The cross item, spawned from the jp2 campaign item

Dec 6 07:56 UTC 2003

Picking up from the discussion in the jp2 campaign item:

Dan (cross), I have to say that I am puzzled by your perception of the
character of mary's responses to your comments and actions.  I find her to
be a very compassionate, but very outspoken individual with little or no
compunctions about saying what she thinks, but also without a detectable trace
of vindictiveness or hubris about her.
I can only think that you simply did not carefully read what she said to you,
or that you responded to her comments defensively and without really taking
the time to understand what she was saying.  I think she was saying that she
wished you would have taken a more collaborative approach to dealing with what
looked like it might not have been a really cut-and-dried abuse case,
especially in light of your relative inexperience in balancing the concerns
that Grex staffers very carefully balance on a daily basis.

That may appear to be totally at odds with the point of adding new staffers
and energizing the staff with new blood, but it really isn't.  There's no harm
in asking first, even about things that seem clear, at least for a while until
the responses to those questions consistently agree with your own conclusions
about the appropriate actions.  This is essentially analogous to a
self-monitored training period.  Grex's management philosophy pretty much
seems to be that it is always good to check with people to make sure you're on
the right track, especially if you think you don't need to.

response 2 of 53:

Dec 6 12:12 UTC 2003

What "Abuse" exactly prompted locking out the accounts and the subsequent IP
banning?

response 4 of 53:

Dec 6 13:07 UTC 2003

The limit is not the number of mail messages but rather the size of the
bulk mailing.  That makes sense when you consider the issue is our limited
resources and how sending 500K of mail brings Grex to its knees. 

Our staff walks a fine line between setting hard and fast rules where
everyone gets treated the same (as in what Valerie did recently with jp2)
and trying to understand what's behind a problem and factor that into the
staff intervention (as in what cross did).  Most of the time individual
staff members make at least reasonable decisions but they always leave
themselves open to the opinion of other users and other staff members. And
as uncomfortable as that might be for the staff member involved, it's part
of the job.  Always was and will be. 

Now, here is where I think Dan went a little wrong.  He went past reacting
to the facts of an incident of system abuse into building theories about
who all was involved and their motivations and connections.  He then used
his staff power to lock accounts and tried to block the suspects access to
Grex.  And when it was shown his theories were incorrect he responded by
stating: 

  "I locked asddsa's account because I had reason to suspect
   he was the same person as dah.  Both their comments in the
   bbs (I infrequently see both them in party) struck me as
   juvenille and immature.  Their harassment of staff was annoying.
   Their continuing complaint about polytarp's account
   being locked was just stupid.  Forgive me if I couldn't tell
   Tweedle-Dee from Tweedle-Dum."  Coop, item 29, response #17

Maybe it's just me being Old Grex, but I found this response worthy of
criticism.  When you start using staff police powers based on assumptions
instead of fact, you open yourself up to having to say, "I was wrong and
I'm sorry", which is what the response should have been in this instance. 

I made four responses in item #17, and I won't bore people by entering
them again, but if you're into it they are responses #21, 66, 96 and 118. 

That Dan's response to my comments was to quasi-resign from staff
speaks for itself.  It takes some patience and skin to be Grex
staff.  And it takes some experience to be really good at it.

Dan, I hope this helps.

response 6 of 53:

Dec 6 15:33 UTC 2003

5: Well, that's really debatable.  It is possible for justice to be 
blind in the absence of highly specific rules, it's just not very 
commen.  In some ways, laying out a comprehensive set of rules would 
make Grex a lot easier to manage, but at what I think would be the 
cost of its character and driving philosophy.

This might simply be an example of the kind of growing pains small 
organizations always experience when they begin to become larger 
organizations, and the things that worked before just don't work as 
well anymore because of the greater difficulty of applying the 
priciples to a larger and exponentially more complex structure.

response 8 of 53:

Dec 6 15:58 UTC 2003

resp 3&4 It wasn't mass-mailing that caused the dah and asddsa accounts to
be locked.

re 7 Or unknown ones, as it may be.

response 10 of 53:

Dec 6 16:20 UTC 2003

Okay , that brings back to my original question ..

what will you do ... if I decide to send 500 KB ( this or whatever
renders the system unusable ) now .. would I get my account locked for
two days ? Just that or more .. I don't see any reason why I should be
treated differently that the earlier two cases. 

