Archive-name: net-abuse-faq/part2 Posting-Frequency: biweekly [Table of Contents for part two only:] NITTY-GRITTY 3.1) Yeah, but how many times is 'X'? 3.2) What is the Breidbart Index (BI)? 3.3) What is NoCeM? 3.4) Is there a blacklist of net-abusers? 3.5) How can I tell if a post is forged? 3.6) How do I know when I've got spam on my hands? 3.7) OK, I think I've spotted a spam. Who should I mail-bomb? 3.8) OK, I think I've spotted a spam. What should I do? 3.9) What about e-mail spam? 3.10) I e-mailed a complaint to {so-and-so} about their {e-mail, post} and now they're threatening to complain to my system administrator. What should I do? 3.11) What's a cancel-bot? 3.12) Where can I get me one? 3.13) How do spam-cancellers cancel spam? 3.14) Can I sick The Man on these MAKE.MONEY.FAST losers? 3.15) What is a killfile, and how do I use one? GROAN 4.1) Why are you net-abuse people such net-cops? 4.2) Hey, I think my newsgroup is being invaded by alt.syntax.tactical! 4.3) Hey, somebody posted an ad to <newsgroup>! 4.4) Hey, so-and-so's not being nice in <newsgroup>! 4.5) Hey, the Good Times virus-- 4.6) Hey, there's this <AT&T, Jerry Garcia, whatever> banner message in the newsgroup descriptions! 4.7) Hey, one of those net.cops posted an ad for <something>! Haw! Haw! APPENDIX news.admin.net-abuse.misc charter news.admin.net-abuse.misc charter and guidelines NITTY-GRITTY ============ 3.1) Yeah, but how many times is 'X'? How many posts does it take to push the spam envelope? To use up all your spam charity points? For a bare-bones spam? To trigger the raging-spam-cancellers-from-Hell? Among those who agree that spam should be defined solely by quantity, -----------------> 20 <-------------------- appears to be the magic number, or at least a number so middle-of-the-road that it provokes very little passionate dissent in either direction. Notably, Cancelmoose[tm] refuses to set a firm number, in the belief that people would simply post [X-1] messages. It's safe to say that a couple incidents of 19-post spams would cause the magic number to plummet. Thus, 20 should be considered a vague approximation only. Passionately dissenting note: Rahul Dhesi [dhesi@rahul.net], one of the fathers of the cancel-bot movement, sticks by the following definition: More than five physically distinct postings with substantially identical content posted within a period of ten days. 3.2) What is the Breidbart Index (BI)? The Breidbart Index (BI) is a measure of the breadth of any multi-posting, cross-posting, or combination of the two. BI is defined as the sum of the square roots of how many newsgroups each article was posted to. If that number approaches 20, then the posts will probably be cancelled by somebody. For instance, four identical posts to nine newsgroups each (4 times 3) has a BI of 12. However, nine identical posts to four newsgroups each (9 times 2) has a BI of 18. 3.3) What is NoCeM? NoCeM is an end to all this spam, and an end to all this cancelling. With NoCeM (pronounced "No See 'Em"), your newsreader goes out and gets certain posts (from trusted parties) that contain lists of junk articles (ECP, spam, etc.) Your newsreader then hides those articles from you. Note that right now there's only a NoCeM newsreader for Unix. The move to NoCeM is headed by the Cancelmoose[tm] (moose@cm.org), and the moose's web site has all the info you might want about NoCeM: http://www.cm.org Also check out the newsgroup alt.nocem.misc, which will degenerate into a Big 7 newsgroup one of these days. 3.4) Is there a blacklist of net-abusers? Yes, Axel Boldt maintains the world-renowned "Blacklist of Internet Advertisers" at http://math-www.uni-paderborn.de/~axel/BL/blacklist.html 3.4) How can I tell if a post is forged? Gandalf (gandalf@ddi.digital.net) is putting together a guide to tracking down forgeries, and posting the FAQ to news.admin.net-abuse.misc. I've saved a copy of the second draft at http://www.bluemarble.net/~scotty/forgery.html For a rough article on forgery, originally constructed for this FAQ out of information contributed by Robert Bonomi, Arthur Byrne, Emma Pease, and Alan Bostick, see http://sckb.ucssc.indiana.edu/kb/data/all.afco.html For more information on headers, see RFC-1036, "Standard for Interchange of Usenet Messages," at http://www.cis.ohio-state.edu/htbin/rfc/rfc1036.html 3.5) How can I tell how many newsgroups an article was posted to? For people who can't use the classic "grepping the newsspool" method, nn or nngrab may be able to help. (The following is adapted from a posting by Lee Rudolph--thanks.) You can force the Unix newsreader nn to ignore your .newsrc and create a "merged newsgroup" consisting only of articles containing a certain word in their subject line. For instance, to gather all articles at your site containing the word "spam" in their subject line, use this command: % nngrab spam That's basically a faster version of % nn -i -s"spam" -mXx Caution: this latter method can be a long, tedious process. See the nn man page for more details. 