By the time I got to the discussion of NewsProxy (nfilter), I had
already deleeted all of the trash that had been posted here. Did
anyone set up a filter for that guy, and would you be willing to share
your NewsProxy settings?

I just downloaded it and got it working in fron of FreeAgent, but I
don't yet have a handle on the filter settings.

Thanks,
Ed Bailen

In article , Ed Bailen wrote:
By the time I got to the discussion of NewsProxy (nfilter), I had
already deleeted all of the trash that had been posted here. Did
anyone set up a filter for that guy,

Well, sort of. Do a Google Groups search for a post by me with the word
"TurdStorm" in the subject for more info.

and would you be willing to share your NewsProxy settings?

Absolutely. See my sig.

--
Regards,
Doug Miller (alphageek-at-milmac-dot-com)

Get a copy of my NEW AND IMPROVED TrollFilter for NewsProxy/Nfilter
by sending email to autoresponder at filterinfo-at-milmac-dot-com
You must use your REAL email address to get a response.

Download Nfilter at http://www.milmac.com/np-120.exe

On Fri, 19 May 2006 23:30:06 GMT, (Doug Miller)
wrote:

In article , Ed Bailen wrote:
By the time I got to the discussion of NewsProxy (nfilter), I had
already deleeted all of the trash that had been posted here. Did
anyone set up a filter for that guy,

Well, sort of. Do a Google Groups search for a post by me with the word
"TurdStorm" in the subject for more info.

Any idea why:

* drop lines:1

isn't working on this latest batch? I don't know why he switched to
forging it to this, it makes it easier to spot, but my filter isn't
working.

My newserver doesn't include NNTP-Posting-Host or Path in the overview
so I'm SOL. I emailed my ISP's tech support to see if they could add
it and after a few emails to get past the first line of defense to
someone who supposedly knows what they are talking about was told "we
don't control the servers" and to "email usenet". Uh huh. I'll
assume they meant they outsource it.

Is there a list someone of pay newsfeeds that do have these fields in
the overview?


-Leuf

By the time I got to the discussion of NewsProxy (nfilter), I had
already deleeted all of the trash that had been posted here. Did
anyone set up a filter for that guy,

Well, sort of. Do a Google Groups search for a post by me with the word
"TurdStorm" in the subject for more info.

Any idea why:

* drop lines:1

isn't working on this latest batch? I don't know why he switched to
forging it to this, it makes it easier to spot, but my filter isn't
working.

My newserver doesn't include NNTP-Posting-Host or Path in the overview
so I'm SOL. I emailed my ISP's tech support to see if they could add
it and after a few emails to get past the first line of defense to
someone who supposedly knows what they are talking about was told "we
don't control the servers" and to "email usenet". Uh huh. I'll
assume they meant they outsource it.

Is there a list someone of pay newsfeeds that do have these fields in
the overview?

When you say "overview" do you mean "header"? Below are two of them. You
can see that the NNTP-Posting_Host values are wildly different. But what
about that terra.com.br domain? Has anyone tried sending some of the files
to the X-Complaints-To address? Is there any reason to assume that's not
spoofed, too?

- Owen -

Path: number1.nntp.dca.giganews.com
!border1.nntp.dca.giganews.com
!nntp.giganews.com
!newsfeed00.sul.t-online.de
!t-online.de
!207.46.248.126.MISMATCH
!TK2MSFTFEEDS01.phx.gbl
!TK2MSFTNGP01.phx.gbl
!TK2MSFTNGP05.phx.gbl
!usenet.terra.com.br
!not-for-mail
Message-ID:
From: "Mike Dembroge"
Newsgroups: microsoft.public.test.here,rec.woodworking
Subject: He'll be pulling within clean Ophelia until his ball wanders
smartly.
Date: Fri, 19 May 2006 22:37:09 GMT
Lines: 1
Organization: he might promise the lost tyrant and climb it above its
satellite
X-Complaints-To:
Followup-To: rec.woodworking
NNTP-Posting-Host: anonymizer.ccc.de 80.237.206.93

Path: number1.nntp.dca.giganews.com
!border1.nntp.dca.giganews.com
!nntp.giganews.com
!newshub.sdsu.edu
!msrtrans
!TK2MSFTFEEDS01.phx.gbl
!TK2MSFTNGP01.phx.gbl
!TK2MSFTNGP02.phx.gbl
!usenet.terra.com.br
!not-for-mail
Message-ID:
From: Patriarch
Newsgroups: microsoft.public.test.here,rec.woodworking
Subject: Both irrigating now, Ricky and Rachel played the stupid lanes in
front of rude pitcher.
Date: Fri, 20 May 2006 02:52:11 GMT
Lines: 1
Organization: are you humble, I mean, cooking for hollow films
X-Complaints-To:
Followup-To: rec.woodworking
NNTP-Posting-Host: tor-proxy1.internap.com 64.74.207.50

In article , Owen Lawrence
wrote:

When you say "overview" do you mean "header"? Below are two of them. You
can see that the NNTP-Posting_Host values are wildly different. But what
about that terra.com.br domain? Has anyone tried sending some of the files
to the X-Complaints-To address? Is there any reason to assume that's not
spoofed, too?

