>>>>>> On 2023-12-06 21:22, micky wrote:
>>>>>>> Wow, just now 25 real posts and 2600 spam. Thank goodness for filters.
>>>>>>
>>>>>> Where? I only saw one or two, in this group at least.
>>>>>
>>>>> Don't you understand how it works?
>>>>> It depends whether your service provider is filtering or not.
>>>>>
>>>>> My goodness, Carlos!
>>>>
>>>> Do you really think I didn't know?
>>>>
>>>> You are a fun spoiler.
>>>
>>> On News.Individual.Net there are big holes in the article number
>>> ranges, i.e. where the spam articles were before they got (locally)
>>> canceled.
>>>
>>> For safety reasons, I pull only 50 articles at a time, but because of
>>> the holes, each pull actually pulls only a few or no articles.
>>>
>>> Because today my own posts from yesterday appeared, I found out that
>>> my pulls have a backlog of some 2000 (mostly non-existing) articles.
>>>
>>> So if I'm slow in responding, you know why! :-) Just blame Google
>>> (Groups).
>>
>> Two or three times, start of day, machine booted or coming from
>> suspend/hibernation, Thunderbird asks for permission to download 3000
>> headers. But then just a few actually show up.
>>
>> Maybe TB is just looking at the index number, and as you say, there are
>> holes.

Frank Slootweg <this@ddress.is.invalid> wrote

> Trying to load 3000 articles is probably enough. Over the past few
> days, I've seen article number deltas of some 2000 per day.

I thank Carlos & Frank for their civil discussion of what's going on.
We can all learn from Frank's assessment of the nntp server facts.

> A newsreader can only ask for headers by article numbers, because
> while it does know past article numbers (and so can ask for the next
> ones), it does not know the message-ids of the next ones (because the
> message-ids are in the headers which it still has to fetch).
>
> So the newsreader only gets the headers for the articles which
> actually exist, not for the (spam) articles which have been (locally)
> canceled by the news server.
>
> So your 3000 headers at a time works for you.

I have my scripts set to download all available headers, which is likely
why I've been noticing slowdowns when only 10 headers show up but it seems
like it's taking the time to download thousands of headers instead.

Thanks for assessing the facts which I have been seeing on my end.

> I OTOH have to do it bit by bit, because my local news server
> (Hamster) does the fetching of headers and articles and I do not want to
> risk loading *other* (than this GG) 'spam', because I keep my groups
> 'forever' (currently upto some 20 years) and Hamster has no way of
> deleting (local cancel) already received articles, so this spam would
> forever pollute my local news server (and hence its disk space, backup,
> etc.).

I use a variety of news servers where I looked into my log file and it
seems the incoming server I used for Android just got about 1,700 headers.

Only 9 of which showed up after my kill-all-google-spam filters kicked in.
That's about 1/2 of 1% of the messages are real messages. 99.5% are spam.

Yesterday, I wrote:
> Carlos E. R. <robin_listas@es.invalid> wrote:
> > On 2023-12-06 22:06, Jörg Lorenz wrote:
> > > On 06.12.23 21:48, Carlos E. R. wrote:
> > >> On 2023-12-06 21:22, micky wrote:
> > >>> Wow, just now 25 real posts and 2600 spam. Thank goodness for filters.
> > >>
> > >> Where? I only saw one or two, in this group at least.
> > >
> > > Don't you understand how it works?
> > > It depends whether your service provider is filtering or not.
> > >
> > > My goodness, Carlos!
> >
> > Do you really think I didn't know?
> >
> > You are a fun spoiler.
>
> On News.Individual.Net there are big holes in the article number
> ranges, i.e. where the spam articles were before they got (locally)
> canceled.
>
> For safety reasons, I pull only 50 articles at a time, but because of
> the holes, each pull actually pulls only a few or no articles.
>
> Because today my own posts from yesterday appeared, I found out that
> my pulls have a backlog of some 2000 (mostly non-existing) articles.
>
> So if I'm slow in responding, you know why! :-) Just blame Google
> (Groups).

It seems that currently News.Individual.Net is not able to catch all
Google Groups spam in this group.

My filter caught some 50 extra spam articles in about 6 hours, so even
on a filtered feed (NIN), more spam than ham (legit articles).

Perhaps the spammers changed something in their posts, which makes the
filters to miss some articles.

Also one spam article (with (probably) the known key) in a dormant
group (comp.sys.hp.misc).

On 2023-12-08 19:58, Frank Slootweg wrote:
> Yesterday, I wrote:
>> Carlos E. R. <robin_listas@es.invalid> wrote:
>>> On 2023-12-06 22:06, Jörg Lorenz wrote:
>>>> On 06.12.23 21:48, Carlos E. R. wrote:
>>>>> On 2023-12-06 21:22, micky wrote:

....

