Grex Oldcoop Conference

Item 304: Access to Email on Grex

Entered by bhoward on Mon Jan 2 09:15:28 2006:

We allow anyone who gets an account to have instant access to email.

I personally prefer that grex continue providing open access to
email but I am worried that we have made the barriers too low for
would-be spammers and vandals.  

Their continued misbehavior is ruining the value of email for
legitimate users by getting the system repeatedly listed in various
spam databases and unfortunately, is consuming an inordinate amount
of staff time that could be better spent on other system problems.

The purpose of this item is to discuss whether to raise the barrier
for access to email and possible ways of implementing such barriers,
be they social or technical.
149 responses total.

#1 of 149 by steve on Mon Jan 2 11:14:16 2006:

   No social system is going to work with spam weasels, sadly.
We're going to have to come up with a decent way to throttle
exim from handling 100+ emails at once from someone, or make
email only available to some kind of 'verified' user.

   One of the reasons I haven't been participating in coop
for the last several weeks is that just about all my time
spent on Grex lately has been watching for spammers, and
cleaning up after them.  I have removed more than 150,000
emails from the queue because of these idiots.

   The net really isn't what it once was, and Grex needs
to adjust itself to these realities.  I note that M-Net
has gone through much the same problem, and they elected
to shut off outbound mail.

   We have to figure something out.  I'm hoping that a
throttle system will work, and/or a spam filter system
that can apply to outbound mail as well.


#2 of 149 by keesan on Mon Jan 2 16:44:38 2006:

What size throttle?  Is there any need for grexers to send more than 50 copies
of the same mail at once?  


#3 of 149 by aruba on Mon Jan 2 18:12:26 2006:

I liked the idea of implementing an ascii CAPTCHA test in newuser, to keep
spammers from creating accounts automatically.  That would at least slow
them down, I think.


#4 of 149 by krj on Mon Jan 2 18:28:07 2006:

I would like to suggest a more radical approach, 
to bring Grex's email service to a graceful end.
 
Email is not a core part of Grex's mission, it's just something 
that happened along the way.  And free e-mail is available from an 
awful lot of providers now.    There are lots of ideas for programming
and configuration changes which could allow Grex to continue providing 
email service, but all of these require staff time resources; the 
last year or so has pretty well demonstrated that Grex doesn't have 
staff time resources for that sort of development.

(I use Grex as my principal non-work e-mail address.)


#5 of 149 by nharmon on Mon Jan 2 19:54:51 2006:

I think it is important for Grex, as an organization, to be a good
netizen. And having spam come from us is a perfect way to spoil our
reputation. I'm with Ken, I do not think providing e-mail is an
efficient use of staff resources.

When m-net turned off their e-mail, we laughed. Now we're beginning to
see the wisdom of that decision.


#6 of 149 by keesan on Mon Jan 2 22:06:01 2006:

I email other grexers from within grex and would really really hate to be
forced to use webmail to do it.  Sometimes I am trying to teach them to use
'talk', and it helps to write emails about this.  I prefer dealing with the
spammers some other way than punishing the rest of us.


#7 of 149 by naftee on Tue Jan 3 01:24:56 2006:

resp:1 looks like poetry


#8 of 149 by chimda25 on Tue Jan 3 03:22:46 2006:

hic hic hello


#9 of 149 by sholmes on Tue Jan 3 03:51:12 2006:

Guess only to/from grex mail can be allowed !


#10 of 149 by bhoward on Tue Jan 3 04:48:51 2006:

Hmm.  How about for 48 hours, you are limited to local mail.  After 48 
hours, you gain the right to run a program which asks you to type in an
ascii CAPTCHA, which if answered correctly places you into a group that
is allowed full email privileges?

Implementing this should be relatively easy.


#11 of 149 by steve on Tue Jan 3 04:55:41 2006:

   I'm not in favor of removing mail from Grex if we can help it,
as mail is still the best communications system there is.  If we
can't control the spammers however, we may have to stop it.  That
would be really horrid though.

   In terms of a throttle on the number of emails, I'm not sure.
I know most people send less than 20 emails a day, judging from
a time when I went over the logs of several days.  We should be
able to change that throttle as needed.


#12 of 149 by cross on Tue Jan 3 05:09:45 2006:

I'd favor having the ASCII CAPTCHA in newuser itself.  I've been toying
with the idea of a newuser rewrite in either Perl or Python....


#13 of 149 by aruba on Tue Jan 3 06:02:19 2006:

Bruce's description in #10 sounds good to me.


#14 of 149 by keesan on Tue Jan 3 14:02:14 2006:

What is a CAPTCHA?


#15 of 149 by jep on Tue Jan 3 15:07:19 2006:

Some sites use a graphic image of a sequence of letters and/or 
numbers.  They're somewhat difficult to read, intentionally so, in 
order to be very hard for a program to read.  You have to identify the 
sequence of characters and then type them in, which authenticates you 
as a human being.  Other free e-mail systems use them to prevent 
comptuers systems from automatically creating e-mail accounts to use 
for spam.

Someone (bhoward?) had the idea of using ASCII art -- for example, 
figlet fonts -- on Grex in the same way.  Computers would have a hard 
time identifying such characters, so only human beings would be able to 
run newuser to create an outbound e-mail account.

Does that explain the concept, Sindi?


