Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Nulling out --> User-Agent: ForteAgent/8.00.32.1272

168 views
Skip to first unread message

Tuzov Vladislav

unread,
Jan 30, 2015, 5:56:49 PM1/30/15
to
Has anyone successfully nulled out the User-Agent in Agent 8
If so, what is the binary offset location?

Tibi grates..




--- news://freenews.netfront.net/ - complaints: ne...@netfront.net ---

Stray Cat

unread,
Jan 30, 2015, 6:06:29 PM1/30/15
to
I am not interested in v 8, but if you post the agent.exe (only to the .leek group please) I will take a look at it.

It used to be in one or more of the v 7 builds you could send your own User-Agent: header and it would overwrite the stock one, but
Forte fixed that. Have you tried that anyway?

Message has been deleted

straycat

unread,
Jan 30, 2015, 6:50:30 PM1/30/15
to
OK, backup your agent.exe file then edit the original.

Beginning at 00bea4eb and thru 00bea52b overwrite the left hand side
hex data with 0s


This reply was made with 8.00.32.1272 edited as above.

Good luck!

Tuzov Vladislav

unread,
Jan 30, 2015, 8:40:52 PM1/30/15
to
Message has been deleted

Tuzov Vladislav

unread,
Jan 30, 2015, 8:58:27 PM1/30/15
to
The modified 'extended evaluation'<cough> Agent.exe (it checks clean) is available on the Usenet here:

Newsgroups: alt.binaries.town,alt.binaries.town.z.delta,alt.binaries.town.z.echo
Date: 03 Nov 2014

Forte.Agent.v8.0.1272-TE.part1.rar
Message-ID: <ZrbeIUudDgFh...@JBinUp.local>

Forte.Agent.v8.0.1272-TE.part2.rar
Message-ID: <fOA6BCu4OdiF...@JBinUp.local>

depending on the binary retention of your chosen NSP perhaps someone else could post it into this group for experimentations and research.

Stray Cat

unread,
Jan 30, 2015, 9:03:03 PM1/30/15
to
On Sat, 31 Jan 2015 01:53:37 +0000 (UTC), "Bill" wrote:

>Tuzov Vladislav <tu...@vsu.ru> wrote:
>
>>Forger wrote:
>>
>>>OK, backup your agent.exe file then edit the original.
>>>
>>>Beginning at 00bea4eb and thru 00bea52b overwrite the left hand side
>>>hex data with 0s
>>>
>>>
>>>This reply was made with 8.00.32.1272 edited as above.
>>>
>>>Good luck!
>>
>>
>>http://ih0.redbubble.net/image.13761900.6000/flat,550x550,075,f.jpg
>
>Huh? I'm 99% sure that's the real Stray Cat and if you
>want help in the future, that's an odd way to reply.

Go figure.

Stray Cat

unread,
Jan 30, 2015, 9:25:52 PM1/30/15
to
The cracked agent.exe in the TE release has been compressed in such a way as to make the data that needs to be edited unavailable.
Unless it can somehow be expanded back to full size, it cannot be modified to remove the User-Agent: header. Perhaps someone else has a
solution for that file, I don't.

You have my other reply that does contain the instructions to edit the original agent.exe file to do what you want, but it of course is
not cracked. So far I have not seen another patched, full size version of ForteAgent/8.00.32.1272, or a good reg key. Until then,
perhaps News Proxy can be used to filter out that header for you?

Tuzov Vladislav

unread,
Jan 30, 2015, 10:33:10 PM1/30/15
to
On Fri, 30 Jan 2015 21:26:04 -0500, Stray Cat <Stra...@alt.anonymous.messages> wrote:

<snip>
>
>
>The cracked agent.exe in the TE release has been compressed in such a way as to make the data that needs to be edited unavailable.
>Unless it can somehow be expanded back to full size, it cannot be modified to remove the User-Agent: header. Perhaps someone else has a
>solution for that file, I don't.
>
>You have my other reply that does contain the instructions to edit the original agent.exe file to do what you want, but it of course is
>not cracked. So far I have not seen another patched, full size version of ForteAgent/8.00.32.1272, or a good reg key. Until then,
>perhaps News Proxy can be used to filter out that header for you?