>> On News.Individual.Net there are big holes in the article number
>> ranges, i.e. where the spam articles were before they got (locally)
>> canceled.
>>
>> For safety reasons, I pull only 50 articles at a time, but because of
>> the holes, each pull actually pulls only a few or no articles.
>>
>> Because today my own posts from yesterday appeared, I found out that
>> my pulls have a backlog of some 2000 (mostly non-existing) articles.
>>
>> So if I'm slow in responding, you know why! :-) Just blame Google
>> (Groups).
>
> It seems that currently News.Individual.Net is not able to catch all
> Google Groups spam in this group.
>
> My filter caught some 50 extra spam articles in about 6 hours, so even
> on a filtered feed (NIN), more spam than ham (legit articles).

I have seen maybe a dozen not caught spam, compared to a several
thousands posts deleted. I'm not complaining.

The only thing I have seen it that the upstream filter has a delay, it
deleted spam after it has been posted, so that Thunderbird may download
those before they are deleted. As they become cached, they are not
automatically deleted locally when they are deleted upstream.

For these I am editing a filter.

> Perhaps the spammers changed something in their posts, which makes the
> filters to miss some articles.

Yeah, of course, they must be changing things.

>
> Also one spam article (with (probably) the known key) in a dormant
> group (comp.sys.hp.misc).

--
Cheers,
Carlos E.R.

On 2023-12-08 15:30, Frank Slootweg wrote:
> Carlos E. R. <robin_listas@es.invalid> wrote:
>> On 2023-12-07 19:01, Frank Slootweg wrote:
>>> Carlos E. R. <robin_listas@es.invalid> wrote:
>>>> On 2023-12-06 22:06, Jörg Lorenz wrote:
>>>>> On 06.12.23 21:48, Carlos E. R. wrote:
>>>>>> On 2023-12-06 21:22, micky wrote:
>>>>>>> Wow, just now 25 real posts and 2600 spam. Thank goodness for filters.
>>>>>>
>>>>>> Where? I only saw one or two, in this group at least.
>>>>>
>>>>> Don't you understand how it works?
>>>>> It depends whether your service provider is filtering or not.
>>>>>
>>>>> My goodness, Carlos!
>>>>
>>>> Do you really think I didn't know?
>>>>
>>>> You are a fun spoiler.
>>>
>>> On News.Individual.Net there are big holes in the article number
>>> ranges, i.e. where the spam articles were before they got (locally)
>>> canceled.
>>>
>>> For safety reasons, I pull only 50 articles at a time, but because of
>>> the holes, each pull actually pulls only a few or no articles.
>>>
>>> Because today my own posts from yesterday appeared, I found out that
>>> my pulls have a backlog of some 2000 (mostly non-existing) articles.
>>>
>>> So if I'm slow in responding, you know why! :-) Just blame Google
>>> (Groups).
>>
>> Two or three times, start of day, machine booted or coming from
>> suspend/hibernation, Thunderbird asks for permission to download 3000
>> headers. But then just a few actually show up.
>>
>> Maybe TB is just looking at the index number, and as you say, there are
>> holes.
>
> Trying to load 3000 articles is probably enough. Over the past few
> days, I've seen article number deltas of some 2000 per day.
>
> A newsreader can only ask for headers by article numbers, because
> while it does know past article numbers (and so can ask for the next
> ones), it does not know the message-ids of the next ones (because the
> message-ids are in the headers which it still has to fetch).
>
> So the newsreader only gets the headers for the articles which
> actually exist, not for the (spam) articles which have been (locally)
> canceled by the news server.
>
> So your 3000 headers at a time works for you.

I tell TB to download them all, no problem, It just warns me that there
are 3000.

>
> I OTOH have to do it bit by bit, because my local news server
> (Hamster) does the fetching of headers and articles and I do not want to
> risk loading *other* (than this GG) 'spam', because I keep my groups
> 'forever' (currently upto some 20 years) and Hamster has no way of
> deleting (local cancel) already received articles, so this spam would
> forever pollute my local news server (and hence its disk space, backup,
> etc.).

--
Cheers,
Carlos E.R.

In comp.mobile.android, on Fri, 8 Dec 2023 21:07:47 +0100, "Carlos E.
R." <robin_listas@es.invalid> wrote:

>On 2023-12-08 19:58, Frank Slootweg wrote:
>> Yesterday, I wrote:
>>> Carlos E. R. <robin_listas@es.invalid> wrote:
>>>> On 2023-12-06 22:06, Jörg Lorenz wrote:
>>>>> On 06.12.23 21:48, Carlos E. R. wrote:
>>>>>> On 2023-12-06 21:22, micky wrote:
>
>...
>
>>> On News.Individual.Net there are big holes in the article number
>>> ranges, i.e. where the spam articles were before they got (locally)
>>> canceled.
>>>
>>> For safety reasons, I pull only 50 articles at a time, but because of
>>> the holes, each pull actually pulls only a few or no articles.
>>>
>>> Because today my own posts from yesterday appeared, I found out that
>>> my pulls have a backlog of some 2000 (mostly non-existing) articles.
>>>
>>> So if I'm slow in responding, you know why! :-) Just blame Google
>>> (Groups).
>>
>> It seems that currently News.Individual.Net is not able to catch all
>> Google Groups spam in this group.
>>
>> My filter caught some 50 extra spam articles in about 6 hours, so even
>> on a filtered feed (NIN), more spam than ham (legit articles).
>
>I have seen maybe a dozen not caught spam, compared to a several
>thousands posts deleted. I'm not complaining.
>
>The only thing I have seen it that the upstream filter has a delay, it
>deleted spam after it has been posted, so that Thunderbird may download
>those before they are deleted. As they become cached, they are not
>automatically deleted locally when they are deleted upstream.
>
>For these I am editing a filter.
>
>> Perhaps the spammers changed something in their posts, which makes the
>> filters to miss some articles.

