From: morgan@ms.uky.edu (Wes Morgan)
Newsgroups: alt.comp.acad-freedom.talk,comp.org.eff.talk,comp.admin.policy,alt.censorship,soc.college
Subject: Re: Sysadmin for a Day, was Re: Banned Computer Material 1992
Date: 9 Oct 92 13:37:34 GMT
    <1992Oct9.000104.18126@eff.org>
Organization: The Puzzle Palace, UKentucky

In article <1992Oct9.000104.18126@eff.org> kadie@eff.org (Carl M. Kadie) writes:
>morgan@ms.uky.edu (Wes Morgan) writes:
>
>[...]
>>I didn't ask about its effectiveness, I asked how you would handle it.
>>Some sysadmins are bluntly told, "Keep Crack/IRC/MUD code off our sys-
>>tems"; how should they handle it?  Let's hear some concrete ideas!
>[...]
>
>Do you mean how should they handle the risks of Crack or how should
>they handle being told bluntly to keep Crack off the system?
>

Either, both, I don't care; I'd just like to hear some concrete
discussion, as opposed to the endless discussion of "what *should*
be".  Discussions of "what should be" are great (I've certainly done
my share in this area), but they inevitably lead to questions of
concrete implementation.  If we want to change things, we need to
develop concrete steps; I can toss citations from policy statements
on any desk I choose, but they won't do any good until I can say:

".....and here's how XXX implements them: "
                   or
".....and here's how I plan to implement this: "

>Just to inject some information/confusion into the discussion, here
>are some library policy excerpts on dangerious material. (They
>sound a little lofty, even to me.)

They are lofty indeed.  8)

I have maintained for some time that library policy, despite its
strengths, cannot be applied to computer systems.  There is a huge
difference between libraries and computer systems:

	Libraries provide information; however, they do not (in most
	cases) provide a means of implementation.  In addition, library
	resources are (in many cases) nonintrusive; if one person trashes
	a library book, the other patrons can easily use other copies or "get
	another copy of their books" from other branches/libraries.

	Computer systems, on the other hand, provide *both* information
	and the means of implementation.  If a particular piece of source 
	code is online, it's a quick (and immediate) step to execution.  In
	addition, misuse (or incorrect use) of computing resources can be 
	extremely intrusive; if one person crashes a computer system, the 
	other users cannot easily "use other systems" or "get another copy 
	of their stuff".  (This is the rationale behind my limitations on 
	networking code.)

	Additionally, computing systems are the basis for daily academic
	and research work.  One does not often hear of research projects
	or student work being delayed due to "library problems"; however, 
	failure of computational resources has derailed many such projects.

	Therefore, computational resources must be governed by policies
	which are, out of necessity, more restrictive than those governing
	library.

Don't misunderstand me; many areas of computational use (notably BBS and
Usenet usage) are directly comparable to library/free-speech policies.
However, we must protect the computational users of our systems.  With 
this necessity, we are often forced to implement policies that may
be construed as "suppressive".

I offer alternatives in every situation.  For those interested
in Crack, I offer various texts on cryptography, the DoD Password
Management Guideline (which includes some interesting information),
"sanitized" log files from my own runs of Crack, and the source code
in hardcopy form.  [If someone can argue that the only way to under-
stand Crack is to run it, I'd like to hear it.]

Would you support a student who wanted to use the Chemistry lab to make
nitroglycerin "for the heck of it"?  If you did support such an endeavor,
wouldn't you implement certain safety precautions?  Wouldn't those pre-
cautions be for the protection of ALL lab users?  Why shouldn't a com-
puting facility be protected by similar procedures?

--Wes

-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu
Newsgroups: alt.comp.acad-freedom.talk