Slashdot Mirror
Filtering the Anonymous USENET Trolls?
BoneFlower asks: "Anonymous remailers are all well and good, but sometimes people use them to abuse people through email or through trolling newsgroups. I've had limited results filtering "anonymous" on a USENET group I frequent but many anonymous remailer trolls get through. The group was nearly unuseable for over a week due to the volume of anonymous remailer trolls. Does anyone have tips on filtering them out? I personally use Forte Agent 1.9.1, many others use Netscape/Mozilla, OE, and various others. If you could help us out, we'd appreciate it."
Second...well, I guess I said everything that needs saying above. In short, don't bite and you won't get bitten.
If you post the name of the Usenet group of which you are writing, I think the whole Slashdot community would be glad to get behind you and help out however they can.
Karma: Good (despite my invention of the Karma: sig)
I've never used Forte, but common sense would say that it contain some way to filter by IP address (from the NNTP-Posting-Host header). Worst case scenario is you have to filter each troll individually, but even that shouldn't be a problem if it gets you peace and quiet afterwards.
We see a thread full of trolls in response to a story about how to avoid trolls. Perhaps you should not have used Slashdot for this purpose? And in response to your question, everyone knows usenet is only for pr0n and mp3z/w4r3z. :-P
Is quite possibly the worst news reader ever made.
I know this is off topic (though not totally), but do these people who send all these huge amounts of spam actually make money? Or is it just a symptom of some late night infomercial pipedream?
One option that seems to work fairly well, if you have the resources, is to set up a local news spool, then filter out the crap locally. With a local spool, you can perform checks that are too expensive to perform in the reader, e.g., not just verifying a valid looking sender, but actually performing A and MX record lookups for the domain to eliminate one class of spamware. (Unfortunately other spamware sees nothing wrong with criminally impersonating innocent third parties, but there are other ways to catch them.) Or you could do some regular expression matching looking for suspicious phrases, decoding uuencoded/base64-encoded blocks to check for viral loads, etc.
If you decide to do this, you can usually perform the tests during the ingest process (if it's always running), or as a daemon that periodically runs and checks the most recent messages.
The results can be staggering. I was doing this on a couple alt.* groups as a test, and a few simple rules could reduce the SNR from about 1-in-20 messages to about 2-in-3 messages. More importantly, this approach tends to eliminate the stuff that's mindlessly repeated hundreds of times. Most people don't mind getting a spam message once, but seeing the 247th identical message to make your breasts and penis larger (*who* needs this stuff?!) can make anyone lose it.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
There's no need to be snide. Just call BoneFlower a complete dumb fuck. You'll feel better, and so will we.
By "Slashdot community" you must be refering to you and the other ./ trolls. Yeah, the best way to solve this problem is to give it more publicity and traffic by announcing the group name to the trolls and posters here.
Mod me off-topic if you must, but I am reminded of the halcyon days of Serdar Argic. It's just not as trollsome without him :)