#16 of 149 by keesan on Tue Jan 3 16:09:01 2006:

So how will that stop or even slow down a spammer who already knows about grex
and has a graphical browser?


#17 of 149 by mcnally on Tue Jan 3 16:11:55 2006:

  It will make it very difficult for them to automate their procedure for
  creating multiple accounts.


#18 of 149 by cross on Tue Jan 3 17:02:24 2006:

(At which point they'd probably give up and go somewhere else that's easier.)


#19 of 149 by tod on Tue Jan 3 18:11:42 2006:

How about a throttle on outbound mail which limits users to 5 per day?


#20 of 149 by keesan on Tue Jan 3 19:56:23 2006:

Why does a spammer need multiple accounts if we don't have any limit on number
of outgoing mails per day?
Five per day is too low for normal users.  I get about 10 a day here and
answer them all.  Make it 25 at least.


#21 of 149 by tod on Tue Jan 3 22:45:45 2006:

Its just an arbitrary number but does the idea of a cap on number per day seem
reasonable?


#22 of 149 by cross on Wed Jan 4 01:54:51 2006:

I wonder how to implement it.  You'd have to maintain some sort of hash and
`expire' data from it every day.  That would be easy to implement, but I've
found that things like that tend to be fragile: I like to minimize moving
parts, if I can.  That's why I'd prefer something that just relied on groups
or something like that.


#23 of 149 by ric on Wed Jan 4 14:34:41 2006:

It's very difficult to control email on a system in which users can pipe
things to sendmail.  We're not talking about joe schmoe using elm to send
50,000 emails.  Presumably, direct queue injection via the sendmail binary
- or possibly SMTP from localhost via a perl script.

<ric goes to test something>


#24 of 149 by ric on Wed Jan 4 14:39:23 2006:

Grex does accept SMTP from localhost... I presume there are mail clients
(PINE?) that use SMTP rather than direct queue injection via sendmail...


#25 of 149 by cross on Wed Jan 4 15:17:16 2006:

You can control access to the SMTP port on the localhost interface using
PF.  Access to the sendmail binary can be controlled via group membership,
as I outlined in some post somewhere.


#26 of 149 by bhoward on Wed Jan 4 15:20:40 2006:

Re#20 Right now, they don't need multiple accounts but from the
debris left behind in their acccounts, it appears they are splitting
their target lists into smaller sets and setting each account to
work on a different subset.

I don't recall offhand if each account was pumping out the same
message so it is possible, they were using a different account to
send different messages.

Re#22 Perhaps the simplest way is to have exim maintain a hash
table.  Each time a mail is sent, you hash on the senders login,
retrieve a record containing a message count and a date stamp.  If
the time stamp is <= 24 hours old, just increment the message count
for the sender and refuse to accept the message for processing.  If
the time stamp is more than 24 hours old, the message count is reset
to 1 and the date stamp is set to the current time.

Today is the first day I've had a real chance to dig into how exim
works and may be extended so I lack the vocabulary to describe this
using proper exim terms.  However, it appears there are a few
different mechanisms one could use.


#27 of 149 by bhoward on Wed Jan 4 15:21:07 2006:

(25 slipped in ahead of my 26)


#28 of 149 by keesan on Wed Jan 4 16:45:46 2006:

Do the spammers use mail lists (available with Pine, don't know about other
mail programs)?  Is there anything specific they do which can be restricted
to paying members without seriously interfering with mail use by other normal
users?


#29 of 149 by other on Thu Jan 5 16:23:02 2006:

> If the time stamp is <= 24 hours old, just increment the message count > for
the sender and refuse to accept the message for processing. If > the time stamp
is more than 24 hours old, the message count is reset > to 1 and the date stamp
is set to the current time. 26: Don't you mean "If the time stamp is more than
24 hours old *and the message count is higher than x*?


#30 of 149 by ric on Thu Jan 5 18:32:57 2006:

let's say I wanted to use grex to send spam.  

I'd create an account.

I'd upload a list of addresses... say 50,000 email addresses, one per line.
I'd create a text file with my spam message.
Then i'd run the following perl script:

##################################################
#!/usr/local/bin/perl

open(FH,"~/addresses.txt") or die;
while(<FH>) {
        chomp;
        system("cat ~/spam.txt | mail -s Spam $_");
}
close(<FH>);
##################################################

And poof.  50,000 spam messages go out.

That being said.. the only way I can think of to stop spam from happening 
on grex is to unplug grex or disable outgoing mail.

you could reduce spam by creating a waiting period for access to email.  
But I'd make it longer than 48 hours... a week, at least.

You could reduce it even more by allowing access to email ONLY to members.  
Then a spammer would have to give money to grex and (theoretically) be 
"verified" before they could send their spam.

A limitation of 50 outbound emails per day or even 100 outbound emails per 
day per account would also be useful, combined with an ASCII CAPTCHA on
newuser *AND* the delay for access to outbound mail.

If a spammer wants to manually create 100 accounts, wait a week for each, 
then send out 100 emails per day - each.... that'd be an awful lot of 
work to send 10,000 messages per day.  Easier to hack into someone's 
unsecure version of Wordpress.

If, on top of the last step, you do some mail logging that reports how 
many emails each user sends - per day - over a certain threshhold.. you 
could eliminate those user accounts pretty easily.



#31 of 149 by keesan on Thu Jan 5 20:27:22 2006:

Could grex automatically delete large mail lists, perhaps anything with more
than 100 @ signs in it?  


