Re: Flood of Qwest posts

On 2007-08-22, Peter J Ross <pjr@xxxxxxxxxxxxxxx> claimed:
In comp.os.linux.misc on Wed, 22 Aug 2007 10:10:26 -0500, John Hasler
<john@xxxxxxxxxx> wrote:

The Natural Philosopher writes:
Someone is issuing cancel messages pretty fast tho.

Unfortunately many ISPs ignore all control messages.

The latest batch also have a Cancel-Lock header.

For what it's worth, here's an slrn scorefile entry that will catch
all the spew n COLM from the past ten days and seems not to produce
any false positives during that time.

[comp.os.linux.misc]
Score: =-9999
~References: .
{::
Path: !feed\.news\.qwest\.net!mpls-nntp-0\d\.inet\.qwest\.net!news\.qwest\.net!not-for-mail
Path: !hwmnpeer01\.[a-z]\{3\}!news\.highwinds-media\.com!hw-filter\.[a-z]\{3\}!newsfe\d\d\.[a-z]\{3\}\.POSTED!53ab2750!not-for-mail
Path: !post0\d\.iad01!roadrunner\.com!not-for-mail
Path: !newsfeed\.hananet\.net!tnews\.hananet\.net!
Path: !nntp\.eutelia\.it!news\.edisontel\.com!53ab2750!not-for-mail
Path: news\.tele\.dk!feed118\.news\.tele\.dk!not-for-mail
Path: !post0\d\.iad01!news\.suddenlink\.net!not-for-mail
Path: !nntp\.bresnan\.com!news\.bresnan\.com\.POSTED!not-for-mail
Path: !nntp\.rcn\.net!news\.rcn\.net.POSTED!not-for-mail
Path: !local!news\.eskimo\.com!eskimo\.com!not-for-mail
Path: !news\.infoave\.net!\c[A-Z]+\.[A-Z]+\.[A-Z]+![A-Z][a-z]+\.[A-Z][a-z]+
Path: !newsfeeder\.syd\.optusnet\.com\.au!news\.optusnet\.com\.au!not-for-mail
}

(Warning: applying this rule will take a moment or three.)

(Warning #2: some of the regular expressions won't work in newsreaders
other than slrn, so be careful if adapting the above.)

I tested it in slrn just now. It took out a name I see in here
frequently (CptDondo, I think it is) and a couple from google that look
legit. There were only a handful of posts to work with, too.

The danger of future false positives (e.g. from optusnet.com.au) is
great enough for it to be a good idea to delete or comment out the
rule after applying it once, but it may help if somebody has
screenfuls of recent spew and doesn't want to wade through it all
manually.

There are enough false positives that I'll keep looking at other
headers for ways to dump them. But I may experiment with commenting out
some and modifying others to see what happens.

I thought this sort of thing should be over. Isn't school back in
session already in most places?

--
Conformity constipates creativity!
.

Relevant Pages

  • Re: [Slrn] Cancel-Lock header
    ... SLrn as they recommend that you insert the header yourself. ... When I look in my sent posts there is only one cancel-lock header, ... When you run slrn --version is canlock shown as 'compiled in'? ... COMPILE TIME OPTIONS: ...
    (news.software.readers)
  • Re: [Slrn] Cancel-Lock header
    ... I get no Cancel-Lock header of my own (unless I just can't see it while ... I might try re-compiling slrn on this system to make sure that canlock is ... Styresystem: Debian ... your local server setting MIDs, ...
    (news.software.readers)
  • [Slrn] Cancel-Lock header
    ... I'm new to Slrn (and Linux) so bear with me. ... SLrn as they recommend that you insert the header yourself. ... When I look in my sent posts there is only one cancel-lock header, ...
    (news.software.readers)
  • Re: Update: [slrn] NNTP-Posting-Host whois lookup macro
    ... Doing some stuff Thomas W outlined, I now have the new slrn installed ... It seems to have led to my next issue -- the long-header warning ... to find slang2 and therefore install, ...
    (news.software.readers)
  • Re: Update: [slrn] NNTP-Posting-Host whois lookup macro
    ... I seem to have ldconfig and I just ran it. ... Doing some stuff Thomas W outlined, I now have the new slrn installed ... It seems to have led to my next issue -- the long-header warning ... to find slang2 and therefore install, ...
    (news.software.readers)