David Ritz <dritz@mindspring.com> writes:
Neodome appears to be just fine with this activity.
From: abuse@neodome.net
To: David Ritz <dritz@mindspring.com>
Date: Thu, 03 Jun 2021 03:38:45 -0500
Subject: Re: Flood: 100 forwarded messages...
On 2021-06-02 17:22, David Ritz wrote:
Please try harder.
Which Usenet client are you using? Please let me know and I'll help
you to set up filtering.
Just was trying to figure out which group out of four was the
target. Appear to be alt.checkmate. Someone didn't like Neodome users
posting there so I had to block access to that group for now.
I suggest that while client side filtering is not a remedy
Which client are you using? Please let me know and I'll help you set up >filtering - based on Message-ID or Newsgroups header.
, depeering certainly would help.
:-)
David, I've cut the crosspost to the email newsgroup and I fixed the
typo on Subject.
Neodome Admin <admin@neodome.net> wrote:
David Ritz <dritz@mindspring.com> writes:
Neodome appears to be just fine with this activity.
From: abuse@neodome.net
To: David Ritz <dritz@mindspring.com>
Date: Thu, 03 Jun 2021 03:38:45 -0500
Subject: Re: Flood: 100 forwarded messages...
On 2021-06-02 17:22, David Ritz wrote:
Please try harder.
Which Usenet client are you using? Please let me know and I'll help >>>>>you to set up filtering.
Just was trying to figure out which group out of four was the
target. Appear to be alt.checkmate. Someone didn't like Neodome users >>posting there so I had to block access to that group for now.
I suggest that while client side filtering is not a remedy
Which client are you using? Please let me know and I'll help you set up >>filtering - based on Message-ID or Newsgroups header.
Please stop it. I've occassionally been sympathetic with your position
of openness but each time there's a flood through your server, you
exhaust my patience.
I do kill file based on your server, and I've asked certain posters that
I read not to post through your server so I don't have to make
exceptions for them. With the exception of posters I'd been reading for
years before your server was set up, your users don't post on topic nor
do they make worthwhile contributions to discussion in groups that I read.
It takes a lot of resources and everyone else's to do this thanks to
allowing a flooding problem originating at your News site to continue unaddressed. You lose sympathy for the moral position you are supposedly taking.
, depeering certainly would help.
:-)
Caring about your own reputation would help even more.
"Adam H. Kerman" <ahk@chinet.com> writes:
Neodome Admin <admin@neodome.net> wrote:
David Ritz <dritz@mindspring.com> writes:
Neodome appears to be just fine with this activity.
From: abuse@neodome.net
To: David Ritz <dritz@mindspring.com>
Date: Thu, 03 Jun 2021 03:38:45 -0500
Subject: Re: Flood: 100 forwarded messages...
On 2021-06-02 17:22, David Ritz wrote:
Please try harder.
Which Usenet client are you using? Please let me know and I'll help >>>>>>you to set up filtering.
Just was trying to figure out which group out of four was the
target. Appear to be alt.checkmate. Someone didn't like Neodome users >>>posting there so I had to block access to that group for now.
I suggest that while client side filtering is not a remedy
Which client are you using? Please let me know and I'll help you set up >>>filtering - based on Message-ID or Newsgroups header.
Please stop it. I've occassionally been sympathetic with your position
of openness but each time there's a flood through your server, you
exhaust my patience.
Oh wow. I guess I should really feel sorry. I mean, exausting Adam's >patience. Who in their right mind would do that? Should I kill myself?..
Sorry Adam. We both know you never been sympathetic to my position. I
really doubt you're even able to explain what my position is.
As to the David Ritz, I will never believe that this guy have no idea
how to deal with a simple flood coming from a single source, directed to >groups he don't read.
I do kill file based on your server, and I've asked certain posters that
I read not to post through your server so I don't have to make
exceptions for them. With the exception of posters I'd been reading for >>years before your server was set up, your users don't post on topic nor
do they make worthwhile contributions to discussion in groups that I read.
Is that suppose to make me look bad? . . .
. . .
Quit that shit, man. You've been here long enough, you should know very
well what it's all about. There is no any "reputation" I'm gaining for
any of it. Instead, I'm being blamed by both sides of political
spectrum. I was already told that I'm receiving money from "Demonrats",
I was already threatened with all kind of shit, except probably
death. But I suspect I'll be soon enough.
