I’m seeing posts in non-latin writing systems, particularly Hebrew and
Arabic. They appear to be posted using Google Groups, and contain lots of
anomymised links which I, for one, ain’t gonna click on.

I just killed a whole bunch of them.

In article <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>,
WolfFan <akwolffan@zoho.com> wrote:
>I’m seeing posts in non-latin writing systems, particularly Hebrew and
>Arabic. They appear to be posted using Google Groups, and contain lots of
>anomymised links which I, for one, ain’t gonna click on.
>
>I just killed a whole bunch of them.

Yes, there is currently a massive spam run coming from GG and it has been
going on for a couple weeks now to the point where Google is actually
doing something about it. Mind you, they are doing useless and ineffective
things, but something.

I believe your news admins are acceping nocem cancels so you are probably
seeing a lot less of this than people on sites that don't. But a killfile
will help a whole lot to remove the remaining ones since they have pretty
clear spam signatures.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On Thu, 23 Nov 2023 10:21:44 -0500, WolfFan <akwolffan@zoho.com>
wrote:

>I’m seeing posts in non-latin writing systems, particularly Hebrew and
>Arabic. They appear to be posted using Google Groups, and contain lots of
>anomymised links which I, for one, ain’t gonna click on.
>
>I just killed a whole bunch of them.

Spam.

Been pickin' those out of my teeth for a long time now.

My Usenet Filters list is very long, with "?" as the most common
letter by far.
--
"Here lies the Tuscan poet Aretino,
Who evil spoke of everyone but God,
Giving as his excuse, 'I never knew him.'"

On 11/23/2023 9:21 AM, WolfFan wrote:
> I’m seeing posts in non-latin writing systems, particularly Hebrew and
> Arabic. They appear to be posted using Google Groups, and contain lots of
> anomymised links which I, for one, ain’t gonna click on.
>
> I just killed a whole bunch of them.

Ray Banana (the Eternal-September (E-S) owner and admin) has been
leading the fight to get rid of the Thai and other non-English spam.
The spammer is not doing it for money, he is doing to taunt people. Ray
has been doing a great job and hacking up his news server software and
cluster like crazy.

Ray found another backdoor into his news server cluster Tuesday using
UUCP and slammed that shut so he may have gotten rid of it for the moment.

Unfortunately, Ray's solution using Spam Assassin is having a problem
with false positives. I have alerted Ray to a problem with a posting
from Ahasuerus getting deleted yesterday but I am not sure that Ray can
fix it as the posting was 95% quoted and that is a trigger for SA.

Lynn

On Thursday, November 23, 2023 at 10:22:01 AM UTC-5, WolfFan wrote:
> I’m seeing posts in non-latin writing systems, particularly Hebrew and
> Arabic. They appear to be posted using Google Groups, and contain lots of
> anomymised links which I, for one, ain’t gonna click on.
>
> I just killed a whole bunch of them.

If your newsreader has a decent killfile feature, kill on the Subject
containing any of several common Thai characters.

Pt

On 24/11/23 12:16, pete...@gmail.com wrote:
> On Thursday, November 23, 2023 at 10:22:01 AM UTC-5, WolfFan wrote:
>> I’m seeing posts in non-latin writing systems, particularly Hebrew and
>> Arabic. They appear to be posted using Google Groups, and contain lots of
>> anomymised links which I, for one, ain’t gonna click on.
>>
>> I just killed a whole bunch of them.
>
> If your newsreader has a decent killfile feature, kill on the Subject
> containing any of several common Thai characters.
>
> Pt

I just checked my Eternal September killfile log and there has been no
Thai spam for a few days now.