Thank you sir for your kind help and a thousand apologies for my wrong
assumption that Message-ID: <a36oca5keumshbpdc...@4ax.com>
was someone forging you.

I had just opened the TE Agent.exe (4.52 MB) in UltraEdit and saw that
the last line (end of file) was 004859f0 and assumed someone was being
a jerk. Your explanation of the file's compression makes perfect sense
now.

Stray Cat

unread,
Jan 30, 2015, 10:56:42 PM1/30/15
to
On Sat, 31 Jan 2015 03:33:07 +0000, Tuzov Vladislav <tu...@vsu.ru> wrote:

>On Fri, 30 Jan 2015 21:26:04 -0500, Stray Cat <Stra...@alt.anonymous.messages> wrote:
>
><snip>
>>
>>
>>The cracked agent.exe in the TE release has been compressed in such a way as to make the data that needs to be edited unavailable.
>>Unless it can somehow be expanded back to full size, it cannot be modified to remove the User-Agent: header. Perhaps someone else has a
>>solution for that file, I don't.
>>
>>You have my other reply that does contain the instructions to edit the original agent.exe file to do what you want, but it of course is
>>not cracked. So far I have not seen another patched, full size version of ForteAgent/8.00.32.1272, or a good reg key. Until then,
>>perhaps News Proxy can be used to filter out that header for you?
>
>
>Thank you sir for your kind help and a thousand apologies for my wrong
>assumption that Message-ID: <a36oca5keumshbpdc...@4ax.com>
>was someone forging you.

Apology accepted.

>I had just opened the TE Agent.exe (4.52 MB) in UltraEdit and saw that
>the last line (end of file) was 004859f0 and assumed someone was being
>a jerk. Your explanation of the file's compression makes perfect sense
>now.

After TE patched the file, they packed it with PECompact v2.5. I do not have the tools and skill set to unpack it to restore it to its
original form so that it can be hex edited, or to discern the data that was patched to make it registerable.

Best I can do. Perhaps someone else can accomplish what needs to be done to unpack that file.



Message has been deleted

Stray Cat

unread,
Jan 31, 2015, 9:34:53 AM1/31/15
to
On Sat, 31 Jan 2015 06:05:01 -0600, Buddha <Bud...@Nirvana.net> wrote:

>On Fri, 30 Jan 2015 22:56:46 +0000, Tuzov Vladislav <tu...@vsu.ru> wrote:
>
>>Has anyone successfully nulled out the User-Agent in Agent 8
>>If so, what is the binary offset location?
>
>In agent.exe:
>Search for: "%s/%s", Replace with "00 00 00 00 00"
>Search for: "User-Agent", Replace with "00 00 00 00 00 00 00 00 00 00"

That will not work for the OP's TE agent.exe, the file has been packed and that data is not there.

Also, for the stock agent.exe, there is no need to alter User-Agent. Once the other data has been properly nulled, the program will send
an empty User-Agent: header which the news server will ignore.

Tuzov Vladislav

unread,
Jan 31, 2015, 2:02:09 PM1/31/15
to
Thank you again for your help, SC. I said in a earlier post that the
Agent.exe file "checks clean" but now I am not so confident that is
true. How effective are virus/malware scanners like Kaspersky,
Symantec, McAfee etc at finding malware embedded within compressed
executables? Would not the compression itself mask or hide most (if
not all) nefarious bit-patterns indicative of malware? Or, are modern
anti-virus programs capable of decompressing executables to peer
inside? I realize many anti-virals are capable of checking inside
zip/rar files, but I wonder about inside a proprietary compression
like PECompact?

Stray Cat

unread,
Jan 31, 2015, 2:21:50 PM1/31/15
to
I am not sure if virus scanners somehow expand packed executable files (as opposed to compressed) before scanning or just look at the
raw file. Your concern is valid as I have read about files being deliberately infected and then packed in order to mask the infection.
This is one reason people try to unpack files they find in the wild under controlled conditions.

Also, from what I have read it is possible to protect packed files from being expanded anywhere other than when they are executed. In
that way, they defy analysis.