It was the third time someone threatened me with "Usenet Death penalty." >That's why I used that smile. I should start saving Message-IDs, I
guess. "Reputation", lol.
As to the David Ritz, I will never believe that this guy have no
idea how to deal with a simple flood coming from a single source,
directed to groups he don't read.
I mean, yeah, it's pretty sad that open Usenet server is used to
bitch to the world about horrors of rival political opinions.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Saturday, 05 June 2021 12:57 -0000,
in article <s9fsc2$tk6$1@neodome.net>,
Neodome Admin <admin@neodome.net> wrote:
On Saturday, 05 June 2021 12:57 -0000, Neodome Admin wrote:
[...]
As to the David Ritz, I will never believe that this guy have no
idea how to deal with a simple flood coming from a single source,
directed to groups he don't read.
Your assumptions are bad and your clairvoyance quotient sucks, as does
mine. What I read or don't read is quite irrelevant to the problem.
Your recommendation of filtering shifts responsibility dealing with the >issues surrounding network abuse instances originating from
news.neodome.net. Man up and take responsibility for the problems
you and the implementation of your philosophy invite.
I have dealt with NewsAgent floods previously, as well as floods of
cancel messages, supersedes replacing legitimate posts with spam and
the issuance of $alz formatted preemptive cancels, using this Swiss
Army Knife of Usenet Abuse. NewsAgent was specifically designed to
exploit open proxies, as you saw for yourself, in the recent attack on >alt.checkmate and alt.slack. The apparent ability to switch proxies,
for each post, appears to be a fairly recent hack. Thanks for
including the posting-host information, for the second round of this
attack.
Thanks to the speed of news.neodome.net, the attack was somewhat
limited. In years past, I have observed more than 300k NewsAgent
generated porn spam posts, in a single twenty four hour period, via an
open AnalogX proxy running on a Videotron.ca home user's computer. >Personally, I do not miss those bad old days.
[...]
I mean, yeah, it's pretty sad that open Usenet server is used to
bitch to the world about horrors of rival political opinions.
This is the same lame excuse, used by hosting providers, for
infrastructure facilitating cybercrime operations. You and your
server are nothing new nor anything special.
Please consider moving news.neodome.net to an authenticated users only
setup. Intentionally running open servers seems an open invitation to
abuse.
- --
David Ritz <dritz@mindspring.com>
"There will be more spam." -- Paul Vixie
-----BEGIN PGP SIGNATURE-----
iF0EARECAB0WIQSc0FU3XAVGYDjSGUhSvCmZGhLe6wUCYLxGGAAKCRBSvCmZGhLe >64ATAKDHyYnjh6AmJ/0JP3iv4Y5T+9oeHgCg6YCUKwGgkotZdtS3wiqq12aJt0U=
=8A5X
-----END PGP SIGNATURE-----
Intentionally running open servers seems an open invitation to
abuse.
Il 06/06/21 05:50, David Ritz ha scritto:
Intentionally running open servers seems an open invitation to
abuse.
For about twenty years I have been administering a news server that intentionally allows all users to post without authentication.
Although in some rare circumstances my server has been involved in
some floods, it has always given few problems of massive abuse. The
few times it happened, I quickly fixed the problem.
IMHO, David, the problem is not the public news servers but the
people who manage them. The problem with neodome is not that it is
open without authentication but that it is poorly managed.
neodome simply does not react to abuse and this makes it dangerous
for the rest of the network and it is a good reason to ban it.
On Saturday, 05 June 2021 12:57 -0000,
in article <s9fsc2$tk6$1@neodome.net>,
Neodome Admin <admin@neodome.net> wrote:
On Saturday, 05 June 2021 12:57 -0000, Neodome Admin wrote:
[...]
As to the David Ritz, I will never believe that this guy have no
idea how to deal with a simple flood coming from a single source,
directed to groups he don't read.
Your assumptions are bad and your clairvoyance quotient sucks, as does
mine. What I read or don't read is quite irrelevant to the problem.
Your recommendation of filtering shifts responsibility dealing with the issues surrounding network abuse instances originating from
news.neodome.net. Man up and take responsibility for the problems
you and the implementation of your philosophy invite.