It's safe to assume most of it's spoofed.

However, I'm able to easily filter 99% of it. If you look at the
headers you'll be able to as well.

On Fri, 19 May 2006 23:43:28 -0400, "Owen Lawrence"
wrote:

Is there a list someone of pay newsfeeds that do have these fields in
the overview?

When you say "overview" do you mean "header"?

Sort of. When you connect to the server the software first reads this
"overview database" which has just part of the header of all the
messages. This is done to reduce the load on the server. And that's
the problem, the database isn't there to allow filtering, it dates
back to a simpler time when these problems didn't exist. It's now
being used to filter on, but everything in the standard configuration
database is easily forged. So if the server isn't configured to have
that field in the overview then you can't filter on it. It seems like
usually the full header is only downloaded with the body, though just
to confuse the issue there is a provision for getting it but the
server has to allow it.

Below are two of them. You
can see that the NNTP-Posting_Host values are wildly different.

The last batch they were all the same. Now he's using anonymizers.
You can still start filtering those out. Last time they were
supposedly coming from .ar, now it's brasil. Next time it'll be
something else. Path is easy to forge, NNTP-Posting-Host is supposed
to not be, which is why he has to hide behind anonymizers.


-Leuf

The Dave Balderstone entity posted thusly:

However, I'm able to easily filter 99% of it. If you look at the
headers you'll be able to as well.

I had pretty good luck filtering out the turdstorm, and am in the
process of tuning the filters to suit me.

I changed all instances of 'drop' to "flag:[DIAGx] where x is a unique
identifier. I did this because for some reason, I missed R.H's "What
is it" post, and a few other posts I expected to see.

Now I can see which rule would have dropped a message, and decide if I
want to see them.

It's a decent little program, and Trollfilter is a GREAT start on a
filter file. I am hoping to do some mods on the code if I can get out
from under a few work-deadlines soon.

Leuf writes:

My newserver doesn't include NNTP-Posting-Host or Path in the overview
so I'm SOL.

I'm using this as the filter:

X-Complaints-To:

--
Sending unsolicited commercial e-mail to this account incurs a fee of
$500 per message, and acknowledges the legality of this contract.

I am trying to filter out the lastest batch of spam here. Using
Newsproxy and Doug's filter when I add a new filter line nothing gets
filtered out.

Here is what I added to Newproxy filter:

rec.woodworking drop Path:usenet\.terra\.com\.br

Is this right?

In article , Bill Davis Jr wrote:
I am trying to filter out the lastest batch of spam here. Using
Newsproxy and Doug's filter when I add a new filter line nothing gets
filtered out.

Here is what I added to Newproxy filter:

rec.woodworking drop Path:usenet\.terra\.com\.br

Is this right?

Yes, but -- as I've noted before -- it may not work. For more info, do a
Google Groups search on this group for a post by me, dated 15 May 2006 and
titled "Partial relief from latest turdstorm", or cut-and-paste this:

http://groups.google.com/group/rec.
woodworking/browse_thread/thread/fc6eebf4413ea518/81adbd3f25241ac8?
lnk=st&q=group%3Arec.woodworking+insubject%3Aturds torm


--
Regards,
Doug Miller (alphageek at milmac dot com)

It's time to throw all their damned tea in the harbor again.

In article ,
Leuf wrote:
On Fri, 19 May 2006 23:30:06 GMT, (Doug Miller)
wrote:

In article , Ed Bailen
wrote:
By the time I got to the discussion of NewsProxy (nfilter), I had
already deleeted all of the trash that had been posted here. Did
anyone set up a filter for that guy,

Well, sort of. Do a Google Groups search for a post by me with the word
"TurdStorm" in the subject for more info.

Any idea why:

* drop lines:1

isn't working on this latest batch? I don't know why he switched to
forging it to this, it makes it easier to spot, but my filter isn't
working.