Well I just have a big fat google groups filter and I only got 8 posts
this time and about 2500 spam.
>
>Yeah, of course, they must be changing things.
>
>
>>
>> Also one spam article (with (probably) the known key) in a dormant
>> group (comp.sys.hp.misc).

But I don't know where Forte Agent is putting the GG spam. I only hve
one post in Junk and and 6000 in Trash, but those 6000 sorted by date
are mostly from previous years, and by people I know, including me. I
don't know why they ar in the Trash but I'm sure there was a good reason
at the time. So where has the spam gone? (When I close Agent and it
asks if I want to empty the trash I always say no.)

Carlos E. R. <robin_listas@es.invalid> wrote:
> On 2023-12-08 19:58, Frank Slootweg wrote:
[...]

> > It seems that currently News.Individual.Net is not able to catch all
> > Google Groups spam in this group.
> >
> > My filter caught some 50 extra spam articles in about 6 hours, so even
> > on a filtered feed (NIN), more spam than ham (legit articles).
>
> I have seen maybe a dozen not caught spam, compared to a several
> thousands posts deleted. I'm not complaining.
>
> The only thing I have seen it that the upstream filter has a delay, it
> deleted spam after it has been posted, so that Thunderbird may download
> those before they are deleted. As they become cached, they are not
> automatically deleted locally when they are deleted upstream.

Yes, I don't know what NIN is doing, but I think they are indeed
deleting (local 'cancel' commands) the spam articles *after* the fact,
so there is indeed a time they are on the server - and hence can_be/are
downloaded to one's newsreader - before they are deleted.

So that's not 'filtering' per se, but deleting after the fact.

That might seem like a strange way of doing things, but that's
inherent in the way news server peer with other servers and how they
present articles to newsreaders.

Theoretically, this could be changed to real filtering, but it
requires quite a big change in how the news server are set up. Not just
changing some settings, but really redesigning their infrastructure.

NIN says "We ... have some anti-spam measures for our reader servers"
[1], but doesn't detail those measures.

> For these I am editing a filter.

Yes, I do the same. Anything from Google Groups gets dropped by my
Hamster server.

> > Perhaps the spammers changed something in their posts, which makes the
> > filters to miss some articles.
>
> Yeah, of course, they must be changing things.
>
> > Also one spam article (with (probably) the known key) in a dormant
> > group (comp.sys.hp.misc).

It is strange that of my subscribed newsgroups, the GG spam is only in
this group (comp.mobile.android). (The single spam article is
comp.sys.hp.misc is an exception.)

Do you/others also see the GG spam only in this group?

[1] Message-ID: <ktj0j1F3r9tU1@mid.uni-berlin.de>

On 2023-12-09 14:02, Frank Slootweg wrote:
> Carlos E. R. <robin_listas@es.invalid> wrote:
>> On 2023-12-08 19:58, Frank Slootweg wrote:
> [...]
>
>>> It seems that currently News.Individual.Net is not able to catch all
>>> Google Groups spam in this group.
>>>
>>> My filter caught some 50 extra spam articles in about 6 hours, so even
>>> on a filtered feed (NIN), more spam than ham (legit articles).
>>
>> I have seen maybe a dozen not caught spam, compared to a several
>> thousands posts deleted. I'm not complaining.
>>
>> The only thing I have seen it that the upstream filter has a delay, it
>> deleted spam after it has been posted, so that Thunderbird may download
>> those before they are deleted. As they become cached, they are not
>> automatically deleted locally when they are deleted upstream.
>
> Yes, I don't know what NIN is doing, but I think they are indeed
> deleting (local 'cancel' commands) the spam articles *after* the fact,
> so there is indeed a time they are on the server - and hence can_be/are
> downloaded to one's newsreader - before they are deleted.
>
> So that's not 'filtering' per se, but deleting after the fact.
>
> That might seem like a strange way of doing things, but that's
> inherent in the way news server peer with other servers and how they
> present articles to newsreaders.

I guess they can not insert something like SpamAssassin in the incoming
process.

> Theoretically, this could be changed to real filtering, but it
> requires quite a big change in how the news server are set up. Not just
> changing some settings, but really redesigning their infrastructure.
>
> NIN says "We ... have some anti-spam measures for our reader servers"
> [1], but doesn't detail those measures.
>
>> For these I am editing a filter.
>
> Yes, I do the same. Anything from Google Groups gets dropped by my
> Hamster server.