#32 of 149 by steve on Fri Jan 6 00:14:12 2006:

   That doesn't solve the problem.  Spammers typically send out N emails
with one person in each email.  Some don't of course, but the recent 
barrage of emails from AOL and .ro idiots does this, so that isn't a
solution.


#33 of 149 by tod on Fri Jan 6 00:29:41 2006:

Romania is a country, not an ISP.  Can you be a little more specific with
domain suffixes when you sling insults?


#34 of 149 by bhoward on Fri Jan 6 01:38:40 2006:

First, correcting an editing error by rewording slightly what I
said in #25:

Each time a mail is sent, you hash on the senders login, retrieve
a record containing a message count and a date stamp. If the time
stamp in the record is <= 24 hours old, just increment the message
count for the sender and refuse to accept the message for processing
if the message count is over the 24 message limit.  If the time
stamp in the record is more than 24 hours old, the message count
is reset to 1 and the date stamp is set to the current time.

Re#29 No, because the message count is a max of how many messages
they are allowed to send in a 24 hour period.  If the next message
sent pushes them over the max message count, that is only a problem
if it has been less than 24 hours since the timestamp of the first
message.

The idea is that the first message starts a 24 hour count down.
That count should be reset once 24 hours has past but we don't
actually need to check until the next time they send a message.


#35 of 149 by eprom on Fri Jan 6 05:36:15 2006:

I agree with a week long waiting period


#36 of 149 by bhoward on Fri Jan 6 06:23:19 2006:

Typed-in twice, and still dropping words.  
    "...if the message count is over the 24 message limit" 

should have read:
    "...if the message count is over the 24 hour message limit"


#37 of 149 by naftee on Sat Jan 7 05:45:29 2006:

El Senor Bruce da howard.


#38 of 149 by bhoward on Sun Jan 8 02:33:24 2006:

(somehow it seems like there ought to be a sudden snap
of castanets when he says that...)


#39 of 149 by mcnally on Sun Jan 8 03:20:31 2006:

 Or a flourish of mariachi guitar..


#40 of 149 by aruba on Sun Jan 8 04:11:12 2006:

Ole!


#41 of 149 by naftee on Sun Jan 8 04:36:09 2006:

everybody dance !


#42 of 149 by aruba on Sun Jan 8 18:57:51 2006:

Comcast is now blocking mail from Grex, which means I can't remind certain
members to renew their memberships.


#43 of 149 by keesan on Sun Jan 8 23:38:58 2006:

Are we still on the RBL list?
Can we try not letting new users send outgoing mail for the first week, and
if that does not work, then try other things?


#44 of 149 by bhoward on Mon Jan 9 07:09:08 2006:

We could declare a emergency moratorium on mail privileges for new
users but allow existing users to keep their mail privileges until
outbound mail limits can be implemented.  Any spammers with existing
accounts would either lie low or quickly be identified and locked.

This might allow us a respite to get off the blacklists and focus
on fixing mail.


#45 of 149 by keesan on Mon Jan 9 14:23:01 2006:

Is there a new spammer this week?  Comcast at least lets you know why they
bounced your mail (RBL).  Would it be fair to allow unlimited outbound mail
to members but only maybe 100K per day for others?  Or would spammers find
some way to sign up for 1000 new addresses?


#46 of 149 by ric on Mon Jan 9 17:21:45 2006:

You'd be surprised at how many spam messages you could fit into 100k.


#47 of 149 by ric on Mon Jan 9 17:26:54 2006:

Oh, one thing you'll want to remember is that people could write a spam script
in perl, and execute it from the web, so the email would be generated by the
"nobody" "apache" or "httpd" user - depending on how apache is configured
here.


Ah, I see it's "www"


#48 of 149 by aruba on Tue Jan 10 02:41:42 2006:

How could you execute a spam script from the web?


#49 of 149 by cross on Tue Jan 10 04:42:01 2006:

Via a CGI script.  Fortunately, I think grex is configured NOT to allow
normal users to execute CGI scripts out of their personal web directories.


#50 of 149 by albaugh on Tue Jan 10 17:13:12 2006:

Is it not also possible, perhaps probable, that SPAM is being sent with a
spoofed from address of @cyberspace.org, and that is accounting for the
blacklisting?  Or is the blacklisting smart enough to know where the mail
actually originated from?


#51 of 149 by krj on Tue Jan 10 17:36:42 2006:

Nobody intelligent acts on the basis of a From: line in spam;
such lines are all presumed to be forged.  Mail recipient 
programs know the IP address they are receiving the mail from.
 


#52 of 149 by krj on Tue Jan 10 17:40:06 2006:

If bhoward's proposal in resp:44 can be quickly implemented (with
user groups?), it should be done to buy staff time to work on a better
fix.


#53 of 149 by ric on Tue Jan 10 18:04:00 2006:

re 49 - ah, yes, grex doesn't allow php or cgi scripts in home directories.

re 50 - Ken is right in #51 .. peole forge from addresses all the time, and
spam blockers (and those who write spam blocking software) all all aware of
this.  Black listing is pretty much always IP based.  Even if you receive a
million spams from the Ann Arbor Observer, and they did NOT forge their from
address... their IP address would be blacklisted, not the organization.  So
if they changed their IP address they could start sending spam again - until
that was also blacklisted.