3.6) OK, I'm certain it's spam. Who should I mail-bomb? Don't mail-bomb anybody. Harrassment is illegal everywhere. If somebody's done something truly evil, they'll get enough single responses from individuals to acheive the same effect. 3.7) OK, I'm certain it's spam. What should I do? * Check n.a.n-a.announce. If somebody's already made a definitive spotting, there's no sense in an "I've seen it, too" post. * Include a *complete* header from one copy of the spam in your post to n.a.n-a.announce. Set followups to n.a.n-a.misc. * Say how many newsgroups at your site it was posted to; list 20 or more of them. (See "How do I know how many newsgroups an article was posted to?") * Complain politely to the spammer and the Usenet administrator at the spammer's site (whose address should be "usenet@site.name"; if that fails, try "postmaster@site.name".) Request that the Usenet administrator post a response to n.a.n-a.announce, detailing what actions have been taken. 3.8) What about e-mail spam? You can always complain about unsolicited e-mail to both the bozo that sent it to you and the bozo's postmaster. To write to a postmaster, just substitute the perp's username in their address (e.g., bozo@otherwise.lovely.com) with "postmaster" (i.e., postmaster@otherwise.lovely.com.) Please be brief and polite with the postmasters, include a copy of the e-mail you received, and leave the subject-line intact (in case the postmaster wants to set up an auto-responder.) 3.9) I e-mailed a complaint to so-and-so about their {post, mail}, and now they're threatening to complain to my system administrator. What should I do? Let your sys-admin know right away what's happening. Tell them the story, briefly. [Include the post(s) in question?] Then keep them updated on any further threats. If you're brief, polite, and on the right side, you can usually find an ally in your sys-admin. 3.10) What is a cancel-bot? First off, "cancel-bot" is an unfortunate misnomer, and one that the conventional media have understandably misunderstood. "bot" implies that something is out there, running unattended, cancelling whatever meets its nefarious qualifications... But this author knows of *no* automated cancel programs in use against any type of Usenet postings, and has never heard of such a program. All spam-cancels are sent out manually and deliberately by actual human beings. (They happen to use a program that is commonly referred to as a "cancel-bot".) A cancel-bot is a program that sends out cancel messages; you feed it the message-IDs of posts, and it sends out a cancel message for each one (see RFC 1036.) Cancel messages are normally sent out by a newsreader in response to a user's request to cancel a message, using a newsreader command, *if* the user was also the original poster of the message. Sites will ignore cancel messages that don't appear to come from the original poster. Cancel-bots work around this restriction by using header lines that make it look like the original poster sent out the cancel; they'll usually add something like a "Cancelled-By" header line as well, to keep things nominally above-board. Use of a cancel-bot against anything besides 'consensus spam' outrages people, as it should. See alt.religion.scientology for sample discussions. 3.11) Where can I get me a cancel-bot? If you have to ask, you should probably wait a while. ;} 3.12) How do the spam-cancellers cancel spam? * They make bloody sure they know how to use their cancel-bot; * They confirm the spam themselves; * They announce their action to n.a.n-a.announce. This prevents everyone from waiting around and wondering whether anyone's done anything. Here's a standard section from a cancel-notification post by the beloved Cancelmoose(TM): The $alz cancel. and Path: cyberspam conventions were followed. [The $alz convention is to create your cancel message-ID by prepending 'cancel.' to the original one. The cyberspam convention is to use- 'Path: cyberspam!usenet' so that sites that do not want your cancels can easily opt out. Please use these when cancelling spam.] 3.13) Can I sick The Man on these MAKE.MONEY.FAST losers? You can complain about e-mail or Usenet pyramid schemes (at least those involving Americans somehow) to the FTC: STAFF CONTACT: Bureau of Consumer Protection David Medine, 202-326-3224 dmedine@ftc.gov Before doing so, consider seriously whether you actually want to encourage government intervention. The number of 'net cases the FTC has been involved in is very low at this point; in an ideal world, it would probably remain that way. 3.15) What is a killfile, and how do I use one? A killfile enables you to permnanently avoid reading posts by certain people, or from a certain site, or whose Subject: lines contain particular words... Check out the RN killfile FAQ at http://www.cis.ohio-state.edu/hypertext/faq/usenet/killfile-faq/faq.html Here's some newsreaders that support killfiles (search http://vsl.cnet.com/cgi-bin/vsl-master/QuickForm? to acquire the software): * trn (Unix) * nn (Unix) * NewsHopper (Mac) [please send me the names of those you know about. Thanks--] If your newsreader doesn't allow killfiling, write the author of the newsreading software and ask them to add support for killfiles. Although it doesn't discuss killfiling, see 'The "Good Net-Keeping Seal of Approval" for Usenet Software' at http://kalypso.cybercom.net/~rnewman/Good_Netkeeping_Seal for more information on what makes a good newsreader. GROAN ===== 4.1) I hate net-cops like you people. Who will watch the watchmen? net-cop.cops like this, apparently. ;} Anyways, anyone who wanted to police the net would be a pig-headed, unrealistic fool. Thankfully, we just want to shoot spam out of the sky, because * We hate it, * It feels good, and * We can. Anyways, if you don't like spam being cancelled at your site, you can have your upstream feeds alias your site to "cyberspam". 4.2) Hey, I think my group's being invaded by alt.syntax.tactical! We're sorry. Please don't bring that subject up again here. Good luck... Keith "Justified and Ancient" Cochran, who has been wrongfully accused of a.s.t involvement himself, adds: "I would suggest the first thing you do is take a chill pill." (Note that there is no second thing to do. However, you may want to pass the time reading the alt.bigfoot FAQ: http://www.cis.ohio-state.edu/hypertext/faq/usenet/bigfoot/top.html --particularly the part about cats.) See also "What is a killfile, and how do I use one?" 4.3) Hey, somebody posted an ad in {newsgroup}! So? Alright, alright: first, check to see if the post was obviously forged (see "How can I spot a forgery?") Then check to see if it's spam (see "What is Spam" and "How do I know when I've got spam on my hands?") It's probably not. We only want to hear about it if it's spam. If the ad is off-topic, and you really can't let it go, check out the advice in "Hey, so-and-so's not being nice in {newsgroup}!" 4.4) Hey, so-and-so's not being nice in {newsgroup}! Happens all the time. We don't want to hear about it. However, here are some things you can do (written by Keith "Justified and Ancient" Cochran): "The first thing to do is take it up with user@some.site. If you can't achieve a mutual understanding, then you _MIGHT_ (note, not WILL, _MIGHT_) want to mail postmaster@some.site with your complaint. If you are going to write to postmaster@some.site, be sure to include the full, unedited post you have a problem with, a short but descriptive summary of why you have a problem with it, and a short, but descriptive explanation of what you would like to have happen. "Note that this does not apply to MAKE.MONEY.FAST. If you see a copy of M.M.F, just e-mail postmaster@some.site, including the article ID, and the first paragraph of the post." See also "What is a killfile, and how do I use one?" 4.5) Hey, the "Good Times" virus-- is a total, 100%, long-proven hoax. For the complete story, see http://www.nsm.smcm.edu/News/GTHoax.html 4.6) Hey, there's this <AT&T, Jerry Garcia, whatever> banner message in the newsgroup descriptions! We know, we know... It's a fairly common prank to add bunches of newsgroups whose descriptions spell something out. Ask your local news admninstrator to rmgroup the whole lot. 4.7) Hey, one of those net.cops posted an ad for <something>! Haw! Haw! "Ad" does not equal "spam". "Ad" does not equal "net-abuse". APPENDIX ======== news.admin.misc charter: news.admin.net-abuse.misc is for the discussion of possible abuses of netnews and e-mail. It is for the discussion of standards of net abuse, to suggest appropriate courses of action (if any) to net abuse and to post reports of alleged occurrences of net abuse. Relevant topics include events associated with net abuse such as: spamming (posting many individual copies of any article), excessive crossposting of non-germane articles, injection of malformed articles into the news system (broken gateways, for example), or other forms of "roboposting" involving large numbers of postings to one or more groups, forging identity of postings, forged approval to moderated groups, forged cancellation of articles including cancellation of net abuse articles, use of rmgroup/newgroup in an abusive manner, large-scale mailings to mailing lists or other mail-bombing, deciding what isn't net abuse, general issues of netiquette, methods for resolving conflicts, proposed blacklists and boycotts, "renegade" sites, etc. Postings include news reports, reviews, and conferences, and net-abuse FAQs. Although commercial posts are not inherently net-abuse, proper methods of posting commercial material are within the scope of this group. news.admin.net-abuse.announce charter and guidelines: news.admin.net-abuse.announce Charter and Guidelines 1. What topics are relevant to this group? Events associated with net abuse, such as: - posting many individual copies of any article. Or, excessive crossposting of non-germane articles. - injection of malformed articles into the news system (broken gateways, for example), or other forms of "roboposting" involving large numbers of postings to one or more groups. - Forging identity of postings - Forged approval to moderated groups - Forged cancellation of articles not included above. Note that cancellation of net abuse articles is also relevant to the topic of net abuse. - Use of rmgroup/newgroup in an abusive manner - large-scale mailings to mailing lists or other mail-bombing Postings to this group may also include announcements relevant to the topic of net abuse, such as news reports, reviews, and conferences, and possible net-abuse FAQs. The purpose of this group is not to decide the guilt or innocence of any parties, but rather to simply report on the activity (much like the crime section found in many local newspapers). It must be kept clear that the net is a new legal area, but it is also one with a lot of unwritten rules. The moderators are in no way are attempting to act as judges, lawyers, or mediators. 2. Posting of reports of this kind of activity in no way implies that net-wide cancellation of such articles are to be encouraged. How local news admins deal with such incidents is strictly up to them. The moderators of this group should not be held responsible for actions taken by others in response to articles posted to news.admin.net-abuse.announce. 3. No moderator will engage in the following activities: - cancellation of any posts other than ones posted by them, excepting articles with forged approval to newsgroups they moderate or, if they are a news admin, posts originating from their site (following the local site's procedures). - Sending of "mailbombs", threats, abusive e-mail, or other attacks in response to alleged net abuse. 4. We are committed to providing accurate information regarding events related to net abuse (with emphasis on Usenet) in a timely manner. However, as we the moderators must often rely on the reports of others, whenever we have not confirmed a report ourselves we will state so in the posting. 5. Right of Reply. If posts have been made in this group concerning an individual's alleged net abuse and the individual and/or site from which it originated have suffered negative consequences in the form of articles cancelled, accounts cancelled, or substantial negative email; then the individual and site each have the right to one (but no more than one) reply for the purpose of justification, rebuttal, or reports of actions taken to correct or cancel the alleged abuse. 6. Examples of inappropriate postings: - redundant reports of events - Trivial events, for example "Hey, this guy posted an ad to comp.sys.xyz!" 7. Administravia - Approval of postings will be made by a team of moderators. - Change of moderators will be made by majority. Forcible removal of a moderator will be by consensus of remaining moderators. - Any rule changes will be made by majority of the moderators. Initial moderators: David Barr <barr@math.psu.edu> Joel Furr <jfurr@acpub.duke.edu> Paul Phillips <paulp@CERF.NET> Abby Franquemont-Guillory <abbyfg@tezcat.com> ---- [New:] Liszt: http://www.liszt.com/ A searchable directory of over 22,000 mailing lists.
Закладки на сайте Проследить за страницей |
Created 1996-2024 by Maxim Chirkov Добавить, Поддержать, Вебмастеру |