On Nov 23, 2023, Lynn McGuire wrote
(in article <ujog5i$1vuc9$1@dont-email.me>):

> On 11/23/2023 9:21 AM, WolfFan wrote:
> > I’m seeing posts in non-latin writing systems, particularly Hebrew and
> > Arabic. They appear to be posted using Google Groups, and contain lots of
> > anomymised links which I, for one, ain’t gonna click on.
> >
> > I just killed a whole bunch of them.
>
> Ray Banana (the Eternal-September (E-S) owner and admin) has been
> leading the fight to get rid of the Thai and other non-English spam.
> The spammer is not doing it for money, he is doing to taunt people.

interesting. It’s rather ineffectual as both spam and taunts when it is so
easily detected (at least when using a newsreader like the Hog) and instantly
killable, even if you don’t use a killfile for it. I had a look at one,
killed it, scanned the list of available posts, selected posts similar,
killed them. Took less than 5 minutes. I kill new posts as necessary, takes
less than 5 seconds. If I get tired of killing posts by hand, I’ll add a
line or two to the killfile. All that m’man is doing is convincing me that
he’s not real bright.
> Ray
> has been doing a great job and hacking up his news server software and
> cluster like crazy.
>
> Ray found another backdoor into his news server cluster Tuesday using
> UUCP and slammed that shut so he may have gotten rid of it for the moment.
>
> Unfortunately, Ray's solution using Spam Assassin is having a problem
> with false positives. I have alerted Ray to a problem with a posting
> from Ahasuerus getting deleted yesterday but I am not sure that Ray can
> fix it as the posting was 95% quoted and that is a trigger for SA.
>
> Lynn

On 11/23/2023 11:02 PM, WolfFan wrote:
> On Nov 23, 2023, Lynn McGuire wrote
> (in article <ujog5i$1vuc9$1@dont-email.me>):
>
>> On 11/23/2023 9:21 AM, WolfFan wrote:
>>> I’m seeing posts in non-latin writing systems, particularly Hebrew and
>>> Arabic. They appear to be posted using Google Groups, and contain lots of
>>> anomymised links which I, for one, ain’t gonna click on.
>>>
>>> I just killed a whole bunch of them.
>>
>> Ray Banana (the Eternal-September (E-S) owner and admin) has been
>> leading the fight to get rid of the Thai and other non-English spam.
>> The spammer is not doing it for money, he is doing to taunt people.
>
> interesting. It’s rather ineffectual as both spam and taunts when it is so
> easily detected (at least when using a newsreader like the Hog) and instantly
> killable, even if you don’t use a killfile for it. I had a look at one,
> killed it, scanned the list of available posts, selected posts similar,
> killed them. Took less than 5 minutes. I kill new posts as necessary, takes
> less than 5 seconds. If I get tired of killing posts by hand, I’ll add a
> line or two to the killfile. All that m’man is doing is convincing me that
> he’s not real bright.
>> Ray
>> has been doing a great job and hacking up his news server software and
>> cluster like crazy.
>>
>> Ray found another backdoor into his news server cluster Tuesday using
>> UUCP and slammed that shut so he may have gotten rid of it for the moment.
>>
>> Unfortunately, Ray's solution using Spam Assassin is having a problem
>> with false positives. I have alerted Ray to a problem with a posting
>> from Ahasuerus getting deleted yesterday but I am not sure that Ray can
>> fix it as the posting was 95% quoted and that is a trigger for SA.
>>
>> Lynn

The conversations by Ray and the other usenet admins on
eternal-september.support have been very interesting for the last two or
three weeks. And so glad that I do not have my own usenet server. I
homed my corporate email domain on top of gmail two decades ago and
never regretted it.