I have dealt with NewsAgent floods previously, as well as floods of
cancel messages, supersedes replacing legitimate posts with spam and
the issuance of $alz formatted preemptive cancels, using this Swiss
Army Knife of Usenet Abuse. NewsAgent was specifically designed to
exploit open proxies, as you saw for yourself, in the recent attack on alt.checkmate and alt.slack. The apparent ability to switch proxies,
for each post, appears to be a fairly recent hack. Thanks for
including the posting-host information, for the second round of this
attack.
Thanks to the speed of news.neodome.net, the attack was somewhat
limited.
In years past, I have observed more than 300k NewsAgent
generated porn spam posts, in a single twenty four hour period, via an
open AnalogX proxy running on a Videotron.ca home user's computer. Personally, I do not miss those bad old days.
[...]
I mean, yeah, it's pretty sad that open Usenet server is used to
bitch to the world about horrors of rival political opinions.
This is the same lame excuse, used by hosting providers, for
infrastructure facilitating cybercrime operations. You and your
server are nothing new nor anything special.
Please consider moving news.neodome.net to an authenticated users only
setup. Intentionally running open servers seems an open invitation to
abuse.
In my opinion, only people who were actually affected by the flood are
Google Groups users and those who are saving everything for archiving purposes. In case of Google Groups it's deliberate choice of Google to pretend that Usenet does not exist, so they intentially don't provide
their users with a client that have any Usenet-specific functionality
while also not doing any kind of moderation. In case of the guys doing archiving - I'm sorry, but 10 MBs of messages are not going to put a
dent on their racks of 8 TB HDDs. Since archives are requiring some
manual attention anyway, they can just come back to it whenever they
feel like it and get rid of that garbage. In case if 10 years later
someone will be interested, I'm saving Message-IDs belonging to the
flood.
FYI, I run a small personal/private server and keep the groups which I subscribe to 'forever' (which currently is some 18 years). I do not have "racks of 8 TB HDDs" and yes, a flood of 30k messages (in a single
group) *is* an rather big annoyance which I'd rather do without.
FWIW, sofar I've not been affected by floods from Neodome, but have
been affected by (10k articles) floods from Aioe.org. Same difference.
David Ritz <dritz@mindspring.com> writes:
On Saturday, 05 June 2021 12:57 -0000,
in article <s9fsc2$tk6$1@neodome.net>,
Neodome Admin <admin@neodome.net> wrote:
On Saturday, 05 June 2021 12:57 -0000, Neodome Admin wrote:
[...]
As to the David Ritz, I will never believe that this guy have no
idea how to deal with a simple flood coming from a single source,
directed to groups he don't read.
Your assumptions are bad and your clairvoyance quotient sucks, as
does mine. What I read or don't read is quite irrelevant to the
problem.
You're correct. But you were not correct when you claimed that it's impossible to filter it on the client side.
Your recommendation of filtering shifts responsibility dealing with
the issues surrounding network abuse instances originating from
news.neodome.net. Man up and take responsibility for the problems
you and the implementation of your philosophy invite.
Are there any, really?
Pretty much all Usenet servers use cleanfeed, and there are very
simple settings over there:
Because normally all articles from Neodome have single posting host,
I'm not sure why E-S is not using such filter, I guess that would be
the question for Ray.
The reason you and other Giganews users are seeing it is because
you're getting "uncensored" Usenet which is basically a stream of
data with headers that you're free do anything with. You're your own "censor", same as me - and considering your experience I'm pretty
sure you know what to do to get the data you want.
I have dealt with NewsAgent floods previously, as well as floods of
cancel messages, supersedes replacing legitimate posts with spam
and the issuance of $alz formatted preemptive cancels,
using this
Swiss Army Knife of Usenet Abuse. NewsAgent was specifically
designed to exploit open proxies, as you saw for yourself, in the
recent attack on alt.checkmate and alt.slack. The apparent ability
to switch proxies, for each post, appears to be a fairly recent
hack. Thanks for including the posting-host information, for the
second round of this attack.
It actually was a bad thing. More articles were able to pass the
filters because of constantly changing injection point.
Thanks to the speed of news.neodome.net, the attack was somewhat
limited.
