* Jesse Rehmer wrote:

> Curious if you'll publish your NoCeM details in the 'registry' or announce
> otherwise? I went ahead and added your entry and key, but may be worth
> announcing somewhere so others can take advantage. Or maybe you did somewhere
> and I missed it.

My original plan was to run a burn-in test for 4 weeks and then submitting
all necessara information to the NoCeM registry. As the situation with Google
escalated over the last couple of days, I decided to start publishing the
NoCeM notices in news.lists.filters right away and do the administrative
work as my limited time allowed.

Ivo has already posted the link to Eternal-September's NoCeM page

https://www.eternal-september.org/index.php?showpage=nocem

More information will be added to that page as the work progresses
and I will submit all required information to the NoCeM registry.

--
Пу́тін — хуйло́
http://www.eternal-september.org

On 06/10/2023 03:18, Ray Banana wrote:
>
> As the situation with Google
> escalated over the last couple of days, I decided to start publishing the
> NoCeM notices in news.lists.filters right away

Yes you have replaced Google spam with your spam. That's a very bright
idea!!!!!.

On Oct 5, 2023 at 9:18:58 PM CDT, "Ray Banana" <rayban@raybanana.net> wrote:

> * Jesse Rehmer wrote:
>
>> Curious if you'll publish your NoCeM details in the 'registry' or announce
>> otherwise? I went ahead and added your entry and key, but may be worth
>> announcing somewhere so others can take advantage. Or maybe you did somewhere
>> and I missed it.
>
> My original plan was to run a burn-in test for 4 weeks and then submitting
> all necessara information to the NoCeM registry. As the situation with Google
> escalated over the last couple of days, I decided to start publishing the
> NoCeM notices in news.lists.filters right away and do the administrative
> work as my limited time allowed.
>
> Ivo has already posted the link to Eternal-September's NoCeM page
>
> https://www.eternal-september.org/index.php?showpage=nocem
>
> More information will be added to that page as the work progresses
> and I will submit all required information to the NoCeM registry.

Makes sense. I happen to be one of the weirdos who looks at news.lists.filters
every once in a while and noticed them and that it seemed at least a few
operators were aware.

In news.admin.net-abuse.usenet Ray Banana <rayban@raybanana.net> wrote:

> My original plan was to run a burn-in test for 4 weeks and then submitting
> all necessara information to the NoCeM registry. As the situation with Google
> escalated over the last couple of days, I decided to start publishing the
> NoCeM notices in news.lists.filters right away and do the administrative
> work as my limited time allowed.

On which hierarchies are you running this filter?

pl.* is infested as well (see pl.soc.polityka), but it seems the filter
doesn't catch it.

Is it possible to add pl.* to the list of hierarchies that are checked?

Thanks for your work!

* Adam W. wrote:
> On which hierarchies are you running this filter?

I run the filter on ALL articles originating from Google Groups
and I noticed that some postings to pl.* are blocked already.

OTOH, spam from GG seems to be carefully crafted for specific hierarchies
or even newsgroups. I need to take a closer look at pl.* to find out
the specifics for this type of spam.

--
Пу́тін — хуйло́
http://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote:

>> On which hierarchies are you running this filter?
>
> I run the filter on ALL articles originating from Google Groups
> and I noticed that some postings to pl.* are blocked already.
>
> OTOH, spam from GG seems to be carefully crafted for specific hierarchies
> or even newsgroups. I need to take a closer look at pl.* to find out
> the specifics for this type of spam.

Thanks!

I just looked at posting statistics per group (I collect them daily):

http://news.chmurka.net/stats.php

(it's in Polish, but it's mostly data anyway)

It looks like only pl.soc.polityka has been affected by it so far.

I processed all NoCeM notices that I have on news.lists.filters and it
cleaned up comp.lang.c, but there's still this spam on pl.soc.polityka. Is
there any chance for you to run the filter on all posts that are on this
group and emit a NoCeM notice for them?

Adam W. <gof-cut-this-news@cut-this-chmurka.net.invalid> wrote:

>> I run the filter on ALL articles originating from Google Groups
>> and I noticed that some postings to pl.* are blocked already.
>>
>> OTOH, spam from GG seems to be carefully crafted for specific hierarchies
>> or even newsgroups. I need to take a closer look at pl.* to find out
>> the specifics for this type of spam.
>
> Thanks!

And by the way, sometimes some contents (or maybe Subject?) of spam
messages ends up in the notice as well. See this msgid for example:

Message-ID: <20231012111504$ff6e@news.eternal-september.org>

It contains these lines:

#v+
<873b5879-ed41-4b22-9dcd-24488b878783n@googlegroups.com> soc.culture.punjab
=20
=20
+27718057023 PROCEDURE OF JOINING GREAT ILLUMINATI TEMPLE Of MONEY AND P=
<32b70e6e-76af-4139-83e1-cc4b3f2c9535n@googlegroups.com> comp.lang.c
#v-

So two proper msgids and some spam text between them.

I'm not sure how or if it affects NoCeM processing but it might be worth
looking at.

* Adam W. wrote:
> And by the way, sometimes some contents (or maybe Subject?) of spam
> messages ends up in the notice as well. See this msgid for example:
>
> Message-ID: <20231012111504$ff6e@news.eternal-september.org>
>
> It contains these lines:
>
> #v+
> <873b5879-ed41-4b22-9dcd-24488b878783n@googlegroups.com> soc.culture.punjab
> =20
> =20
> +27718057023 PROCEDURE OF JOINING GREAT ILLUMINATI TEMPLE Of MONEY AND P=
> <32b70e6e-76af-4139-83e1-cc4b3f2c9535n@googlegroups.com> comp.lang.c
> #v-
>
> So two proper msgids and some spam text between them.

Thanks. I noticed this issue earlier on, but it only happens for some
malformed articles (about 2 in 1000 articles). I suspect this is a bug
in the News::Article module that is used by News::Article::NoCem, but
I haven't nailed it yet, because

> I'm not sure how or if it affects NoCeM processing but it might be worth
> looking at.

perl-nocem will just ignore these lines, because it's looking for a
<message.id>, so this is an esthetic problem and doen't cause
any problem otherwise.

--
Пу́тін — хуйло́
http://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote:

>> I'm not sure how or if it affects NoCeM processing but it might be worth
>> looking at.
>
> perl-nocem will just ignore these lines, because it's looking for a
> <message.id>, so this is an esthetic problem and doen't cause
> any problem otherwise.

Sure, thanks for clarification!

* Adam W. wrote:
> I just looked at posting statistics per group (I collect them daily):
>
> http://news.chmurka.net/stats.php
>
> (it's in Polish, but it's mostly data anyway)
>
> It looks like only pl.soc.polityka has been affected by it so far.
>
> I processed all NoCeM notices that I have on news.lists.filters and it
> cleaned up comp.lang.c, but there's still this spam on pl.soc.polityka. Is
> there any chance for you to run the filter on all posts that are on this
> group and emit a NoCeM notice for them?

I have a list of all spam messages in pl.soc.polityka (~4000).
Since you are looking for a way to save these articles prior
deleting them, I will not sent a NoCeM report for these articles
without prior warning, so please inform me when it's OK to send it.

--
Пу́тін — хуйло́
http://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote:

> I have a list of all spam messages in pl.soc.polityka (~4000).
> Since you are looking for a way to save these articles prior
> deleting them, I will not sent a NoCeM report for these articles
> without prior warning, so please inform me when it's OK to send it.

It was just a thought, something that would be nice to have. But it's
okay, I don't need to save them. Go ahead.

Thanks.