#54 of 149 by krj on Tue Jan 10 21:10:53 2006:

I should have phrased #51 as "Nobody knowledgable..." rather than 
"Nobody intelligent..."


#55 of 149 by cross on Wed Jan 11 02:12:39 2006:

Regarding #54; You shouldn't assume that the people who run either ISPs or
blacklists are either.


#56 of 149 by bhoward on Wed Jan 11 15:04:37 2006:

Just to let you know...

Pending next weeks discussion at the BOD meeting, I have implemented
an initial throttle on email for newusers.  

The net effect of this is that all grex users as of this evening,
will see no change to their mail access.  Any newuser account created
from this evening onward, will not be able to send mail to external
sites until their account has been added to a file containing a
list of authorized users.  Mail within grex continues to be available
to all users.

Note, this has been implemented on an emergency basis in order to
give staff time to stabilize the situation from a technical standpoint
until the BOD are able to discuss this issue next week.


#57 of 149 by cross on Wed Jan 11 18:38:05 2006:

Outstanding.


#58 of 149 by bhoward on Wed Jan 11 19:11:53 2006:

Don't start dancing yet...it needs to settle in and I wasn't all
that familiar with exim when the grex spam problem really started
to explode recently.

I'm watching the logs and doing further tests carefully as my mailer
science skills have rusted a bit since the mispent days of my hacking
youth when I used to do this for a living (and for some strange
reason, actually liked hacking on mail systems).


#59 of 149 by cross on Wed Jan 11 19:49:39 2006:

True, but there's a big difference between upas and what passes for
mailers these days.  :-)


#60 of 149 by tod on Wed Jan 11 21:46:23 2006:

re #56
THANKS!!!


#61 of 149 by keesan on Thu Jan 12 00:07:26 2006:

How do you plan to authorize new users?


#62 of 149 by bhoward on Thu Jan 12 01:24:37 2006:

I've proposed three ways:
    o write a program that presents a CAPCHA which if correctly
      entered, will add said user to the list of authorized
      mail users.

    o Automatically vest newuser accounts with mail privs after 
      a hold down period (currently suggested at 48 hours) has
      elapsed.

    o Some combination of the above two.


#63 of 149 by kingjon on Thu Jan 12 01:55:42 2006:

I thought the question was "how do you plan to authorize them *in this
temporary stopgap measure*?" 



#64 of 149 by aruba on Thu Jan 12 03:39:17 2006:

Thanks Bruce!  Great job.  And thanks also to STeve for dealing with the
spammers.


#65 of 149 by bhoward on Thu Jan 12 05:02:11 2006:

Re#63 Sindi didn't indicate what time frame she meant; I don't
intend to do a lot about adding newusers in the interim.  If a
newuser thinks to send mail to staff, we'll certainly add them but
my priority is on implementing mechanisms to adding them or delegate
the support load for doing so out to the individual users.

As a next step, I'm looking at:
   * Changing /usr/local/etc/exim.outbound to a dbm file (I used a
   flat file for yesterdays change but that is hard to update
   efficiently)

   * Writing monitoring script to periodically count up how much
   mail has been sent by each person that has sent mail in the last
   24 hours and automatically throw anyone over the limit on the
   explicitly depermitted list.  Removal of offenders from said
   will be a manual process.

   * Thinking about how to flesh my CAPCHA prototype script into a
   proper secure setuid C program and also how to implement the 48
   (or N) hour hold down if that is what the BOD or membership
   decide to go for.


#66 of 149 by naftee on Thu Jan 12 05:32:37 2006:

whoa ! 
bruce is great


#67 of 149 by mary on Thu Jan 12 10:35:02 2006:

Thanks so much, Bruce!


#68 of 149 by ric on Thu Jan 12 16:52:55 2006:

great work bruce.

BTW, it's CAPTCHA


#69 of 149 by slynne on Thu Jan 12 17:26:44 2006:

Thanks bruce! 


#70 of 149 by bhoward on Fri Jan 13 05:39:55 2006:

Re#68 Yeah, thanks for the correction.  I keep forgetting the
spelling because I learned the current term for it long after I had
been using and implementing them.


#71 of 149 by wlevak on Sat Jan 14 05:37:00 2006:

The most effective limit to spammers is the 5 minute delay.  Each outbound
e-mail would be subject to a 5 minute delay before sending, and then only ONE
e-mail would be sent.  Additional e-mail would require another 5 minute wait.
The total e-mail for a user waiting to be sent would also be limited to a
fixed amount, say 2 Meg.

Limits on who could have an e-mail account are also reasonable.  Potential
user from sources that are identifiable, (schools, identifiable companies,
etc.) should be assumed genuine.  Users from internet services that don't
identify users should be subject to additional verification.  Potential users
from that block of IP address in South Korea, where they refuse to identify
the owners, and any like them, should be denied access.

The ultimate deterrent, and one that will probably be necessary against the
worst offenders, is to take legal action against them.  Current Federal law
prohibits mass sending of e-mail to recipients thhat the sender does not have
an established relationship.  This is enforced by the FBI and possibly, the
Secret Service, depending on content.  Fraudulently obtaining accounts, and
using the system in ways not permitted by the rules of operation may be
prosecutable under Michigan's computer tresspass law.  