What if all of the thousands of grex users decide to try it and do the
same ?

My point being in the absence of pre determined set of actions to such
incidents .. it ended up bringing up conflicts amongs the staff . on
both the  earlier incidents.

[quote]It is possible for justice to be 
blind in the absence of highly specific rules,[/quote]

In the presence of rules, however,  it would have been a lot easier to
decide whether cross or anyone for that matter misused their staff power
and the matter would have been just a minor thing.

response 12 of 53:

Dec 6 18:55 UTC 2003

If it's forever , would that go against equal treatment for everyone ? 

response 14 of 53:

Dec 6 20:05 UTC 2003

I didn't read Mary's response #4 closely enough, so it took me a while to
find her comments.  (She refers to different item numbers; the correct one
is #29.)

She took Dan's comments in his response #17 to that item out of context and
then criticised him for it.  He was trying to explain why he considered
several different accounts to belong to just one person.  Blocking one of that
person's accounts is worse than pointless: it's just plain stupid.  Blocking
the accounts of that person, but leaving them access to create new ones is
also stupid.  The only recourse in that instance is blocking the IP address
(or addresses) that the vandal (for lack of a better term) is using.  As was
pointed out at the time, such blocking is standard practice here on grex.

Mary's response #66 was directly preceded by a response from John.  I'm going
to include both here, in their entirety:

} Item #29: Hackers (More tricks)
} Response 65 (125) John H. Remmers (remmers) Sun, Nov  9, 2003 (11:59) 2
lines: }  }  I think that #61 contains a reasonable question, regardless of
what }  one may think of the person asking it. }  }
--------------------------------------------------------------------------- }
Item #29: Hackers (More tricks) } Response 66 (125) Mary Remmers (mary) Sun,
Nov  9, 2003 (12:14) 3 lines: }  }  I'm afraid the answer might be, "because I
can". }   }  I hope we're learning here. }  }
---------------------------------------------------------------------------

Madam, that sure sounds like a personal attack, don't you think?

Oh, the question in #61 was:

]  Why do you continue to block them, when it remains fairly obvious I
] can connect to Grex anyway?

Unfortunately, that particular question never did get addressed.  In the face
of continued criticism, AND ABSOLUTELY NO SUPPORT, Dan gave up.

I echo that last sentence of Response 66 of Item 29.  I hope you spend
some time in front of a mirror, Mary.

response 16 of 53:

Dec 6 20:49 UTC 2003

Regarding #4; I wish you would go back and reread all of item 29, Mary.

Mary writes:

        "Now, here is where I think Dan went a little wrong.  He went past
         reacting to the facts of an incident of system abuse into building
         theories about who all was involved and their motivations and
         connections.  He then used his staff power to lock accounts and
         tried to block the suspects access to Grex."

So, according to you, I went wrong by locking the pseudo's of the
naftee account thinking it was polytarp.  But, you neglect to mention
my statement that naftee himself complained his main account (login:
naftee) had been locked previously.  Who did that?  Not me; it was before
my time on staff.  Let's have a look at the logs:

Wed Feb  6 12:01:20 2002 woot [naftee] another polytarp account

Woot is STeve Andre, and at the time, polytarp was being banned for
sending mass tel's.  So it seems I wasn't that far out of line thinking
that naftee was polytarp, and I had legitimate reasons for thinking so
(hey, STeve Andre thought the same thing!).  It should be noted that
STeve never unlocked the naftee account, even though he incorrectly
assumed naftee was polytarp, just as I did; naftee was recreated in June,
by the original person, after being reaped.  You can't get much more
experienced at grex staff, or as oldgrex, as STeve.

I suppose quoting the above line from the log will be considered an
abuse of staff power.  At least I'm not quoting the line two above that
in the log file!

Mary goes on to say:

        "And when it was shown his theories were incorrect he responded by
         stating:

           "I locked asddsa's account because I had reason to suspect
            he was the same person as dah.  Both their comments in the bbs
            (I infrequently see both them in party) struck me as juvenille
            and immature.  Their harassment of staff was annoying.
            Their continuing complaint about polytarp's account being
            locked was just stupid.  Forgive me if I couldn't tell
            Tweedle-Dee from Tweedle-Dum."  Coop, item 29, response #17"

I made the same mistake other staffers did.  Sorry.

