| Tuesday, February
8, 2000
OK: I now know what happened
yesterday. The full story doesn't reflect greatly to my credit, but so be
it. It began apparently with a coordinated attack on
Yahoo.com for reasons not yet clear. My guess is amusement, and an
experiment to see what could happen, but I don't know. Doubtless someone
will tell me. Usually people do, because I have never blown a source in my
life, and living in California I even have the law on my side:
California's journalist shield laws are pretty good. Anyway, a group
apparently decided to see what they could do. This is where
I come in. The 7th is column deadline day for me, and this weekend, due to
the birth of Catherine Elizabeth to my son Phillip and his wife Patty I
was way behind, not only on writing -- I write fast, and while 9,000 words
is a lot for a day it's nowhere near beyond me -- but also on research.
There were things I needed to do, and some of them had to be done on the
net. Mondays are also the days on which I add new pages to
this site. The old currentview and currentmail become numbered view and
mail pages, the View and Mail "home pages" are updated, and new
currentview and currentmail pages are created. Monday morning I sat down
to do all that; it usually takes about an hour. That would leave me plenty
of time to get the column done by dinnertime. Hah. I
renamed the old currentview and currentmail pages (letting FrontPage fix
all the links those name changes would break; it does that well, one
reason I use FrontPage 2000) and created the new pages with short messages
to the effect that this is column day and there wouldn't be much. All was
well until I set FrontPage to PUBLISH. Even then it all began well: but
apparently right in the middle of that came the initial slowdown of the
net, possibly due to the attack on Yahoo. The result was a
message "The server unexpectedly shut down." Well, thought I. I
tried again. This time I could not log on to the server. First
lesson: error messages are what the programmer thought might be happening,
and do not always have any relationship to what is happening. I was
getting messages to the effect that my password was rejected. What was
really happening was that the net was so slow that the login process took
too long. Worse: the shutdown happened AFTER the pair site
erased my index.html page but BEFORE the new one got uploaded: www.jerrypournelle.com
now showed no page at all. Panic message to pair.cm of
course. Call to Bob Thompson, who's in North Carolina. He
was able to access my web site just fine. Sounds like net traffic
problems, possibly Earthlink, and local to the West Coast, we concluded.
Then he couldn't access the site. This was due to the west coast problems
overwhelming the whole net and propagating to the East Coast, but we
didn't know that, and erroneously concluded that PAIR.COM was having
server problems. Note that he could access own site also at PAIR. But of
course this one gets more traffic than his. Bob was able to upload a new
index page and some of the mail page stuff so this site was no longer crippled. And
at that point email failed: I could get Earthlink email, but all attempts
to get mail from jerrypournelle.com were rejected. Password rejected. Now
I could reach neither site nor email at pair. At that point
I had a panic attack. Column time. Much email due. Many lines of inquiry
out, and replies needed. And my site is dead and worse my main email
address is dead. At this point I made a major mistake: I
sent PAIR.COM a second panic message describing my symptoms: and I sent it
from my normal Outlook accounts, which means that the return address on
that message was from me at jerrypournelle.com, although I included in the
body of the message that replies should be sent to me AT EARTHLINK.NET
rather than to jerrypournelle.com. And, intermittently, I was able to log
on to the jerrypournelle mail site, then the password would be rejected
again. I thought this a server problem. It wasn't. It was a net problem. I
sent messages to friends at Earthlink. They reported there was nothing
wrong with Earthlink, but there were problems on the net; just what
problems they didn't know. Pair looked at their own site
and concluded that nothing was wrong. And a Pair technician, thinking my
password had been scrambled changed the password and sent me a message to
that effect. THAT MESSAGE GOT THROUGH because it was sent to Earthlink.net. Thompson
and I concluded that the problem must have been that they changed the
password, and that was why I could not log on to my site, and he used that
new password to change the password back to what it had been. That worked.