I'm not yet deleting all, but nothing is coming recently from Google
that is not spam. This "attack" has killed them.

Deleting them all is trivial (but after they have been downloaded by
Thunderbird).

>>> Perhaps the spammers changed something in their posts, which makes the
>>> filters to miss some articles.
>>
>> Yeah, of course, they must be changing things.
>>
>>> Also one spam article (with (probably) the known key) in a dormant
>>> group (comp.sys.hp.misc).
>
> It is strange that of my subscribed newsgroups, the GG spam is only in
> this group (comp.mobile.android). (The single spam article is
> comp.sys.hp.misc is an exception.)

I got a notice this afternoon about 600 messages on some other group,
but I clicked before reading. I think it was one of the Windows 10/11
groups.

>
> Do you/others also see the GG spam only in this group?
>
> [1] Message-ID: <ktj0j1F3r9tU1@mid.uni-berlin.de>

I see a little in a Linux group. Nothing like the thousands daily on
this one.

--
Cheers,
Carlos E.R.

In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

>
> It is strange that of my subscribed newsgroups, the GG spam is only in
>this group (comp.mobile.android). (The single spam article is
>comp.sys.hp.misc is an exception.)
>
> Do you/others also see the GG spam only in this group?

Yes, google groups spam only in comp.mobile.android. Not the other 5
groups I read regularly.

Again this morning, 1900 or so of spam.

But where does Forte agent 5 put them when it filters them out? The
only new ones in my trash are two posts from yesterday, both of which I
remember deleting myself. And there are none in Junk (Maybe I was
wrong when yesterday I said there was 1.)

What do the spammers get out of doing this? It seems like at least some
work is involved.

On 2023-12-09 18:13, micky wrote:
> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> <this@ddress.is.invalid> wrote:
>
>>
>> It is strange that of my subscribed newsgroups, the GG spam is only in
>> this group (comp.mobile.android). (The single spam article is
>> comp.sys.hp.misc is an exception.)
>>
>> Do you/others also see the GG spam only in this group?
>
> Yes, google groups spam only in comp.mobile.android. Not the other 5
> groups I read regularly.
>
> Again this morning, 1900 or so of spam.
>
> But where does Forte agent 5 put them when it filters them out? The
> only new ones in my trash are two posts from yesterday, both of which I
> remember deleting myself. And there are none in Junk (Maybe I was
> wrong when yesterday I said there was 1.)

I don't know in Forte Agent, but that's not how nntp works.

The client keeps an index of deleted messages, but it can not "move"
them anywhere. The indexes and probably the slots are there, unmoved.
Just that there is no cached content.

It is not as IMAP. You delete something, that post is deleted on the
server. Here, you can not delete anything, because you don't have an
account, space on the server.

> What do the spammers get out of doing this? It seems like at least some
> work is involved.

Done by scripts.

--
Cheers,
Carlos E.R.

In comp.mobile.android, on Sat, 9 Dec 2023 18:24:33 +0100, "Carlos E.
R." <robin_listas@es.invalid> wrote:

>On 2023-12-09 18:13, micky wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:
>>
>>>
>>> It is strange that of my subscribed newsgroups, the GG spam is only in
>>> this group (comp.mobile.android). (The single spam article is
>>> comp.sys.hp.misc is an exception.)
>>>
>>> Do you/others also see the GG spam only in this group?
>>
>> Yes, google groups spam only in comp.mobile.android. Not the other 5
>> groups I read regularly.

Maybe I misspoke. I don't see the many hundreds of spam in any other ng
but I did just see 8 spams in alt.home.repair. OTOH, they prbably were
not from GG.

I forgot to see if they came from Google-groups (and if they only went
to AHR.) and it seems to be too late now. Even thuogh the confirmation
question said it was going to send all 8 to the Trash folder, they are
not there. On the other hand, two that I just sent one at a time are
there. So Forte-Agent v.5 seems to have some complicated rules.
>> Again this morning, 1900 or so of spam.
>>
>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
>I don't know in Forte Agent, but that's not how nntp works.

Sorry. I wasn't suggesting that that part relates to the discussion of
deletion that preceded it. I added the Forte-agent group because I
thought they would be interested.

>The client keeps an index of deleted messages, but it can not "move"
>them anywhere. The indexes and probably the slots are there, unmoved.
>Just that there is no cached content.
>
>It is not as IMAP. You delete something, that post is deleted on the
>server. Here, you can not delete anything, because you don't have an
>account, space on the server.
>
>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
>Done by scripts.

