What's going on over at the Opera.beta newsgroup?
ge...@none.net
spammers (or worse). It's as if someone or some entity is deliberately
out to destroy it (why not opera.general, too?). The Complaints-To
address is for google groups, and I know it's been reported to them,
but could that address also be falsified? Pretty strange and
demoralizing. Any ideas?
Gene
David W. Hodgins
> Since mid-summer, the beta newsgroup has been colonized by some
> spammers (or worse). It's as if someone or some entity is
Use leafnode to download & filter usenet articles. I then use
the following script to prevent repeats from this spammer ...
#!/bin/bash
sort -u <(
IFS=$'\n'
grepOutput=($(grep -rl 'Subject: ~~~~~~~~~' /var/spool/news/*))
unset IFS
LinesNumber="${#grepOutput[@]}"
for ((LineIndexCurrent=0; LineIndexCurrent < LinesNumber; LineIndexCurrent ++)); do
FileName="${grepOutput[LineIndexCurrent]}"
if ! [[ "${FileName:0:26}" == /var/spool/news/message.id ]] ; then
PostingHost="$(grep NNTP-Posting-Host: $FileName)"
FilterLine="^${PostingHost//./\.}"
FilterLine="${FilterLine/: /:.*}"
echo "$FilterLine"
fi
done
cat /etc/leafnode/filters
) > /etc/leafnode/filters.new
mv -f /etc/leafnode/filters /etc/leafnode/filters.old
mv /etc/leafnode/filters.new /etc/leafnode/filters
service leafnode start
diff /etc/leafnode/filters.old /etc/leafnode/filters
Given the consistency of this spammer, you could also edit the
Spam view rules to filter on the above in the subject.
I keep the last five days for the groups I read. In that time
I've added the following to my filter ...
^NNTP-Posting-Host:.*173\.16\.28\.249
^NNTP-Posting-Host:.*173\.20\.78\.74
^NNTP-Posting-Host:.*173\.29\.126\.27
^NNTP-Posting-Host:.*206\.255\.162\.76
^NNTP-Posting-Host:.*24\.60\.105\.123
^NNTP-Posting-Host:.*24\.85\.231\.119
^NNTP-Posting-Host:.*24\.9\.36\.224
^NNTP-Posting-Host:.*67\.124\.11\.156
^NNTP-Posting-Host:.*67\.162\.3\.101
^NNTP-Posting-Host:.*67\.181\.231\.247
^NNTP-Posting-Host:.*67\.86\.58\.96
^NNTP-Posting-Host:.*68\.122\.164\.128
^NNTP-Posting-Host:.*68\.3\.183\.239
^NNTP-Posting-Host:.*68\.54\.202\.243
^NNTP-Posting-Host:.*69\.120\.194\.74
^NNTP-Posting-Host:.*69\.224\.182\.116
^NNTP-Posting-Host:.*69\.254\.196\.186
^NNTP-Posting-Host:.*70\.171\.194\.92
^NNTP-Posting-Host:.*70\.171\.216\.56
^NNTP-Posting-Host:.*71\.198\.109\.69
^NNTP-Posting-Host:.*71\.204\.16\.18
^NNTP-Posting-Host:.*71\.237\.65\.220
^NNTP-Posting-Host:.*74\.194\.182\.97
^NNTP-Posting-Host:.*75\.21\.99\.151
^NNTP-Posting-Host:.*75\.28\.48\.72
^NNTP-Posting-Host:.*75\.74\.191\.124
^NNTP-Posting-Host:.*75\.80\.32\.30
^NNTP-Posting-Host:.*76\.178\.78\.113
^NNTP-Posting-Host:.*76\.204\.150\.93
^NNTP-Posting-Host:.*76\.208\.17\.52
^NNTP-Posting-Host:.*76\.221\.221\.181
^NNTP-Posting-Host:.*76\.29\.70\.148
^NNTP-Posting-Host:.*98\.184\.94\.211
^NNTP-Posting-Host:.*99\.139\.252\.203
^NNTP-Posting-Host:.*99\.194\.124\.70
Regards, Dave Hodgins
--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)
Remco Lanting
I sent a list of spam to the abuse address once, and I login to google
groups every now and then to mark them all as spam. But when I searched
for what google actually does about it, it seems they don't do anything at
all. All spam reports seem to go to /dev/null :(
On monday I'll see if I can get a hold of one at the sysadmins at Opera,
if they're working at all next week. Unfortunately blocking google groups
seems to be the only real solution to the problem. Since there are people
from Opera reading this too, any input is appreciated so a solution that
works for everyone can be put in place.
