The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.

Best Regards
Tom.

On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:

The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.

Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.

--
Every day above ground is a Good Day(tm).
-----------

Larry Jaques wrote:
On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:


The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.


Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!

Jon

According to Jon Elson :


Larry Jaques wrote:
On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:


The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.


Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!

That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.

At least the garbage has stopped here. There were only about a
hundred or so left over from last night -- which probably came via
slower paths. And I haven't seen any more after I post something (which
normally convinces my newsreader to check for new news).

Enjoy,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

DoN. Nichols wrote:
According to Jon Elson :
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!


That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.
Our University Network administrators pass a beeper around, and
somebody is always on call. They can log in and take a machine
off the outbound firewall's OK list if it goes haywire. Any
place with at least a couple hundred machines should be required
to have similar staffing. Especially with student-owned
computers on their internal net, this is going to happen every
couple days, at least.

Jon

According to Jon Elson :
DoN. Nichols wrote:
According to Jon Elson :
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!


That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.
Our University Network administrators pass a beeper around, and
somebody is always on call. They can log in and take a machine
off the outbound firewall's OK list if it goes haywire.

That would not have worked in this case. It appears that it was
a client machine (probably a Windows box) which was compromised, and
which was dumping articles into the local news server -- which took care
of transmitting them to the outside.

It would have needed someone to identify the offending machine,
and disallow it connecting to the news server -- and then flush
everything posted from it. But a lot of the stuff was already out in
the net, and would be still flowing in to everywhere else for a day or
two.

What is needed there is a limit to the number of articles per
hour that any one machine can submit to the news server.

Any
place with at least a couple hundred machines should be required
to have similar staffing. Especially with student-owned
computers on their internal net, this is going to happen every
couple days, at least.

Agreed,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

DoN. Nichols wrote:

That would not have worked in this case. It appears that it was
a client machine (probably a Windows box) which was compromised, and
which was dumping articles into the local news server -- which took care
of transmitting them to the outside.

It would have needed someone to identify the offending machine,
and disallow it connecting to the news server -- and then flush
everything posted from it. But a lot of the stuff was already out in
the net, and would be still flowing in to everywhere else for a day or
two.

What is needed there is a limit to the number of articles per
hour that any one machine can submit to the news server.



Tell me again why cross posting is a necessary thing???

According to cavelamb himself :
DoN. Nichols wrote:

[ ... ]

What is needed there is a limit to the number of articles per
hour that any one machine can submit to the news server.

[ ... ]

Tell me again why cross posting is a necessary thing???

Because it allows a *proper* newsreader to avoid showing the
same article multiple times when it is cross-posted to a collection of
properly related newsgroups (examples for us are
rec.crafts.metalworking, alt.machines.cnc, and
sci.engineering.joining.welding). It is assumed that a certain
percentage of one such newsgroup will read the others as well, and a
proper cross-posting will only show once with a proper newsreader, so
you don't get offended by seeing the same article many times.

In contrast, multi-posting does not offer this benefit.

Also -- a cross-posted article uses less disk space on the news
servers around the world. Unix filesystems allow links which tie
multiple filenames in different directories to a single file, so only
one copy needs to be stored. As it the article expires in each
newsgroup (which may have a different expire time per newsgroup), that
link is removed, and once the last link is removed, the file vanishes
from the filesystem.

The reason that unix filesystem behavior is important here is
that most news servers run on unix systems.

Yes -- this does not make much difference for a single article
in three newsgroups, but when it happens thousands of time over the
hundreds of thousands of newsgroups, it can make a significant
difference in disk space required to run the news server.

To *you* -- it probably does not make much difference -- other
than the fact that if it becomes more expensive to run news servers,
fewer companies will run them. A lot of news servers are run by
companies as a perq for their employees, and some are run by
individuals. (This is how usenet news was spread around long before the
internet became a choice.

Enjoy,
DoN.
--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

On Mon, 13 Aug 2007 22:53:15 -0700, azotic wrote:
The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:

Seems to me, that ****ing off the sysadmin whose help we need to stop
the problem is both counterproductive and destructive.