response 1 of 58:

Sep 1 20:08 UTC 2006

According to http://www.cyberspace.org/memfaq.html#whydoineedid , proof of
identification required because:

   1. While we are very comfortable allowing anonymous users access to Grex,
we are not comfortable unleashing them on the rest of the Internet. It would
be irresponsible of the Grex administration to allow people we can't identify
to telnet through Grex to other systems, so we require ID from everyone we
allow to do that.
   2. Cyberspace Communications is required by the state of Michigan to
maintain an up-to-date list of members. Implied in this requirement is that
we make sure no two memberships are held by the same person. So we require
ID to connect accounts with real people and make sure no one has the ability
to vote twice in Grex elections.


These reasons are invalid for a number of reasons:

1.  It's incredibly easy to forge I.D. that would be accepted by Grex.

2.  If someone wants to vote twice, they could just sign up their friend,
their spouse, their sometimes lover, or whatever.

3.  Member verification is *not* required by Michigan law.

4.  Many other organizations in Michigan, including Arbornet, Inc., do not
require I.D. from their members and do not appear to have had any problems.

Basically, the I.D. requirement does nothing to stop any of the problems it's
meant to stop, does not help us comply with the law, and inconveniences
potential members.  It should be abolished.

response 3 of 58:

Sep 1 21:38 UTC 2006

I 2nd this motion.

response 5 of 58:

Sep 1 23:10 UTC 2006

By the way, my purpose in proposing this is to a) cut down on hassle and b)
get new members for Grex.

With the rate at which membership has been falling, it is in Grex's interest
to make becoming a member as easy as possible.  I know of at least one person
who would sign up if the identification requirements were dropped.

response 7 of 58:

Sep 2 00:07 UTC 2006

Psst...paypal

response 9 of 58:

Sep 2 16:51 UTC 2006

I don't use Paypal, and would gladly buy a Grex membership were there no ID
rule.

response 11 of 58:

Sep 3 02:19 UTC 2006

But you have to admit that now, in 2006, there are much easier ways to cause
trouble on the Internet without a GreX membership than it was when the ID  
rule was created. A "cracker" would have to go out of their way to send you 
a cheque or money order or whatever to get outbound access from GreX when it 
is far easier to
use certain web proxies to achieve the same effect.  I even welcome you to
suggest something that a "cracker" could do on GreX that he wouldn't be able
to do more easily elsewhere on the internet.  Spamming ? Free e-mail bomb
sites are easy enough to find; ask Winn Schwartau.

Anyway, I promise not to use GreX for anything bad if I had a membership.
Would you take my word for it, instead of ID, aruba ?

response 13 of 58:

Sep 3 03:53 UTC 2006

 totally unlucky.

response 15 of 58:

Sep 3 17:00 UTC 2006

(See Item 354, resp. 14 - resp:354,14 - for the rules governing voting
on member proposals.)

The issue is a bit complex because membership confers several different
tangible benefits:

(1) For US taxpayers, a tax write-off (since we're 501(c)3).
(2) Participation in governance (eligible to vote, serve on the board,
    make proposals).
(3) Access to various outbound internet services.

I don't think I'd support an across-the-board removal of ID
requirements, especially as regards (2):  We owe it to folks to make a
good-faith effort to ensure one-person-one-vote.

Also, being incorporated in Michigan means that Grex is subject to
certain rules regarding maintaing a list of member names and addresses.
I'm not sure what that implies about ID requirements.

response 17 of 58:

Sep 3 17:39 UTC 2006

   Quite true.  Grex is a platform that can be used for bad things.  If
anyone doesn't believe that, please remember the problems we've had with
email, and why we had to turn off automatic outbound mail access for new
accounts.  Today we see people running exploits on port 80 (usually Perl
programs) to attack sites, because we allow that port.

   With fewer systems like Grex on the net, Grex becomes a target for
folks trying to do things.

response 19 of 58:

Sep 4 01:55 UTC 2006

re 16
Give me one of those "bad things" that can be accomplished on GreX.

And wouldn't you agree that if a cracker found GreX to be adequate for his
needs, he would be smart enough to find a way to fake some sort of ID?  Don't
forget that the more stringent you make your ID requirements, the more likely
it is that someone is going to say "screw it; it's only GreX".

I would also like you to give me an example of a cracker using GreX in a
malicious way who was eventually caught thanks to him giving his ID to gain
membership access.  If there has not been such a case, then this ID rule
really is a "just in case" policy that is frankly not worth it anymore.

response 21 of 58:

Sep 4 04:18 UTC 2006

   Yes, a determined vandal could indeed make up false ID and send it in,
but the idea of having to do that is a repellant, such that, as far as I
know its happened only one time and the person using the false ID didn't
do anything with their account.  As far as "bad" things that can be done
on Grex, it is primarily Perl scripts such as udp.pl which are either
udp flooders, or attacks on BBS's (I've seen at least three varients on
udp.pl).

   Yes, there is less interest in systems like Grex now, since anyone
could create a small unix system of their own to play with.  However
we still get people who use Grex to learn about unix, and at least a
dozen people in the last couple of months who've been doing C coding.
It suprises me that there are still folks who need to use Grex for
that kind of thing, but its one of the reasons we're here, so thats
neat.

response 23 of 58:

Sep 4 04:26 UTC 2006

   No, the ID requirement doesn't deter donations, scholar.  Grex gets money
from the people who like Grex and "get" helping out, quite regardless of
what else they need to do.  In that sense, Grex is like public radio--only
a small fraction of the users send in money.  We can make it easier for
folks, like offering Paypal.  Things like that help Grex out more.

   I'll also point out that very very few people have ever complanined
about the ID requirement in the time that we've been doing this.