Apologies for top-posting

I've crossposted this to news.admin.net-abuse.usenet
where it is on-topic and likely to be of interest.

Liz Tuddenham <liz@poppyrecords.invalid.invalid> wrote:

> Alan B <alanrichardbarker@gmail.com.invalid> wrote:
>
> > It happened about 4pm today. I wonder how long it will take for the
> > spammers to find other means of peddling their wares?
>
> Spammers are still appearing in <sci.electronics.design> with the path:
>
> Path:
> uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npeer-n
> g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.ams4!
> peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTED!n
> ot-for-mail
> From: darius <manta103g@gmail.com>
> Newsgroups: sci.electronics.design,free.spam
> Subject: Off Topic Troll Alert! was: Re: European crash tester says
> carmakers must bring back physical
> Followup-To: alt.test.group
> References: <us6a50$uuap$1@solani.org>
> <l54mleF90jqU1@mid.individual.net>
> Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
> Injection-Info: reader02.eternal-september.org;
> posting-host="aefae07b417003b570527823e77a9930";
> logging-data="29200";
> mail-complaints-to="abuse@eternal-september.org";
> posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="
> User-Agent: Xnews/2006.08.05
> Lines: 25
> Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
> X-Complaints-To: https://www.astraweb.com/aup
> NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
> Date: Sun, 10 Mar 2024 06:07:02 GMT
> X-Received-Bytes: 1936
> Xref: uni-berlin.de sci.electronics.design:1579608
> ~~~~~~
>
> These posts are just a constant stream of automated abuse appended to
> nearly every post on the group. I thought responsible servers would
> have put a stop to this sort of nonsense.

--
^Ï^. Sn!pe, PA, FIBS - Professional Crastinator

My pet rock Gordon just is.

Thus spake snipeco.2@gmail.com (Sn!pe)
>> Path:
>> uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npeer-n
>> g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.ams4!
>> peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTED!n
>> ot-for-mail
>> From: darius <manta103g@gmail.com>
>> Newsgroups: sci.electronics.design,free.spam
>> Subject: Off Topic Troll Alert! was: Re: European crash tester says
>> carmakers must bring back physical
>> Followup-To: alt.test.group
>> References: <us6a50$uuap$1@solani.org>
>> <l54mleF90jqU1@mid.individual.net>
>> Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
>> Injection-Info: reader02.eternal-september.org;
>> posting-host="aefae07b417003b570527823e77a9930";
>> logging-data="29200";
>> mail-complaints-to="abuse@eternal-september.org";
>> posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="

Forged Injection-Info header.

>> Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
>> X-Complaints-To: https://www.astraweb.com/aup
>> NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
>> Date: Sun, 10 Mar 2024 06:07:02 GMT

Genuine Highwinds headers.

Cry 'Havoc!', and let slip the dogs of war.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote:
>Thus spake snipeco.2@gmail.com (Sn!pe)

>>>Path:
>>>uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npeer-n
>>>g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.ams4!
>>>peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTED!n
>>>ot-for-mail
>>>From: darius <manta103g@gmail.com>
>>>Newsgroups: sci.electronics.design,free.spam
>>>Subject: Off Topic Troll Alert! was: Re: European crash tester says
>>>carmakers must bring back physical
>>>Followup-To: alt.test.group
>>>References: <us6a50$uuap$1@solani.org>
>>><l54mleF90jqU1@mid.individual.net>
>>>Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
>>>Injection-Info: reader02.eternal-september.org;
>>>posting-host="aefae07b417003b570527823e77a9930";
>>> logging-data="29200";
>>>mail-complaints-to="abuse@eternal-september.org";
>>>posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="

>Forged Injection-Info header.

>>>Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
>>>X-Complaints-To: https://www.astraweb.com/aup
>>>NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
>>>Date: Sun, 10 Mar 2024 06:07:02 GMT

>Genuine Highwinds headers.

Well, that sucks. Is there anyone to contact at Highwinds to get them to
refuse proto articles with preloaded injection headers?

>Cry 'Havoc!', and let slip the dogs of war.

Thus spake "Adam H. Kerman" <ahk@chinet.com>

>>Forged Injection-Info header.
>>Genuine Highwinds headers.

> Well, that sucks. Is there anyone to contact at Highwinds to get them to
> refuse proto articles with preloaded injection headers?

Highwinds use their own proprietary server software and haven't yet
implemented the current standard RFCs 5536/5537, so this is going to
happen any time soon. But, hey, the were the first to support 64-Bit
article numbers.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Thus spake "Adam H. Kerman" <ahk@chinet.com>

>>Forged Injection-Info header.
>>Genuine Highwinds headers.