#72 of 149 by janc on Sat Jan 14 20:23:01 2006:

Implementing a five minute delay on outgoing mail would be fairly
complex, I fear.  An upper limit on the number of emails per day is
probably vastly easier to do.


#73 of 149 by keesan on Sun Jan 15 00:33:48 2006:

Can you also limit the number of new accounts that can be opened in one day
from some IP address?


#74 of 149 by wlevak on Mon Jan 16 00:27:28 2006:

I don't see how it would more difficult to do than the things discussed above.
Mail would go int an output queue, and be sent out every five minutes.  Exect
timing is not necessary here.  It's the average effect that would stifle
spammers.  Counting over a five minute interval would be no more complicated
than counting email sent per day, but require less data accumulation.  In
addition, it would essentially reset every five minutes, thus correcting
quickly any errors, without the need of operator intervention.

While the mail is waiting in the queue, the outgoing mail could be scanned
for unacceptable output, and excessive use by one or more users.  Again, exact
amounts are not necessary here.  It's the average effect that would stifle
spammers.


#75 of 149 by wlevak on Mon Jan 16 00:35:56 2006:

When services complain of unacceptable mail form Grex, it would be the ideal
time to complain to them of their unacceptable mail to Grex.  I am referring
to the so-called "returned" mail that didn't come form here.  I used to
complain of this to the "postmaster" or "administrator" of the systems this
came from, with some effect.  But, all of them have stopped accepting
complaints at these standard addresses.  They are helping spammers didtribute
their spam, and they don't seem to care.  If they won't pay any attention to
our complaints, why should we pay any attention to their's?


#76 of 149 by richard on Thu Jan 19 15:39:53 2006:

just make offsite email a members only perk.  I've suggested this in the past.
nobody needs grex for free email anymore.


#77 of 149 by kingjon on Thu Jan 19 18:45:12 2006:

And every time you've suggested it several counterexamples to "no one needs
..." have been brought up. If it were a members-or-dialups-only I think fewer
would object on strictly pragmatic grounds, but I still don't agree with that
position. (The idea of anything as a "member perk," IMO, is in discord with the
founding principles of Grex -- I suggest you read the discussion about the
decision to restrict outgoing telnet and ftp.)



#78 of 149 by jadecat on Thu Jan 19 19:45:43 2006:

Technically no one NEEDS e-mail at all. Or the internet. Or water beds.
But there are people who want those things.


#79 of 149 by mcnally on Thu Jan 19 19:57:10 2006:

 re #78:  exactly.  Let's not talk about "needs".


#80 of 149 by spooked on Thu Jan 19 20:49:02 2006:

Yeah, but if they want it they have a zillion other places they can find 
it - so that argument is just as shakey.


#81 of 149 by kingjon on Thu Jan 19 20:59:14 2006:

There are several people in the 734 area code whose only source of email -- or
any Internet at all -- is Grex. (Some of them are introduced to Grex in their
first exposure to a *computer*.) While Grex is not an ISP, it has in the past
made these people a priority -- "open access" is, after all, one of its
founding principles. I don't want to change this; my family was in this
position for a long time, and might be again.



#82 of 149 by nharmon on Thu Jan 19 21:04:07 2006:

I am in the 734 area code, and I do not support the idea that people
living closer to Grex are a "priority". If there is no financial problem
with keeping the lines open, then okay. But if Grex needs to decide
whether to dump modem access or dump disk space...I vote for dumping the
modem access.


#83 of 149 by kingjon on Thu Jan 19 21:09:55 2006:

(So would I -- but I don't think it'll come to that.) By "priority" I don't
mean "highest-priority" -- I'm just saying that to assume that everyone who
logs into Grex has other access to email and thus we can freely restrict it to
members only has a false antecedent.



#84 of 149 by richard on Thu Jan 19 21:20:51 2006:

If you dont restrict email to members, then how else do you solve the email
spam problem other than closing newuser?  Because these are likely not new
users spamming, they are persons we all know who they are, who have a habit
of running newuser constantly and churning out new logins and email addresses.


#85 of 149 by twenex on Thu Jan 19 21:24:51 2006:

My, to WHOM could you be referring?


#86 of 149 by richard on Thu Jan 19 21:24:57 2006:

last year I had a certain grexer flood my email box with 10,000 emails.  I
notified staff, but what could they do?  If they took out his login, he'd just
run newuser again.  If they blocked his ip address, he'd use an anonymizer.
unless you restrict offsite email to new users, or take it away altogether,
what can staff do?  they can do nothing...


#87 of 149 by kingjon on Thu Jan 19 21:28:58 2006:

There have been several suggestions for reducing the *amount* of mail someone
could send. I also wouldn't mind a delay (even of a couple of weeks).

If "we all know who they are," then why haven't their ISPs been notified of 
their activities?


#88 of 149 by cross on Thu Jan 19 21:40:40 2006:

My understanding is that the restrictions on email are not for email within
grex, but rather for mail going from grex to the rest of the Internet.

So what if there's some set of users who are in some area code local to
michigan who can only use grex as their email source?  Adjust the technology
so they're not shut out, or ask them to contribute to grex financially in
some way.

Or, introduce another class of users who are somehow considered `verified.'
Verification could be by becoming a member (one of the requirements for
membership is that your identity is verified by the treasurer), or by going
through some other process (logging in from a dialup or sending a letter
via US mail to grex, for instance).  Verification gets you onto the green
sheet to send email offsite.

