• Anyone else notice a lot of strange posts?

    From WolfFan@21:1/5 to All on Thu Nov 23 10:21:44 2023
    I’m seeing posts in non-latin writing systems, particularly Hebrew and Arabic. They appear to be posted using Google Groups, and contain lots of anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Scott Dorsey@21:1/5 to akwolffan@zoho.com on Thu Nov 23 15:50:20 2023
    In article <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>,
    WolfFan <akwolffan@zoho.com> wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and >Arabic. They appear to be posted using Google Groups, and contain lots of >anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.


    Yes, there is currently a massive spam run coming from GG and it has been
    going on for a couple weeks now to the point where Google is actually
    doing something about it. Mind you, they are doing useless and ineffective things, but something.

    I believe your news admins are acceping nocem cancels so you are probably seeing a lot less of this than people on sites that don't. But a killfile
    will help a whole lot to remove the remaining ones since they have pretty
    clear spam signatures.
    --scott
    --
    "C'est un Nagra. C'est suisse, et tres, tres precis."

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul S Person@21:1/5 to All on Thu Nov 23 09:02:58 2023
    On Thu, 23 Nov 2023 10:21:44 -0500, WolfFan <akwolffan@zoho.com>
    wrote:

    I’m seeing posts in non-latin writing systems, particularly Hebrew and >Arabic. They appear to be posted using Google Groups, and contain lots of >anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    Spam.

    Been pickin' those out of my teeth for a long time now.

    My Usenet Filters list is very long, with "?" as the most common
    letter by far.
    --
    "Here lies the Tuscan poet Aretino,
    Who evil spoke of everyone but God,
    Giving as his excuse, 'I never knew him.'"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Lynn McGuire@21:1/5 to WolfFan on Thu Nov 23 15:28:17 2023
    On 11/23/2023 9:21 AM, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and Arabic. They appear to be posted using Google Groups, and contain lots of anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    Ray Banana (the Eternal-September (E-S) owner and admin) has been
    leading the fight to get rid of the Thai and other non-English spam.
    The spammer is not doing it for money, he is doing to taunt people. Ray
    has been doing a great job and hacking up his news server software and
    cluster like crazy.

    Ray found another backdoor into his news server cluster Tuesday using
    UUCP and slammed that shut so he may have gotten rid of it for the moment.

    Unfortunately, Ray's solution using Spam Assassin is having a problem
    with false positives. I have alerted Ray to a problem with a posting
    from Ahasuerus getting deleted yesterday but I am not sure that Ray can
    fix it as the posting was 95% quoted and that is a trigger for SA.

    Lynn

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From petertrei@gmail.com@21:1/5 to WolfFan on Thu Nov 23 15:16:10 2023
    On Thursday, November 23, 2023 at 10:22:01 AM UTC-5, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and Arabic. They appear to be posted using Google Groups, and contain lots of anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    If your newsreader has a decent killfile feature, kill on the Subject containing any of several common Thai characters.

    Pt

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Titus G@21:1/5 to pete...@gmail.com on Fri Nov 24 14:37:19 2023
    On 24/11/23 12:16, pete...@gmail.com wrote:
    On Thursday, November 23, 2023 at 10:22:01 AM UTC-5, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and
    Arabic. They appear to be posted using Google Groups, and contain lots of
    anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    If your newsreader has a decent killfile feature, kill on the Subject containing any of several common Thai characters.

    Pt

    I just checked my Eternal September killfile log and there has been no
    Thai spam for a few days now.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From WolfFan@21:1/5 to Lynn McGuire on Fri Nov 24 00:02:38 2023
    On Nov 23, 2023, Lynn McGuire wrote
    (in article <ujog5i$1vuc9$1@dont-email.me>):

    On 11/23/2023 9:21 AM, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and Arabic. They appear to be posted using Google Groups, and contain lots of anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    Ray Banana (the Eternal-September (E-S) owner and admin) has been
    leading the fight to get rid of the Thai and other non-English spam.
    The spammer is not doing it for money, he is doing to taunt people.

    interesting. It’s rather ineffectual as both spam and taunts when it is so easily detected (at least when using a newsreader like the Hog) and instantly killable, even if you don’t use a killfile for it. I had a look at one, killed it, scanned the list of available posts, selected posts similar,
    killed them. Took less than 5 minutes. I kill new posts as necessary, takes less than 5 seconds. If I get tired of killing posts by hand, I’ll add a
    line or two to the killfile. All that m’man is doing is convincing me that he’s not real bright.
    Ray
    has been doing a great job and hacking up his news server software and cluster like crazy.

    Ray found another backdoor into his news server cluster Tuesday using
    UUCP and slammed that shut so he may have gotten rid of it for the moment.

    Unfortunately, Ray's solution using Spam Assassin is having a problem
    with false positives. I have alerted Ray to a problem with a posting
    from Ahasuerus getting deleted yesterday but I am not sure that Ray can
    fix it as the posting was 95% quoted and that is a trigger for SA.

    Lynn

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Lynn McGuire@21:1/5 to WolfFan on Thu Nov 23 23:44:45 2023
    On 11/23/2023 11:02 PM, WolfFan wrote:
    On Nov 23, 2023, Lynn McGuire wrote
    (in article <ujog5i$1vuc9$1@dont-email.me>):

    On 11/23/2023 9:21 AM, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and >>> Arabic. They appear to be posted using Google Groups, and contain lots of >>> anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    Ray Banana (the Eternal-September (E-S) owner and admin) has been
    leading the fight to get rid of the Thai and other non-English spam.
    The spammer is not doing it for money, he is doing to taunt people.

    interesting. It’s rather ineffectual as both spam and taunts when it is so easily detected (at least when using a newsreader like the Hog) and instantly killable, even if you don’t use a killfile for it. I had a look at one, killed it, scanned the list of available posts, selected posts similar, killed them. Took less than 5 minutes. I kill new posts as necessary, takes less than 5 seconds. If I get tired of killing posts by hand, I’ll add a line or two to the killfile. All that m’man is doing is convincing me that he’s not real bright.
    Ray
    has been doing a great job and hacking up his news server software and
    cluster like crazy.

    Ray found another backdoor into his news server cluster Tuesday using
    UUCP and slammed that shut so he may have gotten rid of it for the moment. >>
    Unfortunately, Ray's solution using Spam Assassin is having a problem
    with false positives. I have alerted Ray to a problem with a posting
    from Ahasuerus getting deleted yesterday but I am not sure that Ray can
    fix it as the posting was 95% quoted and that is a trigger for SA.

    Lynn

    The conversations by Ray and the other usenet admins on eternal-september.support have been very interesting for the last two or
    three weeks. And so glad that I do not have my own usenet server. I
    homed my corporate email domain on top of gmail two decades ago and
    never regretted it.

    Lynn

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul S Person@21:1/5 to lynnmcguire5@gmail.com on Fri Nov 24 08:14:29 2023
    On Thu, 23 Nov 2023 15:28:17 -0600, Lynn McGuire
    <lynnmcguire5@gmail.com> wrote:

    On 11/23/2023 9:21 AM, WolfFan wrote:
    I’m seeing posts in non-latin writing systems, particularly Hebrew and
    Arabic. They appear to be posted using Google Groups, and contain lots of
    anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    Ray Banana (the Eternal-September (E-S) owner and admin) has been
    leading the fight to get rid of the Thai and other non-English spam.
    The spammer is not doing it for money, he is doing to taunt people. Ray
    has been doing a great job and hacking up his news server software and >cluster like crazy.

    Ray found another backdoor into his news server cluster Tuesday using
    UUCP and slammed that shut so he may have gotten rid of it for the moment.

    Unfortunately, Ray's solution using Spam Assassin is having a problem
    with false positives. I have alerted Ray to a problem with a posting
    from Ahasuerus getting deleted yesterday but I am not sure that Ray can
    fix it as the posting was 95% quoted and that is a trigger for SA.

    That can be tricky.

    My former ISP once treated /it's own monthly billing reminder/ as
    spam.

    The things you find in an ISP's spam folder can be ... very
    interesting. To look at, not to open. Unless they clearly are legit.
    --
    "Here lies the Tuscan poet Aretino,
    Who evil spoke of everyone but God,
    Giving as his excuse, 'I never knew him.'"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Scott Dorsey@21:1/5 to pete...@gmail.com on Fri Nov 24 17:14:59 2023
    In article <01ffe2c3-78db-4a06-9136-3e50d3110987n@googlegroups.com>, pete...@gmail.com <petertrei@gmail.com> wrote:
    On Thursday, November 23, 2023 at 10:22:01=E2=80=AFAM UTC-5, WolfFan wrote:
    I=E2=80=99m seeing posts in non-latin writing systems, particularly Hebre= >w and=20
    Arabic. They appear to be posted using Google Groups, and contain lots of= >=20
    anomymised links which I, for one, ain=E2=80=99t gonna click on.=20
    =20
    I just killed a whole bunch of them.

    If your newsreader has a decent killfile feature, kill on the Subject=20 >containing any of several common Thai characters.

    That is effective for this group, but comp.os.vms and comp.protocols.time.ntp are being flooded with English and Malay posts which cannot be killed just
    by rejecting specific characters or rejecting all UTF-8 posts. The actual problem is wider than one group.

    It's severe enough that someone at Google has actually noticed that they have Usenet service still.
    --scott
    --
    "C'est un Nagra. C'est suisse, et tres, tres precis."

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Scott Dorsey@21:1/5 to bcfd36@cruzio.com on Fri Nov 24 19:09:59 2023
    In article <ujqqtg$2e6a3$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote:

    I am seeing things like the quoted text below in my feed. I use >eternal-September so maybe I am seeing Spam Assassin stuff. I know I
    have not been able to see one or two of my posts that others have seen.

    Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail >> From: Lynn McGuire <lynnmcguire5@gmail.com>
    Newsgroups: rec.arts.sf.written
    Subject: Re: Anyone else notice a lot of strange posts?
    Date: Thu, 23 Nov 2023 23:44:45 -0600
    Organization: A noiseless patient Spider
    Lines: 46
    Message-ID: <ujpd8f$27b71$1@dont-email.me>
    References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
    <ujog5i$1vuc9$1@dont-email.me>
    <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8; format=flowed
    Content-Transfer-Encoding: 8bit
    Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
    Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
    logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
    User-Agent: Mozilla Thunderbird
    Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
    In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
    Content-Language: en-US
    Xref: news.eternal-september.org rec.arts.sf.written:613026


    All of this looks perfectly normal (except in that the post is
    MIME-encoded, which is kind of rude but perfectly allowed). What are
    you thinking is a problem here?

    I am also adding these extra lines to see if my message DOESN'T get
    caught up in SA.

    What extra lines are you adding and why would you think your messages
    would ever get caught up in Spamasassin? You aren't posting from
    Google Groups.

    If what was said previously is true, quoting a message that quotes text
    that goes 6 deep in other messages and just adding "I agree" to your
    message will trip the eternal-september SA filter.

    I don't know, because I don't know how eternal-september is filtering
    messages from their customers, and it probably changes on a daily basis.
    In this case the issue isn't how they filter messages from their customers
    but how they filter messages from Google Groups, since that is where all
    the spam (really, where all spam period) originates.

    Is anyone else seeing message header data in any of the messages they
    are reading?

    I see message header data in every message I read, and have for the past
    forty years now. It's important.

    I am very confused about what you think your problem is.
    --scott
    --
    "C'est un Nagra. C'est suisse, et tres, tres precis."

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dave@21:1/5 to Lynn McGuire on Fri Nov 24 10:44:00 2023
    On 11/23/23 21:44, Lynn McGuire wrote:
    In article <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>,
    WolfFan <akwolffan@zoho.com> wrote:

    [stuff deleted

    I just killed a whole bunch of them.


    [more stuff deleted
    things, but something.


    I am seeing things like the quoted text below in my feed. I use eternal-September so maybe I am seeing Spam Assassin stuff. I know I
    have not been able to see one or two of my posts that others have seen.

    Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Lynn McGuire <lynnmcguire5@gmail.com>
    Newsgroups: rec.arts.sf.written
    Subject: Re: Anyone else notice a lot of strange posts?
    Date: Thu, 23 Nov 2023 23:44:45 -0600
    Organization: A noiseless patient Spider
    Lines: 46
    Message-ID: <ujpd8f$27b71$1@dont-email.me>
    References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
    <ujog5i$1vuc9$1@dont-email.me>
    <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit
    Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
    Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
    logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
    User-Agent: Mozilla Thunderbird
    Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
    In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com> Content-Language: en-US
    Xref: news.eternal-september.org rec.arts.sf.written:613026


    [more stuff deleted]

    Unfortunately, Ray's solution using Spam Assassin is having a problem
    with false positives. I have alerted Ray to a problem with a posting
    I believe your news admins are acceping nocem cancels so you are probably seeing a lot less of this than people on sites that don't. But a killfile will help a whole lot to remove the remaining ones since they have pretty clear spam signatures.
    --scott

    I use Thunderbird as newsreader and am not having any luck yet in
    pulling "other" criteria out of the customizable filters. I'm going to
    play with that today.

    I am also adding these extra lines to see if my message DOESN'T get
    caught up in SA.

    If what was said previously is true, quoting a message that quotes text
    that goes 6 deep in other messages and just adding "I agree" to your
    message will trip the eternal-september SA filter.

    Is anyone else seeing message header data in any of the messages they
    are reading?

    --
    Dave Scruggs
    Captain, Boulder Creek Fire (Retired)
    Sr. Software Engineer (Retired, mostly)

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dave@21:1/5 to Scott Dorsey on Fri Nov 24 11:46:44 2023
    On 11/24/23 11:09, Scott Dorsey wrote:
    In article <ujqqtg$2e6a3$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote:

    I am seeing things like the quoted text below in my feed. I use
    eternal-September so maybe I am seeing Spam Assassin stuff. I know I
    have not been able to see one or two of my posts that others have seen.

    Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail >>> From: Lynn McGuire <lynnmcguire5@gmail.com>
    Newsgroups: rec.arts.sf.written
    Subject: Re: Anyone else notice a lot of strange posts?
    Date: Thu, 23 Nov 2023 23:44:45 -0600
    Organization: A noiseless patient Spider
    Lines: 46
    Message-ID: <ujpd8f$27b71$1@dont-email.me>
    References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
    <ujog5i$1vuc9$1@dont-email.me>
    <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8; format=flowed
    Content-Transfer-Encoding: 8bit
    Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
    Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
    logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
    User-Agent: Mozilla Thunderbird
    Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
    In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
    Content-Language: en-US
    Xref: news.eternal-september.org rec.arts.sf.written:613026


    All of this looks perfectly normal (except in that the post is
    MIME-encoded, which is kind of rude but perfectly allowed). What are
    you thinking is a problem here?

    I am also adding these extra lines to see if my message DOESN'T get
    caught up in SA.

    What extra lines are you adding and why would you think your messages
    would ever get caught up in Spamasassin? You aren't posting from
    Google Groups.

    If what was said previously is true, quoting a message that quotes text
    that goes 6 deep in other messages and just adding "I agree" to your
    message will trip the eternal-september SA filter.

    I don't know, because I don't know how eternal-september is filtering messages from their customers, and it probably changes on a daily basis.
    In this case the issue isn't how they filter messages from their customers but how they filter messages from Google Groups, since that is where all
    the spam (really, where all spam period) originates.

    Is anyone else seeing message header data in any of the messages they
    are reading?

    I see message header data in every message I read, and have for the past forty years now. It's important.

    I am very confused about what you think your problem is.
    --scott
    None of the header data has EVER shown up in text body of incoming
    messages prior to a few weeks ago. If you will notice, the header data
    is shown in the quoted area of a previous message. This is not normal.

    So, my problem is that header data from deleted messages is showing up
    in the body text of other messages. Messages from me and other users are
    not showing up but when this happens, header data will show up in the
    body of other messages. THAT is my problem.

    Try not to be condescending. I've been doing this a long time.

    --
    Dave Scruggs
    Captain, Boulder Creek Fire (Retired)
    Sr. Software Engineer (Retired, mostly)

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Scott Dorsey@21:1/5 to bcfd36@cruzio.com on Fri Nov 24 20:23:44 2023
    In article <ujquj4$2ep1a$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote: >None of the header data has EVER shown up in text body of incoming
    messages prior to a few weeks ago. If you will notice, the header data
    is shown in the quoted area of a previous message. This is not normal.

    A carriage return is the separator between the header and the message text.
    If there is a spurious carriage return in the file, or if your newsreader is seeing something else as a carriage return that is not, then this will
    happen.

    So, my problem is that header data from deleted messages is showing up
    in the body text of other messages. Messages from me and other users are
    not showing up but when this happens, header data will show up in the
    body of other messages. THAT is my problem.

    You should email your news provider and be VERY SPECIFIC about what newsreader you are using. Not just Thunderbird, but specifically what version of Thunderbird you are using. Point out that some messages are showing up
    this way and give them the message-ids of some examples. Don't talk about cancellation or anything related. Just tell them when you started seeing them, which ones they are, what newsreader you are using, and how your newsreader
    is displaying them differently than other messages.

    Try not to be condescending. I've been doing this a long time.

    Then describe the problem and ask the question instead of just saying
    "I see this" without explaining what is wrong.
    --scott

    --
    "C'est un Nagra. C'est suisse, et tres, tres precis."

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Titus G@21:1/5 to Dave on Sat Nov 25 11:53:01 2023
    On 25/11/23 08:46, Dave wrote:
    snip
    None of the header data has EVER shown up in text body of incoming
    messages prior to a few weeks ago. If you will notice, the header data
    is shown in the quoted area of a previous message. This is not normal.

    So, my problem is that header data from deleted messages is showing up
    in the body text of other messages. Messages from me and other users are
    not showing up but when this happens, header data will show up in the
    body of other messages. THAT is my problem.

    snip

    This happens to me very infrequentlyly and has done for some years.
    Sometimes, messages that I have kept to read later have been replaced
    with junk like that from messages that I have deleted. I remain clueless
    as to why and as it is a rare occurrence, I have not pursued a remedy.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Default User@21:1/5 to WolfFan on Sun Nov 26 08:07:23 2023
    WolfFan wrote:

    I’m seeing posts in non-latin writing systems, particularly Hebrew
    and Arabic. They appear to be posted using Google Groups, and contain
    lots of anomymised links which I, for one, ain’t gonna click on.

    I just killed a whole bunch of them.

    No, between ES's and my own filters I didn't get any new ones this
    refresh.


    Brian

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)