Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I'm so tired of shoe and watch spam.

Wes
--
"Additionally as a security officer, I carry a gun to protect
government officials but my life isn't worth protecting at home
in their eyes." Dick Anthony Heller

Wes wrote:
Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I'm so tired of shoe and watch spam.

Wes
--
"Additionally as a security officer, I carry a gun to protect
government officials but my life isn't worth protecting at home
in their eyes." Dick Anthony Heller


Wholesale
Jewelry
Fake (gets a lot of it)
Watch
Wholesale (gets a lot more)
Cheap (I think that got the last of it)

Oh, and..

Hawk
Cliff

On 2008-04-03, Wes wrote:
Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I killfile googlegroups and I am very happy about it. Ditto to what
you said. I had to un-killfile a few people, and after that I am very
happy.

i

On Apr 3, 12:18 pm, Wes wrote:
Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I'm so tired of shoe and watch spam.

Wes
--
"Additionally as a security officer, I carry a gun to protect
government officials but my life isn't worth protecting at home
in their eyes." Dick Anthony Heller

I use Google groups and email. Their email spam blocker works really
well. I post with my email address in the clear here and only about
onespam mail gets past the filter each week. I don''t understand why
they don't use it on the newsgroups.
Karl

On Thu, 03 Apr 2008 18:18:19 -0400, with neither quill nor qualm, Wes
quickly quoth:

Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I'm so tired of shoe and watch spam.

No kidding. I hate the fact that I have to -save- a copy of the
message I wanted filtered in Agent. (Are you fracking listening,
Forte? Give us better filtering, damnit!)

BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

--
Never tell people how to do things. Tell them what
to do and they will surprise you with their ingenuity.
-- George S. Patton

On Apr 4, 7:37*am, " wrote:

I use Google groups and email. Their email spam blocker works really
well. I post with my email address in the clear here and only about
onespam mail gets past the filter each week. I don''t understand why
they don't use it on the newsgroups.
Karl

Same here. Only 2 reached the inbox in the last month, though there
may be 10-15 per day in the spam can. I have a 19" monitor set to
1280x1024 and can see enough threads at a time to visually filter out
the spammers and whiners and pick the few good posts worth reading.
Often the new postings fit on one page.

Jim Wilkins

On 2008-04-04, Larry Jaques novalidaddress@di wrote:
On Thu, 03 Apr 2008 18:18:19 -0400, with neither quill nor qualm, Wes
quickly quoth:

[ ... ]

I'm so tired of shoe and watch spam.

No kidding. I hate the fact that I have to -save- a copy of the
message I wanted filtered in Agent. (Are you fracking listening,
Forte? Give us better filtering, damnit!)

BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?
It took a while to get all of the Chinese news sources killfiled, but I
do now, and don't see anything from those sources. Same for Korea, and
India. I didn't bother marking each entry as to where it was, so I
can't just give you a list of the ones which apply to China for example.
I do have 184 lines of NNTP-Posting-Host entries. Here is an example
from China:

NNTP-Posting-Host: 121\.[8-9]\.
NNTP-Posting-Host: 121\.1[0-5]\.

which kills off IPs ranging from 121.8.0.0 through 121.15.255.255
all assigned to CHINANET-GD (CHINANET Guangdong province network) from
China Telecom.

In front of each line is:

================================================== ====================
[rec.crafts.metalworking]
Sco =-9999
================================================== ====================

The syntax for these is for the slrn scorefile.

Enjoy,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:

On 2008-04-04, Larry Jaques novalidaddress@di wrote:
BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?

Newp. Forte gives us filtering for subject or author only. there's a
whole scripting language for it, so it's pretty complex, but it won't
filter for message text or other headers. That sucks.

--
Never tell people how to do things. Tell them what
to do and they will surprise you with their ingenuity.
-- George S. Patton

Larry Jaques wrote:

On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:


On 2008-04-04, Larry Jaques novalidaddress@di wrote:

BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?


Newp. Forte gives us filtering for subject or author only. there's a
whole scripting language for it, so it's pretty complex, but it won't
filter for message text or other headers. That sucks.

--
Never tell people how to do things. Tell them what
to do and they will surprise you with their ingenuity.
-- George S. Patton


Mozilla has a "Sender" option - which took Don's NNTP numbers -
and syntax - and seems to be working (!)

Thanks Don!


Try sticking those numbers in the Author field?
Or get the ones from one of the headers, if your agen doesn't like
the range syntax?


Richard
--
(remove the X to email)

Now just why the HELL do I have to press 1 for English?
John Wayne

On Fri, 04 Apr 2008 19:46:39 -0700, Larry Jaques
wrote:

On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:

On 2008-04-04, Larry Jaques novalidaddress@di wrote:
BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?

Newp. Forte gives us filtering for subject or author only. there's a
whole scripting language for it, so it's pretty complex, but it won't
filter for message text or other headers. That sucks.

This regexp/filter (works in older Forte) will knock out a
bunch of them:

Author: {.*sales.*|.*handbags.*|.*sneakers.*|.*jewelry.*|. *shoes.*|.*wholesale.*|.*watches.*}

Remove the first "" symbol and add it to the Usenet
Filters. Your choice if you want it to "delete" or just
"mark as read". The latter is a nice choice if you're not
too sure it will work as expected. You can always change
that part later.