But, this is quoted out of context.  Here the entire post Mary quoted
parts of.  I wrote:

        "Nonsense.  I told him I'd give him his account back if he said he
         wouldn't damage the system.  The response was something on the
         lines of, ``CAN YOU TELL ME HOW TO FIX MY TV!''  I concluded
         after a couple more exchanges he wasn't serious about getting
         anything unlocked, but just wanted to be irritating.

         This is a hard issue; Freedom of speech is a rough thing.
         It means, in exchange for the right to express one's own ideas,
         periodically one has to put up with idiots who want to abuse
         the system for kicks, who in effect take advantage of the right
         to say whatever they want to say things just meant to annoy,
         who push the limits just because they can.  Sometimes the
         latter is good; sometimes shocking people out of a complacent
         existence can be beneficia, if that complacency is itself bad.
         But sometimes, it's just irritating, and while it's an irritation
         we have to put up with, but that doesn't oblige me, or anyone
         else, to facilitate it.

         I locked asddsa's account because I had reason to suspect he
         was the same person as dah.  Both their comments in the bbs
         (I infrequently see both them in party) struck me as juvenille
         and immature.  Their harassment of staff was annoying.  Their
         continuing complaint about polytarp's account being locked
         was just stupid.  Forgive me if I couldn't tell Tweedle-Dee
         from Tweedle-Dum.

         A few people I trust have since said that
         asddsa/naftee/soup/salad isn't polytarp/dah/scholar.  Okay,
         fine.  However, I'm not going to play a series of games with
         naftee over getting his account back; freedom of speech doesn't
         entitle you to a specific login name.  It's clear naftee, or
         whatever his name is, knows how to run newuser, and it's clear
         he's both figured out a way to access the BBS via the web, and
         login interactively.  As far as I'm concerned, he hasn't been
         censored, and he can get his other accounts back after they've
         been expired in the normal reap cycle.  I have better things
         to do than (a) fix naftee's TV, and (b) engage in juvenille
         debate over this or that."

I still don't think there's anything particularly bad in there.  I said
in words what STeve said in actions.  Maybe I'm a bit gruff.  Too bad,
I live in New York.  Deal with it.

I tried talking to naftee (using his pseudo at the time) to determine
whether he really wasn't polytarp, and whether he was planning on
abusing the system in the future.  I said, if I recall correctly, ``if
you tell me you won't abuse the system, I'll unlock your account.''
His response asked me whether I would fix his TV.  Not knowing how to
fix TV's, I declined.  But I also went away thinking he wasn't too
serious about getting his account back.  Given that, I wasn't going
to waste a lot of time playing games with him over it.  Eventually, I
unlocked his account and sent him the new password.  That's more than
the old school grex staff did in the *exact same situation.*  Yet,
Mary chooses to criticize me for mishandling the situation.  Mary,
why didn't you criticize other grex staffers the first time this happened?

Mary makes vague statements that I should have asked before locking
dah et al.  Actually, I did.  In an email to the staff mailing list on
October 28, 2003, I wrote:

        "Sure, I'll agree with that, too.  I chmod'ed everything in his
         home directory to be unwritable by group and other.  Still,
         I think, if we can ferrit out who's doing this (I'm reasonably
         confident it's not Jamie), we should boot that person. Dah has
         been paying a lot of attention to Jamie's account.  I find that
         a little weird."

The ``Sure, I'll agree with that, too'' is in reference to Valerie's
suggestion that we lock jp2's account if it gets vandalized again because
he had permissions on some files and other's could write into them.
By the way, Sapna, that was what dah did: he wrote about 400 megabytes
into a few of his files that were world writable, and filled up the
/d partition.  He then posted somewhere, maybe in coop, that Jamie's
account should be locked because he had filled up the grex.  Hence my
comments about abusing the system and trying to pin it on someone else:
he abused grex, and tried to pin it on Jamie.  Evidently, to Mary, this
isn't a good reason to lock an account; doing so would be un-grexlike.
The funny thing is, it's common practice with grex staff to lock accounts
that are over quota.

