From: alexis@panix.com (Alexis Rosen)
Newsgroups: alt.bbs,comp.bbs.misc,comp.misc
Subject: Re: The bogus Nixpub Posting
Date: 27 Aug 92 08:44:29 GMT
Organization: PANIX Public Access Unix, NYC

peterd@pjd.dev.cdx.mot.com (Peter Desnoyers) writes:
>alexis@panix.com (Alexis Rosen) writes:
>>Furthermore, you don't need to provide an anonymous login at all- just a way
>>to register on-line and/or read a help file.

>Wait a minute. Nixpub is a list of public access >>>UNIX<<< systems. "a way
>to register on-line and/or read a help file" on a UNIX system is going to 
>involve a dummy user account, with its shell set to the registration/
>help program, and with no password. Hence John's fears of hackers.

That's a total non-sequiteur. The setup you describe is exactly what we have
here on panix. You couldn't hack your way into a shell from our info or
registration programs if you had a million years. They're just not complex
enough for the subtle bugs that cause vulnerabilities.

>Although Phil can put whatever he wants in the NixPub list, I should add
>that I am a bit disappointed. I had thought that "public access" meant
>that accounts - access - was available to the public, rather than 
>restricted to members of some community. (e.g. commercial or university

Huh? It does mean what you thought it meant.

>machines) Silly me - it turns out that "public access" has nothing to
>do with the conditions for getting an account on the system, but rather
>is based on non-account access given to people without accounts.

Not true. It has everything to do with conditions for getting an account.
There's also a requirement that systems support some sort of public access
(if only for info/registration) to non-account-holders. I'd say that this
is very public.

If you're incapable of meeting Phil's requirements, your system is going to
be problematic to the point where it probably wouldn't be useful for it to
be in the list anyway.

>For the terminally insecure (a group very over-represented on the net)
>this might be an important issue, as otherwise you might have to talk 
>to a real, live person to get an account. Or even carry a letter down
>the block to a mailbox, and risk having someone see you crawling out 
>during the light of day. 

Heh. We won't validate an account until we talk to the user in person on
the phone.

>For other individuals who own modems but not telephones, this might be
>an issue as well. For the other 99.9% of the general public who would
>like to get an account on a public access machine, this criteria seems
>a bit bogus. If there were thousands of machines available to the public,
>and Phil's list was a boutique, as it were, offering only selections
>according to this little quirk of taste, it would be one thing. However,
>the current nixpub list probably covers half or a third of all the 
>public access systems in the country, and I don't know of any list
>covering the rest.

Where did you get those numbers?

This is silly. His requirement take ten minutes for a competent admin to meet.
If it were an irrelevant or major obstacle, I could see complaining about it.
As it is? I can't even believe I'm wasting my own time typing this in! And I
suggest that everyone reading this be smarter than I and not bother... :-)

--
Alexis Rosen   Owner/Sysadmin,
PANIX Public Access Unix & Internet, NYC.
alexis@panix.com
{uupsi,cmcl2}!panix!alexis
Newsgroups: alt.bbs,comp.bbs.misc,comp.misc