It is filtering on these words in an author's email address,
so I don't think it will knock out too many regular posters
(shrug).

--
Leon Fisk
Grand Rapids MI/Zone 5b
Remove no.spam for email

Leon Fisk wrote:

On Fri, 04 Apr 2008 19:46:39 -0700, Larry Jaques
wrote:


On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:


On 2008-04-04, Larry Jaques novalidaddress@di wrote:

BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?

Newp. Forte gives us filtering for subject or author only. there's a
whole scripting language for it, so it's pretty complex, but it won't
filter for message text or other headers. That sucks.


This regexp/filter (works in older Forte) will knock out a
bunch of them:


Author: {.*sales.*|.*handbags.*|.*sneakers.*|.*jewelry.*|. *shoes.*|.*wholesale.*|.*watches.*}


Remove the first "" symbol and add it to the Usenet
Filters. Your choice if you want it to "delete" or just
"mark as read". The latter is a nice choice if you're not
too sure it will work as expected. You can always change
that part later.

It is filtering on these words in an author's email address,
so I don't think it will knock out too many regular posters
(shrug).


I haven't seen a single one since adding DoN's advice to my filters.

DoN, you da man!

Richard
--
(remove the X to email)

Now just why the HELL do I have to press 1 for English?
John Wayne

On 2008-04-05, cavelamb himself wrote:
Leon Fisk wrote:

On Fri, 04 Apr 2008 19:46:39 -0700, Larry Jaques
wrote:


On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:

[ ... ]

Can't you filter on the "NNTP-Posting-Host: " header filters?

[ ... ]

I haven't seen a single one since adding DoN's advice to my filters.

DoN, you da man!

Note that I only gave a single sample of an IP range, and you'll
have to add a lot more to get them all. I seem to have all of the IP
ranges which they are currently using covered, but more may pop up and
then I'll have to add more myself.

Assuming you understand REs (Regular Expressions), you'll
typically need to first use some variant of whois to expand the IPs in
the latest spam to as large a range as you can get and stay within the
same country, and then craft several lines of REs to cover the whole
range. A pity it can't accept one of the common IP range formats, such
as:

range: 10.0.0.0 - 10.255.255.255
netmask: 10.0.0.0/255.0.0.0
CIDR: 10.0.0.0/8

any one of which is more compact than then cluster of needed REs, unless
you are lucky. (The example which I gave could be handled by:

NNTP-Posting-Host: 10\.

(but don't use that -- it is unlikely to block anything useful -- just
internal addresses behind a firewall. :-)

Something like 10.240.0.0 - 10.255.0.0 is fairly easy:

NNTP-Posting-Host: 10\.2[45][0-9]\.

because the numbers don't go any higher than 255, so the fact that this
would also block 10.259.23.224 doesn't matter because that is an illegal
address anyway.

Something like 10.0.0.0 - 10.127.255.255 requires a bit more
work:

NNTP-Posting-Host: 10\.[1-9]\. Single digit only

NNTP-Posting-Host: 10\.[1-9][0-9]\. Two digit only

NNTP-Posting-Host: 10\.1[0-1][0-9]\. Most of the three-digits

NNTP-Posting-Host: 10\.12[0-7]\. The last eight while
avoiding blocking 128 * 129

My apologies if you already know how to look up IP ranges and
use REs, but then this might help someone else -- if it does not scare
them off. :-)

There are currently 185 lines in my slrnScore file specifying
NNTP-Posting-Host: entries.

Good Luck,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

On Sat, 05 Apr 2008 14:05:44 -0400, with neither quill nor qualm, Leon
Fisk quickly quoth:

On Fri, 04 Apr 2008 19:46:39 -0700, Larry Jaques
wrote:

On 4 Apr 2008 23:22:35 GMT, with neither quill nor qualm, "DoN.
Nichols" quickly quoth:

On 2008-04-04, Larry Jaques novalidaddress@di wrote:
BUT, I just saved all the shoe and watch spams in order to put a kill
filter on them. deep sigh

Can't you filter on the "NNTP-Posting-Host: " header filters?

Newp. Forte gives us filtering for subject or author only. there's a
whole scripting language for it, so it's pretty complex, but it won't
filter for message text or other headers. That sucks.

This regexp/filter (works in older Forte) will knock out a
bunch of them:

Author: {.*sales.*|.*handbags.*|.*sneakers.*|.*jewelry.*|. *shoes.*|.*wholesale.*|.*watches.*}

Remove the first "" symbol and add it to the Usenet
Filters. Your choice if you want it to "delete" or just
"mark as read". The latter is a nice choice if you're not
too sure it will work as expected. You can always change
that part later.

Thanks, Leon. I've added it and will give it a try.


It is filtering on these words in an author's email address,
so I don't think it will knock out too many regular posters
(shrug).

Agreed.