Even with scripts, it must take some work. Who writes the subject
lines, all of which are little different? Who writes and/or maintains
the scripts?

micky <NONONOmisc07@fmguy.com> wrote:
> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> <this@ddress.is.invalid> wrote:
>
> > It is strange that of my subscribed newsgroups, the GG spam is only in
> >this group (comp.mobile.android). (The single spam article is
> >comp.sys.hp.misc is an exception.)
> >
> > Do you/others also see the GG spam only in this group?
>
> Yes, google groups spam only in comp.mobile.android. Not the other 5
> groups I read regularly.
>
> Again this morning, 1900 or so of spam.
>
> But where does Forte agent 5 put them when it filters them out? The
> only new ones in my trash are two posts from yesterday, both of which I
> remember deleting myself. And there are none in Junk (Maybe I was
> wrong when yesterday I said there was 1.)

It depends on what your filter rule *does* when it encounters a
matching header. The most sane action would be to drop the article - not
(download and) save it - and also dropping the header. So after that,
there's nothing left.

> What do the spammers get out of doing this? It seems like at least some
> work is involved.

That's the million dollar question. Who on earth is going to look at
such articles and where (on GG or Usenet)?

As to 'work': As with all spam, one or a few persons make the spamming
tools, the others just run them and sit back, watching the show.

Carlos E. R. <robin_listas@es.invalid> wrote:
> On 2023-12-09 14:02, Frank Slootweg wrote:
[...]

> > So that's not 'filtering' per se, but deleting after the fact.
> >
> > That might seem like a strange way of doing things, but that's
> > inherent in the way news server peer with other servers and how they
> > present articles to newsreaders.
>
> I guess they can not insert something like SpamAssassin in the incoming
> process.

AFAIK they can not. OTOH I seem to vaguely remember something about
'hooks', like 'perl-hooks' but don't remember if that's only in the
reader path or also in the path between peers 'feeding' eachother. Too
long ago since I ran a real news server (INN)! :-) (Now I only run
Hamster, which is much simpler and normally only connects as a
newsreader - not a peer - to the real NSP (NIN).)

[...]

> > It is strange that of my subscribed newsgroups, the GG spam is only in
> > this group (comp.mobile.android). (The single spam article is
> > comp.sys.hp.misc is an exception.)
>
> I got a notice this afternoon about 600 messages on some other group,
> but I clicked before reading. I think it was one of the Windows 10/11
> groups.

I see no GG spam in the Windows groups (including the Windows 10/11
ones) and my filter logs show no dropped GG articles in those groups.

> > Do you/others also see the GG spam only in this group?
> >
> > [1] Message-ID: <ktj0j1F3r9tU1@mid.uni-berlin.de>
>
> I see a little in a Linux group. Nothing like the thousands daily on
> this one.

In comp.mobile.android, on 9 Dec 2023 18:12:03 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

>micky <NONONOmisc07@fmguy.com> wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:
>>
>> > It is strange that of my subscribed newsgroups, the GG spam is only in
>> >this group (comp.mobile.android). (The single spam article is
>> >comp.sys.hp.misc is an exception.)
>> >
>> > Do you/others also see the GG spam only in this group?
>>
>> Yes, google groups spam only in comp.mobile.android. Not the other 5
>> groups I read regularly.
>>
>> Again this morning, 1900 or so of spam.
>>
>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
> It depends on what your filter rule *does* when it encounters a
>matching header. The most sane action would be to drop the article - not
>(download and) save it - and also dropping the header. So after that,
>there's nothing left.

Yep, you're right.

Well, what this one says is
400 Delete [comp.mobile.android] messsage-id: googlegroups.com

So it's not moving it anywhere. How about that. That accounts for why
it's not there. If I overstate what it should do, it's gone, but!!
can still be recalled with Get headers / Sample recent headers.

>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
> That's the million dollar question. Who on earth is going to look at
>such articles and where (on GG or Usenet)?
>
> As to 'work': As with all spam, one or a few persons make the spamming
>tools, the others just run them and sit back, watching the show.

On 2023-12-09 18:49, micky wrote:
> In comp.mobile.android, on Sat, 9 Dec 2023 18:24:33 +0100, "Carlos E.
> R." <robin_listas@es.invalid> wrote:
>
>> On 2023-12-09 18:13, micky wrote:
>>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>>> <this@ddress.is.invalid> wrote:

...

>>> What do the spammers get out of doing this? It seems like at least some
>>> work is involved.
>>
>> Done by scripts.
>
> Even with scripts, it must take some work. Who writes the subject
> lines, all of which are little different? Who writes and/or maintains
> the scripts?

Guessing, there would be a database of the things they would want
posted, and some process would take them randomly and generate the body.
Some other thing generates the subjects, also randomly with some rules.

--
Cheers,
Carlos E.R.

On 2023-12-09 19:12, Frank Slootweg wrote:
> micky <NONONOmisc07@fmguy.com> wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:

....

>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
> It depends on what your filter rule *does* when it encounters a
> matching header. The most sane action would be to drop the article - not
> (download and) save it - and also dropping the header. So after that,
> there's nothing left.

There has to be an index entry. Either the index entry of the upstream
server, marking the post dropped or something, or the message-id.

>
>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
> That's the million dollar question. Who on earth is going to look at
> such articles and where (on GG or Usenet)?

