RE: Message from Kevin Guthrie, JSTOR's President

["Hamaker, Chuck" <cahamake@email.uncc.edu>]

 I agree with what David has said below. The responsibility for walk-in
users is a continuing obligation that we carefully include in contracts.
It might be onerous for JSTOR's system to register proxy servers, but that
is not an impossible task I would think. If the server is registered that
should limit substantially the access from off campus to mostly legitimate
users, and if there is abuse then it should be easier to track who it is
coming from if its off campus. At the same time, the abilty to provide ip
filtering for on campus use is just too important to discontinue it. The
ip filtering as a common filter, is also a significant reason that linked
resources work as well as they do. And in fact, requiring each user to
register creates other significant problems I believe, specifically if you
have the information on who uses what, you can under the US Patriots act
get in a situation where the individuals use of materials can always be
tracked.

We solve the problem with book circulation in some systems by breaking the
identifying link between the exact user when the book is returned. How do
we protect confidentiality in a system every user MUST log on.-I hope I'm
not misunderstating this-I may not understand all the nuances.

Chuck 

-----Original Message-----
From: David Goodman
To: liblicense-l@lists.yale.edu
Sent: 12/10/02 5:27 PM
Subject: RE: Message from Kevin Guthrie, JSTOR's President 

As I understand it, the solutions proposed by Kevin would eliminate the
possibility of walk in users. Many of us have fought long and successfully
to have these users permitted on our licenses. We are all replacing or
supplementing print resources with electronic ones. It would not make
sense to permit those authorized to have access to our libraries (and, in
some universities, paying considerable sums for the privilege), not being
able to access the most important resources. Some (public) universities
may be legally required to provide all their users access to all their
resources.

There are perhaps some work arounds: it might be possible to give walk in
users temporary user names, possibly through specific library machines
configured to do this in a manner hidden from the user.

As I understand it, a server can determine many things about the
characteristics of the browser accessing it. Can it determine if the
browser is running on a machine that is itself set up as a server? If so,
it would possible to deny access except for machines on a list of
authorized proxy servers.

I would certainly imagine that those more technically knowledgeable than I
should be able to think of other solutions. I think the extent of the
problem may be serious enough to require more directed action than has
previously been considered reasonable. We should ensure our efforts do not
however impair the positive use of the resources by the entire user
community.

My personal opinion only, of course. David Goodman