If it is possible to unpack that file, it's just a matter of getting it in front of someone who can.

Although the people patching stuff like this are very talented and their work is appreciated, the real wizards are those who write bare
key generators that aren't also associated with a patch. ChiangMai Cracker was the first to do it for Agent but I haven't seen anything
of him in more than a decade.


Message has been deleted
Message has been deleted
Message has been deleted
Message has been deleted

Noob

unread,
Mar 21, 2015, 9:10:39 PM3/21/15
to
On Mon, 02 Feb 2015 22:28:17 -0600, Buddha <Bud...@Nirvana.net> wrote:

>On Mon, 02 Feb 2015 16:51:28 -0700, Franklin <fr...@spam.not> wrote:
>
>>On Mon, 02 Feb 2015 17:10:34 -0600, Buddha <Bud...@Nirvana.net> wrote:
>>>The point of nulling out "User-Agent" is so one can then use their own
>>>User-Agent string.
>>
>>That would be your point, not necessarily _the_ point. I might null
>>it out just to annoy those who check headers to see what I'm using.
>
>Thank you, Mr Autist.

Please inform me how to use my own User-Agent string. I have managed
to remove it. Wouldn't editing the agent.exe change file size?

Thanks in advance.
Message has been deleted

n0Ob

unread,
Mar 22, 2015, 4:48:56 PM3/22/15
to
On Sun, 22 Mar 2015 16:00:23 +0000 (UTC), "Bill" wrote:

>Noob wrote:
>
>[...]
>>Please inform me how to use my own User-Agent string. I have managed
>>to remove it.
>
>O'Rly? Message-ID: <tr8sga520cdoveed0...@4ax.com> still
>contains User-Agent: ForteAgent/8.00.32.1272

Yup, it worked but i reverted to the stock executable for that post.
You will notice it missing in this post.

>>Wouldn't editing the agent.exe change file size?
>
>No, and you do not want to change the file size unless you
>really know what you are doing. If you add an extra byte
>anywhere in the code section, the exe won't run.
>
>>Thanks in advance.
>
>Stray Cat's answer is in Message-ID: <a36oca5keumshbpdc...@4ax.com>
>
>I'm still using Agent 2.0, but from what I've read,
>you can add extra headers in modern versions of
>Agent. Once you've successfully nulled out the
>User-Agent string, you can add a new editable
>User-Agent header.

Okay, but that's not very clear, but anyway, I'm now more interested
in your newsproxy. Very cool.

>My answer is in Message-ID: <86dpo2....@news.alt.net>
>which does not require any editing of Agent.exe at all.
>It also works with any usenet posting tool.
>
>Feel free to ask more questions.

I am very grateful for your help! Thanks in advance.

I installed newsproxy from 86dph1....@news.alt.net

I created an nfilter.dat file but I have no idea what to put in it.

I found an nfilter faq but they only give a command line below, which
is not explained. I went to an oriental site but it was no help
because i don't speak Chinese. I read your instructions but they
appear to be for editing the source code.

newsgroup action[:marker] header:value [header:value] ...

I need a good example of a command line to understand this. Maybe I
can leave it empty if I just want to block headers?

The faq says that Agent must be set to "localhost" but it still
doesn't work. The closest success i get is when Agent stalls
downloading a message.

Your directions in 86dph1....@news.alt.ne appear to be for the
source code, for which I'm guessing is for Linux users, and other OS.
Perhaps you expect us to compile the source for our own uses?

Best regards
Message has been deleted
Message has been deleted

no...@no.email.org

unread,
Mar 22, 2015, 9:48:05 PM3/22/15
to
On Sun, 22 Mar 2015 17:43:47 -0500, Buddha <Bud...@Nirvana.net> wrote:

>On Sun, 22 Mar 2015 17:49:03 -0400, n0Ob wrote:
>
>>On Sun, 22 Mar 2015 16:00:23 +0000 (UTC), "Bill" wrote:
>>
>>>I'm still using Agent 2.0, but from what I've read,
>>>you can add extra headers in modern versions of
>>>Agent. Once you've successfully nulled out the
>>>User-Agent string, you can add a new editable
>>>User-Agent header.
>>
>>Okay, but that's not very clear, but anyway, I'm now more interested
>>in your newsproxy. Very cool.
>
>Tools, Options, Posting Messages, Personas.
>
>Click Edit on the default persona and you will see a Custom Message Fields
>box at the bottom where you can add a custom User-Agent string.

