4 ms·

Aren’t most accounts site licenses? I assume it’s like a raspberry pi running on a university library network somewhere

by eli 7y ago

lolc 7y ago
You mean you don't have to login to use the journal? That authentication is done by IP-Address? Possible, I don't know how they implement access-controls. Sounds like a fun way to piss of universities who pay for access: Block their gateway!
- grenoire 7y ago
  That will get the university network account you use blocked, if anything. The journals know which blocks are used by the registered institutions; oftentimes being on the campus network will tunnel you directly, and off-campus you'll be using your personal account to access whatever index there is.
- matwood 7y ago
  > You mean you don't have to login to use the journal? That authentication is done by IP-Address? Depends on the journal/resource. Many resources purchased by universities are authenticated by IP. It's less friction for students when trying to access something, and provides psuedo-anonymity. There is some push to move to something like OpenAthens for all authentication/authorization, but universities do not want to lose the privacy aspect for their students.
  - cybert00th 7y ago
    > There is some push to move to something like OpenAthens for all authentication/authorization Or shibboleth - we treat shib as a gateway to our auth service at this here journal publishing salt mine. Seems to work well enough - at least, the roof doesn't fall in on us when an IDP entity (federation of universities, et al) goes offline denying their collective users access. A "have you switched it off and on again" message to the federations IT bods usually works.
    - Spivak 7y ago
      Ugh Shibboleth, the greatest SSO system if anyone, including the original developer who wrote it, could figure out how to configure it properly. I've always wondered how it ended up catching on in seemingly exclusively academia.
      - quotemstr 7y ago
        > I've always wondered how it ended up catching on in seemingly exclusively academia I'm guessing in part it's the name, which ordinary people probably find hard to remember, spell, and pronounce. (The original shibboleth "shibboleth" was meant to be hard to pronounce!)
      - QIjwnVohaNycJ2 7y ago
        > including the original developer who wrote it, could figure out how to configure it properly Oh, Scott knows how to configure it, the problem is he's the only one. I'm a developer at the university works/created it at, and anything that needs to use shibb goes through him. Fortunately, he manages all the configuration (I'm assuming because no one else here knows how), requesting shibb for a new site or whatever is dreaded. It's almost a rite of passage for devs to get a scathing email back from him (almost always in less that 5 minutes) because your request wasn't filled out correctly, the worst part is he will only tell you what you screwed up and not give much help (or any) as to how fix it, and then indirectly (or I've heard directly too) to not waste his time. As a user, shibb isn't really that bad. As a developer, I hate it so much. Scott, from what I can tell, is a strictly Java developer. So that means we're stuck with Apache and a shitload of XML, there exists a module on GitHub to integrate shibb with Nginx which I think literally every dev here I've talked to would love to be using rather than Apache, but that's probably not going to happen here unfortunately. And Apache with all the XML crap wouldn't be all that terrible if the documentation wasn't extremely vague or just plain missing. I wanted to get some extra information about the user on signin that, according to the docs, would be available but wasn't clear enough that I felt I could just go in to even our staging servers and monkey around with. So, I figured I throw together some docker containers tinker with before I did it on anything real. It took me an entire week, to get a working shibb setup in docker since the docs literally only got me as far as getting things installed before they stopped being helpful. But, I'm now the only one in my department (at least) that knows how to get shibb up from scratch -- but I wouldn't trust it outside development. Apologies for the rant, but shibb is probably my least favorite thing I have to deal with here -- when you hear the guy that made it works here, you'd at least think we'd get some good/helpful information about it from the source, but he seems quite happy being the only one that knows anything about it.
- joshvm 7y ago
  It varies. Some paper downloads are watermarked with individual IP addresses and the connecting institution. It's not solely IP based because services like Shibboleth or OpenAthens let you log in to your institutional account and download from wherever. In that latter case, you're exposing your personal IP to the publisher and your university who validate your login, which is probably logged. For example, you can also connect to sites via eduroam globally, but your access (I think) depends on the specific location that you're piggybacking. Sometimes you can download stuff, other times you still need to login to your home institution.
- buboard 7y ago
  > That authentication is done by IP-Address I think so. most universities have well known static ips
- deftturtle 7y ago
  Yes, I’m a student at Linfield College, and our IP gets us certain journals, like Chronicle of Higher Ed, among others. No authentication required
marcosdumay 7y ago
At least here in Brazil, yes. And if somebody sells something to our government, doesn't deliver it, and even then an administrator authorizes the payment, that person is for some hell on life. I imagine things are not different on most places. This can end very badly for everybody.