That's intentional. Neodome is constantly slowing the posting rate
from any single IP address if it keeps posting.
In years past, I have observed more than 300k NewsAgent generated
porn spam posts, in a single twenty four hour period, via an open
AnalogX proxy running on a Videotron.ca home user's computer.
Personally, I do not miss those bad old days.
It's not the "old days" anymore. 30k messages that came from
Neodome, 300k messages from Videotron.ca, even 3m messages - all are
small numbers, barely noticeable, actually. I didn't even bothered
to run htop, but I bet if I would in the middle of flood, my server
load would be probably same as usual, which is around 5%. Usual
amout of messages Neodome receives daily is around
500,000-1,000,000, and I expect it to easily handle 10x that amount. Commercial Usenet providers can handle hundreds time more, and won't
even notice the difference.
There were several attacks on my server in the last few years, for
example, just recently someone tried to open hundreds of thousands
of connections, but failed miserably because he ran out of resources
before I did. I didn't even bother to check his IP address.
If not for whiners, I would just let it all run and let the filters
take care of everything.
The only legit complain I heard so far was from Adam, and he was
saying that such flood is effectively a DoS attack against smaller
servers. I, however, disagree. [...]
[...]
I mean, yeah, it's pretty sad that open Usenet server is used to
bitch to the world about horrors of rival political opinions.
This is the same lame excuse, used by hosting providers, for
infrastructure facilitating cybercrime operations. You and your
server are nothing new nor anything special.
Please consider moving news.neodome.net to an authenticated users
only setup. Intentionally running open servers seems an open
invitation to abuse.
Well, at least you're not saying I'm the cybercriminal. That's
something.
I've seen your last email, and I appreciate that you're willing to
help. I am, however, is not willing to use outside services such as spamhaus.org, because they will never supply me with their full
database, and I'm not going to supply them with IPs of my users to
check against their database. That's going against everything I'm
standing for.
Please don't take it wrong. If I realise that Neodome is a source of
problem that cannot be simply filtered out I'll probably turn off
posting and make Neodome a peering only server. But currently I
don't see anything like that. How many seconds did it take for you
to filter them out once you opened affected group? 0.1?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Wednesday, 09 June 2021 06:00 -0000,
in article <s9pldp$t8j$1@neodome.net>,
Neodome Admin <admin@neodome.net> wrote:
David Ritz <dritz@mindspring.com> writes:
On Saturday, 05 June 2021 12:57 -0000,
in article <s9fsc2$tk6$1@neodome.net>,
Neodome Admin <admin@neodome.net> wrote:
On Saturday, 05 June 2021 12:57 -0000, Neodome Admin wrote:
[...]
As to the David Ritz, I will never believe that this guy have no
idea how to deal with a simple flood coming from a single source,
directed to groups he don't read.
Your assumptions are bad and your clairvoyance quotient sucks, as
does mine. What I read or don't read is quite irrelevant to the
problem.
You're correct. But you were not correct when you claimed that it's
impossible to filter it on the client side.
You are putting words in my mouth^W fingers. I never claimed it was >impossible to filter. When you recommended client side filtering as a >solution, I replied:
<quote>
Network abuse is not a client side issue. Please take action to
mitigate this NewsAgent spew.
</quote>
I stand by my words. Your loose interpretation is an outright >misrepresentation of the exchange. You assume too much, while
ignoring the the heart of the matter entirely. Only by making
patently false assertions are you able to try to deflect from the
issue of network abuse, through a quite lame attempt at deflection.
Your recommendation of filtering shifts responsibility dealing with
the issues surrounding network abuse instances originating from
news.neodome.net. Man up and take responsibility for the problems
you and the implementation of your philosophy invite.
Are there any, really?
Are there any what? Responsibilities?
Indeed, as it was your recommendation of client side filtering, as a >solution, which prompted me into this discussion. Your failure to
respond immediately upon notification, to shut down the attack, and
instead attempting to shift responsibility to the operators of every
NNTP node on the network, and to their users, is the subject at hand.
Pretty much all Usenet servers use cleanfeed, and there are very
simple settings over there:
Please see my header comment regarding assumptions. Your assumptions
are quite simply fallacious. The result of basing your arguments upon
false premises renders them moot. Your assertion regarding the
ubiquity of INN demonstrates a quite parochial perspective and
provincial attitude.
