internet access.


#73 of 96 by dang on Sun Feb 1 03:37:46 1998:

I agree with Rane.


#74 of 96 by gibson on Sun Feb 1 04:13:15 1998:

        I think limiting access to members is a good idea. I fail to see any
benefit to multiple access and the only drawback i see is tieing up disk space.


#75 of 96 by mary on Sun Feb 1 05:57:07 1998:

Option 3 is essentially selling service.  Option 2 is offering
members enhanced perks.  Option 1 is closest to doing what
the vote to restrict access intended to do - limit access
to a scarce resource.

I think if folks asking about having multiple internet
accounts were simply told that Grex is not an internet
provider but rather than not offering it at all it is
being allowed on a limited basis, for members only, 
one account per membership.  Warn them it's not speedy
and ask them to please not abuse the scarce resource
by sharing the access with others.




#76 of 96 by remmers on Sun Feb 1 11:51:35 1998:

Telling them that would certainly be consistent with what
people are told when they try to do other things that are
too taxing on resources -- such as running mailing lists
from Grex, or building eggdrop.


#77 of 96 by janc on Sun Feb 1 16:37:20 1998:

Why is having second account taxing on Grex resources if it is for personal
use only?


#78 of 96 by mary on Sun Feb 1 17:01:32 1998:

Having two accounts under one name isn't using more of our resources.  Oh,
maybe a little if you take into account the treasurer's time.  Mostly,
option two would be extending additional perks for membership, something I
thought we were going to avoid doing as much as possible.

Maybe it's time to again go to the membership and find out how folks feel
about this.  Maybe the "we" of Grex would like to bundle lots of incentive
perks into the membership catagory.  That would certainly bring in more
money and lots of voting members who would probably be real supportive of
the concept of membership perks, and we could be off and running in a
whole new direction. ;-) 



#79 of 96 by rcurl on Sun Feb 1 20:14:31 1998:

...in a well worn rut, too...


#80 of 96 by janc on Mon Feb 2 16:41:20 1998:

Guests can have as many pseudo accounts as they want.  Why not members?  Why
is that a "member perk?"

I actually only know of one person who wants this, and that person doesn't
seem ready to jump off any bridges if they don't get it.


#81 of 96 by other on Mon Feb 2 18:37:25 1998:

how much additional system resource does a full-access pseudo account use than
does a non-member account?

it seems like a reasonable approach.  there is the fear that it would be
abused, say for example if a bunch of people split the cost of one membership
and then got pseudos for each one to use as their own...   


#82 of 96 by rcurl on Mon Feb 2 19:31:21 1998:

Members can have as many pseudo accounts as they want, too. Just not with
more member "perqs".

I just see no good reason for expanding this "perq" for members. I think
that one-person, one set of member "perqs" is a good policy. Given how few
members we have, it would probably not overload the system, but the principle
runs counter to the purposes of Grex (IMO).


#83 of 96 by lilmo on Tue Feb 3 22:53:52 1998:

Is there some way to set up a member's account and psuedos so that one one
of the can use the member perqs at a time?  Would that be acceptable if it
were?


#84 of 96 by arthurp on Wed Feb 4 02:11:12 1998:

when I break up this idea into a pie chart I see a huge wedge of it
being staff time.  Staff time is not something we have lots of.  I'd
rather see us stay where we are.  I might sorta like to have more than
one account with outbound access, but I don't see how that contributes
to grex in any way whatever.  I see how it drains staff time away.  I
see how it can be abused.  I see how it can cost us money, but I don't
see enough increased revenue to offset the staff costs. I also see
allowing multiple paid accounts as selling access.  I would be crushed
to see grex go there after being what it is for so long.  Yuck. 



#85 of 96 by aruba on Wed Feb 4 05:27:03 1998:

I'm afraid I don't see any staff time at all.  Could you explain what you
mean, Charles?


#86 of 96 by mta on Wed Feb 4 17:49:11 1998:

This doesn't sound like a reasonable goal to me, anymore.

As someone pointed out up there, the cost of Internet access has come down so
much that it's now within reach for most people who consider it a priority.

If we can't offer free access to everyone (and there have been some good
reasons given why that doesn't seem like a good plan) we shouldn't be going out
of our way to try to provide twice as much access to certain people while some
get none at all.  

After all, the people who can afford to donate twice as much to Grex are not
the people who can't afford a reasonable ISP.  

I think Grex's goal has been and should be to get information technology into
the hands of people who would otherwise have to do without, and far less so to
provide it to those people who would otherwise be inconvenienced by higher
costs.

Yes, donations are Grex's lifeblood and we oughtn't discourage people from
donating as much as they'd like.  But we aren't a pay for service ststem, and I
don't think very many of us want to see grex head in that direction.  

If people donate because they think they get something out of it, they're
donating for th wrong resosns and we'll eventually, as Mary said, find that we
have a membership intent on voting to up Member Perqs to the detriment of our
original goals.

Want to donate a little extra to Grex? Want to feel like you're "getting
something for the money"?  Why not pick your favourite non-member grexer and
gift him or her with a membership?  You'll be adding to the number of members,
steering Grex in a direction you like (by influencing the balance of the
membrship) and doing a good deed for someone else.  Great idea?  I think so.