My newserver doesn't include NNTP-Posting-Host or Path in the overview
so I'm SOL. I emailed my ISP's tech support to see if they could add
it and after a few emails to get past the first line of defense to
someone who supposedly knows what they are talking about was told "we
don't control the servers" and to "email usenet". Uh huh. I'll
assume they meant they outsource it.

Is there a list someone of pay newsfeeds that do have these fields in
the overview?

Supernews now has _every_ header available for use by filters. Thats
new with them -- it's been in place for about 2 weeks.

In article , Oleg Lego
wrote:

It's a decent little program, and Trollfilter is a GREAT start on a
filter file. I am hoping to do some mods on the code if I can get out
from under a few work-deadlines soon.

I wish there was something equivalent on the Mac platform, but
fortunately Thoth's filtering capability is pretty robust, including
RegEx.

In article , Robert Bonomi
wrote:

Supernews now has _every_ header available for use by filters. Thats
new with them -- it's been in place for about 2 weeks.

That's awesome. I didn't know that!

On Sat, 20 May 2006 08:16:59 -0600, Dave Balderstone wrote:
In article , Robert Bonomi
wrote:

Supernews now has _every_ header available for use by filters. Thats
new with them -- it's been in place for about 2 weeks.

That's awesome. I didn't know that!

Yeah, its interesting. My newsreader (slrn) reports "retrieving additional
headers" when filters are active, as in this group. Its also WAY slower than
just using the default set of headers.

--
Art

In article , Art Greenberg
wrote:

Yeah, its interesting. My newsreader (slrn) reports "retrieving additional
headers" when filters are active, as in this group. Its also WAY slower than
just using the default set of headers.

I don't mind slower for better filtering. I did notice a bot of a
slowdown on Supernews a while back, but it's measured in seconds.

In article , -
bonomi.com says...
In article ,
Leuf wrote:

Is there a list someone of pay newsfeeds that do have these fields in
the overview?

Supernews now has _every_ header available for use by filters. Thats
new with them -- it's been in place for about 2 weeks.

Very cool -- now is there someone here who has both a Supernews account,
*and* a copy of Nfilter installed, who can confirm the ability to filter
these gibberish posts on Path and/or NNTP-Posting-Host?

On Sun, 21 May 2006 19:17:57 GMT, Doug Miller wrote:
Very cool -- now is there someone here who has both a Supernews account,
*and* a copy of Nfilter installed, who can confirm the ability to filter
these gibberish posts on Path and/or NNTP-Posting-Host?

I can conduct experiments. I'll have to "un-catch-up" on the group first. I'm
using NNTP-Posting-Host in slrn directly, and its working fine. I haven't seen
one of those posts in a few days now.

I'll give it a go tomorrow morning, and report my findings here. But last time
I tried it, it failed. That's why I'm filtering with slrn's facilities now.

--
Art Greenberg
artg at eclipse remove-this dot net

In article ,
Doug Miller wrote:
In article , -
bonomi.com says...
In article ,
Leuf wrote:

Is there a list someone of pay newsfeeds that do have these fields in
the overview?

Supernews now has _every_ header available for use by filters. Thats
new with them -- it's been in place for about 2 weeks.

Very cool -- now is there someone here who has both a Supernews account,
*and* a copy of Nfilter installed, who can confirm the ability to filter
these gibberish posts on Path and/or NNTP-Posting-Host?

From examining the nFilter source-code and having confirmed what Supernews
_now_ does for various NNTP commands, I can state it _should_ work just
fine. 'trn' killfiles _do_ work on the gubbage, using the Path header.
Can't test from Windows, only my unix server lives in the right address-space.

On Mon, 22 May 2006 15:06:16 -0000, Robert Bonomi wrote:

From examining the nFilter source-code and having confirmed what Supernews
_now_ does for various NNTP commands, I can state it _should_ work just
fine. 'trn' killfiles _do_ work on the gubbage, using the Path header.
Can't test from Windows, only my unix server lives in the right
address-space.

No joy, yet. I've configured slrn to connect to "localhost", and I have
nfilter running with Doug's filter file. slrn does authenticate properly, and
I can get the list of groups OK. But it seems to take forever to get the
initial article list from any group (forever as in nothing after 3 hours, so I
killed it). I _know_ I had that much working before, it just didn't filter at
all. I'll report back later if I can get this working. I'm _sure_ its
something really dumb that I've got wrong.