Many servers running INN also run cleanfeed. How well maintained they
are, on any particular site, is open to conjecture.
Too few other NNTP server software solutions are devised to
accommodate cleanfeed. Are you aware, for example, there are still
people out there, who run Microsoft news server enterprise solution
software? These things respond to only the most minimal of NNTP
commands. They do not even support queries of any type.
Do you understand that where many ISPs used to provide NNTP services
using HighWinds server software? Most no longer provide this service.
The server software was incapable of user authentication and were open
to any IP address on their subnets, including hijacked proxies
running on home users computers, most often installed by malware..
What about other leaf node servers?
There are some pretty significant news sites, which do not run
IneterNetNews. Two of the servers I access on a regular basis do not, >including the service from which I primarily read news and the one via
which this post originates.
Then, of course, there is the lowest common denominator of Usenet
access providers, groups.google.com, where you can rest assured the
entire flood is archived. You can find NewsAgent floods similarly
archived in the Google Usenet archive, which date back decades. That
in no way excuses the abuse and points to the importance of
preventing it. Once it begins, it is imperative that it gets shut
down, just as quickly as possible.
[ snip cleanfeed specific comments, as irrelevant to the underlying
abuse issue ]
Because normally all articles from Neodome have single posting host,
[snip]
This would seem to have been another false assumption, in this case.
Is this your first experience with NewsAgent? The flooding, which
nicked news.neodome.net, has be in progress for at least two decades.
I'm not sure why E-S is not using such filter, I guess that would be
the question for Ray.
It's not your place to pose the question. You are out of line.
The reason you and other Giganews users are seeing it is because
you're getting "uncensored" Usenet which is basically a stream of
data with headers that you're free do anything with. You're your own
"censor", same as me - and considering your experience I'm pretty
sure you know what to do to get the data you want.
It seems you need to review the definition of 'censor'. Dropping
thousands of word salad NewsAgent posts is not an infringement upon
speech, as it was neither speech nor communication of any kind. It is
just noise. Filtering noise has nothing to do with the suppression of >information or ideas. Flooding of this nature is akin to the state
sponsored jamming of radio signals, to censor broadcasts and prevent
the dissemination of information.
Preventing this crap from ever entering the news stream actually
improves communication. In case you had not noticed, communication --
for some value of communication -- is the primary purpose of text
newsgroups.
I read news from giganews.com servers, as it is included with one of
my ISP accounts. I choose to read from a full feed, specifically so I
can see, recognize and try to deal with network abuse incidents.
That is my choice. It is what I did, when reporting this specific
flooding incident to you. You seemed to shrug it off, as if it was
not your problem.
I have dealt with NewsAgent floods previously, as well as floods of
cancel messages, supersedes replacing legitimate posts with spam
and the issuance of $alz formatted preemptive cancels,
<correction>
These were not cancel messages. Although they were posted to
control.cancel, and include Subjects beginning, "cmsg cancel," they
included no Control header. They were intended to prevent the posting
of cyberspam cancels using $alz M-IDs. This led to the creation of
the $alz2 format. See the Cancel Messages FAQ: >http://wiki.killfile.org/projects/usenet/faqs/cancel/
</correction>
using this
Swiss Army Knife of Usenet Abuse. NewsAgent was specifically
designed to exploit open proxies, as you saw for yourself, in the
recent attack on alt.checkmate and alt.slack. The apparent ability
to switch proxies, for each post, appears to be a fairly recent
hack. Thanks for including the posting-host information, for the
second round of this attack.
It actually was a bad thing. More articles were able to pass the
filters because of constantly changing injection point.
I hope this was a learning experience.
Thanks to the speed of news.neodome.net, the attack was somewhat
limited.
That's intentional. Neodome is constantly slowing the posting rate
from any single IP address if it keeps posting.
That sounds like the Dave Hayes logarithmic back-off patch. It, too,
was easily defeated by switching IP addresses. In the specific
instance I recall, it was being accomplished from a dial-up, posting
no more than a handful of spammed articles, before disconnecting, >reconnecting and repeating, 24*7.
In years past, I have observed more than 300k NewsAgent generated
porn spam posts, in a single twenty four hour period, via an open
AnalogX proxy running on a Videotron.ca home user's computer.
Personally, I do not miss those bad old days.
It's not the "old days" anymore. 30k messages that came from
Neodome, 300k messages from Videotron.ca, even 3m messages - all are
small numbers, barely noticeable, actually. I didn't even bothered
to run htop, but I bet if I would in the middle of flood, my server
load would be probably same as usual, which is around 5%. Usual
amout of messages Neodome receives daily is around
500,000-1,000,000, and I expect it to easily handle 10x that amount.
Commercial Usenet providers can handle hundreds time more, and won't
even notice the difference.
Frankly, no one give a flying fig about your resource load. Site
operators and users are concerned with your willingness to shift the
load to them.
Old days or not, there is no respectable reason to allow network
abuse, by default, whether with respect to spamming, spewing or
forgery. (It was a forgery of Archimedes Plutonium which first
alerted me to news.neodome.net, although it is unlikely Archie Pu has
the acumen to formulate a cogent or coherent abuse report. See >n.a.n-a.misc.)
There were several attacks on my server in the last few years, for
example, just recently someone tried to open hundreds of thousands
of connections, but failed miserably because he ran out of resources
before I did. I didn't even bother to check his IP address.
The attack you describe is unrelated to the emission of a flood
originated via news.neodome.net.
If not for whiners, I would just let it all run and let the filters
take care of everything.
That is some kind of attitude you have.
[snip comments regarding Google Groups]
The only legit complain I heard so far was from Adam, and he was
saying that such flood is effectively a DoS attack against smaller
servers. I, however, disagree. [...]
Are you suggesting that the reports I sent you were somehow
illegitimate? These were not complaints. They were reports of an
ongoing network abuse incident. All that I asked of you, was that you
please take action. The reports, themself, consisted solely of sample
spew, with full and complete headers.
[...]
I mean, yeah, it's pretty sad that open Usenet server is used to
bitch to the world about horrors of rival political opinions.
This is the same lame excuse, used by hosting providers, for
infrastructure facilitating cybercrime operations. You and your
server are nothing new nor anything special.
Please consider moving news.neodome.net to an authenticated users
only setup. Intentionally running open servers seems an open
invitation to abuse.
Well, at least you're not saying I'm the cybercriminal. That's
something.
I've seen your last email, and I appreciate that you're willing to
help. I am, however, is not willing to use outside services such as
spamhaus.org, because they will never supply me with their full
database, and I'm not going to supply them with IPs of my users to
check against their database. That's going against everything I'm
standing for.
The Spamhaus data feed, a subscription service, would include those
items providing 127.0.0.4 DNS responses. These identify the
compromised hosts used in this specific attack. Again, I'll note, all
of the IP addresses which I checked, when you provided posting-host >information in later flood headers, were included in the Spamhaus XBL
zone.
https://www.spamhaus.org/xbl/
https://www.spamhaus.org/datafeed/
Using proxies is not a network abuse issue; hijacking compromised
hosts is, more so to perpetrate attacks on the network's
infrastructure.
[...]
Please don't take it wrong. If I realise that Neodome is a source of
problem that cannot be simply filtered out I'll probably turn off
posting and make Neodome a peering only server. But currently I
don't see anything like that. How many seconds did it take for you
to filter them out once you opened affected group? 0.1?
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview >headers, at a bare minimum. Downloading thousands of XOVER headers of
noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
- --
David Ritz <dritz@mindspring.com>
"The first principle of a free society is an untrammeled flow of
words in an open forum." - Adlai Stevenson (1900-1965)
-----BEGIN PGP SIGNATURE-----
iF0EARECAB0WIQSc0FU3XAVGYDjSGUhSvCmZGhLe6wUCYMGkXAAKCRBSvCmZGhLe >61nLAKC0iw7Uc7Q1xFjRJ8KPlEaS+QH7EACgqODe2t/2Sm/nubvQL7FO+BzIR9I=
=eCLL
-----END PGP SIGNATURE-----
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview headers, at a bare minimum. Downloading thousands of XOVER headers of
noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
Il 09/06/21 20:58, Frank Slootweg ha scritto:
FWIW, sofar I've not been affected by floods from Neodome, but have
been affected by (10k articles) floods from Aioe.org. Same difference.
have you reported that abuse to aioe.org abuse desk?
newsmasters react when someone alerts them about a running flood.
BTW last time, in march, only a few thousand of nonsense messages were
sent through my server before being stopped. Abuse were blocked as soon
as it was reported (a few hours after the beginning).
you should consider that it is not possible to prevent an user from
flooding a group using a list of open proxies, the only possible countermeasure is to stop him as soon as possible.
David Ritz <dritz@mindspring.com> wrote:
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview headers, at a bare minimum. Downloading thousands of XOVER headers of noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
I?m not going to comment on everything you said, at least not now.
However, I would like to say that since so many people are determined that it?s a DoS attack, I have no choice but to admit that my idea of what
Usenet is is apparently quite different than what most people think.
I?ll turn the posting off, for now partially, and then completely.
Unwanted sites in Path [Top 20]:
Site Count news.neodome.net 827
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[ news.admin.peering removed ]
We (TINW) got the message, the very first time you posted your
unsuported and nonsensical whine. You continue to flog a deceased
equine. If you hadn't noticed, most individuals participating in this >newsgroups can not only find the headers, they can read and understand
them.
If you want to play with the big kids, act as though you are one.
Otherwise, please climb in your TARDIS and fuck off. Your attempted >"contributions" will not be missed in some quarters.
HTH. HAND.
In article <alpine.OSX.2.20.2106102053460.17522@mako.ath.cx>,
David Ritz <dritz@mindspring.com> wrote:
[ news.admin.peering removed ]
We (TINW) got the message, the very first time you posted your
unsupported and nonsensical whine. You continue to flog a deceased
equine. If you hadn't noticed, most individuals participating in
this newsgroups can not only find the headers, they can read and
understand them.
If you want to play with the big kids, act as though you are one.
Otherwise, please climb into your TARDIS and fuck off. Your
attempted "contributions" will not be missed in some quarters.
HTH. HAND.
Shake.
But this is not neodome.
It will tke a group efforts to do in Google.
</restored>Dave, now kindly do us (TINU) a favor, and do the same with these
sites, so you can cease your spam reposts in n.a.n-a.usenet.
postnews.google.com
google-groups.googlegroups.com
If we want to depeer google,
you have to convience their peers to do so.
While i am at is, my news.admin.peering has disappeared from my
active and newsgroup file.
David Ritz <dritz@mindspring.com> wrote:
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview
headers, at a bare minimum. Downloading thousands of XOVER headers of
noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
I’m not going to comment on everything you said, at least not now.
However, I would like to say that since so many people are determined that it’s a DoS attack, I have no choice but to admit that my idea of what Usenet is is apparently quite different than what most people think.
I’ll turn the posting off, for now partially, and then completely.
On 6/10/2021 8:54 AM, Neodome Admin wrote:
David Ritz <dritz@mindspring.com> wrote:
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview
headers, at a bare minimum. Downloading thousands of XOVER headers of
noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
I’m not going to comment on everything you said, at least not now.
However, I would like to say that since so many people are determined that
it’s a DoS attack, I have no choice but to admit that my idea of what
Usenet is is apparently quite different than what most people think.
I’ll turn the posting off, for now partially, and then completely.
Why don't you just limit posts to 100 per 3 hour period, across all groups.
Or even more.
David Ritz <dritz@mindspring.com> wrote:
news.neodome.net is killfiled in two out of five or six news clients I
use, but is not for this user agent. In any case, user agents, for
which killfiles operate, still require downloading all of the overview
headers, at a bare minimum. Downloading thousands of XOVER headers of
noise is a waste of my resources and time. That you seem to think
little of it, suggests you are not a particularly good Usenet
neighbor.
Be conservative in what you send, be liberal in what you accept.
I’m not going to comment on everything you said, at least not now.
However, I would like to say that since so many people are determined that it’s a DoS attack, I have no choice but to admit that my idea of what Usenet is is apparently quite different than what most people think.
I’ll turn the posting off, for now partially, and then completely.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 295 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 01:13:01 |
| Calls: | 6,642 |
| Calls today: | 2 |
| Files: | 12,190 |
| Messages: | 5,325,419 |
