FTC meeting. April 15, 2014

1. Michael Connolly organized us for a surprise greeting as part of a “tribute” for Rita Owens. Thank you Rita from the FTCs. But do not tell anyone(?).

2. Google Mail. ITS notes – Heartbleed vulnerability – “over flow attack” - servers can be spoofed to provide more data than a request seems to seek. Some concern that this vulnerability has been possible for the last two years. Open SSL servers are the vulnerable ones – banks do not use it. BC is now protected – patches in place.

Question from new member George Weiner (CSOM) – question about certificate revocations as a remedy. Scott answers that there is not widespread agreement about what to do. This has been going on so long that a sudden change will cause chaos – round the clock concern of ITS. Scott – recommends being sure to follow recommendations for security updates. Tell colleagues to be extra cautious about phishing - ironically, remedies for this (and also our facuty transition to Google) open individuals up to fake requests (phishing). Changing passwords is an option; but this will not be a remedy; compromise of individual passwords likely low. Open SSL vulnerability was present in the software from the start – that this was not caught by security experts is a true shock. Constant vigilance.

George Weiner again – programmer error not to have caught the “Meg” request for Meg plus more-than-Meg.

3. Scare #2 – The article Joe Burdo mentioned at the last meeting of FTCs. Gmail issue at U of Illinois Chicago. Spam attack that caused “blacklisting” of the .edu domain. BC differs – students do not have forwarding any longer - all BC students stay within the umbrella. Five years ago AOL or Yahoo blacklisted us; so now we have automation for a large volume of outflowing spam; Our relationship to Google seems good; UIC episode included their claim that there was no one to call at Google. Underscores possible problems with an outsourced email/cloud service.

Supporting example: Kit Baum – BC has been having problems with Federal Reserve because Feds use a private contractor for blacklisting. Scott - .govs are very suspicious of .edu. Blacklisting could/would happen with any email client they might have used. Google has not offered information – do not reply to newsy items generally.

4. Google Apps for Education. ITS has now move. Scott Cann reports process “mostly good”. There has also been good feedback from early adopters about recommendations for Clients. At first ITS was “religious” about Google Chrome, but this has been dialed back. Some of the feedback (pushback against requiring Chrome use – is the class action lawsuit being developed against Google for data mining; Google’s answer is that “data mining” has to do with procedures for “scraping” data to improve service. The lawsuit is based on possible violations of COPA and FERPA because Google does not provide a way to disable data mining – Google has now committed to trying to be more specific and targeted. They are responding to a judge’s judgment that there was no basis for class action, but some basis for concerns about “scraping”. We are not directly affected with Google because we have a non-advert clause. “Ghostery” (Michael Connolly) software can be installed to let you know who is “scraping” data where and for what. The software allows this to be blocked on a site by site basis. “Weboftrust” is a second option. Or “Noscript” (Firefox). Or try from Barry Schaudt – “adblockplus” from Firefox. ITS asked to develop a webpage with a list of useful software. George Weiner – classroom situations can arise when an ad precedes what you wish to show, forcing you to allow the ad..

George Weiner – brought his colleagues query about the process of transitioning to Google For Education. Scott Cann – workshops in preparation and ITS will come to particular departments at their request . Individual faculty can be trained to develop department-related materials. One particular sticking point: The structure of old emails from earlier clients .

5. VPN. BC infrastructure is outdated and needs replacement. BC VPN was embedded and now will require a client. Current users are being notified. Kit Baum – migrated two machines to VPN – message from Barbara Mento of library that moving through Library to jump to an off campus vendor will not be possible. May be an issue for those using various databases. Michael Connolly – grad students off campus are heavy users. Now necessary to use the Library Proxy. Scott – PPTP (tunnel) replaced by “secure socket” (SSL); only bc.edu data goes across this; Netflix traffic will not go through this pipeline. Leaving VPN live is no longer a danger of overwhelming a pipeline. Sisco VPN client – bc.edu/vpn. Also see APPENDIX below on the library use question.

6. Christina Roy on Canvas. Summer courses already established. Canvas instructors can publish on their own. IDes will proactively create a Canvas course for all listed courses before faculty requests; in two weeks all fall classes will have been created. There is a portal directly to Canvas (short term) owing to a lag in the main portal course link. Folks interested for the fall can come to the workshops. Canvas courses will be featured at spring meeting (Technology Day). Only published courses will be populated; no courses that do not use Canvas will be visible in Canvas contexts.

6a. Syllabus question – Canvas is not set up for printing syllabuses from the LMS. Departments that still want paper docs or paper doc formats have nothing to go to in Canvas. IDes has requested installation of a possible print button. George Weiner on printing syllabus page – syllabus can just be printed, but appearance will suffer. Users can “troll” feature requests and Canvas notes the “likes” count for features, if functions such as this are needed by large numbers of faculty.

May meeting will include goodies/prizes.

APPENDIX:

Letter to faculty from Adeane Bregman, O’Neill Library

Recently, BC Information Technology Services sent an email to users of BC VPN (Virtual Private Network) indicating that the university is adopting a new, more secure and better supported VPN Software client called Cisco AnyConnect . The message also indicated that the old BC VPN service will be discontinued on July 1, 2014.

If you use VPN to access Online Library resources, for example, JSTOR, ARTstor, EBSCO, ProQuest, from off campus, the new Cisco AnyConnect client (also known as Eagle VPN) will not allow you to seamlessly access restricted library materials from off-campus unless you use a library supplied EZProxy link.

There are several ways you can be sure you are using an EZProxy link when you are off campus:

a.)   Link to Library Resources from the BC Library Web sites. All links to online databases, e-journals and other e-resources from BC Library Web Sites already use EZProxy links.

b.)   You can Search for the database/resource you want to access in the Holmes Library Catalog (http://www.bc.edu/holmes) or in the Online Databases System (http://databases.bc.edu/V?func=find-db-1&mode=title ) and link to it from the search results. These links already use EZProxy.

You can find more detailed information about accessing library resources here:  http://libguides.bc.edu/remote