> Well, that sucks. Is there anyone to contact at Highwinds to get them to
> refuse proto articles with preloaded injection headers?

Highwinds use their own proprietary server software and haven't yet
implemented the current standard RFCs 5536/5537, so this is NOT going to
happen any time soon. But, hey, the were the first to support 64-Bit
article numbers.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote:
>Thus spake "Adam H. Kerman" <ahk@chinet.com>
>
>>>Forged Injection-Info header.
>>>Genuine Highwinds headers.
>
>> Well, that sucks. Is there anyone to contact at Highwinds to get them to
>> refuse proto articles with preloaded injection headers?
>
>Highwinds use their own proprietary server software and haven't yet
>implemented the current standard RFCs 5536/5537, so this is NOT going to
>happen any time soon. But, hey, the were the first to support 64-Bit
>article numbers.

That would seem a relatively easy thing to do. If there's a line in the
incoming message that meets a given pattern, remove it. If they are running
their own homebrew software it should be very easy to fix.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

Am 10.03.24 um 18:00 schrieb Ray Banana:
> Thus spake snipeco.2@gmail.com (Sn!pe)
>
>>> Path:
>>> uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npeer-n
>>> g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.ams4!
>>> peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTED!n
>>> ot-for-mail
>>> From: darius <manta103g@gmail.com>
>>> Newsgroups: sci.electronics.design,free.spam
>>> Subject: Off Topic Troll Alert! was: Re: European crash tester says
>>> carmakers must bring back physical
>>> Followup-To: alt.test.group
>>> References: <us6a50$uuap$1@solani.org>
>>> <l54mleF90jqU1@mid.individual.net>
>>> Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
>>> Injection-Info: reader02.eternal-september.org;
>>> posting-host="aefae07b417003b570527823e77a9930";
>>> logging-data="29200";
>>> mail-complaints-to="abuse@eternal-september.org";
>>> posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="
>
> Forged Injection-Info header.

+1

>>> Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
>>> X-Complaints-To: https://www.astraweb.com/aup
>>> NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
>>> Date: Sun, 10 Mar 2024 06:07:02 GMT
>
> Genuine Highwinds headers.

I would say so.

--
"Gutta cavat lapidem." (Ovid)

Scott Dorsey <kludge@panix.com> wrote at 18:05 this Sunday (GMT):
> Ray Banana <rayban@raybanana.net> wrote:
>>Thus spake "Adam H. Kerman" <ahk@chinet.com>
>>
>>>>Forged Injection-Info header.
>>>>Genuine Highwinds headers.
>>
>>> Well, that sucks. Is there anyone to contact at Highwinds to get them to
>>> refuse proto articles with preloaded injection headers?
>>
>>Highwinds use their own proprietary server software and haven't yet
>>implemented the current standard RFCs 5536/5537, so this is NOT going to
>>happen any time soon. But, hey, the were the first to support 64-Bit
>>article numbers.
>
> That would seem a relatively easy thing to do. If there's a line in the
> incoming message that meets a given pattern, remove it. If they are running
> their own homebrew software it should be very easy to fix.
> --scott

Just test it with regex.
--
user <candycane> is generated from /dev/urandom

Sn!pe wrote:
> Apologies for top-posting
>
> I've crossposted this to news.admin.net-abuse.usenet
> where it is on-topic and likely to be of interest.
>
>
> Liz Tuddenham <liz@poppyrecords.invalid.invalid> wrote:
>
>> Alan B <alanrichardbarker@gmail.com.invalid> wrote:
>>
>>> It happened about 4pm today. I wonder how long it will take for the
>>> spammers to find other means of peddling their wares?
>>
>> Spammers are still appearing in <sci.electronics.design> with the path:
>>
>> Path:
>> uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npeer-n
>> g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.ams4!
>> peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTED!n
>> ot-for-mail
>> From: darius <manta103g@gmail.com>
>> Newsgroups: sci.electronics.design,free.spam
>> Subject: Off Topic Troll Alert! was: Re: European crash tester says
>> carmakers must bring back physical
>> Followup-To: alt.test.group
>> References: <us6a50$uuap$1@solani.org>
>> <l54mleF90jqU1@mid.individual.net>
>> Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
>> Injection-Info: reader02.eternal-september.org;
>> posting-host="aefae07b417003b570527823e77a9930";
>> logging-data="29200";
>> mail-complaints-to="abuse@eternal-september.org";
>> posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="
>> User-Agent: Xnews/2006.08.05
>> Lines: 25
>> Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
>> X-Complaints-To: https://www.astraweb.com/aup
>> NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
>> Date: Sun, 10 Mar 2024 06:07:02 GMT
>> X-Received-Bytes: 1936
>> Xref: uni-berlin.de sci.electronics.design:1579608
>> ~~~~~~
>>
>> These posts are just a constant stream of automated abuse appended to
>> nearly every post on the group. I thought responsible servers would
>> have put a stop to this sort of nonsense.
>
>

