From: takkyon@dartmouth.edu (Dr. Tachyon)
Newsgroups: rec.games.mud.tiny
Subject: Re: Tiny logs ...
Keywords: penn, security, tinylogs, idiocy
Date: 14 Oct 92 07:43:12 GMT
Organization: PsiLords of Takis Health Club and Massage Parlor
X-Useragent: Diamond Mask 2.7b5

In article [cut] John H. Yates, yates@a.chem.upenn.edu writes:
>In article [cut] takkyon@dartmouth.edu (Dr. Tachyon) writes:
>    (much deleted)

(Yes, I know he said he'd ignore followups.  My feeling, however, is that
some of the topics here are of sufficent interest to warrant a reply
anyway.)

>As the one *most* responsible for the well being of the privately owned 
>group's UNIX machine that wreaked this havoc, one that some group
members 
>share the root password  on (hey, they bought it, it IS theirs, I try 
>to educate them but...),  I'd like to address this part of this post.

My immediate response: Yuck.  Your tone seems to imply that the roots are
not, well, entirely unix-clueful, and imnsho it's *stupid* to put a
machine on the net if you don't know what you're doing.  ('You' should
not be construed to mean Mr. Yates.  'You' means the people on the
machine who f*cked up.)

>>As Lydia says, the logs were posted from a guest account at upenn.  This
>>is a revoltingly bad security problem.  IMNSHO someone should *not* be
>>able to do this.  Period.  There is little or no excuse for allowing it
>No one should be able to leave their car without locking it either.
>Let's make it a law. Hey it happens. This is the real world.

I find this attitude, well, a little discouraging.  Yes, it *does*
happen, but casual acceptance of security breaks is a little jarring. 
Rather than "Hey it happens", it'd be nice to see something like, "Gee,
we f*cked up, we're sorry it happened, it won't happen again."  I did
not, incidentally, find anything close to an apology in this post, which
is also a little discouraging.  If you're responsible for it, you're also
responsible for what's done from it, and I'd say you owe some of these
people an apology, IMNSHO.  

>The group shares sysadmin tasks. One of them made a terrible mistake
>in giving guest a trivially guessable password. They also installed
>rn themselves, and not completely correctly, which is why the articles
>cannot be cancelled from guest on the machine. I have now identified why
>that happened, and hope that my staff member can reinstall rn tomorrow
>morning and then I can cancel the articles. (no guarantee, the problem
may
>still have a header mismatch, but I am trying.)

The level of clues in some sysadmins is frighteningly low.  On the other
hand, anyone can make a mistake, and this is one way to learn, I suppose,
but it's a damn regrettable one all the same.  (If any of them are
readers of this newsgroup, it's probably safe to assume that the problem
won't arise again. :P) )

>>to happen.  Perhaps the upenn sysadmins ought to spend less time
worrying
>>about whether cs students exceed their cpu time limits, and more time
>>fixing the security holes in their system.
>cs has nothing at all to do with this private machine in another
department.

I'm sure you're right here, and for this snipe I do apologize -- the
above-mentioned cpu time business is a pet peeve of mine, for various
reasons, and I can only plead extreme anger for this mention of it.

>[cut]
>Sometimes they make mistakes, as one did on sg1. Other peoples mistakes
>are even less controllable by me than my own mistakes, of which I
>try very hard not to make in sysadmin at least.

This, of course, is absolutely true; it's a little hard to blame you for
someone else's mistake.  Personally, I applaud your taking the trouble to
respond to this when it wasn't your mistake in the first place.

>I have personally spent most of the last 7 hours on this problem,
>trying to cancel the articles, trying to contact the group's sysadmin
>which evidently there is none for this group, and tracing logins and
>network connections logs to snag the perpetrator. It is now midnight
>and tomorrow is another day.

I, as well as most of the other readers of this newsgroup, wish you the
best of luck in tracking down this, ah, person.  If anything, we're
probably more eager to find him (or her) than you.

>I also perused this group a little for the first time. I saw that
>people were already concerned with people keeping logs and hiding
>etc. My personal opinion is that it is rather naive of the game
>users to believe that someone is not recording what they say,
>and that it could eventually get into the wrong hands. Are the
>authors of the game to be trusted any more than any other average
>stranger?

Most mu* admins *are* trustworthy, for the simple reason of Natural
Selection.  If you get a reputation as a God who pulls stupid tricks of
this variety, odds are pretty good your mu* won't last long.  C.f. the
number of mu*s on the network, and the number from which logs such as
this are posted to the net.  I don't believe a whole lot of MUSHes log
all commands (although, of course, it is possible); most of the ones I
know log wizard commands, connects, etc., and that's about it.  (Of
course, if one uses wizard commands to do anything embarassing...this
*did* happen on one MUSH I'm wizard on, and the person in question was
QUITE embarassed, despite the fact that the God never distributed or even
*quoted* the log to the rest of us, much less posted it.)  

>Words of wisdom: if you don't want it to be repeated, don't say it
>in public (if at all), and this game seems to consist of what I would
>call public rooms, whatever you call them, where some listeners can hide
>and record. 

No, you're misinterpreting the way the game works.  It is, in fact, quite
easy on most social mu*s to create an area impossible to enter without
the approval of the owner.  (It's very easy for a wizard to spy on
people, yes, but if the wizards can't be trusted, you're in trouble
anyway.)  The logs in question were recorded by one of the players
involved, and one can hardly blame THEM for being there.  The problem
arose because someone evidently got into the person's account somehow and
made copies of the logs.  A complete discussion of exactly how the game
works is obviously inappropriate here, but I'd be more than happy to
discuss it at length with anyone who has questions.  

>Sheesh! And I get complaints about guest security? This
>game is a security disaster waiting to happen. 

Not really, no.  Besides which, whether or not this is so hardly excuses
the mistakes that allowed the logs to get posted.

>I just wish the perpetrator had penetrated someone elses machine,

Sooner wish he'd penetrated *nobody's* machine.

>or perhaps mailed you all the stuff to your US Mail boxes, which they 
>probably could map to, but for the cost of stamps.

Ah, what wonderful sensitivity.  Lovely.

>John
>yates@a.chem.upenn.edu

			-- dt
					Ye Royal Lord High Twink-Squisher Extraordinaire, Amby's Army
--
email: takkyon@dartmouth.edu / takkyon@northstar.dartmouth.edu
"The French are masters of "the dog ate my homework" school of diplomatic
relations." 
		-- P. J. O'Rourke