Anyway, my email received no objections, no one said, ``hold up before
you do that.''  So, it would appear that I *did* ask (in the form of
stating my intentions, to which no one disagreed) before doing what I did.
As for naftee getting caught in the sweep of polytarps access, well,
I've already explained that enough times.  It's interesting to note
that the policy written up in jp2's campaign item is that, in cases of
mistaken identity, particularly when someone's actively attacking the
system, it's better to lock first and ask questions later.  I thought
dah represented a serious threat to the system, as he had filled up a
user partition (making the system unusable for a significant number of
users, the offense jp2's account was locked for, which Mary seemed to
agree with); there was no reason to believe he wouldn't do it again.
I did what I thought was prudent.  So if I was doing what Mary suggested
I do when she wrote:

        "Oh for heaven's sake.  Cross, you are brand spanking new to
         staff.  There is a learning curve.  You have some rough edges.
         None of this means you won't fit in nicely but you'll need
         to ask some questions and listen to the answers to make that
         process easier."

        ...

        "And I'll compliment you on this - you are eager and willing to
         help out.  That's a huge plus right now.  But, at least in the
         beginning, think it through and maybe ask those who have been
         doing this a very long time if your plan is sound."

Well, it seems I did ask some questions and listen for the answers (which
never came).  What's more, I followed the *exact* *same* *path* ``those
who have been doing this for a very long time'' did (cf. steve locking the
naftee account back in February, not to mention all the account locking
that happens on a nearly continuous basis).  I boggles the mind why Mary
criticized me for this, but not STeve.  Maybe she wasn't aware of what
STeve did, but if she was, would her reaction have been any different?

At the end of the day, I think the only thing Mary can *really* take
exception to was that I didn't immediately reinstate the naftee account.
Okay, point taken, but that's not how she presented herself in item
29.  For instance, dah, aka polytarp, the person who had filled up
the /d drive, asked the following:

        "Why do you continue to block them, when it remains fairly
         obvious I can connect to Grex anyway?"

This was in reference to blocking the IP addresses of his ISP.  Remmers
went on to say:

        "I think that #61 contains a reasonable question, regardless
         of what one may think of the person asking it."

To which Mary responds:

        "I'm afraid the answer might be, "because I can".

         I hope we're learning here."

Never mind that I'd already explained why I had banned him.  I'm not
sure what we're supposed to be learning; Mary never explained that
comment.

Scott did have this to say about one of Mary's comments:

        "Actually we do on occasion site-block.  We feel shitty about
         having to do so, but at times it has been necessary."

She never responded to that comment.  But then again, it didn't support
her thesis.

Later, I wrote:

        "Regarding #70; Okay.  I've unblocked all the Canadian ISP's
         I blocked.  Someone else can clean up these problems on grex;
         I've got other things to do."

Then:

        "I've unlocked the polytarp and dah accounts, and emailed
         the new passwords for both to willcome."

Which polytarp followed up to by writing:

        "And that's what I get for chasing away staff members, and
         DoSing the system and blaming it on potentuak staff members.
         (more than I started with)."
        ...
        "I meant potential (impotent, importent) Board MEmbers."

So, the person who abused the system admits it, and proves my point
for me.  Here are the lessons I learned:

1) While new to staff (I'm not new to Unix system administration,
   or dealing with unruly users), don't do things other staffers have
   done before you, because you're wrong while they were right.

2) The president of the board plays favorites and doesn't
   listen to explanations of actions that go against her preconceptions.

3) It's okay to vandalize grex as long as you complain about
   being punished later in BBS.

4) Users will not be held accountable for their actions if they staffer
   who tries to do so isn't on the favorite person list of the president
   of the board.

5) The grex old guard will defend itself.  Note that no one has taken
   Mary to task for her uneven reaction to different staffers doing the
   *exact* *same* *thing*.

6) Attempting to public explain yourself will bring you nothing but
   misery here.

response 18 of 53:

Dec 6 22:05 UTC 2003

Had STeve's actions come to my attention I would have voiced my
opinion, just as I did with you.  Don't believe me, ask STeve.
We've had animated discussions.  We are also friends.

response 20 of 53:

Dec 6 22:25 UTC 2003

Maybe I've do have it wrong.  I realize you have to lock account and site
block.  But when you assume someone deserves such treatment, take the
action, then find out you spanked the wrong person, what is staff's
response?  Accepted response?

response 22 of 53:

Dec 6 22:35 UTC 2003

There's a pope in Paris.

response 24 of 53:

Dec 7 03:37 UTC 2003

That was the most confused post ever.