Re: Suggested filter rules for the flood of 2007-08-07 01:30 GMT

On 07 Aug 2007 11:55:37 +0300, Phil Carmody wrote:
Peter Pearson <ppearson@xxxxxxxxxxxxxxx> writes:

Cancel posts if any of these criteria matches:

The NNTP-Posting-Host field is 196.43.2.61
The NNTP-Posting-Host field is 203.170.144.26
The NNTP-Posting-Host field is 203.170.144.27

The path containing !peony.singnet.com.sg!news.loxinfo.co.th!
seemed to cover all of the recent batch. However, my feed
seems to have a large proportion of his sporgeries cancelled,
so I don't get to see them all any more.

I think you're right about singnet. The reason I tend to
list the offending IP addresses instead is to avoid
filtering out an entire site when more precise targetting
information is available. One reason I felt that preference
was because before I switched to Supernews, my old news
service was one whose behavior invited whole-site
obliteration. (See, for example, François Griuex's filter
recipes at

http://fragrieu.free.fr/sci_crypt_kill_rules.txt .)

Supernews does a thorough job of cleaning up sci.crypt,
so I still monitor my old feed to get statistics. (I have
lots. Want some?) Like you, though, I see evidence that
the great majority of malicious posts disappear before
reaching me.

By the way, if I could make life easier for anybody by
posting suggested rules in some other format, please
say so, preferably by email.

--
To email me, substitute nowhere->spamcop, invalid->net.
.

Relevant Pages

  • Re: Suggested filter rules for the flood of 2007-08-07 01:30 GMT
    ... Peter Pearson writes: ... The NNTP-Posting-Host field is 196.43.2.61 ... filtering out an entire site when more precise targetting ... One reason I felt that preference ...
    (sci.crypt)
  • Re: Are You On Long Island, NY? -- Whew!!
    ... with some replies or "quoted lines" that appear as one long string ... I've tried various newsreaders and it just kind of depends upon the mood ... would allow for filtering in the NNTP-Posting-Host field though... ...
    (rec.scuba)