Is it just my mistaken impression, or has the amount of legitimate
traffic also dropped away since GG stopped contributing to the flood of
spam?

R Daneel Olivaw <Danny@hyperspace.vogon.gov> wrote:
>Is it just my mistaken impression, or has the amount of legitimate
>traffic also dropped away since GG stopped contributing to the flood of
>spam?

Not that I have seen in technical groups. Interestingly, the group
rec.arts.sf.fandom seems to have become extremely quiet even though few
of the posters were ever using google groups anyway.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 15 Mar 2024, R Daneel Olivaw <Danny@hyperspace.vogon.gov> posted some
news:ut22uc$b2qc$1@paganini.bofh.team:

> Sn!pe wrote:
>> Apologies for top-posting
>>
>> I've crossposted this to news.admin.net-abuse.usenet
>> where it is on-topic and likely to be of interest.
>>
>>
>> Liz Tuddenham <liz@poppyrecords.invalid.invalid> wrote:
>>
>>> Alan B <alanrichardbarker@gmail.com.invalid> wrote:
>>>
>>>> It happened about 4pm today. I wonder how long it will take for the
>>>> spammers to find other means of peddling their wares?
>>>
>>> Spammers are still appearing in <sci.electronics.design> with the
>>> path:
>>>
>>> Path:
>>> uni-berlin.de!fu-berlin.de!news.uni-stuttgart.de!npeer.as286.net!npee
>>> r-n
>>> g0.as286.net!peer03.ams1!peer.ams1.xlned.com!news.xlned.com!peer03.am
>>> s4!
>>> peer.am4.highwinds-media.com!news.highwinds-media.com!fx03.ams4.POSTE
>>> D!n ot-for-mail
>>> From: darius <manta103g@gmail.com>
>>> Newsgroups: sci.electronics.design,free.spam
>>> Subject: Off Topic Troll Alert! was: Re: European crash tester says
>>> carmakers must bring back physical
>>> Followup-To: alt.test.group
>>> References: <us6a50$uuap$1@solani.org>
>>> <l54mleF90jqU1@mid.individual.net>
>>> Injection-Date: Sun, 10 Mar 2024 01:07:02 -0000 (UTC)
>>> Injection-Info: reader02.eternal-september.org;
>>> posting-host="aefae07b417003b570527823e77a9930";
>>> logging-data="29200";
>>> mail-complaints-to="abuse@eternal-september.org";
>>> posting-account="U2FsdGVkX18QBXYPJWay5G0R7zD10mjY5gUD5xOvt6I="
>>> User-Agent: Xnews/2006.08.05
>>> Lines: 25
>>> Message-ID: <a6cHN.2008540$tl1.775242@usenetxs.com>
>>> X-Complaints-To: https://www.astraweb.com/aup
>>> NNTP-Posting-Date: Sun, 10 Mar 2024 06:07:02 UTC
>>> Date: Sun, 10 Mar 2024 06:07:02 GMT
>>> X-Received-Bytes: 1936
>>> Xref: uni-berlin.de sci.electronics.design:1579608
>>> ~~~~~~
>>>
>>> These posts are just a constant stream of automated abuse appended
>>> to nearly every post on the group. I thought responsible servers
>>> would have put a stop to this sort of nonsense.
>>
>>
>
> Is it just my mistaken impression, or has the amount of legitimate
> traffic also dropped away since GG stopped contributing to the flood
> of spam?

Absolutely it has. One particular group averaged over 200 legit posts per
day excluding spam and troll posts equaling 70-150+ daily.

Since the end of GG it is lucky to have 30 - 60 legit posts per day.

V Martin <vmartin@eod.org> wrote:
>Absolutely it has. One particular group averaged over 200 legit posts per
>day excluding spam and troll posts equaling 70-150+ daily.
>
>Since the end of GG it is lucky to have 30 - 60 legit posts per day.

What group is this? Is it a technical group?
And are you my former officemate Vernard?
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."