--
Never tell people how to do things. Tell them what
to do and they will surprise you with their ingenuity.
-- George S. Patton

The standard way to killfile googlegroups is by Message-ID.

i

On 2008-04-06, Steve Ackman wrote:
In , on 5 Apr 2008 23:31:38
GMT, DoN. Nichols, wrote:

Note that I only gave a single sample of an IP range, and you'll
have to add a lot more to get them all. I seem to have all of the IP
ranges which they are currently using covered, but more may pop up and
then I'll have to add more myself.

The spammer IP addresses do change over periods of
years or so, as different IP blocks get bought and sold,
policies change, etc.
I date my /etc/mail/sendmail/access entries, and every
once in a while I comment out any that are older than
two or three years old. Actually, it's surprising how
many don't need uncommenting again.

Along those lines, I just wiped my slrn IP based
rules, and am starting from scratch using leafnode to
filter IPs (leaving fewer than a dozen (non-IP) filters
for slrn).

So if anyone wants the ones I've seen during the
last 36 hours or so:

# ----- IP Block Section -----
# ----- China
^NNTP-Posting-Host: 58\.22
^NNTP-Posting-Host: 58\.62
^NNTP-Posting-Host: 59\.3[2-9]
^NNTP-Posting-Host: 59\.4[0-2]
^NNTP-Posting-Host: 59\.58
^NNTP-Posting-Host: 117\.26
^NNTP-Posting-Host: 121\.1[0-5]\.
^NNTP-Posting-Host: 125\.78
^NNTP-Posting-Host: 211\.81
^NNTP-Posting-Host: 218\.19
^NNTP-Posting-Host: 219\.136

# ----- India
^NNTP-Posting-Host: 117\.97
^NNTP-Posting-Host: 122\.169\.145
^NNTP-Posting-Host: 221\.134\.225

# ----- Malaysia
^NNTP-Posting-Host: 60\.54

# ----- Brazil
^NNTP-Posting-Host: 201\.7[89]

# ----- Turkey
^NNTP-Posting-Host: 88\.253


There are currently 185 lines in my slrnScore file specifying
NNTP-Posting-Host: entries.

I wonder how many it takes before you start to notice
slrn slowing down.

In article , wrote:
In , on Sat, 05 Apr 2008
22:11:05 -0500, Ignoramus14041, lid wrote:
The standard way to killfile googlegroups is by Message-ID.

I don't necessarily want to killfile all googlegroups
posts. I only want to killfile spammers.

Killfiling *all* traffic that originates at Google Groups may be the only hope
of persuading Google to accept responsibility for the sewage that they allow
to be spewed into Usenet, and finally do something to stop it.

--
Regards,
Doug Miller (alphageek at milmac dot com)

It's time to throw all their damned tea in the harbor again.

On Sun, 06 Apr 2008, (Doug Miller) wrote:
wrote:
on Sat, 05 Apr 2008, Ignoramus14041 wrote:

The standard way to killfile googlegroups is by Message-ID.

I don't necessarily want to killfile all googlegroups
posts. I only want to killfile spammers.

Killfiling *all* traffic that originates at Google Groups may be the only hope
of persuading Google to accept responsibility for the sewage that they allow
to be spewed into Usenet, and finally do something to stop it.

Gee, I wonder who *their* upstream provider is? Maybe we can get
Google Groups' connectivity (at least sending) blackholed for TOS/AUP?

Just the threat (coming from said provider) should finally get their
attention on this matter - Stranger things have happened...

-- Bruce --

" wrote:

On Apr 3, 12:18 pm, Wes wrote:
Since forte started getting it's resold feed from easynews instead of
supernews, I'm seeing massive amounts of spam. Generally from google.

Wtf is google thinking? They bought the dejanews usenet archives years ago
and now they seem to be the vehicle for killing off usenet since they do
squat about filtering spam from their end if I'm reading the headers
correctly.

I'm thinking about filtering google out of the satistics and wonder if there
are regulars that only post from Google that I'd be eliminating?

I'm so tired of shoe and watch spam.

Wes


--
"Additionally as a security officer, I carry a gun to protect
government officials but my life isn't worth protecting at home
in their eyes." Dick Anthony Heller

I use Google groups and email. Their email spam blocker works really
well. I post with my email address in the clear here and only about
onespam mail gets past the filter each week. I don''t understand why
they don't use it on the newsgroups.
Karl

Karl,
Could you post a test post to r.c.m. I've got two news readers set up atm.
One using filtering and the other seeing everything. I want to make sure my
rule to keep you is working.

Wes

Jim Wilkins wrote:

On Apr 4, 7:37*am, " wrote:

I use Google groups and email. Their email spam blocker works really
well. I post with my email address in the clear here and only about
onespam mail gets past the filter each week. I don''t understand why
they don't use it on the newsgroups.
Karl

Same here. Only 2 reached the inbox in the last month, though there
may be 10-15 per day in the spam can. I have a 19" monitor set to
1280x1024 and can see enough threads at a time to visually filter out
the spammers and whiners and pick the few good posts worth reading.
Often the new postings fit on one page.

Jim Wilkins

Jim,

I'm filtering out googlegroups but I set a rule based on your from: so
please post a message to r.c.m. so I can see if my rule is keeping you.

Thanks,

Wes