NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/alt/comp/acadfre/talk/2690

Internet Message Format | 1992-08-29 | 8.2 KB

Path: sparky!uunet!haven.umd.edu!darwin.sura.net!news.larc.nasa.gov!lll-winken!iggy.GW.Vitalink.COM!cs.widener.edu!eff!eff-gate!usenet
From: [e-mail] (Carl M. Kadie)
Newsgroups: alt.comp.acad-freedom.talk
Subject: [comp.admin.policy]  Re: Policy regarding Crack
Message-ID: <[e-mail]>
Date: 28 Aug 92 06:19:00 GMT
Sender: [e-mail]
Organization: EFF mail-news gateway
Lines: 161
Approved: [e-mail]
Originator: [e-mail]
Nntp-Posting-Host: eff.org

From: [e-mail] (Olaf Titz)
Newsgroups: comp.admin.policy
Subject:  Re: Policy regarding Crack
Message-ID: <[e-mail]>
Date: 28 Aug 92 15:31:08 GMT

In <[e-mail]> [e-mail] writes:

>  This approach borders on acceptability for one reason only -- I'm not
>  looking at the files myself.  If such a script reports that "file
>  /users/booga/foo/blast is in /etc/passwd format", I would simply dis-
>  cuss the matter with the owner of the file.  I don't examine user files.

Two ways to answer this come to my mind:
1. 'The sysadmin should mind his own f*g business and care the hell
about user files, these are MINE.' (This is NOT my opinion but
common among users who feel harrassed enough by admins; see below.)
or:
2. 'OK, agreed.' (Under the provision that admin's reaction is, for
instance, writing user a mail telling about it and inviting him for a
discussion of the matter. Not an immediate account revocation without
prior notice as is unfortunately common...)

>...
>  >>  "Academic freedom" is not equivalent to "a blank check".
>  >
>  >Right, but... be VERY careful about that.
>  >
>  >The step from your Japanese parser to general restrictions like 'we
>  >don't carry alt* and rec* newsgroups' is dangerously short.
>
>  Excuse me, but the two concepts are NOT as similar as you claim them to be.
>  In my example, I suggest a policy that would prevent the use of a
>  particular facility by an individual user (namely, the future use of
>  my system for cracking programs).  Your counter-example, the revocation
>  of alt.* and rec.* newsgroup access, suggests the revocation of current
>  use by all users.  The two cases are markedly different; you're comparing
>  apples and oranges.

I knew this was a bad example ;-) but an example of what does happen,
being justified by the same arguments: alledged non-academic or
non-study-related use, therefore considered abuse. But I agree that
your thing is a different issue.

>  >Take
>  >another example: When I want books from my university library, nobody
>  >cares about the importance of, say, a book on music history for my
>  >computer science studies.
>
>  This example is irrelevant.  The university libraries are, by definition,
>  open to all students of the University.  My systems, on the other hand,
>  are open only to Engineering students/faculty/staff.

O.K.

>...
>  >Not a blank check, but the provision of
>  >CERTAIN resources for own use (as opposed to the provision of
>  >resources for CERTAIN use - understood?)
>
>  I agree; however, when that use begins to approach illegal activity
>  (or activity prohibited by University policy), then actions must be
>  taken.  Would you agree?

Agreed. (A definition of what is prohibited is needed, and it should
be ensured that users are aware of it, but at least the latter can
easily be done.)

>  >but I think universities should provide the resources they
>  >are able to (technically, financially,...) and place no restrictions
>  >on their use unless there are justifiable reasons to do so,
>
>  Yup, but who determines the justification?  There are those who argue
>  that playing games is justifiable 'educational use'; there are others
>  who argue that diskspace quotas are a violation of their 'academic
>  freedom'.  You want to use it, and I have to manage it for all users;
>  sooner or later, we may butt heads.

Here we come to the heart of the issue: a collision of interests of
users and admins. Is that necessary?

Diskspace quotas are simply a technical need. Space is limited and
will be filled up, sooner or later. If, however, you have 50 users and
a 500MB user disk and give each user 1MB of quota, then users may well
question the setting of the quota *that low*. (I wouldn't call that a
violation of academic freedom, though.)

Take another example: The machine I am currently on prohibits access
from 9pm to 8am, and there are simply no technical reasons for it, but
when asking you'll get the answer that it has been introduced because
of 'hacker' problems (alledgedly 'hackers' have been operating from
here cracking machines in America, some 3 years ago now). Now,
'hackers' OF COURSE are only students not employed at some institute
(those who are have accounts with no restrictions) and OF COURSE do
only work at night. (To prevent terminology discussions: I know these
'hackers' are really crackers but at our department nobody knows the
distinction - that is how they told me.) This is a completely silly
restriction placed upon users for political reasons only, if for
reasons at all. NOBODY sees any admin interest contradicting the
users' interest of doing their work when they want to. (Another
argument was the possibility of machines (workstations, in that case,
which do not provide any central services) crashing and having to be
rebooted. Besides from this being able to be done the next morning,
again crashing of machines OF COURSE can be done only by ordinary
students. Another 'justification' out of the air.)

Playing games is a sensitive issue. Prohibiting that special use (and
what is a game? Some people think of IRC being a game too) is not
justified but plaing games on university machines is IMO (!!) not
justified either. I know of examples of settling the issue by stating
that playing is not allowed, but will be tolerated unless persons with
real work want the machines. Given the problems mentioned above, this
systems works astonishingly well here.

>  >e.g.
>  >outright abuse (what this is, however, should not be stated par ordre
>  >du mufti but established, ideally, by a board of staff AND students).
>
>  The other problem with the definition of offenses comes here.  I've
>  been trying to write a polcy for almost a year, and I keep hearing
>  that "it's not specific enough".  One student even complained about
>  the sentence "Forgery, or attempted forgery, of electronic mail messages
>  is prohibited."; he said that it was "too general".

It may be considered too general as long it is not stated what
constitutes a forgery *attempt*. At many sites, all network
connections are logged, and an admin sweeping through the log files
(yes, there are people who do that) may see the dreaded '25' and
conclude immediately an email forgery (where this could have been a
simple verify as well).

But there are always the radical people who will not tolerate anything
that might interfere with their life in one way or another, and these
can IMHO be peacefully ignored when the issue is settled with the
majority. I simply prefer a democratic approach over the 'admin
dictatorship'. (Not intended as a personal insult, of course :-)

>  We will NOT be able to develop a written policy that covers every possible
>  offense.  Some discretion must be left with the administrators.

Really? I would like to reformulate the last sentence to: ...must be
left for case-by-case resolution by the admins *in cooperation with
the users*. No ordre du mufti, please.

>  I repeat: "academic freedom" does not equal "a blank check".

Agreed again :-) but what DOES constitute academic freedom should be
more clearly stated. I think of it as that all restrictions have to be
justified in the first place and this justification be stated by
consensus of the people involved. Real clashes of interests are rare
and most cases can be settled without too much headache on either
side, IMHO, but cooperation is the necessary precondition.

MfG,
        Olaf
--
Olaf Titz - comp.sc.student - Univ of Karlsruhe - [e-mail] -
[e-mail] - praetorius@irc - [phone] - did i forget something?
OS/360 devotes 26 bytes of the permanently resident date-turnover routine
 to the proper handling of Dec.31 on leap years. That might have been
 left to the operator. - Fred Brooks (1975)