Aren’t most accounts site licenses? I assume it’s like a raspberry pi running on a university library network somewhere

by eli 7y ago

Aren’t most accounts site licenses? I assume it’s like a raspberry pi running on a university library network somewhere

lolc 7y ago

You mean you don't have to login to use the journal? That authentication is done by IP-Address? Possible, I don't know how they implement access-controls. Sounds like a fun way to piss of universities who pay for access: Block their gateway!

grenoire 7y ago
That will get the university network account you use blocked, if anything. The journals know which blocks are used by the registered institutions; oftentimes being on the campus network will tunnel you directly, and off-campus you'll be using your personal account to access whatever index there is.
matwood 7y ago
> You mean you don't have to login to use the journal? That authentication is done by IP-Address? Depends on the journal/resource. Many resources purchased by universities are authenticated by IP. It's less friction for students when trying to access something, and provides psuedo-anonymity. There is some push to move to something like OpenAthens for all authentication/authorization, but universities do not want to lose the privacy aspect for their students.
- cybert00th 7y ago
  > There is some push to move to something like OpenAthens for all authentication/authorization Or shibboleth - we treat shib as a gateway to our auth service at this here journal publishing salt mine. Seems to work well enough - at least, the roof doesn't fall in on us when an IDP entity (federation of universities, et al) goes offline denying their collective users access. A "have you switched it off and on again" message to the federations IT bods usually works.
  - Spivak 7y ago
    Ugh Shibboleth, the greatest SSO system if anyone, including the original developer who wrote it, could figure out how to configure it properly. I've always wondered how it ended up catching on in seemingly exclusively academia.
    - quotemstr 7y ago
      > I've always wondered how it ended up catching on in seemingly exclusively academia I'm guessing in part it's the name, which ordinary people probably find hard to remember, spell, and pronounce. (The original shibboleth "shibboleth" was meant to be hard to pronounce!)
    - QIjwnVohaNycJ2 7y ago
      > including the original developer who wrote it, could figure out how to configure it properly Oh, Scott knows how to configure it, the problem is he's the only one. I'm a developer at the university works/created it at, and anything that needs to use shibb goes through him. Fortunately, he manages all the configuration (I'm assuming because no one else here knows how), requesting shibb for a new site or whatever is dreaded. It's almost a rite of passage for devs to get a scathing email back from him (almost always in less that 5 minutes) because your request wasn't filled out correctly, the worst part is he will only tell you what you screwed up and not give much help (or any) as to how fix it, and then indirectly (or I've heard directly too) to not waste his time. As a user, shibb isn't really that bad. As a developer, I hate it so much. Scott, from what I can tell, is a strictly Java developer. So that means we're stuck with Apache and a shitload of XML, there exists a module on GitHub to integrate shibb with Nginx which I think literally every dev here I've talked to would love to be using rather than Apache, but that's probably not going to happen here unfortunately. And Apache with all the XML crap wouldn't be all that terrible if the documentation wasn't extremely vague or just plain missing. I wanted to get some extra information about the user on signin that, according to the docs, would be available but wasn't clear enough that I felt I could just go in to even our staging servers and monkey around with. So, I figured I throw together some docker containers tinker with before I did it on anything real. It took me an entire week, to get a working shibb setup in docker since the docs literally only got me as far as getting things installed before they stopped being helpful. But, I'm now the only one in my department (at least) that knows how to get shibb up from scratch -- but I wouldn't trust it outside development. Apologies for the rant, but shibb is probably my least favorite thing I have to deal with here -- when you hear the guy that made it works here, you'd at least think we'd get some good/helpful information about it from the source, but he seems quite happy being the only one that knows anything about it.
joshvm 7y ago
It varies. Some paper downloads are watermarked with individual IP addresses and the connecting institution. It's not solely IP based because services like Shibboleth or OpenAthens let you log in to your institutional account and download from wherever. In that latter case, you're exposing your personal IP to the publisher and your university who validate your login, which is probably logged. For example, you can also connect to sites via eduroam globally, but your access (I think) depends on the specific location that you're piggybacking. Sometimes you can download stuff, other times you still need to login to your home institution.
buboard 7y ago
> That authentication is done by IP-Address I think so. most universities have well known static ips
deftturtle 7y ago
Yes, I’m a student at Linfield College, and our IP gets us certain journals, like Chronicle of Higher Ed, among others. No authentication required

marcosdumay 7y ago

At least here in Brazil, yes. And if somebody sells something to our government, doesn't deliver it, and even then an administrator authorizes the payment, that person is for some hell on life. I imagine things are not different on most places. This can end very badly for everybody.