Perhaps someone doesn't want to pony up the $6 a month to become a member.
Okay, fair enough, but are you serious telling me they can't come up with
50c for a stamp, envelope, and sheet of paper?

Don't think of it as a ``member perk.''  Create another class of users,
of which members may be a subset, who are verified and therefore trusted
to send offsite email.


#89 of 149 by kingjon on Thu Jan 19 21:43:03 2006:

I wouldn't object to that, either, except that verification of non-US users
(some of whom may not have other email -- I'm thinking of something in the
discussion the *last* time this was brought up) would cost them more than 50
cents.



#90 of 149 by richard on Thu Jan 19 22:00:58 2006:

verification involves too much staff time.  even just verifying members means
somebody has to physically do it, and grex isn't paying anyone for that time


#91 of 149 by keesan on Thu Jan 19 22:25:17 2006:

Only new members are verified, not all 47 or so of us every year.  How many
new members do we get in a year?  And how many people do you think would write
grex asking for outgoing email in a year?  They could send $1 to sdf instead
and get a much bigger mailbox.


#92 of 149 by kingjon on Thu Jan 19 22:28:39 2006:

The people you introduce to computers and to Grex are the people I was thinking
of, Keesan. The verification idea was intended as something to allow them email
while restricting it for the rest of the nonmembers. (If SDF has a local dialup
phone line in the 734 area code, I wasn't aware of it.)



#93 of 149 by keesan on Fri Jan 20 01:02:23 2006:

FOr $7/month you can get sdf-related internet connection, with sdf as your
email and webspace provider.  Local phones all over the country.  Anyone
living in Washtenaw County should be able to afford $6/month and if not, come
up with a good reason why they should be subsidized to be a member.


#94 of 149 by kingjon on Fri Jan 20 01:40:47 2006:

I think the idea that providing a service to someone is "subsidizing" them is
foreign to the central principles of Grex -- *open access.* I suggest that
everyone look at the precedent vote (found in
/usr/local/grexdoc/archives/votes/vote02); the primary reason for restricting
access to ftp, telnet, etc., was that they took up too much bandwidth. I have
no objections to requiring some sort of verification (which is what that motion
said the Board could do once the link increased), but I worry at discriminating
against either local (734 area code) or international users.


#95 of 149 by keesan on Fri Jan 20 15:27:22 2006:

Most of my spam has international 'from' addresses such as .de and .cn.

Low income residents of our county can qualify for $150/month of food stamps.
I will gladly buy $6/month of food from any of them that can't come up with
$6/month to be a grex member and use outgoing ftp and telnet.


#96 of 149 by aruba on Fri Jan 20 20:24:42 2006:

Eliminating modems or restricting services to members only is a change to
Grex's basic mission, and could jeopardize our 501(c)3 status with the IRS.
See Grex's 501(c)3 application at
  http://www.cyberspace.org/local/grex/501c3.html
for what they expect of us now.


#97 of 149 by richard on Fri Jan 20 21:09:12 2006:

but grex already restricts some things to members, like outbound telnet and
ftp right?  


#98 of 149 by kingjon on Fri Jan 20 21:16:44 2006:

Yes, but for the primary consideration of *bandwidth*. I suggest you read the
precedent-setting vote.



#99 of 149 by cross on Sat Jan 21 00:55:13 2006:

Regarding #90; Then come up with a way to make it easy; use the technology.

For instance, Grex considers receipt of money from an account that's been
verified on paypal as sufficient verification.  Why wouldn't sending a penny
via PayPal be considered sufficient for verification purposes?  Perhaps we
could consider some sort of vouch-for program where members could verify
the identity of other users (here, I'm thinking specifically of users who
are set up with grex access by, say, Sindi and Jim).  We could consider some
sort of call-back verification for dial-in users, similar to how BBS's used
to operate in the dial-up world back in the day.  Most of this would be
handled electronically with a minimim of manual intervention.

Regarding #96; I don't think you need to make it ``members only.''  But it
is reasonable to impose some level of verification on the process, and I
don't see why members shouldn't be allowed to verify users.  That said, I
don't see why getting rid of dialin access would be a fundamental change
in grex's mission.


#100 of 149 by wlevak on Sat Jan 21 06:13:37 2006:

It is not necessary to verify the identity of every user.  Users who connect
through a service that requires identification to get the service, are already
identified to a sufficient extent, ie. educational institutions, users who
use their employer's access, etc.  It's the commercial services that sell
access to anyone for money, that is the problem.  Yahoo and Yahoo Korea, are
two that produce a lot of spam.


#101 of 149 by keesan on Sat Jan 21 16:17:04 2006:

So do we allow access to anyone coming from an .edu?  Is there a list of
trustworthy ISPs somewhere?  Would every applicant for outgoing email have
to be manually checked out?


#102 of 149 by cross on Sat Jan 21 17:37:14 2006:

Regarding #100; Not true.  There are plenty of public kiosk settings at,
say, universities that don't require any sort of authentication to use.
Blindly applying a regular expression to the connecting hostname is not
a good idea.  You are correct that you don't need to verify every user,
though.


#103 of 149 by richard on Sat Jan 21 19:51:42 2006:

Listen, if the government becomes more draconian in its attempts to 
regulate the 'net, grex may one day be REQUIRED to verify all users.  
As it is, some terrorist living in the U.S. could log on to grex using 
an anonymizer to hide his location, and using an anonymously generated 
login, and pass along terrorist information to his people back at 
home.  It is safer than calling them on the phone since we all know 
they wiretap international phone records now.  