--
Art Greenberg
artg at eclipse dot net

Art Greenberg wrote:
On Mon, 22 May 2006 15:06:16 -0000, Robert Bonomi wrote:

From examining the nFilter source-code and having confirmed what Supernews
_now_ does for various NNTP commands, I can state it _should_ work just
fine. 'trn' killfiles _do_ work on the gubbage, using the Path header.
Can't test from Windows, only my unix server lives in the right
address-space.

No joy, yet. I've configured slrn to connect to "localhost", and I have
nfilter running with Doug's filter file. slrn does authenticate properly, and
I can get the list of groups OK. But it seems to take forever to get the
initial article list from any group (forever as in nothing after 3 hours, so I
killed it). I _know_ I had that much working before, it just didn't filter at
all. I'll report back later if I can get this working. I'm _sure_ its
something really dumb that I've got wrong.


Telling your newsreader to look to localhost is only half if the project. That
tells your newsreader to look to NetProxy for any messages. Now you have to
tell NetProxy itself where to download them so it can begin filtering for you.

Open NetProxy. Click on Edit Configuration Network. Make sure the proper
news server is listed on the page, ie, "news-server.carolina.rr.com".

Let us know if that corrected things for you or do we need to go to Plan B?



--
Mortimer Schnerd, RN

VE

On Mon, 22 May 2006 15:25:12 GMT, Mortimer Schnerd, RN wrote:
Telling your newsreader to look to localhost is only half if the project. That
tells your newsreader to look to NetProxy for any messages. Now you have to
tell NetProxy itself where to download them so it can begin filtering for you.

Open NetProxy. Click on Edit Configuration Network. Make sure the proper
news server is listed on the page, ie, "news-server.carolina.rr.com".

Let us know if that corrected things for you or do we need to go to Plan B?

Thanks.

I had that done ... just didn't mention it explicitly. If I hadn't done that,
I'd have not been able to authenticate to the server and get the list of
groups.

I do think I have a lead. I told slrn to "catch up", so there are no headers
to download. Then I told it to read all available headers. Its working, but
going _very_ slowly. As in just a couple hundred headers per minute. With many
thousand available, that is going to take hours.

On groups where I have no filters specified, it goes *much* faster. It would
probably go faster if I were only filtering on the header rows that Supernews
supplies by default.

So, it seems to be working. I just need to wait a long while to see if the
filtering actually works.

--
Art Greenberg
artg at eclipse dot net

On Mon, 22 May 2006 15:58:14 -0000, Art Greenberg wrote:

So, it seems to be working. I just need to wait a long while to see if the
filtering actually works.

Well, no, it doesn't look like its working. Posts about odiferous male
privates are getting through, in spite of the explicit filtering instructions
in nfilter. I tried several forms of the instructions, like this:

rec.woodworking drop NNTP-Posting-Host:200\.84\.173\.68
rec.woodworking drop NNTP-Posting-Host:200.84.173.68
rec.woodworking drop NNTP-Posting-Host: 200.84.173.68

No joy. I saw this before, with slrn. I'm not at all familiar with NNTP, or
how nfilter works, or how slrn interacts with nfilter. So I'm unable to
speculate as to why it fails. And as I noted, this is s-l-o-w. It takes about
a minute per 200 headers.

But slrn with similar specifications in its score file _does_ filter out these
posts. And its way faster.

--
Art Greenberg
artg at eclipse dot net

On 2006-05-22, Art Greenberg ranted thusly:
On Mon, 22 May 2006 15:58:14 -0000, Art Greenberg wrote:

So, it seems to be working. I just need to wait a long while to see if the
filtering actually works.

Well, no, it doesn't look like its working. Posts about odiferous male
privates are getting through, in spite of the explicit filtering instructions
in nfilter. I tried several forms of the instructions, like this:

rec.woodworking drop NNTP-Posting-Host:200\.84\.173\.68
rec.woodworking drop NNTP-Posting-Host:200.84.173.68
rec.woodworking drop NNTP-Posting-Host: 200.84.173.68

No joy. I saw this before, with slrn. I'm not at all familiar with NNTP, or
how nfilter works, or how slrn interacts with nfilter. So I'm unable to
speculate as to why it fails. And as I noted, this is s-l-o-w. It takes about
a minute per 200 headers.

But slrn with similar specifications in its score file _does_ filter out these
posts. And its way faster.

I haven't used nfilter so can't speak to that, but I'm using slrn and
have seen similar to what you describe.

Using my filtering rules I don't see any of the stupid posts but yeah,
it seems to be slow. Watching my network activity graph I see lots of
spikes with (short) quiet periods between them.

Earlier I was also having a problem with the rules but seemed to be able
to take care of that with some minor changes to the regular expressions
used to capture the garbage.