I doubt on Usenet. Unless they don't monitor the places they spam and
have not realized that on Usenet their stuff is removed.

Mind, it could be a denial of service attack attempt.

The servers might run out of index numbers :-?

> As to 'work': As with all spam, one or a few persons make the spamming
> tools, the others just run them and sit back, watching the show.

--
Cheers,
Carlos E.R.

Carlos E. R. <robin_listas@es.invalid> wrote:
> On 2023-12-09 19:12, Frank Slootweg wrote:
> > micky <NONONOmisc07@fmguy.com> wrote:
> >> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> >> <this@ddress.is.invalid> wrote:
>
> ...
>
> >> But where does Forte agent 5 put them when it filters them out? The
> >> only new ones in my trash are two posts from yesterday, both of which I
> >> remember deleting myself. And there are none in Junk (Maybe I was
> >> wrong when yesterday I said there was 1.)
> >
> > It depends on what your filter rule *does* when it encounters a
> > matching header. The most sane action would be to drop the article - not
> > (download and) save it - and also dropping the header. So after that,
> > there's nothing left.
>
> There has to be an index entry. Either the index entry of the upstream
> server, marking the post dropped or something, or the message-id.

Yes, the 'index' is the range of article numbers the newsreader has
downloaded versus the range of article numbers the server has.

The former is commonly known as the .newsrc file. Thunderbird also has
such a file, just with a different name and hidden from the user.

For example for this group, the entry in my .newsrc file is

comp.mobile.android: 1-87092,87094-87095

This means I've read articles with article numbers (see the numbers in
the Xref: headers of the articles in your newsreader) 1-87092, have not
yet read article 87093 (if that exists) and have not yet feteched
articles 87095 and above (if such (will) exist).

So the newsreader does not (read: does not have to) keep track of a
list of message-ids, but keeps track of a *range* (not list) of article
numbers on the respective news server (NIN in (y)our case).

[...]

> The servers might run out of index numbers :-?

That used to be a worry, but with 'modern' news servers / clients with
much, much bigger ranges, that should not be a problem.

But as my personal server is quite old, *I* may need to look into
that! :-(

[...]

Frank Slootweg <this@ddress.is.invalid> wrote...

> Carlos E. R. <robin_listas@es.invalid> wrote:

>> I guess they can not insert something like SpamAssassin in the incoming
>> process.
>
> AFAIK they can not. OTOH I seem to vaguely remember something about
> 'hooks', like 'perl-hooks' but don't remember if that's only in the
> reader path or also in the path between peers 'feeding' eachother. Too
> long ago since I ran a real news server (INN)! :-)

To resolve that, the INN software allows embedding a Perl (or Python)
script that can inspect each article upon arrival, and tell the server
to "filter" it. The de-facto standard is called Cleanfeed (not to be
confused with the *censored* British content filter). It may be
installed on any kind of server, for transit or client-facing.

It is possible to call SpamAssassin from there, but I'd strongly advise
against it: Time is important, on a text-only site the entire processing
of an article must be done in some 300ms on average. The Perl filter is
good enough, and I was surprised to see you can catch most of that junk
with just a few additional rules.

Anyway, for users I'd suggest:

Create a filter based on the Message-ID: Anything that ends in
"n@googlegroups.com>" is very likely Spam.

or

Ask the admins of your server to honor NoCeMs, I can confirm they do a
very good job (roughly 99.9% gets caught).

> I see no GG spam in the Windows groups (including the Windows 10/11
> ones) and my filter logs show no dropped GG articles in those groups.

It's been more than 20 years since I stopped using Hamster because I
switched completely to Linux. But if memory serves me right, you might
see in the fetch logs there seem to be a lot of new articles, but in
fact they are not there. That's the spam that has been eliminated.

Christoph (not really reading this group, but using it to check the
quality of server-side filtering)

In alt.usenet.offline-reader.forte-agent, on Sat, 9 Dec 2023 20:40:46
+0100, "Carlos E. R." <robin_listas@es.invalid> wrote:

>
>Mind, it could be a denial of service attack attempt.
>
>The servers might run out of index numbers :-?

That certainly could be a problem. It's a wider ranging problem than
just denial of service attacks.

Since Arabic numbers were invented, powerful people in Arab lands have
controlled their production. They made a very good living, but recently
the arrival of computers has greatly increased the world's use of
numbers. So now the Arab bigwigs make much more money (and they pay
enormous taxes to their governments). In fact Saudi Arabia, for
example, makes more from its share of the number export business than it
does from oil.

They haven't been able to increase production as fast as demand has gone
up. That leads to price increases but soon will lead to serious
shortages, not just for those who like to play number games but in
health care, national defense, education. Already in some hospitals
and especially clinics in small American town, they are running out of
numbers, so they've devalued the numbers they report by a factor of 10.
That means for example that normal blood pressure is no longer reported
as 120/80 but as 12/8. Two numbers saved, and it won't be long until
such cost cutting measures come to the parts of the US where the posters
here live, and to Spain.