--
Remco Lanting
[Unofficial Opera bug tracker links]
http://opera.remcol.ath.cx/bugs |
http://my.opera.com/community/forums/topic.dml?id=217364 |
remco.lanting...@gmail.com
Aaron W. Hsu
<remco....@no.spam.at.gmail.com.please> wrote:
> Unfortunately blocking google groups seems to be the only real solution
> to the problem.
A lot of regular Usenet readers do this.
Aaron W. Hsu
--
A professor is one who talks in someone else's sleep.
Beauregard T. Shagnasty
> Remco Lanting wrote:
>> Unfortunately blocking google groups seems to be the only real
>> solution to the problem.
>
> A lot of regular Usenet readers do this.
From the late Blinky the Shark:
http://twovoyagers.com/improve-usenet.org/
--
-bts
-Four wheels carry the body; two wheels move the soul
ge...@none.net
"Aaron W. Hsu" <arc...@sacrideo.us> wrote:
> On Sat, 26 Dec 2009 20:00:12 -0500, Remco Lanting
> <remco....@no.spam.at.gmail.com.please> wrote:
>
> > Unfortunately blocking google groups seems to be the only real
> > solution to the problem.
>
> A lot of regular Usenet readers do this.
The problem with this solution is that many ISPs no longer provide
newsgroup feeds, while other posters are at computers where web-based
access to newsgroups via google groups is the only choice. Plus,
there's all those people who like to participate but don't have a clue
how to do so via their email clients.
Opera.beta is a particularly odd case. The spammer(s) isn't cross
posting and I haven't seen anything like this on the other groups I
frequent.
Gene
Ed Jay
I'm seeing it in a rec.arts ng and in alt.www.webmasters
--
Ed Jay (remove 'M' to reply by email)
Win the War Against Breast Cancer.
Knowing the facts could save your life.
http://www.breastthermography.info
Aaron W. Hsu
> The spammer(s) isn't cross
> posting and I haven't seen anything like this on the other groups I
> frequent.
In these particular instances, it is usually sufficient to set up a
filtering rule to block these posters specifically.
Aaron W. Hsu
> The problem with this solution is that many ISPs no longer provide
> newsgroup feeds, while other posters are at computers where web-based
> access to newsgroups via google groups is the only choice.
Lacking proper usenet access is a continuing problem, but there are some
free news servers out there. I guess for many people usenet access is not
worth paying for, but there are very cheap news servers out there as well
which provide access for a nominal fee.
Auric__
> Opera.beta is a particularly odd case. The spammer(s) isn't cross
> posting and I haven't seen anything like this on the other groups I
> frequent.
I have, in rec.games.roguelike.development (and probably all of r.g.r.*). The
spammer likely has a program that does the posting for them. (Such an app is
trivially easy to write.) The program reads in a list of groups, randomly
generates bogus headers (subject, from, etc.) then posts, one group at a
time. (Multipost = more ad views.) At most, they'd have to use the freely-
avaiable Google API to do the posting.
--
We are a light in the darkness of bloatware. Do you see?
ge...@none.net
"Aaron W. Hsu" <arc...@sacrideo.us> wrote:
> On Sun, 27 Dec 2009 17:20:02 -0500, <ge...@none.net> wrote:
>
> > The spammer(s) isn't cross
> > posting and I haven't seen anything like this on the other groups I
> > frequent.
>
> In these particular instances, it is usually sufficient to set up a
> filtering rule to block these posters specifically.
Are you referring to filtering at the individual computer? What
does a filtering rule look like for spam whose specifics appear to
change with every post?
Gene
ge...@none.net
"Remco Lanting" <remco....@no.spam.at.gmail.com.please> wrote:
> On Sat, 26 Dec 2009 22:02:08 +0100, <ge...@none.net> wrote:
>
> > Since mid-summer, the beta newsgroup has been colonized by some
> > spammers (or worse). It's as if someone or some entity is
> > deliberately out to destroy it (why not opera.general, too?). The
> > Complaints-To address is for google groups, and I know it's been
> > reported to them, but could that address also be falsified? Pretty
> > strange and demoralizing. Any ideas?
>
> I sent a list of spam to the abuse address once, and I login to
> google groups every now and then to mark them all as spam. But when I
> searched for what google actually does about it, it seems they don't
> do anything at all. All spam reports seem to go to /dev/null :(
>
> On monday I'll see if I can get a hold of one at the sysadmins at
> Opera, if they're working at all next week. Unfortunately blocking
> google groups seems to be the only real solution to the problem.
> Since there are people from Opera reading this too, any input is
> appreciated so a solution that works for everyone can be put in place.
The spammer must have been on holiday. It's started again today
- four posts.
Gene