We got, for a few minutes, full access to jerrypournelle.com and about 25
messages downloaded. Then the progressive collapse of the
entire net hit, and once again I could not access my mail or my site with
any password. I sent a message to Pair, once again using the Outlook
account that uses jerrypournelle.com as the return address. And
at 1300 my time Pair once again changed the password (I had not asked them
to; they concluded it was scrambled by Outlook, and I could have told them
that was not the case because ws_ftp was having the same problem) -- and
sent the net password to me at jerrypournelle.com, that is, to an account
that could now be accessed only through that password. And promptly
began to ignore my increasingly panicked messages that I wasn't getting my
mail. And of course Thompson couldn't access my mail or my
site either, because he did not have the new password. This
went on for four hours. I then realized that all my messages to Pair (all
of which with few exceptions had a return address to jerrypournelle.com
but contained in the body of the message the earthlink.net and ibm mail
addresses I keep) would have the jerrypournelle.com return address so I
would not be seeing automatic replies. Could they be sending real as well
as automatic replies to me at jerrypournelle.com, not having cottoned on to
the fact that they'd changed the password so I could not access the
account? Of course they could be. They were. Probably
compounded by a shift change so the new duty officers wouldn't be familiar
with what had gone before. I went into Outlook and changed
the default to the Earthlink account so that return addresses would be to
me at Earthlink. I also described the symptoms, that from 1300 my time on
I was unable to access anything, and that Thompson on the other side of
the country couldn't either, and therefore this must be a Pair.com server
problem. At that point someone at pair changed my password once again, but
this time sent the new password to me at earthlink.net. I fed that new
password to my mail and site access accounts, and lo! all was well,
because by now it was about 7:30 PM my time and all the problems with the
net itself were long over. Some 95 mail messages downloaded including the
last stuff I needed to finish the column. I finished the column and sent
it to Istanbul and Tokyo and points north south east and west, published
my site, and went to bed. There are lessons to be learned
here, and not just by me. There's not a lot of fault to be found. Lesson
one: have more than one access method to the net; this is for diagnosis as
much as for reliability. We didn't know if the problem was Earthlink,
Pair, or the net itself, and with the tools available to a normal user you
can't find out. Neither did the troubleshooters at Earthlink and at Pair
although at Earthlink at least they did some traces and concluded
there was net-wide difficulty. Lesson Two: error
messages are not reliable information. Your password may be rejected for
reasons having nothing to do with your password or the server that hosts
the account. Lesson Three: the critical need detector in
the net works fine. None of this would have been much of a problem if this
were not Column Day. A better way to say this is, Don't Panic: it seldom
does any good, and often it spooks the people trying to help you (such as
the troops at Pair.com) and that can generate a self-propagating chain of
errors. Let me conclude by saying that Pair and Earthlink
have some things to learn from this, but they are not obvious lessons, and
I am in no way berating them for not already having learned them. Attacks
on the net that cause such long delays that logins to passworded accounts
fail are not going to happen every day. It's no criticism that they didn't
have the right contingency plans. And all is well that ends
well...
I saw 60 Minutes Sunday night and had considerable
sympathy for the CIA analyst who claimed to have been fired capriciously.
Now comes this: 2158: AP. An agency memo said a Jewish
attorney who says the CIA fired him because of anti-Semitism within the
agency failed two lie-detector tests about whether he gave or sold US
secrets "to an Israeli national." Adam Ciralsky, 28, of
Milwaukee, joined the spy agency in December 1996 as a contract employee
in the Office of General Counsel. By the following October, Ciralsky had
been placed on unpaid leave. His top-secret security clearance was revoked
in July 1998, and he was fired in late 1999. Ciralsky was airing his
complaints against the agency Sunday night on CBS' "60 Minutes."
The agency said it acted against Ciralsky because he did not fully reveal
a relationship with two people holding dual US- Israeli citizenship, both
employees of Israeli defense firms with possible ties to Israeli
intelligence. Bill Harlow, CIA public affairs director, disputed
Ciralsky's allegations of anti-Semitism. He said the allegations had been
reviewed by the agency's inspector general, by several congressional
panels and by a citizens' review group. The memorandum about Ciralsky's
case, first reported by The Washington Post, was written by Alan Wade, the
CIA's associate deputy director for security. The memo said Ciralsky
failed two polygraph examinations. The questions he was asked, Wade wrote,
were about "deliberately compromising US government classified
information to an Israeli national, accepting compensation from an Israeli
national in exchange for US government classified information, and
deliberately concealing from the US government a relationship with an
Israeli national." The CIA's Harlow refused to discuss the memo. He
said the agency had been willing to publicly discuss details of Ciralsky's
case, but that his lawyers had blocked them from doing so by invoking the
Privacy Act.
TOP |
CLICK HERE for
a Special Request. 
