I'm not a perl expert or an expert on cleanfeed. However, I've noted that
the "operation sudden fall" spam uses the newsgroup name as the domain part
of the message ID. Certainly there are no hosts that happen to coincide
with newsgroup names - so has anyone written a snippet for this that one may
add to cleanfeed to disallow this behavior?

On Thu, 22 May 2008 18:27:25 -0700, D. Stussy bde-arc.ampr.org> wrote:

Dunno, but probably not, as it is mostly useless unless you're currently
suffering under a attack. It is trivial for spammer to modify and avoid, and
next spam run probably won't be using it. And you do accumulate cruft, and
it might hit a false positive (some annonce-bot might be using similar
scheme, or something like that)

However (untried, from the top of my head, and I haven't seen the spam in
the first place), if you really want it, something along the lines of:

foreach my $g (@groups) {
return reject('spam') if $hdr{'Message-ID'} =~ /$g/;
}

in your local_filter_last() or similar.

"Matija Nalis" wrote in message
news:slrng3emj3.v4r.mnalis-news@eagle102.home.lan...

wrote:

that

part

may

and

Thus spake "D. Stussy" bde-arc.ampr.org>

From cleanfeed:

sub filter_art {
[...]
@groups = split(/[,\s]+/, $hdr{Newsgroups});

[...]

}

So it's a list of all groups the article is actually posted to.
And I wouldn't run the above code snippet against all groups in the
active file for performance reasons.

"Ray Banana" wrote in message
news:80zlqgjl7z.fsf@banana.shacknet.nu...

from

Hi Matija,

I would tend to prefer $hdr{'Message-ID'} =~ /\Q$g\E>$/
because $g contains dots (.) and maybe pluses (+, ++).
It should also be the end of the Message-ID (with '>$' I think).

HOWEVER, even that this routine will catch some cancel messages like:

May 22 22:39:36.844 fr.comp.os.linux.annonces>
Cancelling observe.edu.sg>

which should NOT have been rejected!

I believe the best thing to do is using NoCeM because bleachbot (maintained
by Xavier Roche) already deals with such spam:

[...]
May 22 22:31:48 news innd: SERVER cancelled <87e37059.85bf5de5@geometry.pre-college>
May 22 22:31:48 news innd: SERVER cancelled <4df4b4b1.725b63fc@hannet.ml.netbsd.current>
May 22 22:31:48 news...

"Julien

Hi D. Stussy,

It seems odd to use that pattern for legitimate messages. But nobody
says it is forbidden...

If you really want to filter, I believe you should do it on "*@news.group.name>"
and not "*news.group.name*".

"Julien