DOH! Thanks so much Buddah! It's very rewarding to accomplish
something after some hard work. There really are quite a few options
in this program. I have been using Agent since version .99 I believe.
It's great to see you guys keeping up the spirit of helping on usenet.
Thanks again! Checkout my user-agent now :) Cool beans!

no...@no.email.org

unread,
Mar 22, 2015, 10:13:08 PM3/22/15
to
On Sun, 22 Mar 2015 23:29:13 +0000 (UTC), "Bill" wrote:

>n0Ob wrote:
>
>[...]
>>I installed newsproxy from 86dph1....@news.alt.net
>>
>>I created an nfilter.dat file but I have no idea what to put in it.
>
>You don't need one if you just want to manipulate headers.
>
>>I found an nfilter faq but they only give a command line below, which
>>is not explained. I went to an oriental site but it was no help
>>because i don't speak Chinese. I read your instructions but they
>>appear to be for editing the source code.
>>
>>newsgroup action[:marker] header:value [header:value] ...
>>
>>I need a good example of a command line to understand this. Maybe I
>>can leave it empty if I just want to block headers?
>
>Yes.
>
>>The faq says that Agent must be set to "localhost" but it still
>>doesn't work. The closest success i get is when Agent stalls
>>downloading a message.
>>
>>Your directions in 86dph1....@news.alt.net appear to be for the
>>source code,
>
>While I make mention of the source code, it's only to
>point out that you can use the source code to recreate
>the instructions for using header manipulation.
>
>Please read that message carefully for the text that
>must be entered in the Approved header to trigger the
>header manipulation code.
>
>Also please note that nfilter (and thus NewsProxy)
>hasn't been the easiest app to use.

Yes, I noticed that VirusTotal says that Googal thinks the program is
"intensive". I agree.
>
>>for which I'm guessing is for Linux users, and other OS.
>>Perhaps you expect us to compile the source for our own uses?
>
>Of course not. Message-ID: <86dph1....@news.alt.net> has
>the compiled executable.
>
>1. Unzip nps-125.zip
>2. Run NewsProxy.exe
>3. Edit->Configuration->Network Tab
>4. Server Name or Numeric Address
>
>This is where you put in the name or address of your news
>server.
>
>5. Apply.
>6. Stop.
>7. Start.
>8. Open a DOSBox (i.e., run CMD.exe) and
>
>telnet localhost 119
>

TELNET! OMG, my network is getting compromised! You have to wonder
about a program that I find in the wilds on Usenet, that routes my
nntp protocol out of my newsgroup client into localhost! Telnet is
traditionally the protocol of most of the major hacks, especially the
classic, computer controlling ones!

>You should get
>
>200 NNTP Filtering Proxy v1.2.5. For info type help
>
>9. Type quit and hit enter to end the telnet session.
>
>If all went well, you're ready to use Agent.
>
>In Agent, set the name of the news server to localhost
>(or numerically, 127.0.0.1) and use Agent as normal.
>
>By default, the ini file is created in the same directory
>as NewsProxy.exe, but you can feed it the name of a config
>file on the command line (or in a Windows shortcut,
>C:\bin\Agent\Common\NewsProxy.exe -f C:\cfg\Agent\altopia.ini
>)
>
>Ask more questions if you have them.

Well, I buy all my programs so that I don't get hacked, but using this
program seems counter productive. My spider sense is acting up on this
one!

I'd be more willing to try it if I knew more exactly what it can do
for me. Can I alter the message-ID of my posts?

Basically, I like to preserve my anonymity on usenet because I like to
debate the neocons in political groups. They get really pissed easily
and always threaten me. Anything else that this program may offer
along these lines?

Don't get me wrong, I really appreciate you guys helping me out, and I
trust you, but this program is a bit much. Thanks again! You guys are
great.

