In news.admin.net-abuse.usenet Joerg Lorenz <hugybear@gmx.net> wrote:
> Probably you mean NNTP.

The point was to share a successful outcome, using Bughunters to report a spam
attack on a Google Group having ties to a Google development team. What worked
for that Group might not work for another, but a person could try it. My
suggestion was that spam overrunning comp.mobile.android could be posted on
Bughunters to the attention of the Android development team. The Android team
might be invested enough and in a position to escalate it internally and get it
fixed, just as the Time team did.

(Nothing to do with NTP and NNTP having similar spelling.)

Cheers! Edward

Scott Dorsey <kludge@panix.com> wrote

>>Then there's the "you gave X number of articles to the free global
>>Usenet out of the Y total articles therein" where X is significantly
>>smaller than Y and as such you get an infinitesimally small part back,
>>if that.
>
> Yes, precisely.

BTW, on the Android newsgroup some of us are discussing WHY they're doing
all this spam, where not every newsgroup is being spammed, it seems.

These are:
<https://groups.google.com/g/alt.internet.wireless>
<https://groups.google.com/g/alt.comp.microsoft.windows>
<https://groups.google.com/g/uk.telecom.mobile>
<https://groups.google.com/g/rec.photo.digital>
<https://groups.google.com/g/alt.home.repair>
<https://groups.google.com/g/comp.mobile.android>
etc.

These are not:
<http://alt.comp.os.windows-10.narkive.com>
<http://alt.comp.os.windows-11.narkive.com>
<https://groups.google.com/g/comp.mobile.ipad>
<https://groups.google.com/g/misc.phone.mobile.iphone>
etc.

I haven't looked extensively but they don't seem to be spamming groups
(such as the Windows 10 and 11 newsgroups most people post to) which aren't
auto-archived - but that could also be because the Google-to-Usenet portal
might not work for groups that aren't part of the DejaNews archives.

Dunno what they're doing for real, but it's only some newsgroups.
Not all.

On 12/12/23 19:38, Wally J wrote:
> BTW, on the Android newsgroup some of us are discussing WHY they're doing
> all this spam, where not every newsgroup is being spammed, it seems.

I'm of the opinion that it's a bunch of different spam campaigns, likely
by almost as many spammers.

> I haven't looked extensively but they don't seem to be spamming groups
> (such as the Windows 10 and 11 newsgroups most people post to) which aren't
> auto-archived - but that could also be because the Google-to-Usenet portal
> might not work for groups that aren't part of the DejaNews archives.

^DejaNews^Usenet

I know that the newsgroups for Thunderbird / Firefox support and some of
the newer versions of Windows don't have Usenet newsgroups inside of
Google Groups.

In traditional news parlance, Google doesn't carry said newsgroups /
they aren't in Google's active newsgroups file. As such there is
nothing inside of Google Groups that the spammers can post to using the
Google Groups Usenet gateway.

> Dunno what they're doing for real, but it's only some newsgroups.
> Not all.

I don't think I've ever seen a single spam campaign hit all of the
newsgroups that I subscribe to, much less all of the thousands in my
server's active file. All of them are one or few groups and there is no
rime or reason that I'm aware of in their selection of groups.

Grant. . . .

Grant Taylor <gtaylor@tnetconsulting.net> wrote

>> BTW, on the Android newsgroup some of us are discussing WHY they're doing
>> all this spam, where not every newsgroup is being spammed, it seems.
>
> I'm of the opinion that it's a bunch of different spam campaigns, likely
> by almost as many spammers.
>
>> I haven't looked extensively but they don't seem to be spamming groups
>> (such as the Windows 10 and 11 newsgroups most people post to) which aren't
>> auto-archived - but that could also be because the Google-to-Usenet portal
>> might not work for groups that aren't part of the DejaNews archives.
>
> ^DejaNews^Usenet

I wish we had a name for it but it's like when we talk about unwanted spam.
No matter what name we use, everyone knows what we're talking about.

I call it dejagoogle sometimes.
a. It's a search engine to me
b. And it's a cite reference (better'n a message-ID is anyway)

> I know that the newsgroups for Thunderbird / Firefox support and some of
> the newer versions of Windows don't have Usenet newsgroups inside of
> Google Groups.

Yup. I tried valiantly, as did you, I believe, to get Google to add them to
the auto-archives so that others can run searches to find answers before
they post a question. I failed.
<https://groups.google.com/g/alt.comp.software.thunderbird> 404 not found
<https://groups.google.com/g/alt.comp.software.firefox> Content unavailable
NOTE: Interesting I got two different errors for those two URIs just now.

We might check for the Google spam on the narkives though.
<http://alt.comp.software.thunderbird.narkive.com> (unsafe)
<http://alt.comp.software.firefox.narkive.com> (unsafe)
But my browser setup won't let me.
> In traditional news parlance, Google doesn't carry said newsgroups /
> they aren't in Google's active newsgroups file. As such there is
> nothing inside of Google Groups that the spammers can post to using the
> Google Groups Usenet gateway.

Yeah. That must be why the Gspammers aren't spamming these Windows ngs.
<http://alt.comp.os.windows-10.narkive.com>
<http://alt.comp.os.windows-11.narkive.com>

>> Dunno what they're doing for real, but it's only some newsgroups.
>> Not all.
>
> I don't think I've ever seen a single spam campaign hit all of the
> newsgroups that I subscribe to, much less all of the thousands in my
> server's active file. All of them are one or few groups and there is no
> rime or reason that I'm aware of in their selection of groups.

I've noticed a lot of the spam is in funky characters, which I find odd,
but many also have URLs so they could be phishing attacks for all I know.

The M0VIE spam is particularly repetitive - I suspect they want to get into
search engine results - but I don't know that for a fact. I'm just guessing
as a lot of my tutorials posted to Usenet end up in the first page of hits
from a "normal" www.google.com search - so Usenet _does_ show up there too.

BTW, regarding the message from Individual.net, I was heartened they care.
Anybody have any new datapoints from Giganews & Highwinds admins yet?

On 12/13/23 00:22, Wally J wrote:
> I wish we had a name for it but it's like when we talk about unwanted spam.
> No matter what name we use, everyone knows what we're talking about.

There are (at least) three distinct things in the discussion:

1) The copy of Usenet articles that Deja News had which Google acquired.
2) Usenet as it exists today as a set of newsgroups.
3) The groups in the Google Groups system

#1 is a static and has not changed since acquisition.

#2 is what the people outside of Google use.

#3 is what the people inside of Google use.

#2 and #3 are close and related but are not the same thing.

> Yup. I tried valiantly, as did you, I believe, to get Google to add them to
> the auto-archives so that others can run searches to find answers before
> they post a question. I failed.

I got an authoritative refusal to add the newsgroups from the people
that would do it or authorize me to do it.

> NOTE: Interesting I got two different errors for those two URIs just now.

There could be a number of reasons for that and I wouldn't trust Google
1 mm for each bit making up the NOTE: message.

> Yeah. That must be why the Gspammers aren't spamming these Windows ngs.

They aren't because they can't because the group doesn't exist where the
spammers are originating the spam.

> I've noticed a lot of the spam is in funky characters, which I find odd,
> but many also have URLs so they could be phishing attacks for all I know.

The spam is using Unicode, some are quite literally bells and whistles,
to draw attention or to be funny or cute.

> The M0VIE spam is particularly repetitive - I suspect they want to get into
> search engine results - but I don't know that for a fact. I'm just guessing
> as a lot of my tutorials posted to Usenet end up in the first page of hits
> from a "normal" www.google.com search - so Usenet _does_ show up there too.

I don't think that they are trying to get into web search engines.
After all, most of the operations that I saw were quite questionable in
nature. I think they are simply trying to be the most recent "we have
movie" poster so that they appear most recently in the newsgroup when
someone looks for "what's the most recent movie post?". Quite literally
climbing on top of each other and not caring about the trash they leave
behind them.

> BTW, regarding the message from Individual.net, I was heartened they care.
> Anybody have any new datapoints from Giganews & Highwinds admins yet?

IMHO Individual.net is run by an individual, much like most of the text
only Usenet servers. Both GigaNews and HighWinds are commercial
entities and likely don't care unless one of their paying users complains.

--
Grant. . . .

Grant Taylor wrote on Wed, 13 Dec 2023 09:18:37 -0600 :

>> BTW, regarding the message from Individual.net, I was heartened they care.
>> Anybody have any new datapoints from Giganews & Highwinds admins yet?
>
> IMHO Individual.net is run by an individual, much like most of the text
> only Usenet servers. Both GigaNews and HighWinds are commercial
> entities and likely don't care unless one of their paying users complains.

The 'paying customers' of GigaNews & HighWinds seem to be all spammers. ;->

Thus spake Grant Taylor <gtaylor@tnetconsulting.net>
> IMHO Individual.net is run by an individual, much like most of the
> text only Usenet servers.

News.Individual.net is provided by FU (Free University) Berlin, one of three State
Universities in Berlin, Germany. It is run by the IT department (ZEDAT)
of FU University.

HTH

--
Пу́тін — хуйло́
http://www.eternal-september.org

On 12/13/23 09:41, Andrew wrote:
> The 'paying customers' of GigaNews & HighWinds seem to be all spammers. ;->

I question the veracity of that.

I've paid both for service for a short time in the past. Before I stood
up my own news server.

--
Grant. . . .

Ray Banana <rayban@raybanana.net> wrote:
>Thus spake Grant Taylor <gtaylor@tnetconsulting.net>
>>IMHO Individual.net is run by an individual, much like most of the
>>text only Usenet servers.

>News.Individual.net is provided by FU (Free University) Berlin, one of three State
>Universities in Berlin, Germany. It is run by the IT department (ZEDAT)
>of FU University.

>HTH

I was a suscriber of the predecessor service, but was unable to make
payment from the United States with through their local payment
processor. They subsequently changed payment processors and it's no
longer a problem as I see plenty of subscribers based in the United
States using their server.

The people who run it really like text Usenet and they've always had an
excellent reputation.

https://news.individual.net/commercial.php

On Wed, 13 Dec 2023 18:51:48 +0100, Ray Banana <rayban@raybanana.net>
wrote:

>> IMHO Individual.net is run by an individual, much like most of the
>> text only Usenet servers.
>
> News.Individual.net is provided by FU (Free University) Berlin, one of three State
> Universities in Berlin, Germany. It is run by the IT department (ZEDAT)
> of FU University.

Does that university offer free accounts or only at cost Usenet accounts?

On Wed, 13 Dec 2023 12:29:37 -0700, Ken Blake <Ken@invalid.news.com> wrote:

> Does that university offer free accounts or only at cost Usenet accounts?

Nevermind. https://news.individual.net/commercial.php
Saw that in the post from Adam Kerman (is kerman a generic anon moniker?)

Ken Blake <Ken@invalid.news.com> wrote:
>On Wed, 13 Dec 2023 12:29:37 -0700, Ken Blake <Ken@invalid.news.com> wrote:

>>Does that university offer free accounts or only at cost Usenet accounts?

>Nevermind. https://news.individual.net/commercial.php
>Saw that in the post from Adam Kerman (is kerman a generic anon moniker?)

Yes Ken. Nobody knows who the hell I am.

Am 13.12.2023 um 12:29:37 Uhr schrieb Ken Blake:

> On Wed, 13 Dec 2023 18:51:48 +0100, Ray Banana <rayban@raybanana.net>
> wrote:
>
> >> IMHO Individual.net is run by an individual, much like most of the
> >> text only Usenet servers.
> >
> > News.Individual.net is provided by FU (Free University) Berlin, one
> > of three State Universities in Berlin, Germany. It is run by the IT
> > department (ZEDAT) of FU University.
>
> Does that university offer free accounts or only at cost Usenet
> accounts?

News.Individual.net costs money for external people.

In article <ulbhfc$sbm$1@tncsrv09.home.tnetconsulting.net>,
Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 12/12/23 19:38, Wally J wrote:
>> BTW, on the Android newsgroup some of us are discussing WHY they're doing
>> all this spam, where not every newsgroup is being spammed, it seems.
>
>I'm of the opinion that it's a bunch of different spam campaigns, likely
>by almost as many spammers.

If this is the case, and it's possible, first thing is that they are using
the same script to do it. And secondly, they all are dumping stuff with
the intention of being disruptive rather than the intention of gimmicking
search engines. I suspect initially they were trying to get search engine
results up, but at this point they are just intending to be destructive.

This is why I suspect it's more likely to be one spammer, but I am not
positive.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>There are (at least) three distinct things in the discussion:
>
>1) The copy of Usenet articles that Deja News had which Google acquired.
>2) Usenet as it exists today as a set of newsgroups.
>3) The groups in the Google Groups system
>
>#1 is a static and has not changed since acquisition.

This is not true. It has degraded since acquisition which is where the
resentment of older Usenet users comes from.

>#2 is what the people outside of Google use.

Yes.

>#3 is what the people inside of Google use.

Yes.

>#2 and #3 are close and related but are not the same thing.

They are quite remarkably different, especially in that #3 is far more full
of spam than #2.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 12/13/23 15:57, Scott Dorsey wrote:
> This is not true. It has degraded since acquisition which is where the
> resentment of older Usenet users comes from.

I maintain that the corpus of articles that Google acquired from Deja
News has not changed since the acquisition.

Yes, the interface thereto has gotten worse and yes more has been added
to the newsgroups.

But the articles as they existed in late 2000 still exist and have not
changed.

> They are quite remarkably different, especially in that #3 is far more full
> of spam than #2.

Google is spewing the spam out to the world.

It is by the grace of server administrators retroactively cleaning up
Google's mess that you aren't seeing nearly as much.

But if the outside news admins don't clean things up / block Google
Groups, you will see very close to the same thing as inside of Google.

I'll say it this way: An unfiltered news feed outside of Google will
show very similar things as a news feed inside of Google.

--
Grant. . . .

On 12/13/23 15:54, Scott Dorsey wrote:
> If this is the case, and it's possible, first thing is that they are using
> the same script to do it.

I suspect that some ... creative miscreants have produced code /
programs to spam Google Groups and distributed it -- likely for profit
-- to even lower miscreants who are spewing massive amounts of spam.

Before I started filtering I was seeing very similarly formatted things
in multiple languages advertising very different things.

I suspect it's a common tool and possibly common template therein that
causes many of the similarities.

> And secondly, they all are dumping stuff with the intention of being
> disruptive rather than the intention of gimmicking search engines.

I'm not convinced of that.

> I suspect initially they were trying to get search engine results up,
> but at this point they are just intending to be destructive.

I don't think that it ever did much for a /web/ search engine. Maybe it
did something for a /Usenet/ search engine. But I'm defaulting to /web/
as that's what 90% of people will think of when you ask them what a
search engine searches. ;-)

> This is why I suspect it's more likely to be one spammer, but I am not
> positive.

Let's agree to disagree. :-D

--
Grant. . . .

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 12/13/23 15:57, Scott Dorsey wrote:
>> This is not true. It has degraded since acquisition which is where the
>> resentment of older Usenet users comes from.
>
>I maintain that the corpus of articles that Google acquired from Deja
>News has not changed since the acquisition.
>
>Yes, the interface thereto has gotten worse and yes more has been added
>to the newsgroups.
>
>But the articles as they existed in late 2000 still exist and have not
>changed.

This is possible, but we can't really know with the indices having been
broken so badly. There are messages that I know were in the database
in 2000 which I have copies of, but which I cannot find on google with any
search. They might be there but I have to assume they aren't.

>I'll say it this way: An unfiltered news feed outside of Google will
>show very similar things as a news feed inside of Google.

Unfortunately true, which is why everyone uses some degree of filtering.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 12/13/23 15:54, Scott Dorsey wrote:
>
>> This is why I suspect it's more likely to be one spammer, but I am not
>> positive.
>
>Let's agree to disagree. :-D

Let's send a legal disclosure request to Google for user information.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

Grant Taylor <gtaylor@tnetconsulting.net> wrote

>> I suspect initially they were trying to get search engine results up,
>> but at this point they are just intending to be destructive.
>
> I don't think that it ever did much for a /web/ search engine. Maybe it
> did something for a /Usenet/ search engine. But I'm defaulting to /web/
> as that's what 90% of people will think of when you ask them what a
> search engine searches. ;-)

We know the difference between what http://groups.google.com/g/<nameofng>
searches versus what http://google.com searches where the groups.google.com
search is _only_ inside that singular newsgroup...

But...

I'll just make a point that when I search on the normal google.com search
engine, I sometimes find my own tutorials showing up, especially when the
topic is esoteric...

Which means...

Usenet results can spill into the regular google.com search engine output;
but (to my knowledge), web sites outside of Usenet/GoogleGroups do NOT
spill into the DejaGoogle search engine results.

If the spam wasn't there, DejaGoogle is rather useful for two purposes:
a. Looking things up BEFORE you post to a newsgroup, and,
b. Referencing an article by URI instead of by Message-ID

The beauty is that no newsreader is needed - and no account is needed.
And article retention is, for our purposes, forever (so to speak).
--
Usenet is a way to express what you think is the situation only to find
others who know it better than you do who correct your prior assessment.

kludge@panix.com (Scott Dorsey) writes:

> Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>>On 12/13/23 15:54, Scott Dorsey wrote:
>>
>>> This is why I suspect it's more likely to be one spammer, but I am not
>>> positive.
>>
>>Let's agree to disagree. :-D
>
> Let's send a legal disclosure request to Google for user information.

That's an interesting idea.

On 12/13/23 18:06, Scott Dorsey wrote:
> This is possible, but we can't really know with the indices having been
> broken so badly. There are messages that I know were in the database
> in 2000 which I have copies of, but which I cannot find on google with any
> search. They might be there but I have to assume they aren't.

I wonder if it would be possible, all be it extremely annoying ~>
infuriating, to go backwards message by message from current to find the
message that you're looking for.

> Unfortunately true, which is why everyone uses some degree of filtering.

I believe there are still people who aren't filtering in any way.

--
Grant. . . .

On 12/13/23 18:07, Scott Dorsey wrote:
> Let's send a legal disclosure request to Google for user information.

Good luck.

Google will fight a user disclosure request with a LOT of money.

Then there is the question of what constitutes a user. Is a singular
person using two completely independent and unrelated accounts one or
two users?

--
Grant. . . .

On 12/13/23 19:41, Wally J wrote:
> We know the difference between what http://groups.google.com/g/<nameofng>
> searches versus what http://google.com searches where the groups.google.com
> search is _only_ inside that singular newsgroup...

We do. But does the average user using (unqualified) Google searching
for movies going to find web sites or news articles?

What if they use a different (unqualified) search engine?

My point being that even searching for the exact phrase in one of the
spam is going to be fairly unlikely to pop up on the first page of
(unqualified) Google search results. And it's even less likely to pop
up on the first page of some other search engine.

> I'll just make a point that when I search on the normal google.com search
> engine, I sometimes find my own tutorials showing up, especially when the
> topic is esoteric...

Yes, it is possible.

I suspect that the plethora of much things for streaming movies will
drown out such a Google Groups post so far past the first page that it's
not even funny.

> Which means...
>
> Usenet results can spill into the regular google.com search engine output;

Yes, it is possible. I just think that it will be extremely unlikely
given the context that the spam I've seen is advertising.

> but (to my knowledge), web sites outside of Usenet/GoogleGroups do NOT
> spill into the DejaGoogle search engine results.

Agreed.

But how many people will search inside of Google Groups Usenet gateway
search for movies to download? The people that will actually do so will
probably use a different search which is associated with their
commercial Usenet provider.

Sure, there will be a few people that try it and run into problems. But
the people actually using Usenet to transfer binary content almost
certainly aren't in the same group.

> If the spam wasn't there, DejaGoogle is rather useful for two purposes:
> a. Looking things up BEFORE you post to a newsgroup, and,
> b. Referencing an article by URI instead of by Message-ID

I absolutely agree.

> The beauty is that no newsreader is needed - and no account is needed.

I'd like to think that some other news provider also provides a web
interface.

Though I don't know about the account part.

> And article retention is, for our purposes, forever (so to speak).

True enough.

--
Grant. . . .

Grant Taylor <gtaylor@tnetconsulting.net> wrote

>> This is possible, but we can't really know with the indices having been
>> broken so badly. There are messages that I know were in the database
>> in 2000 which I have copies of, but which I cannot find on google with any
>> search. They might be there but I have to assume they aren't.
>
> I wonder if it would be possible, all be it extremely annoying ~>
> infuriating, to go backwards message by message from current to find the
> message that you're looking for.

I've been on Usenet for as long as anyone, and certainly prior to the
takeover of DejaNews by Google (which I'll call groups.google.com below).

Every once in a while I look for one of my old Usenet tutorials, where my
observation is that it's amazing how _different_ the results are when using
the www.google.com versus groups.google.com search engines (i.e.,
www.google.com is better at finding things by keyword, and specifically for
requiring and/or excluding items with the "+" and/or "-" directives.

Having observed that, I will also note that, to my recollection, in the
end, I _always_ find what I am seeking using the groups.google.com search
engine - so my plain assessment is that it's all there.

Unfortunately, as of only recently, the inordinate google-based spamming
is, in some groups, currently 99.5% of the spam (e.g., on c.m.a).
<https://groups.google.com/g/comp.mobile.android>
>> Unfortunately true, which is why everyone uses some degree of filtering.
>
> I believe there are still people who aren't filtering in any way.

In teh olden days, I implemented procmail filters, for the occasional spam
of one or two a week, and then I had to rely on the POP3/IMAP4 servers
handling that task, as it had suddenly become immense a decade or so ago.

For Usenet...

Up until I opened the thread asking where the google-based spam was coming
from, the only filters I had were for the likes of Snit & Sn!pe & % (aka
Rod Speed). Probably a half dozen nyms were plonked over the years.

Now I'm _forced_ to implement filters, where, shockingly, they're so simple
as to simply delete anything and everything that comes from google groups.

My telnet scripts will grab upwards of five hundred to a thousand articles
a day on c.m.a., only to result in an actual count of merely a handful.

At this point, for some Usenet newsgroups, much as we used procmail in the
olden days of SMTP, for Usenet, user filtering is currently de-rigueur.

Let's hope the "de-peering" that was initially recommended occurs, or, even
better, that enough people complain to Google such that they fix the issue.

*Please Do This!*
<https://groups.google.com/g/google-usenet/about>
--
The whole point of Usenet is to find team mates who know more than you do.
And to contribute to the overall tribal knowledge value of the newsgroup.
It's a domino effect where each of us helps the next person in the lineup.