Also someone who is into child porn and wants an email to use for such 
correspondence, would be far safer using a Grex email than a Yahoo or 
Hotmail email.  Grex doesn't require any verifiable personal info to 
take out a login.  I am sure the Homeland Security Department would 
love to shut a place as open as Grex down, if they were aware of it.


#104 of 149 by nharmon on Sat Jan 21 19:55:29 2006:

Ok, terrorists using Grex. This conversation has gone too far.


#105 of 149 by mcnally on Sat Jan 21 21:42:21 2006:

 Won't someone PLEASE think of the children?


#106 of 149 by naftee on Sat Jan 21 21:48:55 2006:

richard's absolutely nuts !


#107 of 149 by cross on Sun Jan 22 03:28:39 2006:

I really doubt grex is on anyone's anti-terrorism radar.


#108 of 149 by scholar on Sun Jan 22 06:33:57 2006:

talk to bap.


#109 of 149 by aruba on Sun Jan 22 10:14:48 2006:

Re #99: Dan: Dial-up access is an essential part of Grex's chritable mission
for a number of reasons, not least of which is that we told the IRS it was
an essential part of our charitable mission.  If we were to eliminate our
phone lines, we would have to notify the IRS, and they might cancel our
501(c)3 status.


#110 of 149 by nharmon on Sun Jan 22 16:30:55 2006:

Does m-net have dialup? Do they have 501(c)3 status?


#111 of 149 by cross on Sun Jan 22 16:36:03 2006:

Regarding #109; Huh?  That's a thin argument, I think.  I do see where
dialins are mentioned on the application for 501(c)3 status, but it also
seems to me that that could be amended in light of changes in technology
and undue financial burden that would jeopardize the rest of grex's
mission, etc.  Note that no where in the articles of incorporation are
dialins mentioned; only computer conferencing.  Regardless, I'm not sure
why removing the dialin lines is at issue right now.


#112 of 149 by nharmon on Sun Jan 22 17:21:04 2006:

It isn't. Removing dialup access would reduce operating costs, and would
be an option if Grex's income continued to decline.


#113 of 149 by aruba on Sun Jan 22 18:11:35 2006:

Re #110: M-Net's application was different than Grex's.  The rules say that
if you change your charitable activities, you must notify the IRS of the
change.

Frankly, I think keeping those dialins open is the most charitable thing
that Grex does, and I'm proud that we do it.


#114 of 149 by cross on Sun Jan 22 18:36:09 2006:

Regarding #113; It makes sense as long as people use them.  But keeping
them around if they're not used, or only rarely used, makes little sense.


#115 of 149 by kingjon on Sun Jan 22 18:40:10 2006:

Re #114: Charity rarely makes economic sense -- if it did, it wouldn't be
charity. So long as there are users who use the dialins, I think they should be
left open. (If it were between closing the dialins and closing the Internet
link I would be in favor of the latter, personally, but I suspect I'm in the
extreme minority on that point.)



#116 of 149 by cross on Sun Jan 22 18:50:26 2006:

So a charity that offered sliderules to the masses would be putting its
resources to good use?

Like I said, as long as they're using them, I don't have a problem with it.
Once they stop, it would be foolish to continue offering the service.


#117 of 149 by kingjon on Sun Jan 22 19:06:28 2006:

Re #116: I didn't say that. It *would* be performing a charitable function,
however.



#118 of 149 by keesan on Sun Jan 22 20:06:48 2006:

I use the dialin lines several times a day.


#119 of 149 by wlevak on Mon Jan 23 05:41:21 2006:

User's from .edu domains can be checked against the institutuion' online
directory.  Public access users would not be listed there.  At the University
of Michigan, public access users cannot e-mail.


#120 of 149 by cross on Mon Jan 23 05:56:36 2006:

What does that have to do with anything?


#121 of 149 by mcnally on Mon Jan 23 07:28:13 2006:

 re #119:  
 Strictly hypothetically, let's imagine that someone logs in and tries
 to send 10,000 spam messages from an IP address that reverse-lookup
 tells us belongs to a student computer lab at a large public university,
 for example UCLA.  What good do you suppose that knowledge does us?
 Do we know who to contact at potentially any .edu-listed institution
 across the country if we have a problem?  Will that person respond to
 our inquiries?  Even if we do and even if they would, who's going to
 be willing to spend their time trying to track down each spammer that way?

 I'll grant that people connecting through a .edu address might be less
 likely to spam than other users (I don't know that for a fact, or have
 any real reason to believe it, but I'll certainly admit the possibility
 and even accept it for the sake of argument..)  But so what?


#122 of 149 by tod on Mon Jan 23 17:27:22 2006:

re #104
Is that so hard to believe?


#123 of 149 by nharmon on Mon Jan 23 17:42:55 2006:

Without proof? You bet.


#124 of 149 by tod on Mon Jan 23 20:33:43 2006:

WMD are hidden on Grex


#125 of 149 by nharmon on Mon Jan 23 20:35:54 2006:

I think triludaa has some Weapons of Mass Disturbance.


#126 of 149 by mcnally on Mon Jan 23 22:10:55 2006:

 Do you think he tested them on himself?