If you want to stem this problem, send your tax-deductible contributions
to PCANI: The President's Counsel on Arabic Number Imports

www.pcani.org.

Carlos, even you can contribute but I'll try to find some Spanish or
European group working on the same problem.

Christoph Biedl <cbiedl@gmx.de> wrote:
> Frank Slootweg <this@ddress.is.invalid> wrote...
>
> > Carlos E. R. <robin_listas@es.invalid> wrote:
>
> >> I guess they can not insert something like SpamAssassin in the incoming
> >> process.
> >
> > AFAIK they can not. OTOH I seem to vaguely remember something about
> > 'hooks', like 'perl-hooks' but don't remember if that's only in the
> > reader path or also in the path between peers 'feeding' eachother. Too
> > long ago since I ran a real news server (INN)! :-)
>
> To resolve that, the INN software allows embedding a Perl (or Python)
> script that can inspect each article upon arrival, and tell the server
> to "filter" it. The de-facto standard is called Cleanfeed (not to be
> confused with the *censored* British content filter). It may be
> installed on any kind of server, for transit or client-facing.
>
> It is possible to call SpamAssassin from there, but I'd strongly advise
> against it: Time is important, on a text-only site the entire processing
> of an article must be done in some 300ms on average. The Perl filter is
> good enough, and I was surprised to see you can catch most of that junk
> with just a few additional rules.

Thanks for the update. As I said, it's too long ago (20+ years) since
I ran INN (and I never had these kind of spam flood problems).

> Anyway, for users I'd suggest:
>
> Create a filter based on the Message-ID: Anything that ends in
> "n@googlegroups.com>" is very likely Spam.
>
> or
>
> Ask the admins of your server to honor NoCeMs, I can confirm they do a
> very good job (roughly 99.9% gets caught).

As I mentioned, it seems our (Carlos' and my) NSP, News.Individual.Net,
is not filtering, but cancelling spam articles after the fact. At least
one of their admins is following the abuse and admin groups where these
Google Groups spam floods are being discussed, so I'll leave it up to
them (unless the situation gets totally out of control).

> > I see no GG spam in the Windows groups (including the Windows 10/11
> > ones) and my filter logs show no dropped GG articles in those groups.
>
> It's been more than 20 years since I stopped using Hamster because I
> switched completely to Linux. But if memory serves me right, you might
> see in the fetch logs there seem to be a lot of new articles, but in
> fact they are not there. That's the spam that has been eliminated.

Yes, I meant any spam which was *not* caught in time by my NSP's
cancels and hence would appear in my filter logs.

But you're correct: If there *is* GG spam, but my NSP can cancel it
fast enough, I won't see it, so me not seeing any GG spam in these
Windows groups, doesn't prove there *was* not any.

> Christoph (not really reading this group, but using it to check the
> quality of server-side filtering)

Thanks for your response, much appreciated!

Frank Slootweg <this@ddress.is.invalid> wrote

> It is strange that of my subscribed newsgroups, the GG spam is only in
> this group (comp.mobile.android). (The single spam article is
> comp.sys.hp.misc is an exception.)
>
> Do you/others also see the GG spam only in this group?

To answer your question of Carlos, I see it in many other groups, Frank.

An example is "M0VIE" spam in <https://groups.google.com/g/comp.text.pdf>
But there's drug spam in <https://groups.google.com/g/rec.photo.digital>
And odd language spam in <https://groups.google.com/g/uk.telecom.mobile>
And a mix of all types in <https://groups.google.com/g/rec.food.drink>
Or in <https://groups.google.com/g/alt.internet.wireless>
etc.

Frank Slootweg <this@ddress.is.invalid> wrote

> I see no GG spam in the Windows groups (including the Windows 10/11
> ones) and my filter logs show no dropped GG articles in those groups.

You're not looking in the right places, Frank...

I thought about that problem last week, Frank, and I "think" they're only
spamming the Google Groups that are actually "google groups archived".

None of the Windows 10 and 11 specific newsgroups are archived (AFAIK),
but there are other Windows newsgroups which are archived & spammed.

For example, this is being google-groups spammed to death
<https://groups.google.com/g/alt.comp.microsoft.windows>

So that's one hint of _how_ they choose to spam.
"If group is archived, then spam it; if not, then ignore it."

They seem to be wanting to get into search engine results... but of course,
that's just a guess on my part as I don't know what their true motive is.

Frank Slootweg <this@ddress.is.invalid> wrote

> That's the million dollar question. Who on earth is going to look at
> such articles and where (on GG or Usenet)?

I think they're smarter than we might think, Frank.

I suspect they only want to get into the Google Groups search engine.
Many results on Google groups show up in a "normal" Google search.

If they put out a billion spams, some will eventually show up in a "normal"
Google search (i.e., using the main google.com search engine as opposed to
groups.google.com search engines).

I haven't looked extensively but they don't seem to be spamming groups
(such as the Windows 10 and 11 newsgroups you and I post to) which aren't
auto-archived - but that could also be because the portal might not work.

Dunno what they're doing for real, but micky isn't correct that it's only
this newsgroup as it's certainly other newsgroups getting the same spam.
<https://groups.google.com/g/alt.internet.wireless>
<https://groups.google.com/g/alt.comp.microsoft.windows>
<https://groups.google.com/g/uk.telecom.mobile>
<https://groups.google.com/g/rec.photo.digital>
<https://groups.google.com/g/alt.home.repair>
etc.

In alt.usenet.offline-reader.forte-agent, on Tue, 12 Dec 2023 21:33:39
-0400, Wally J <walterjones@invalid.nospam> wrote:

>Frank Slootweg <this@ddress.is.invalid> wrote
>
>> That's the million dollar question. Who on earth is going to look at
>> such articles and where (on GG or Usenet)?
>
>I think they're smarter than we might think, Frank.
>
>I suspect they only want to get into the Google Groups search engine.
>Many results on Google groups show up in a "normal" Google search.
>
>If they put out a billion spams, some will eventually show up in a "normal"
>Google search (i.e., using the main google.com search engine as opposed to
>groups.google.com search engines).
>
>I haven't looked extensively but they don't seem to be spamming groups
>(such as the Windows 10 and 11 newsgroups you and I post to) which aren't
>auto-archived - but that could also be because the portal might not work.
>
>Dunno what they're doing for real, but micky isn't correct that it's only
>this newsgroup as it's certainly other newsgroups getting the same spam.
> <https://groups.google.com/g/alt.internet.wireless>
> <https://groups.google.com/g/alt.comp.microsoft.windows>
> <https://groups.google.com/g/uk.telecom.mobile>
> <https://groups.google.com/g/rec.photo.digital>

I don't read any of these groups.

> <https://groups.google.com/g/alt.home.repair>
> etc.

But I do read this one and I get very little spam, what I do get (3 or 4
every day or 2 or 3) is the same I've been getting for months before the
recent onslaught in CMA, and ttbomr, they don't resemble what I got in
the Android group, CMA.

My filter is only for the Android group, but it's possible my news
server is filtering them out for AHR but not CMA.

I will pay more attention to what I've been getting and see if they are
from google groups and see if the style resembles CMA's

On 04 Dec 2023 08:53:05 -0500 micky wrote:
>Just downloaded this morning's set of posts. Got 7 posts but 191 that
>my new filter deleted. It's roughtly
> message-id:@google-groups (sp? Hyphen? @?)
>
>It deletes everything from googlegroups. I hope no normal person is
>trying to post from google groups, because I won't see his post. Maybe
>I'll see answers unless everyone else is filtering based on that too.
>
>Or maybe he can post the same things again after the jerk who is
>spamming us stops. OTOH, will I actually think to remove my filter when
>that time comes? If someone reminds me, yet.

I don't filter out everything from GG. Some groups have been in my
subscriptions for years (in PAN) and get very few real posts, and it's
always a pleasant surprise when a real person turns up (after filtering
the drug spam).

I was touched by a recent post in rec.music.makers.squeezebox by a
musician warning fellow readers about malware. I thought of suggesting he
use a proper usenet client but, I thought, no - he's still going to see
much, maybe two posts a year.

<https://groups.google.com/g/rec.music.makers.squeezebox/>

I thought the response was amusing too; I wonder what the OP will make of
it?

--
(Remove numerics from email address)

micky <NONONOmisc07@fmguy.com> wrote

>>Dunno what they're doing for real, but micky isn't correct that it's only
>>this newsgroup as it's certainly other newsgroups getting the same spam.
>> <https://groups.google.com/g/alt.internet.wireless>
>> <https://groups.google.com/g/alt.comp.microsoft.windows>
>> <https://groups.google.com/g/uk.telecom.mobile>
>> <https://groups.google.com/g/rec.photo.digital>
>
> I don't read any of these groups.

I'm sure you don't so I was just being clear that it's many newsgroups.

For example, Dave Royal pointed out this newsgroup is being spammed:
<https://groups.google.com/g/rec.music.makers.squeezebox/>

Suffice to say they're spamming a _lot_ of newsgroups; but not all. :)

>> <https://groups.google.com/g/alt.home.repair>
>> etc.
>
> But I do read this one and I get very little spam, what I do get (3 or 4
> every day or 2 or 3) is the same I've been getting for months before the
> recent onslaught in CMA, and ttbomr, they don't resemble what I got in
> the Android group, CMA.
>
> My filter is only for the Android group, but it's possible my news
> server is filtering them out for AHR but not CMA.
>
> I will pay more attention to what I've been getting and see if they are
> from google groups and see if the style resembles CMA's

Upon closer inspection, the spam on a.h.r is the kind of spam that forced
good people out of that newsgroup long ago, as Steve, badgolferman and I
used to post regularly there until you guys (yes, you too micky) turned it
into a political cesspool of jewish-hating political rants, micky.

So you may be right on a.h.r and I might be wrong, as it's unusable even
before the anonymous spammers get their paws on that specific portal.