Best regards
Message has been deleted

nOOB

unread,
Mar 23, 2015, 9:20:19 AM3/23/15
to
On Mon, 23 Mar 2015 01:23:02 -0123, "Bill" wrote:

>no...@no.email.org wrote:
>
>[...]
>>Well, I buy all my programs so that I don't get hacked, but using this
>>program seems counter productive. My spider sense is acting up on this
>>one!
>
>Then your spider-sense is registering a false positive.
>
>I provide the complete, ready to compile source code.
>That's the opposite pole from malware.
>
>Even if you can't program, you can read through the
>source code and the comments.
>
>I have a lot of enemies in usenet. You'd know by
>now if the app was really malicious.
>
>>I'd be more willing to try it if I knew more exactly what it can do
>>for me. Can I alter the message-ID of my posts?
>
>Yes. See the M= command.
>
>If you use M=4ax.com, you'll get something that looks
>like Forte's standard Message-ID.
>
>Or you can use the X= command and specify the exact
>Message-ID you want to use.

Oh, I think I get it. DOH! I put M=4ax.com in tools/options/personas/custom message fields?
If not, where do I put "M=4ax.com"?

I haven't experimented with it yet because I have spent too much time yesterday at it.
I'm beginning to wonder if I should sandbox it in Vmware first ;)

>>Basically, I like to preserve my anonymity on usenet because I like to
>>debate the neocons in political groups. They get really pissed easily
>>and always threaten me. Anything else that this program may offer
>>along these lines?
>
>You can strip every header from your posts and replace
>them on an individual message basis, changing nothing
>more than a single entry in the Approved header.
>
>Ponder that and the effects it could have on the people
>you want to poke at. You're wasting your time on neocons
>though, they never learn.

We can not have faith in others if we have no faith in ourselves. Without faith there is no love. It follows that the belief in power, in
the sense of domination and the use of power, are the reverse of faith. There is no rational faith in power. There is submission to it or on
the part of those who have it, the wish to keep it. You see from above that authoritarians don't have faith in humanity and believe they
must control it, just like the political extreme right-wing. These facts reveal that extreme authoritarians are lacking in a strong
self-esteem, probably because modern society is so disconnected. Everyone notices how the extreme right-wing engage in ad-hominem attacks.

I think that it is important that when we engage in debate with an obnoxious Con, that we point out their unhappiness. I often notice that
they become thoughtful when I do this :)

Best Regards
Message has been deleted

Noob

unread,
Mar 23, 2015, 12:35:15 PM3/23/15
to
On Mon, 23 Mar 2015 15:06:33 +0000 (UTC), "Bill" wrote:

>nOOB wrote:
>
>>I'm beginning to wonder if I should sandbox it in Vmware first ;)
>
>Just delete it if you're going to continue to insult me.

Your defensiveness and lack of clear documentation is a warning to me.
Why haven't you included good documentation with the program? You have
included some procedure, but it is nowhere complete. The fact that
Agent must access localhost is an important step that people wouldn't
know. In my opinion, accessing localhost is a potential huge security
hole in my network, and somehow you have not placed this information
with the software. It is as though you fear documenting it because you
fear being held responsible.

Your program has been marked by a participant of virustotal as being a
trojan, albeit it could be a false positive. Even if it wasn't marked
a trojan, it is good practice to be careful and check anything
download from the net. This can often mean sandboxing a potential
threat. YOU SHOULD KNOW THIS. Therefore, why are you being so
defensive? Even Microsoft Windows is a security hole, and needs
constant surveilance!

Hmmmmm...could the above point to the reason that you say that so many
people in usenet hate you?

s|b

unread,
Mar 23, 2015, 3:17:45 PM3/23/15
to
On Sun, 22 Mar 2015 22:48:14 -0400, no...@no.email.org wrote:

> Message-ID: <ccvugalo4fpvq7p1g...@4ax.com>

Your message-id is still showing you use Forté Agent...

--
s|b

Noob

unread,
Mar 23, 2015, 4:49:58 PM3/23/15
to
Look again at the raw message by clicking the view tab, and then
click, "display as raw message" .

If you look at my raw message, the header field "User-Agent" is as
follows.

User-Agent: noobagent v0.00001

In other words, it looks like I use the program called "noobagent" and
it is version 0.00001!

You are probably looking at the subject line in the message.

Best regards.

s|b

unread,
Mar 23, 2015, 5:48:48 PM3/23/15
to
On Mon, 23 Mar 2015 18:50:07 -0400, Noob wrote:

> >> Message-ID: <ccvugalo4fpvq7p1g...@4ax.com>

> >Your message-id is still showing you use Forté Agent...

> Look again at the raw message by clicking the view tab, and then
> click, "display as raw message" .

I prefer Ctrl+R.

> If you look at my raw message, the header field "User-Agent" is as
> follows.
>
> User-Agent: noobagent v0.00001

I've changed AGENT.INI so it always shows this header. No need for
Ctrl+R or H. But that's not what I'm talking about.

> In other words, it looks like I use the program called "noobagent" and
> it is version 0.00001!

Except, everybody knows there's no newsreader called "noobagent". :-)

> You are probably looking at the subject line in the message.

I'm talking about the _message--id_. Press H to see your headers and
you'll see your m-id is showing 4ax.com. This domain is owned by Forté
and is used for creating message-ids.

--
s|b
Message has been deleted

Noobster

unread,
Mar 23, 2015, 7:12:13 PM3/23/15
to
Ahh....this is good to information. Thanks.

nOOb

unread,
Mar 23, 2015, 7:50:52 PM3/23/15
to
On Mon, 23 Mar 2015 22:37:28 +0000 (UTC), "Bill" wrote:

>If you have sincere questions about NewsProxy, I'll
>answer them, otherwise don't expect a reply.

Sincere question:

My goal is to make a custom Message=ID.

I need to do this with Forte Agent v8.00/32.1272

Will the following command line satisfy my objective?

$P=Newsg,Subj,Ref,From;M=mynews.mid

Should this command line be placed in the Forte Agent menu
below?

tools/options/personas/custom message fields

If this command line doesn't belong in the above location, where does
it belong?

Thanks in advance.
Message has been deleted

Stray Cat

unread,
Mar 24, 2015, 7:41:55 PM3/24/15
to
On Tue, 24 Mar 2015 18:21:23 -0500, G. Morgan <seal...@osama-is-dead.net> wrote:

>Tuzov Vladislav wrote:
>
>>The modified 'extended evaluation'<cough> Agent.exe (it checks clean) is available on the Usenet here:
>>
>>Newsgroups: alt.binaries.town,alt.binaries.town.z.delta,alt.binaries.town.z.echo
>>Date: 03 Nov 2014
>>
>>Forte.Agent.v8.0.1272-TE.part1.rar
>>Message-ID: <ZrbeIUudDgFh...@JBinUp.local>
>>
>>Forte.Agent.v8.0.1272-TE.part2.rar
>>Message-ID: <fOA6BCu4OdiF...@JBinUp.local>
>
>How did you get it to decompress?
>
>I get checksum errors in Winrar and Uniextract.
>
>
>UNRAR 3.93 freeware Copyright (c) 1993-2010 Alexander Roshal
>
>
>Extracting from
>C:\Users\Graham\Desktop\Forte.Agent.v8.0.1272-TE\rebuilt.Forte.Agent.v8.0.1272-TE.part1.rar
>
>Extracting agentenu800-1272.msi
>17% 34% 51% 68% 85% 99%
>agentenu800-1272.msi - CRC failed
>Unexpected end of archive
>agentenu800-1272.msi : packed data CRC failed in volume
>C:\Users\me\Desktop\Forte.Agent.v8.0.1272-TE\rebuilt.Forte.Agent.v8.0.1272-TE.part1.rar
>Calculating control sums of all volumes.
>Cannot find volume
>C:\Users\me\Desktop\Forte.Agent.v8.0.1272-TE\rebuilt.Forte.Agent.v8.0.1272-TE.part2.rar
>Total errors: 3

Your copy must be corrupted in some way. See if this one is good:

http://ul.to/gfi4852f

Message has been deleted

NOOb

unread,
Mar 25, 2015, 7:56:02 AM3/25/15
to
On Wed, 25 Mar 2015 00:23:34 -0500, Buddha <Bud...@Nirvana.net> wrote:
>You can edit the agent.ini file to change that. Look for the line:
>MsgIdRHS=
>
>Just add a domain name, such as:
>MsgIdRHS=astraweb.com

Buddha, you're awesome! I really appreciate the help. I did find out
about the "msgIDRHS", but your help earlier got me on the right track.
Bill's <cough> program really confused me because I assumed that we
had to use it to add our own USER-AGENT.

I was reminded that I make too many assumptions, and that sometimes,
using program options, the simple way, is the only good way.All the
information is in the threads it seems, but it takes so long to find,
so I thought that asking you would be helpful. Thanks again.

s|b

unread,
Mar 25, 2015, 3:48:12 PM3/25/15
to
On Wed, 25 Mar 2015 00:23:34 -0500, Buddha wrote:

> You can edit the agent.ini file to change that. Look for the line:
> MsgIdRHS=
>
> Just add a domain name, such as:
> MsgIdRHS=astraweb.com

I left that blank and use this:

| GenerateId=0
| NewsIdFormat=0

This way, the generated message-id will have the same domain as the
newsserver that is used as it should be according to some RFC:
<http://www.faqs.org/rfcs/rfc1036.html>

| In order to conform to RFC-822, the Message-ID must have the format:
|
| <unique@full_domain_name>
|
| where full_domain_name is the full name of the host at which the
| message entered the network, including a domain that host is in, and
| unique is any string of printing ASCII characters, not including "<"
| (left angle bracket), ">" (right angle bracket), or "@" (at sign).

--
s|b

Noob

unread,
Mar 25, 2015, 9:51:27 PM3/25/15
to
This is good information. Thanks! I glanced at your above RFC and
couldn't find out what happens if the post Message-ID doesn't conform
to the RFC. The RFC seems to suggest that third parties could choke on
a non-conforming Message-ID, if they rely on its conformity.

Frankly, I never liked the fact that Google archives my political
debates from 1995, and still has them! Therefore, I'm not really
empathic to third parties and their internet archiving. I realize that
I could ask Google to remove them but I can't be bothered. Incidently,
I stopped posting about 2001 because I realized that I couldn't handle
the ad-hominem attacks. Therefore, I don't have much knowledge about
posting with modern newsreaders.

Could you please tell me what the other important ramifications are of
a post with a Message-ID domain doesn't match the newsserver? Thanks
in advance.
Message has been deleted

Noob

unread,
Mar 26, 2015, 1:01:33 AM3/26/15
to
On Thu, 26 Mar 2015 02:44:04 +0000 (UTC), "Bill" wrote:

>Noob wrote:
>
>>This is good information. Thanks! I glanced at your above RFC and
>>couldn't find out what happens if the post Message-ID doesn't conform
>>to the RFC. The RFC seems to suggest that third parties could choke on
>>a non-conforming Message-ID, if they rely on its conformity.
>
>RFC = request for comment, i.e., not a law
>
>>Incidently,
>>I stopped posting about 2001 because I realized that I couldn't handle
>>the ad-hominem attacks.
>
>O'Rly?

Yeah..there were some socialist in the newsgroups who everyone was
picking on, and in the threads I was debating. I got tired of reading
the constant insulting on socialist done by the neocons. I'm a
conservative but not like they are.
Message has been deleted
Message has been deleted

Noob

unread,
Mar 27, 2015, 7:02:37 AM3/27/15
to
On Fri, 27 Mar 2015 00:53:28 -0500, G. Morgan
<seal...@osama-is-dead.net> wrote:

>Noob wrote:
>
>>This is good information. Thanks! I glanced at your above RFC and
>>couldn't find out what happens if the post Message-ID doesn't conform
>>to the RFC. The RFC seems to suggest that third parties could choke on
>>a non-conforming Message-ID, if they rely on its conformity.
>
>Most NNTP servers don't care what info is in the MID. As long as it is
>formatted correctly, does not infringe on someone else's owned domain, and
>does not cause a collision with another message.
>
>>Frankly, I never liked the fact that Google archives my political
>>debates from 1995, and still has them! Therefore, I'm not really
>>empathic to third parties and their internet archiving. I realize that
>>I could ask Google to remove them but I can't be bothered.
>
>Use the XNA (X-No-Archive: Yes) in your headers and Google will drop the
>message after a week. Google also took away the "power" of their former
>"advanced groups search" that allowed easy stalking by some knuckle-draggers
>that followed people around to different groups their "targets" post in.
>
>> Incidently,
>>I stopped posting about 2001 because I realized that I couldn't handle
>>the ad-hominem attacks. Therefore, I don't have much knowledge about
>>posting with modern newsreaders.
>
>Likely half of the "attacks" resulted from most regular Usenet users hating
>"Google Groupers" (Google Luzers); posts originating from GG's web interface
>to be more specific.
>
>>Could you please tell me what the other important ramifications are of
>>a post with a Message-ID domain doesn't match the newsserver?
>
>There are no ramifications. Nobody gives a fuck anymore. You may run into
>the "Big-8 management board" jerks telling you how to format a post on the
>Big-8 hierarchy. A message with the RhS of the MID not showing the server it
>came from is not enforced anywhere I've seen. In fact, the free text-only
>news server, eternal-september (free account sign up on Ray's website here:
>http://www.eternal-september.org/) encourages the use of a unique FQDN on the
>RhS of the MID for his "customers".
>
>This helps prevent spoofers from impersonating you. Only the legitimate
>account holder will be able to use the unique RhS "domain name" (it's a
>subdomain @eternal-september.org or @dont-email.me). For example,
>"n00b.dont-email.me" or "noob.eternal-september.org" can be yours if they are
>not already taken (it's available, I just registered then de-registered it).
>
>If someone is spoofing you, tell the group's regulars you are using a
>registered FQDN, and any other post is a spoof or forgery (there is a
>difference) when you post via the E-S server.
>
>If your FQDN is "windows-8-is-great.eternal-september.org", and Agent
>generates an MID of
>n7o6hapni9pri6fi8...@windows-8-is-great.eternal-september.org -
>then the message *must* have come from you (or someone hacked your
>user/password @ E-S).
>
>The URL is http://www.eternal-september.org/make_user_fqdn.php , and is
>accessible once you create an account and are logged on to the E-S web page.
>
>I use a domain name I own on the RhS in my MID's, and a valid email address.
>That way, if someone were to use (abuse) my domain name or email address have
>an actionable complaint to get the forger's account revoked. Using someone
>else's domain in your From: field or in the MID is considered a big no-no
>(forgery) at virtually all news servers. BTW - it's considered a forgery even
>if you don't own the domain, but use a valid email address from free email
>providers. If you have an email address that is No...@gmail.com and someone
>forges a post by using that email address under your control, you have a valid
>complaint to lodge with the server operator.
>
>Be careful not to use a domain that is registered to someone else in your
>email address or MID. If in doubt, you can always use .invalid as part of the
>fake email address. You can use No...@kiismyass.invalid all day long without
>running into problems.

That is very important information! I think I will just stick to s|b's
recommendation of using the domain of my Usenet provider.

Edit the agent.ini

GenerateId=0
NewsIdFormat=0

Thanks for the great information. Clear and concise.
Message has been deleted
Message has been deleted

Anon Guy

unread,
May 10, 2015, 9:08:00 AM5/10/15
to
no...@no.email.org wrote:

> Basically, I like to preserve my anonymity on usenet

You won't gain anonymity by altering a few header entries. To do so
you have to use remailers, which, reading your postings, may be beyond
your skills.

The OmniMix proxy server (http://www.danner-net.de/om.htm) normalizes
revealing message attributes (MIME boundary delimiter format, header
name capitalization) and removes unnecessary header entries (User-Agent,
X-Newsreader, Message-ID, Date etc.) completely from you Agent's
messages, then routes the results through the Mixmaster network
(https://en.wikipedia.org/wiki/Anonymous_remailer) to hide their origin.

That's true anonymity, where even your ISP doesn't know that you've
ever sent a message.

0 new messages