#127 of 149 by cross on Mon Jan 23 23:41:57 2006:

I think, that while it's possible that terrorists could use grex, it's
pretty unlikely.  Why wouldn't they go for something easier?


#128 of 149 by mcnally on Mon Jan 23 23:45:02 2006:

 Well, one thing we know about Grex is that "It gets easier.."


#129 of 149 by marcvh on Tue Jan 24 00:11:26 2006:

Maybe there's a sleeper cell in the 734 area code who isn't very well
funded and can't afford a real ISP.


#130 of 149 by tod on Tue Jan 24 00:17:41 2006:

Maybe GMail is only a matter of time and AOL and Yahoo mail are obviously not
viable communication mediums?


#131 of 149 by cross on Tue Jan 24 00:45:24 2006:

For what, though?  Yahoo and AOL might be the obvious choices.  Steganographic
techniques are still pretty effective.  Not to mention random postings on
blogs, and the like.  Terrorists communicating via Bill O'Reilly's blog would
almost be poetic.


#132 of 149 by mcnally on Tue Jan 24 01:26:44 2006:

 If I were part of al Qaeda I'd make sure to hide my messages in freerepublic
 posts..


#133 of 149 by tod on Tue Jan 24 07:43:16 2006:

Why hide them?  *snicker*


#134 of 149 by other on Tue Jan 24 23:11:58 2006:

I thought it was pretty obvious by now that terrorists DO communicate
via Bill O'Reilly's blog.


#135 of 149 by mcnally on Wed Jan 25 00:00:50 2006:

 Yes, but we're talking about so-called "Islamo-fascists",
 not the regular kind.


#136 of 149 by tod on Wed Jan 25 04:38:33 2006:

Fornier seems more like a Sean Hannity type...


#137 of 149 by wlevak on Sat Mar 18 05:04:16 2006:

OK, here is a simple verification scheme.  New users get a restricted account.
To get the unrestricted account, they must send Grex a self addressed stamped
envelope.  Someone at Grex sends them in this envelope, a computer generated
random password.  The user must report this password online to the Grex staff
who then removes the restrictions. Perhaps this last step could be automated.

This process uses the postal service to verify the name and address of the
user, or at least that the name and address are valid and the user is
receiving mail there.


#138 of 149 by fuzzball on Thu Mar 30 14:26:51 2006:

I think i get around 3 - 5 help requests every few days asking about 
how to get outgoing mail. I tell them is down for now for new users. 
so i was thinking about something.
would it be hard to setup a database of longtime trusted users <those 
of us that have been here since mid 90's> to have outgoing and 
incoming e-mail privilages, and those who are new <within a few 
months> not alowed outgoing/incoming e-mail unless they pay for an 
account here?


#139 of 149 by keesan on Thu Mar 30 18:04:05 2006:

How about a new category of half-member, who pays $3/month for outgoing mail
and does not get telnet or ftp privileges?   If spammers are not willing to
pay $6/month, probably they would not pay $3 either.  


#140 of 149 by kingjon on Thu Mar 30 18:41:40 2006:

I think making them pay for it may be unnecessary. Simply require some sort of
verification -- a couple of cents from Paypal could be one way (Paypal adds a
random number of cents to your bank account, then asks you how many it added,
to verify that it is in fact yours), while meeting someone official in person
could be another. The typing-in-a-word-on-the-screen thing could be a first
line of defense.



#141 of 149 by keesan on Fri Mar 31 03:36:37 2006:

Paypal does not work with the three browsers I tried it with (the ones at
grex).  


#142 of 149 by fuzzball on Sun Apr 2 05:05:05 2006:

yea, and i know a lot of people arent comfortable using paypal, or 
other means of online payment, and that may not have checking accounts 
or access to a moneyorder.


#143 of 149 by kingjon on Sun Apr 2 09:58:52 2006:

That's why I suggested it as "one way."



#144 of 149 by keesan on Sun Apr 2 14:44:40 2006:

Another way is to send a dollar bill in the mail.


#145 of 149 by kingjon on Sun Apr 2 18:25:45 2006:

The trouble with that, unfortunately, is that it a) requires someone to sort
through it and b) isn't really authentication, just a hoop to jump through,
like the typing-in-the-word thing. The three advantages to Paypal are that they
do authentication for us, one person couldn't use more than one (Paypal)
account (so we'd know if one person were setting up a thousand accounts with
email), and it would be relatively easy (I suppose) to automate. This is not to
say that Paypal ought to be our only method.


#146 of 149 by mcnally on Sun Apr 2 19:53:11 2006:

 I'm not sure it follows that the phishers (who seemed to have been
 the biggest mail problem-users before we shut things down for new
 users) won't have access to multiple identities to register with..

 However it's probably sufficient to make registration for mail
 cumbersome enough and difficult to automate to discourage the
 majority of the problem users.


#147 of 149 by kingjon on Sun Apr 2 20:49:46 2006:

(My references to automation were on the system staff end -- part of objections
to previous suggestions was that the staff are volunteers and can't afford to
devote large amounts of time to Grex.)



#148 of 149 by sholmes on Mon Apr 3 08:21:20 2006:

I dont understand. I have 3 paypal accounts.


#149 of 149 by jesuit on Wed May 17 02:16:02 2006:

TROGG IS DAVID BLAINE


There are no more items selected.

You have several choices: