I see that the Thai spam (first seen by me in alt.obituaries) is now here
in CLC. Here are my trn killfile lines for this stuff:

/........................................................@gmail.com/h:=j
/^[^:]*@gmail.com/h:=j

--
If you don't have faith, it's because you are reading the Bible with an
honest, truthful, real-answer seeking heart.

- Rick C Hodgin -

On 2023-09-30, Kenny McCormack <gazelle@shell.xmission.com> wrote:
> I see that the Thai spam (first seen by me in alt.obituaries) is now here
> in CLC. Here are my trn killfile lines for this stuff:
>
> /........................................................@gmail.com/h:=j
> /^[^:]*@gmail.com/h:=j
>

Here is my SLRN entry:

%BOS
%Score created by slrn on Mon Sep 4 12:13:52 2023

[*]
Score: -9999
Injection-Info: .*google-groups\.googlegroups\.com
%EOS

This is followed by a white list of goofs who use Google Groups,
but are otherwise genuine participants.

Thus, I have no clue what Thai spam you're referring to.

The vast majority of material coming from GG is garbage and is always
changing, so it makes no sense to sit there inventing new pattern
matches to handle new cases.

The non-garbage coming from GG exhibits far less churn; it takes
much less effort to whitelist it.

I won't see a GG post unless someone replies to it; if everyone
blocks this way, then newcomers coming from GG end up ignored.

There is always someone who "takes one for the team", though.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca
NOTE: If you use Google Groups, I don't see you, unless you're whitelisted.

In article <20230930104646.920@kylheku.com>,
Kaz Kylheku <864-117-4973@kylheku.com> wrote:
....
>This is followed by a white list of goofs who use Google Groups,
>but are otherwise genuine participants.

"whitelisting" can never be a real solution. It obviously requires
constant maintenance.

As I mentioned in some similar posts in a.o, sure, just blasting everyone
from anything remotely Google will solve a lot of problems, but there is
substantial risk of "over-solving" (if you get what I mean).

--
I voted for Trump because I thought he'd make pussy grabbing legal.
I honestly don't see any other way America could be made great again.

On 2023-09-30, Kenny McCormack <gazelle@shell.xmission.com> wrote:
> In article <20230930104646.920@kylheku.com>,
> Kaz Kylheku <864-117-4973@kylheku.com> wrote:
> ...
>>This is followed by a white list of goofs who use Google Groups,
>>but are otherwise genuine participants.
>
> "whitelisting" can never be a real solution. It obviously requires
> constant maintenance.

That depends entirely on the particulars of the situation.

Empirically, I'm finding that the whitelist rarely requires attention.

This is because the rate of appearance of genuine new users
from GG is very low.

Even among those, not all are worth whitelisting.

This is really working well on my end.

I doggedly tried to avoid the blanket filter. I even patched
slrn to make the whack-a-mole GG killfile workflow easier.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca
NOTE: If you use Google Groups, I don't see you, unless you're whitelisted.

On 30/09/2023 19:59, Kaz Kylheku wrote:
> On 2023-09-30, Kenny McCormack <gazelle@shell.xmission.com> wrote:
>> In article <20230930104646.920@kylheku.com>,
>> Kaz Kylheku <864-117-4973@kylheku.com> wrote:
>> ...
>>> This is followed by a white list of goofs who use Google Groups,
>>> but are otherwise genuine participants.
>>
>> "whitelisting" can never be a real solution. It obviously requires
>> constant maintenance.
>
> That depends entirely on the particulars of the situation.
>
> Empirically, I'm finding that the whitelist rarely requires attention.
>
> This is because the rate of appearance of genuine new users
> from GG is very low.
>
> Even among those, not all are worth whitelisting.
>
> This is really working well on my end.
>
> I doggedly tried to avoid the blanket filter. I even patched
> slrn to make the whack-a-mole GG killfile workflow easier.
>

I use Seamonkey which is like Thunderbird, I think. Partial extract from my filter file (which is
intended to be maintained through their clunky GUI):

condition="OR (subject,contains,บ) OR (subject,contains,ห) OR (subject,contains,ร) OR
(subject,contains,า) OR (subject,contains,อ)"

This captures all the spam apart from around 1% where for some reason the subject is pure english
text. (The choice of characters to test was pretty much random and loads of variations would work
equally well.)

Anyhow, this approach works for me...

Mike.

In article <uf9koc$1i77u$1@news.xmission.com>,
Kenny McCormack <gazelle@shell.xmission.com> wrote:
>I see that the Thai spam (first seen by me in alt.obituaries) is now here
>in CLC. Here are my trn killfile lines for this stuff:
>
> /........................................................@gmail.com/h:=j
> /^[^:]*@gmail.com/h:=j
>
>--
>If you don't have faith, it's because you are reading the Bible with an
>honest, truthful, real-answer seeking heart.
>
> - Rick C Hodgin -

Get your news server to get a copy of https://ns2.nk.ca/bad_From
and get them implement it in their cleanfeed filter!
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
Manitoba on 3 Oct 2023 vote Liberal! Beware https://mindspring.com

doctor@doctor.nl2k.ab.ca (The Doctor) writes:
[...]
> Get your news server to get a copy of https://ns2.nk.ca/bad_From
> and get them implement it in their cleanfeed filter!

404 Not Found.

--
Keith Thompson (The_Other_Keith) Keith.S.Thompson+u@gmail.com
Will write code for food.
void Void(void) { Void(); } /* The recursive call of the void */

In article <87msx3qf72.fsf@nosuchdomain.example.com>,
Keith Thompson <Keith.S.Thompson+u@gmail.com> wrote:
>doctor@doctor.nl2k.ab.ca (The Doctor) writes:
>[...]
>> Get your news server to get a copy of https://ns2.nk.ca/bad_From
>> and get them implement it in their cleanfeed filter!
>
>404 Not Found.
>
>--
>Keith Thompson (The_Other_Keith) Keith.S.Thompson+u@gmail.com
>Will write code for food.
>void Void(void) { Void(); } /* The recursive call of the void */

Try https://ns2.nk.ca/bad_from
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
Manitoba on 3 Oct 2023 vote Liberal! Beware https://mindspring.com

On Sat, 30 Sep 2023 17:56:34 +0000, Kaz Kylheku wrote:

> On 2023-09-30, Kenny McCormack <gazelle@shell.xmission.com> wrote:
>> I see that the Thai spam (first seen by me in alt.obituaries) is now
>> here in CLC. Here are my trn killfile lines for this stuff:
>>
>> /........................................................@gmail.com/
h:=j
>> /^[^:]*@gmail.com/h:=j
>>
>>
> Here is my SLRN entry:
>
> %BOS %Score created by slrn on Mon Sep 4 12:13:52 2023
>
> [*]
> Score: -9999 Injection-Info: .*google-groups\.googlegroups\.com %EOS
[snip]

My personal preference is not to block on such a wide scope. I agree
that much of the traffic originating from Google Groups is (at best)
noise, and that most of those posting from gmail.com email addresses
have nothing on-topic to say, but I hate having to weed through
headers in order to white-list posters after-the-fact.

I run Pan, and it's Score file seems formatted similar to your SLRN
entry. Here's my Pan filter for the recent Thai gambling site spam:

%BOS
%Score created by Lew
[*]
Score:: =-9999
NNTP-Posting-Host: 2a0e:a942:8c0[13]:
%EOS

HTH
--
Lew Pitcher
"In Skills We Trust"

Lew Pitcher <lew.pitcher@digitalfreehold.ca> writes:
> On Sat, 30 Sep 2023 17:56:34 +0000, Kaz Kylheku wrote:
>> On 2023-09-30, Kenny McCormack <gazelle@shell.xmission.com> wrote:
>>> I see that the Thai spam (first seen by me in alt.obituaries) is now
>>> here in CLC. Here are my trn killfile lines for this stuff:
>>>
>>> /........................................................@gmail.com/
> h:=j
>>> /^[^:]*@gmail.com/h:=j
>>>
>>>
>> Here is my SLRN entry:
>>
>> %BOS %Score created by slrn on Mon Sep 4 12:13:52 2023
>>
>> [*]
>> Score: -9999 Injection-Info: .*google-groups\.googlegroups\.com %EOS
> [snip]
>
> My personal preference is not to block on such a wide scope. I agree
> that much of the traffic originating from Google Groups is (at best)
> noise, and that most of those posting from gmail.com email addresses
> have nothing on-topic to say, but I hate having to weed through
> headers in order to white-list posters after-the-fact.
>
> I run Pan, and it's Score file seems formatted similar to your SLRN
> entry. Here's my Pan filter for the recent Thai gambling site spam:
>
> %BOS
> %Score created by Lew
> [*]
> Score:: =-9999
> NNTP-Posting-Host: 2a0e:a942:8c0[13]:
> %EOS
>
> HTH

Here's an excerpt from my Gnus score filed ($HOME/News/comp.lang.c.SCORE).
It blocks all posts with Thai characters in the user name. (Blocking
Thai characters in the subject would probably also be useful; I haven't
done that yet.)

(("from"
("[ก-๛]" -2000 nil r)
[...]
(expunge -1001))
The "r" means it does a regular expression match. The -2000 score
adjustment means it doesn't show me the articles at all. (A -1000 score
adjustment would show me the articles but mark them as already read.)

--
Keith Thompson (The_Other_Keith) Keith.S.Thompson+u@gmail.com
Will write code for food.
void Void(void) { Void(); } /* The recursive call of the void */

Keith Thompson <Keith.S.Thompson+u@gmail.com> writes:
>
> Here's an excerpt from my Gnus score filed ($HOME/News/comp.lang.c.SCORE).
> It blocks all posts with Thai characters in the user name. (Blocking
> Thai characters in the subject would probably also be useful; I haven't
> done that yet.)
>
> (("from"
> ("[ก-๛]" -2000 nil r)
> [...]
> (expunge -1001))
>
> The "r" means it does a regular expression match. The -2000 score
> adjustment means it doesn't show me the articles at all. (A -1000 score
> adjustment would show me the articles but mark them as already read.)

Thank you! Unfortunately, I'm getting an error message in *Messages*:
Invalid match expunge in /home/joseph/News/comp.lang.c.SCORE

Any thoughts on what I'm doing wrong? My score file contains

(("from"
("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
many lines, all with matching parens
("[ก-๛]" -2000 nil r)
(expunge -1001)))

On 2023-10-03, Joe Pfeiffer <pfeiffer@cs.nmsu.edu> wrote:
> Keith Thompson <Keith.S.Thompson+u@gmail.com> writes:
>>
>> Here's an excerpt from my Gnus score filed ($HOME/News/comp.lang.c.SCORE).
>> It blocks all posts with Thai characters in the user name. (Blocking
>> Thai characters in the subject would probably also be useful; I haven't
>> done that yet.)
>>
>> (("from"
>> ("[ก-๛]" -2000 nil r)
>> [...]
>> (expunge -1001))
>>
>> The "r" means it does a regular expression match. The -2000 score
>> adjustment means it doesn't show me the articles at all. (A -1000 score
>> adjustment would show me the articles but mark them as already read.)
>
> Thank you! Unfortunately, I'm getting an error message in *Messages*:
> Invalid match expunge in /home/joseph/News/comp.lang.c.SCORE
>
> Any thoughts on what I'm doing wrong? My score file contains
>
> (("from"
> ("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
> many lines, all with matching parens
> ("[ก-๛]" -2000 nil r)
> (expunge -1001)))

Keith's indentation, and two closing parens, suggest:

(("from"
("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
many lines, all with matching parens
("[ก-๛]" -2000 nil r))
(expunge -1001))

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca
NOTE: If you use Google Groups, I don't see you, unless you're whitelisted.

Joe Pfeiffer <pfeiffer@cs.nmsu.edu> writes:

> Keith Thompson <Keith.S.Thompson+u@gmail.com> writes:
>>
>> Here's an excerpt from my Gnus score filed ($HOME/News/comp.lang.c.SCORE).
>> It blocks all posts with Thai characters in the user name. (Blocking
>> Thai characters in the subject would probably also be useful; I haven't
>> done that yet.)
>>
>> (("from"
>> ("[ก-๛]" -2000 nil r)
>> [...]
>> (expunge -1001))
>>
>> The "r" means it does a regular expression match. The -2000 score
>> adjustment means it doesn't show me the articles at all. (A -1000 score
>> adjustment would show me the articles but mark them as already read.)
>
> Thank you! Unfortunately, I'm getting an error message in *Messages*:
> Invalid match expunge in /home/joseph/News/comp.lang.c.SCORE
>
> Any thoughts on what I'm doing wrong? My score file contains
>
> (("from"
> ("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
> many lines, all with matching parens
> ("[ก-๛]" -2000 nil r)
> (expunge -1001)))

You have an extra ) here so something is up.

The list of items under "from" needs to be closed, so I'd expect
something like

(("from"
("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
many lines, all with matching parens
("[ก-๛]" -2000 nil r))
(expunge -1001))

Note the double )) closing the list of from matches.

--
Ben.

In article <1b34yran7p.fsf@pfeifferfamily.net>,
Joe Pfeiffer <pfeiffer@cs.nmsu.edu> wrote:
>Keith Thompson <Keith.S.Thompson+u@gmail.com> writes:
>>
>> Here's an excerpt from my Gnus score filed ($HOME/News/comp.lang.c.SCORE).
>> It blocks all posts with Thai characters in the user name. (Blocking
>> Thai characters in the subject would probably also be useful; I haven't
>> done that yet.)
>>
>> (("from"
>> ("[ก-๛]" -2000 nil r)
>> [...]
>> (expunge -1001))
>>
>> The "r" means it does a regular expression match. The -2000 score
>> adjustment means it doesn't show me the articles at all. (A -1000 score
>> adjustment would show me the articles but mark them as already read.)
>
>Thank you! Unfortunately, I'm getting an error message in *Messages*:
>Invalid match expunge in /home/joseph/News/comp.lang.c.SCORE
>
>Any thoughts on what I'm doing wrong? My score file contains
>
>(("from"
> ("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
>many lines, all with matching parens
> ("[ก-๛]" -2000 nil r)
> (expunge -1001)))
>

Too bad you just cannot say flush thai language from comp.lang.c .

Working on https://ns2.nk.ca/bad_from accordingly!
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
Manitoba on 3 Oct 2023 vote Liberal! Beware https://mindspring.com

Ben Bacarisse <ben.usenet@bsb.me.uk> writes:
> You have an extra ) here so something is up.
>
> The list of items under "from" needs to be closed, so I'd expect
> something like
>
> (("from"
> ("Crypto Skills <cryptodigitalskills@gmail.com>" -1000 nil e)
> many lines, all with matching parens
> ("[ก-๛]" -2000 nil r))
> (expunge -1001))
>
> Note the double )) closing the list of from matches.

Thank you, that was it. Not that it's an excuse, but the example at
https://www.gnu.org/software/emacs/manual/html_node/gnus/Score-File-Format.html

ends with eval(ding))), which confused my paren-counting ability.

Well, it's back, sort of.

So, knowing that Google won't take any sort of action to stem the flood
of spam originating from Google Groups, I now block /any/ posting with
a Message-ID matching /<.*@googlegroups\.com>/

To those legitimate Google Groups posters out there, find another news
server.

--
Lew Pitcher
"In Skills We Trust"