Lynn

On Thu, 23 Nov 2023 15:28:17 -0600, Lynn McGuire
<lynnmcguire5@gmail.com> wrote:

>On 11/23/2023 9:21 AM, WolfFan wrote:
>> I’m seeing posts in non-latin writing systems, particularly Hebrew and
>> Arabic. They appear to be posted using Google Groups, and contain lots of
>> anomymised links which I, for one, ain’t gonna click on.
>>
>> I just killed a whole bunch of them.
>
>Ray Banana (the Eternal-September (E-S) owner and admin) has been
>leading the fight to get rid of the Thai and other non-English spam.
>The spammer is not doing it for money, he is doing to taunt people. Ray
>has been doing a great job and hacking up his news server software and
>cluster like crazy.
>
>Ray found another backdoor into his news server cluster Tuesday using
>UUCP and slammed that shut so he may have gotten rid of it for the moment.
>
>Unfortunately, Ray's solution using Spam Assassin is having a problem
>with false positives. I have alerted Ray to a problem with a posting
>from Ahasuerus getting deleted yesterday but I am not sure that Ray can
>fix it as the posting was 95% quoted and that is a trigger for SA.

That can be tricky.

My former ISP once treated /it's own monthly billing reminder/ as
spam.

The things you find in an ISP's spam folder can be ... very
interesting. To look at, not to open. Unless they clearly are legit.
--
"Here lies the Tuscan poet Aretino,
Who evil spoke of everyone but God,
Giving as his excuse, 'I never knew him.'"

In article <01ffe2c3-78db-4a06-9136-3e50d3110987n@googlegroups.com>,
pete...@gmail.com <petertrei@gmail.com> wrote:
>On Thursday, November 23, 2023 at 10:22:01=E2=80=AFAM UTC-5, WolfFan wrote:
>> I=E2=80=99m seeing posts in non-latin writing systems, particularly Hebre=
>w and=20
>> Arabic. They appear to be posted using Google Groups, and contain lots of=
>=20
>> anomymised links which I, for one, ain=E2=80=99t gonna click on.=20
>>=20
>> I just killed a whole bunch of them.
>
>If your newsreader has a decent killfile feature, kill on the Subject=20
>containing any of several common Thai characters.

That is effective for this group, but comp.os.vms and comp.protocols.time.ntp
are being flooded with English and Malay posts which cannot be killed just
by rejecting specific characters or rejecting all UTF-8 posts. The actual
problem is wider than one group.

It's severe enough that someone at Google has actually noticed that they have
Usenet service still.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 11/23/23 21:44, Lynn McGuire wrote:
> In article <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>,
> WolfFan <akwolffan@zoho.com> wrote:

[stuff deleted

>> I just killed a whole bunch of them.
>
>
[more stuff deleted
> things, but something.
>

I am seeing things like the quoted text below in my feed. I use
eternal-September so maybe I am seeing Spam Assassin stuff. I know I
have not been able to see one or two of my posts that others have seen.

> Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
> From: Lynn McGuire <lynnmcguire5@gmail.com>
> Newsgroups: rec.arts.sf.written
> Subject: Re: Anyone else notice a lot of strange posts?
> Date: Thu, 23 Nov 2023 23:44:45 -0600
> Organization: A noiseless patient Spider
> Lines: 46
> Message-ID: <ujpd8f$27b71$1@dont-email.me>
> References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
> <ujog5i$1vuc9$1@dont-email.me>
> <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8; format=flowed
> Content-Transfer-Encoding: 8bit
> Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
> Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
> logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
> User-Agent: Mozilla Thunderbird
> Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
> In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
> Content-Language: en-US
> Xref: news.eternal-september.org rec.arts.sf.written:613026
>

[more stuff deleted]

>>> Unfortunately, Ray's solution using Spam Assassin is having a problem
>>> with false positives. I have alerted Ray to a problem with a posting
> I believe your news admins are acceping nocem cancels so you are probably
> seeing a lot less of this than people on sites that don't. But a killfile
> will help a whole lot to remove the remaining ones since they have pretty
> clear spam signatures.
> --scott

I use Thunderbird as newsreader and am not having any luck yet in
pulling "other" criteria out of the customizable filters. I'm going to
play with that today.

I am also adding these extra lines to see if my message DOESN'T get
caught up in SA.

If what was said previously is true, quoting a message that quotes text
that goes 6 deep in other messages and just adding "I agree" to your
message will trip the eternal-september SA filter.

Is anyone else seeing message header data in any of the messages they
are reading?

--
Dave Scruggs
Captain, Boulder Creek Fire (Retired)
Sr. Software Engineer (Retired, mostly)

In article <ujqqtg$2e6a3$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote:
>
>I am seeing things like the quoted text below in my feed. I use
>eternal-September so maybe I am seeing Spam Assassin stuff. I know I
>have not been able to see one or two of my posts that others have seen.
>
>> Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>> From: Lynn McGuire <lynnmcguire5@gmail.com>
>> Newsgroups: rec.arts.sf.written
>> Subject: Re: Anyone else notice a lot of strange posts?
>> Date: Thu, 23 Nov 2023 23:44:45 -0600
>> Organization: A noiseless patient Spider
>> Lines: 46
>> Message-ID: <ujpd8f$27b71$1@dont-email.me>
>> References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
>> <ujog5i$1vuc9$1@dont-email.me>
>> <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
>> MIME-Version: 1.0
>> Content-Type: text/plain; charset=UTF-8; format=flowed
>> Content-Transfer-Encoding: 8bit
>> Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
>> Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
>> logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
>> User-Agent: Mozilla Thunderbird
>> Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
>> In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
>> Content-Language: en-US
>> Xref: news.eternal-september.org rec.arts.sf.written:613026

All of this looks perfectly normal (except in that the post is
MIME-encoded, which is kind of rude but perfectly allowed). What are
you thinking is a problem here?

>I am also adding these extra lines to see if my message DOESN'T get
>caught up in SA.

What extra lines are you adding and why would you think your messages
would ever get caught up in Spamasassin? You aren't posting from
Google Groups.

>If what was said previously is true, quoting a message that quotes text
>that goes 6 deep in other messages and just adding "I agree" to your
>message will trip the eternal-september SA filter.

I don't know, because I don't know how eternal-september is filtering
messages from their customers, and it probably changes on a daily basis.
In this case the issue isn't how they filter messages from their customers
but how they filter messages from Google Groups, since that is where all
the spam (really, where all spam period) originates.

>Is anyone else seeing message header data in any of the messages they
>are reading?

I see message header data in every message I read, and have for the past
forty years now. It's important.

I am very confused about what you think your problem is.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 11/24/23 11:09, Scott Dorsey wrote:
> In article <ujqqtg$2e6a3$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote:
>>
>> I am seeing things like the quoted text below in my feed. I use
>> eternal-September so maybe I am seeing Spam Assassin stuff. I know I
>> have not been able to see one or two of my posts that others have seen.
>>
>>> Path: eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>>> From: Lynn McGuire <lynnmcguire5@gmail.com>
>>> Newsgroups: rec.arts.sf.written
>>> Subject: Re: Anyone else notice a lot of strange posts?
>>> Date: Thu, 23 Nov 2023 23:44:45 -0600
>>> Organization: A noiseless patient Spider
>>> Lines: 46
>>> Message-ID: <ujpd8f$27b71$1@dont-email.me>
>>> References: <0001HW.2B0FA588035BE30A70000E90338F@news.supernews.com>
>>> <ujog5i$1vuc9$1@dont-email.me>
>>> <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
>>> MIME-Version: 1.0
>>> Content-Type: text/plain; charset=UTF-8; format=flowed
>>> Content-Transfer-Encoding: 8bit
>>> Injection-Date: Fri, 24 Nov 2023 05:44:47 -0000 (UTC)
>>> Injection-Info: dont-email.me; posting-host="ae9a8e13882e4f64049a91a3498331fe";
>>> logging-data="2338017"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nOEgHadJI1daEskQcnuc8zrjd6bC0hnI="
>>> User-Agent: Mozilla Thunderbird
>>> Cancel-Lock: sha1:tTUZ0Xrs1CY2oUD1+JzfYs60Ys0=
>>> In-Reply-To: <0001HW.2B1065EE0388FA7F70000409F38F@news.supernews.com>
>>> Content-Language: en-US
>>> Xref: news.eternal-september.org rec.arts.sf.written:613026
>
>
> All of this looks perfectly normal (except in that the post is
> MIME-encoded, which is kind of rude but perfectly allowed). What are
> you thinking is a problem here?
>
>> I am also adding these extra lines to see if my message DOESN'T get
>> caught up in SA.
>
> What extra lines are you adding and why would you think your messages
> would ever get caught up in Spamasassin? You aren't posting from
> Google Groups.
>
>> If what was said previously is true, quoting a message that quotes text
>> that goes 6 deep in other messages and just adding "I agree" to your
>> message will trip the eternal-september SA filter.
>
> I don't know, because I don't know how eternal-september is filtering
> messages from their customers, and it probably changes on a daily basis.
> In this case the issue isn't how they filter messages from their customers
> but how they filter messages from Google Groups, since that is where all
> the spam (really, where all spam period) originates.
>
>> Is anyone else seeing message header data in any of the messages they
>> are reading?
>
> I see message header data in every message I read, and have for the past
> forty years now. It's important.
>
> I am very confused about what you think your problem is.
> --scott
None of the header data has EVER shown up in text body of incoming
messages prior to a few weeks ago. If you will notice, the header data
is shown in the quoted area of a previous message. This is not normal.

So, my problem is that header data from deleted messages is showing up
in the body text of other messages. Messages from me and other users are
not showing up but when this happens, header data will show up in the
body of other messages. THAT is my problem.

Try not to be condescending. I've been doing this a long time.

--
Dave Scruggs
Captain, Boulder Creek Fire (Retired)
Sr. Software Engineer (Retired, mostly)

In article <ujquj4$2ep1a$1@dont-email.me>, Dave <bcfd36@cruzio.com> wrote:
>None of the header data has EVER shown up in text body of incoming
>messages prior to a few weeks ago. If you will notice, the header data
>is shown in the quoted area of a previous message. This is not normal.

A carriage return is the separator between the header and the message text.
If there is a spurious carriage return in the file, or if your newsreader is
seeing something else as a carriage return that is not, then this will
happen.

>So, my problem is that header data from deleted messages is showing up
>in the body text of other messages. Messages from me and other users are
>not showing up but when this happens, header data will show up in the
>body of other messages. THAT is my problem.

You should email your news provider and be VERY SPECIFIC about what newsreader
you are using. Not just Thunderbird, but specifically what version of
Thunderbird you are using. Point out that some messages are showing up
this way and give them the message-ids of some examples. Don't talk about
cancellation or anything related. Just tell them when you started seeing them,
which ones they are, what newsreader you are using, and how your newsreader
is displaying them differently than other messages.

>Try not to be condescending. I've been doing this a long time.

Then describe the problem and ask the question instead of just saying
"I see this" without explaining what is wrong.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 25/11/23 08:46, Dave wrote:
snip
> None of the header data has EVER shown up in text body of incoming
> messages prior to a few weeks ago. If you will notice, the header data
> is shown in the quoted area of a previous message. This is not normal.
>
> So, my problem is that header data from deleted messages is showing up
> in the body text of other messages. Messages from me and other users are
> not showing up but when this happens, header data will show up in the
> body of other messages. THAT is my problem.
>
snip

This happens to me very infrequentlyly and has done for some years.
Sometimes, messages that I have kept to read later have been replaced
with junk like that from messages that I have deleted. I remain clueless
as to why and as it is a rare occurrence, I have not pursued a remedy.

WolfFan wrote:

>I’m seeing posts in non-latin writing systems, particularly Hebrew
>and Arabic. They appear to be posted using Google Groups, and contain
>lots of anomymised links which I, for one, ain’t gonna click on.
>
>I just killed a whole bunch of them.

No, between ES's and my own filters I didn't get any new ones this
refresh.

Brian