Appending a catchall to a domain name rule, and prepending one to an IP#
seems to do the trick. For example:

[rec.woodworking]
Sco: -9999
NNTP-Posting-Host: tor-proxy1\.internap\.com .*
Expires: 7/1/2006

Sco: -9999
NNTP-Posting-Host: .* 149\.9\.0\.21
Expires: 7/1/2006

You might try something similar with nfilter.

I have additional rules for the offensive language, certain of the
crossposted mailing lists, and the argentina source, and am not sure
which ones are catching the crap...

Don't like that slrn seems slow to catchup, or that it won't keep
headers (and the threads) intact so's I can go back and review for
context... but ESC p works to get the parent of an article so I'm not
too bothered. It'd also be nice if it cached the previously read
articles for a given session, but if I whine too much someone'll tell me
to fix it myself.

er
--
email not valid

On Tue, 23 May 2006 11:08:09 -0500, Enoch Root wrote:

Don't like that slrn seems slow to catchup, or that it won't keep
headers (and the threads) intact so's I can go back and review for
context... but ESC p works to get the parent of an article so I'm not
too bothered. It'd also be nice if it cached the previously read
articles for a given session, but if I whine too much someone'll tell me
to fix it myself.

Maybe I don't understand what you're asking for here ... but you could just
score the undesireable posts with something other than the "kill" score (-9999
by default). Any negative number will do. You'd see all of the headers at
their first appearance. They will be automatically marked for deletion. You
can elect to change your mind about them on an as-needed basis at that time.

--
Art Greenberg
artg at eclipse dot net

On 2006-05-23, Art Greenberg ranted thusly:
On Tue, 23 May 2006 11:08:09 -0500, Enoch Root wrote:

Don't like that slrn seems slow to catchup, or that it won't keep
headers (and the threads) intact so's I can go back and review for
context... but ESC p works to get the parent of an article so I'm not
too bothered. It'd also be nice if it cached the previously read
articles for a given session, but if I whine too much someone'll tell me
to fix it myself.

Maybe I don't understand what you're asking for here ... but you could just
score the undesireable posts with something other than the "kill" score (-9999
by default). Any negative number will do. You'd see all of the headers at
their first appearance. They will be automatically marked for deletion. You
can elect to change your mind about them on an as-needed basis at that time.

Hi Art,

I've determined the '*' flag will keep previously read posting's headers
intact and threaded when I update the group articles. That's what I want
that I think you are responding to. Lord knows I don't want that garbage
I'm filtering out in the threads!

But I think what that does is download the headers of those read articles
anew, it doesn't keep them cached (it's a guess, though).

The score lines I included to suggest some regular expressions you might
want to apply to your filters...

And... at the risk of inciting a stalker, I will reveal some of my
own attempts at cleverness, but with some slight changes to protect the
not-so-innocent from the illiterate readers of the group.

[rec.woodworking]

Sco -100
From: g
Expires: 7/1/2006

Sco -9499
Followup-To: alt\.idiots
Expires: 7/1/2006

This allows what I think is appropriate posts. 'kanuck' still gets a
showing in the wreck (with only a warning color) unless he has jiggered
followups to lead the unwary into his favorite lurking grounds.

Before I switched to slrn I just dropped 'em all. And I might do it
again.

CAVEAT: I don't know if that works yet... just set it up. I'm also
inclined to think that slrn may be downloading extra headers that it
normally wouldn't if it is getting a big slowdown while checking for new
posts. I guess I could use a sniffer to check that...

er
--
email not valid

On Tue, 23 May 2006 14:33:13 -0500, Enoch Root wrote:
But I think what that does is download the headers of those read articles
anew, it doesn't keep them cached (it's a guess, though).

slrn doesn't cache anything. Look at the "jnews.rc" file, which is where it
keeps track of available groups and headers that have been read. It basically
just keeps a list of previously read message numbers there. I've been messing
with that file in order to test filters.

The score lines I included to suggest some regular expressions you might
want to apply to your filters...

Thanks for all of the suggestions!

I'm also inclined to think that slrn may be downloading extra headers that
it normally wouldn't if it is getting a big slowdown while checking for new
posts. I guess I could use a sniffer to check that...

Indeed, that's what it does, _if_ those headers are available. AFAIK, if you
specify a header that is not part of the default set provided by the news
server, it tries to fetch it, but it doesn't tell you if it isn't there.
That can cause downloading headers to be very, very slow indeed.

--
Art Greenberg
artg at eclipse dot net