Newsgroups: bit.listserv.pacs-l
Date:         Fri, 10 Apr 1992 12:21:32 CDT
From:         Public-Access Computer Systems Forum <LIBPACS@UHUPVM1.BITNET>
Subject:      Anonymous Access to OPACs

4 Messages, 103 Lines
*-----
From: Linda.Newman@UC.Edu
Subject: RE: Anonymous Access to OPACs
Christopher Nolan asks
        "How is this different from anyone having a modem and
        dialing numbers either intentionally or randomly?  Certainly
        the potential for hacking exists in either case."

I think the difference in a nutshell is that that it's easier and less
trackable, by several magnitudes, to do hacking via the INTERNET than via
modem.  No long distance calls, no hunting phone numbers, better
connections and faster baud rates, the use of anonymous FTP, etc.

  +------------------------------------------------------------------+
  | Linda Newman               |    BITNET: LNEWMAN@UCBEH            |
  | University of Cincinnati   |  INTERNET: LNEWMAN@UCBEH.SAN.UC.EDU |
  | Library Systems Office     |       FAX: (513)556-2161            |
  | Cincinnati, OH 45221-0033  |     VOICE: (513)556-1441            |
  +------------------------------------------------------------------+
*-----
From:         Steve Cavrak <SJC@uvmvm.uvm.edu>
Subject:      Re: Anonymous Access to OPACs
Christopher,

No, you are not missing something here -- except in maybe assuming
that "public" access is the same as "anonymous" access.  Our labs
at the University of Vermont allow this access, and so do those at
other universities I'm familiar with.  Sometimes the access is not
particularly obvious -- e.g. access to a state library system
allows access to a college library system which then links to another
state library system which then allows access to a college running
a gopher gateway.  This is, I suspect, the type of access most of
us on PACS-L would like to encourage.

There is, however, a vocal contingent of system administrators --
usually at other sites -- who think we are amiss in our responsibility
to protect their systems for them.  The "debate" flares up about once
a year -- sometimes reaching deep into the internet bureaucracy.

What's probably most important is user education.  Computer users who
have direct access to the internet should also realize that the rest
of the internet may have access to their computer -- NCSA Telnet and
Clarkson Telnet both support inward FTP connections -- unless
explicitely disabled.

Steve
*-----
From: "Genevieve Engel" <GENOL@UCCMVSA.BITNET>
Subject:  Re:  Anonymous Access to OPACs
>How is this different from anyone having a modem and dialing
>numbers either intentionally or randomly?  Certainly the potential
>for hacking exists in either case.  The responsibility for
>protection exists with the systems which offer outside access, I

This is different in that the library itself is providing ANONYMOUS
access.  Normally if you dial up to a computer intending to telnet
around the net, you need an account on the computer you are dialing
to.  If you then go and wreck other people's machines you can at
least be traced (or at any rate, the account you used can be traced,
although that could be an account you stole the password to).  Net
access through the OPAC is completely anonymous in most cases.  There
is no way to trace who you are.

Granted, someone who can hack into anything can hack into the net
no matter what the OPAC provides.  However, such people are a lot rarer
than the person who will take advantage of an anonymous connection if
it's easy and obvious.

In the wake of the Internet worm incident there was a lot of talk
going around about tightening up the net.  It sounded to me like
there were lots of network and systems people who would be just as
happy to disallow all anonymous access to anything on the net.  If
our OPACs are found to have major security loopholes that tend to
encourage casual hacking, it is quite possible that anonymous access
of any kind will come under severe scrutiny all over again.

Genevieve Engel                    >  "Information wants to be free"
MELVYL System User Services        >                -- Stewart Brand
University of California           >
gen$ol@uccmvsa.ucop.edu            >
genol@uccmvsa.bitnet               >
*-----
From: jaffe@ucscm.UCSC.EDU (Lee Jaffe, McHenry Library, UC Santa Cruz,
 408/459-3297)
Subject: Re: Anonymous Access to OPACs
Our campus computer center maintains a policy of not allowing off-campus
telnetting from the campus network by non-authenticated users.  The issue
is security.  Basically once you are on the net you can go anywhere.  As
one administrator explained it, if he gets a call from your computer
center that someone is trying to hack your system, we wants to be able to
id the offender.  This may not sound like a big deal but it happens often
enough to be an issue.

They do make exceptions for net addresses that agree to this arrangement.
For instance, we can telnet to Berkeley without being logged into a
secured account because Berkeley said that it was not worried about
their system security.  If every local site was locked down tight, then
open Internet access would make sense.  In the meantime, local systems
admininstrators consider it to be prudent to permit secured access only.

-- Lee Jaffe
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU