More Thai spam in comp.lang.cobol

Andrew

unread,

Jan 23, 2024, 9:22:26 AMJan 23

to

Thai-language spam has made a comeback in comp.lang.cobol. The last
time I looked, Ray B on Eternal September was spam-assassinating it to
oblivion but Ivo Gandolfo (Paganini, the server I'm using to post this)
has let almost all of it through.
As far as I can see, every post to the newsgroup in 2024 is spam, apart
from one today by a "David L". Again, afaics, all of them (including
David L's) have Google Groups Message-IDs.

D

unread,

Jan 23, 2024, 10:13:16 AMJan 23

to

sample header . . .

>Path: n...!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
>Newsgroups: comp.lang.cobol
>Date: Tue, 23 Jan 2024 06:30:31 -0800 (PST)
>Message-ID: <ede23807-bcd1-4127...@googlegroups.com>

that's only about ~338 googlespams since 24 december 2023;
" " " ~238 " " 1 january 2024;

chickenfeed by google standards, in 30 days it'll be water under
the bridge . . . what will the invincible google groups division
do after their discharge from active duty . . . play tiddlywinks?

Andrew

unread,

Jan 23, 2024, 12:49:30 PMJan 23

to

The Doctor

unread,

Jan 23, 2024, 12:53:25 PMJan 23

to

In article <uoou75$1jep7$1...@paganini.bofh.team>,

Sounds like Google Groups!
--
Member - Liberal International This is doc...@nk.ca Ici doc...@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen
Birthday 29 Jan 1969 Born Redhill , England, UK Beware https://mindspring.com

llp

unread,

Jan 23, 2024, 1:02:53 PMJan 23

to

Andrew a formulé ce mardi :

> Thai-language spam has made a comeback in comp.lang.cobol. The last time I
> looked, Ray B on Eternal September was spam-assassinating it to oblivion but
> Ivo Gandolfo (Paganini, the server I'm using to post this) has let almost all
> of it through.

Isn't the conclusion simple?

--
Admin of news.usenet.ovh

Andrew

unread,

Jan 23, 2024, 1:11:02 PMJan 23

to

Yeah, it would be good if Ivo took a little more notice of cancels his
peers have issued. That is in an ideal world, given what I'm paying for
this service, I can't really complain.

Eric M

unread,

Jan 23, 2024, 1:16:17 PMJan 23

to

Le 23/01/2024 à 19:10, Andrew a écrit :

> Yeah, it would be good if Ivo took a little more notice of cancels his
> peers have issued. That is in an ideal world, given what I'm paying for
> this service, I can't really complain.

In french-speaking newsgroups this kind of spam is cancelled immediatly :)
This will end in one month anyway.

Adam H. Kerman

unread,

Jan 23, 2024, 2:01:31 PMJan 23

to

Andrew <Do...@hyperspace.vogon.gov> wrote:
>llp wrote:
>>Andrew:

There were no cancels being issued for spam and abuse coming through
Google Groups. This wasn't being handled like counter abuse in fr.*.

These were NoCeMs. And yes, they figured out a way to run the articles
in question through Spam Assassin as one of the steps as Cleanfeed isn't
capable of "learning" from pattern recognition.

No cancels were issued at all. That's why it wasn't controversial, even
with false positives and false negatives and all the tweaking taking
place.

Discuss with Ivo directly whose NoCeMs he's willing to process, if any.

Adam W.

unread,

Jan 23, 2024, 9:16:11 PMJan 23

to

Andrew <Do...@hyperspace.vogon.gov> wrote:

> Thai-language spam has made a comeback in comp.lang.cobol. The last
> time I looked, Ray B on Eternal September was spam-assassinating it to
> oblivion but Ivo Gandolfo (Paganini, the server I'm using to post this)
> has let almost all of it through.

Looks like all these spams are caught by my filters without any false
positives. Results are published as NoCeMs by news.chmurka.net.

I redirect these spams to local groups to monitor the flow and catch any
false positives. The flow is huge, I didn't catch any false positive yet.

Adam W.

unread,

Jan 23, 2024, 9:17:46 PMJan 23

to

Adam H. Kerman <a...@chinet.com> wrote:

> No cancels were issued at all. That's why it wasn't controversial, even
> with false positives and false negatives and all the tweaking taking
> place.

Yes, this is true. NoCeMs are opt-in by principle, cancels not always.

Adam W.

unread,

Jan 24, 2024, 8:20:56 AMJan 24

to

noel <delet...@invalid.lan> wrote:

> I've used Dnews since pre-mid 90's, like nocems, its never honored
> cancels by default requiring opt-in explicit config changes to allow
> them, which I've never done, anyone who gives a damn never honors cancels
> for the same BS reasons we've been reading about paganini's oliver doing
> in *.fr, that same boring BS saga happened in the 90's... jesus people...
> did we not learn anything from those days, clearly some not so.

Cancel-locks sort of solved this problem. I accept cancels when they're
properly signed.

As to NoCeMs, everyone should evaluate given NoCeM source and decide if
filtering rules applied fit their needs.

But I doubt there will be any more need for it when Google Groups are
finally closed. I just hope they won't postpone the date.

D

unread,

Jan 24, 2024, 9:56:42 AMJan 24

to

it's a biblical two-mouthed gladius (double-edged sword) either way;
seems like their best option is to run it through . . . only 29 days

Adam H. Kerman

unread,

Jan 25, 2024, 8:54:26 PMJan 25

to

noel <delet...@invalid.lan> wrote:

>On Wed, 24 Jan 2024 13:12:44 +0000, Adam W. wrote:
>>noel <delet...@invalid.lan> wrote:

>>>I've used Dnews since pre-mid 90's, like nocems, its never honored
>>>cancels by default requiring opt-in explicit config changes to allow
>>>them, which I've never done, anyone who gives a damn never honors
>>>cancels for the same BS reasons we've been reading about paganini's
>>>oliver doing in *.fr, that same boring BS saga happened in the 90's...
>>>jesus people...
>>>did we not learn anything from those days, clearly some not so.

>>Cancel-locks sort of solved this problem. I accept cancels when they're
>>properly signed.

>Seen all that fail too, trusted people cna and did often, go rogue.

What are you talking about? Third parties DO NOT have access to use
cancel-lock.

>>. . .

Adam W.

unread,

Jan 26, 2024, 12:14:20 PMJan 26

to

noel <delet...@invalid.lan> wrote:

>> Cancel-locks sort of solved this problem. I accept cancels when they're
>> properly signed.
>

> Seen all that fail too, trusted people cna and did often, go rogue.

Only two parties can cancel a post protected with a cancel-lock. One is
the author himself, another one is his newsadmin. Are you talking about
these scenarios? Someone cancelling all posts he posted, or all posts that
were sent using his server?

> Wont make any difference here, since google's trash has been stopped at
> the door for many, many months, its a one liner in my cleanfeed(*) file.

Filtering everything from Google is an easy way. I didn't want to do this,
because genuine posters still post with Google. It's also very easy to do
with a simple reader-side filter, so I didn't think it was a good idea to
make that choice for my users.

> Though yes, usenet as a whole is about to become a much better place.

Hopefully.

> (* DNews's cleanfeed file, it doesnt resemble cleanfeed being
> distributed for INN and from what I was told it wont work with INN, so I
> assume vice versa is also true.)

I don't know about DNews, but INN's cleanfeed is just a Perl script with a
certain, INN-specific API (and there's a Python equivalent too).

Matija Nalis

unread,

Jan 27, 2024, 12:23:42 PMJan 27

to

On 27 Jan 2024 23:55:23 +1000, noel <delet...@invalid.lan> wrote:

> On Fri, 26 Jan 2024 17:06:05 +0000, Adam W. wrote:
>
>> Only two parties can cancel a post protected with a cancel-lock. One is
>> the author himself, another one is his newsadmin. Are you talking about
>> these scenarios? Someone cancelling all posts he posted, or all posts
>> that were sent using his server?
>

> rogue news admins were a massive problem in 90's, I have no reason to
> believe much has changed.

Could you explain what abuse scenario you have in mind exactly, and
specifically how it relates to cancel-lock?

Sure, rogue newsadmin can cancel any and all the articles on their
newsserver if they like to. Rogue newsadmin can also try to send rogue
cancels to other servers (vast majority of which are properly configured,
and will just disregard such rogue cancels)

That is however unrelated to cancel-lock, which allows only original poster
to cancel only their articles on other news servers which do implement
cancel-lock (i.e. which disregard all incoming cancel messages _expect_ the
cancels which have same crypto-signature as the original post they attempt
to cancel).

Whether the person posted the original article on the newsserver which has
rouge newsadmin or a good one is not affecting cancel-lock functionality
(IOW, the rougue newsadmin cannot pretend to be original poster and cancel
their posts on servers which implement cancel-lock technology -- only the
original poster can [1]).

See https://www.rfc-editor.org/rfc/rfc8315.html for details

[1] to avoid nitpicking: the "original poster" meaning "person having access
to private key used to sign the original post, which should be just the
original poster" (and disregarding extreme situations of e.g. someone
holding a gun to your head and asking that you hand over your private
key so they can pretend to be you and cancel your Usenet posts against
your will).

--
Opinions above are GNU-copylefted.

D

unread,

Jan 27, 2024, 1:05:39 PMJan 27

to

sounds like what old-timers called "alchemy" . . . turning lead into gold;
probably nothing ever posted via usenet would "threaten national security"

klu...@panix.com

unread,

Jan 28, 2024, 6:14:55 PMJan 28

to

In article <c2e787ba289ac652...@dizum.com>, D <J@M> wrote:
>
>sounds like what old-timers called "alchemy" . . . turning lead into gold;
>probably nothing ever posted via usenet would "threaten national security"

It might threaten the security of the Church of Scientology though.
--scott

D

unread,

Jan 28, 2024, 7:05:18 PMJan 28

to

not even using long remailer chains with tor and whole message encryption
could protect against that branch of government. . . they've got auditors!

Adam W.

unread,

Jan 28, 2024, 8:44:17 PMJan 28

to

Matija Nalis <mnali...@voyager.hr> wrote:

> (IOW, the rougue newsadmin cannot pretend to be original poster and cancel
> their posts on servers which implement cancel-lock technology -- only the
> original poster can [1]).

Not always.

See the description of canlockadmin here:

https://www.eyrie.org/~eagle/software/inn/docs-2.7/inn-secrets.conf.html