And, maybe, when that membership is up, your beneficiary will find that they
can afford to renew.  If so. that benefits Grex far beyond your 3 or 6 month
donation.

Want two identities on the net?  Use grex for one and get an ISP for the other.
 Many ISP's will even let you use more than one mailbox (intended for family
members, but also useful for nicknames for non-business use.)

Yes, some people will be left behind this way and that's unfortunate.  But we
can't be all things to all people.  We have to decide whether we want to be a
conferencing community that also provides an alternate to an ISP for some
people or whether we want to be an ISP that sponsors a conferencing system.


#87 of 96 by arthurp on Thu Feb 5 01:29:18 1998:

I see staff having to do all kinds of legwork when one of these accounts
is 'loaned' to a friend who does something unpopular on the net.  Who do
we go after?  How do we resolve the stink?  
I see time spent keeping track of which accounts are linked.
I see time spent working on policy before and after any kind of 'event'
linked to this idea.
OTOH I see maybe $60 a year average in the long run.
My main complaint is that we would be selling access for a fee if we
adopted this policy.  This would be bad IMO.
Public TV has little returns for donations, but if you send them $1000,
you don't get 400 mugs from them.


#88 of 96 by aruba on Thu Feb 5 05:20:48 1998:

There are at least three options for what to do (I outlined them in #71), so
I when you say "this policy", Charles, it's unclear what you mean.  One of
the options would give people access from multiple accounts without selling
it.  And keeping track of the linked accounts won't require any staff time,
because the treasurer can do it (and it's really pretty simple).  I don't
understand what you mean about spending time on policy associated with an
"event".  And as to accounts being abused, we have to worry about that now,
too.


#89 of 96 by arthurp on Thu Feb 5 19:41:41 1998:

If we don't sell them, and it doesn't create headaches, that's one 
thing.  Selling them is quite another.  I'm still worried about outbound 
access for people we can't effectively validate.
When I say 'event' I mean something like sending 4 gigs of email 
somewhere, and the staff at that location comes to us.  We have to 
determine who did it.  If they did it by accident, or maliciously, etc. 
That could be hard to do if we don't know who it was.  Right now we 
don't have to worry about abuse of other systems too much.  The ones who 
have outbound access are known.  The ones who don't are limited in what 
they can do out there.


#90 of 96 by remmers on Thu Feb 5 21:22:06 1998:

Mail abuse isn't the best example to support your case, since all
users have access to outbound mail whether they're validated or
not.

I don't see significant support for selling additional net access
for a fee.


#91 of 96 by lilmo on Thu Feb 5 23:07:39 1998:

I have to say that I entered this item with no strong position on the issue
at hand.  I would even add that I had a slight inclination to support allowing
multiple "member accounts", if there was a need, and no net cost to Grex, in
staff time, resources, etc.

I have come to the conclusion that it would not be Grex-ly to have multiple
paid memberships for any given member.  People, not accounts, have member-
ships.  If they want to extend the perqs to more than one of their own
accounts, I'm not sure I see the harm, as long as they take *full*
responsibility for any qsuedos, as they do for their primary account.


#92 of 96 by arthurp on Fri Feb 6 04:24:15 1998:

Right, I was busy with other things when I wrote that.  Here's a better
example.  Stopping all AOL users in a region from using their web
browsers by telnetting to the DNS port on the AOL machine and sending a
stream of control characters to kill named.  If someone were stupid
enough to do that from here, currently we would be able to help trace
that event.  With the enabled pseudos we can't necessarily do that. 
That worries me.  I don't want Grex to become 'that system' on the 'net
that allows crackers to do what they will.
Certainly this is an extreme example, but I would rather fasten down the
edge of the tent just a bit.


#93 of 96 by aruba on Fri Feb 6 07:26:34 1998:

Well... Sure we would, since we'd still have the name of a real person
associated with each account in the internet group.  Yes, members could allow
other people to use their accounts, but we have that problem now.  I don't
understand your objection, Charles, because I don't think crackers are going
to be willing to send us ID.


#94 of 96 by e4808mc on Mon Feb 9 01:27:04 1998:

There is a response in Agora's "spam email" item that points out why it would
be good for members on Grex to be able to use two logins  [Item 87]

#19 of 19: by Mike McNally (mcnally) on Sun, Feb  8, 1998 (19:46):
   However it is far more common to wind up on a spam delivery list because
   you visited a web page, belong to a mailing list, or posted something to
   a Usenet newsgroup.

   I have two main accounts, one of which is the one from which I post to
   Usenet and which belongs to non-local mailing lists.  That one gets about
   40-50 times as much spam as the e-mail address I give to family, friends,
   and professional colleagues (which receives virtually none..).

If someone on Grex wanted to use this strategy, they would not be allowed to
have telnet access for both accounts.


#95 of 96 by rcurl on Mon Feb 9 07:40:56 1998:

That response does not indicate a need for two accounts with telnet access.


#96 of 96 by davel on Tue Feb 10 02:30:45 1998:

Right.  You don't *need* to be a member to join mailing lists or to visit web
sites.  At least in principle, you can't post to usenet even with a
membership, at present.  Obviously there are ways around that, but as at least
some of them are just mail gateways, you don't need membership for *that*.


There are no more items selected.

You have several choices: