|
Re: Stopping Sporge tutorial using NewsProxy (where do we get nfilter.dat)?
de M.L. 01/31/2008 12:19
Glad to see you back Donna. See my comments below.
> Here is what I have.
>
> Let me know if there's something we missed in taking into account
> everyone's constructive input below ...
IMO, there should be several filter file examples, not a
one-size-fits-all filter set.
> # Start of Nfilter.dat to drop Sporge on a.c.f
I don't think the filtering should be specific to acf. It would be easy
to insert a statement on how to substitute the newsgroup asterisk
wildcard with "alt.comp.freeware" if desired
> # Enable regular expressions for this particular nfilter.dat file
There should be alternative filter sets with regexp turned off, which is
the default.
> # Hash marks indicate comments; blank lines are verbotten
> # In NewsProxy, click Edit > Configuration > Enable Regular
> Expressions # (with regexp turned on, exact match often suggests
> ending with .*) # Tell your firewall to allow Newsproxy to function
> as a server # Close and restart NProxy after editing the nfilter.dat
> file # FAQ:
> http://www.saska.co.uk/nfilter/nfilter_faq_modified.html#2.3 #
Good idea to add the FAQ link.
> # Examples:
> # Drop any post from known sporge posting hosts
> # alt.comp.freeware Drop nntp-posting-host:.*65.149.76
> # alt.comp.freeware Drop nntp-posting-host:.*206.216.[456]
> # alt.comp.freeware Drop nntp-posting-host:.*205.184.1[23456789]
> # Remove the newsgroup name to work for all newsgroups:
> # * drop NNTP-Posting-Host:*.iol.ie
> # * drop Path:*news.iol.ie*
> #
> # Use 3-line scoring to combine the two requirements above
> # * score:+10 NNTP-Posting-Host:*.iol.ie
> # * score:+10 Path:*news.iol.ie*
> # * drop score:20
> #
> # Drop posts that come from iol AND have Burkley in the from field
> # * drop Path:*news.iol.ie* From:*Burkley*
> #
> # Drop posts that come from iol OR have Burkley in the from field
> # * drop Path:*news.iol.ie* * drop From:*Burkley*
> #
> # Flag a particular word in a Subject line:
> # alt.comp.freeware Flag:CANCEL= subject:.*[Cc][Ms][Ss][Gg]
> [Cc][Aa][Nc][Cc][Ee][Ll].*
>
> # Drop anything posted from Google
> # alt.comp.freeware drop Message-ID:.*googlegroups.com.*
> #
> # Drop 4 or more xposts
> # alt.comp.freeware Drop xref:[^:]*:[^:]*:[^:]*:[^:]*:.*
>
> # Drop anything also posted to rec.pets.*
> # alt.comp.freeware Drop xref:.*rec.pets.*
> #
> # Drop anything posted from any variant of puppy in the from line
> # alt.comp.freeware Drop from:.*[Pp][Uu][Pp]+[Yy].*
> #
> # Drop anything coming from server "servername"
> # alt.comp.freeware path:.*{{servername}}
Overall, a lot of this info is duplicated in the FAQ. I don't think the
nfilter.dat should be a "how to" document. Also, it would be informative
to add a note that most of the the FAQ examples are meant for
regexp=off.
> #
> # This section kindly supplied by Peter J. Ross on January 26, 2008
> # to combat sporge
> * Drop nntp-posting-host:.*68.205.84.148
> * Drop nntp-posting-host:.*68.195.34.167
> * Drop nntp-posting-host:.*69.115.198.4
> * Drop nntp-posting-host:.*69.116.176.8
> * Drop nntp-posting-host:.*97.96.146.26
> * Drop nntp-posting-host:.*87.12.177.23
> * Drop nntp-posting-host:.*97.100.198.116
> * Drop nntp-posting-host:.*cm233242.red91-117.mundo-r.com
> * Drop nntp-posting-host:.*89-139-93-25.bb.netvision.net.il
> * Drop nntp-posting-host:.*74.77.70.141
> * Drop nntp-posting-host:.*69.201.209.30
> * Drop nntp-posting-host:.*66.68.81.203
> * Drop nntp-posting-host:.*65.184.50.97
> * Drop nntp-posting-host:.*76.168.219.69
> * Drop nntp-posting-host:.*66.182.211.134
> * Drop nntp-posting-host:.*80.192.11.216
> * Drop nntp-posting-host:.*24.163.14.102
> * Drop nntp-posting-host:.*ghf138.internetdsl.tpnet.pl
> * Drop nntp-posting-host:.*24.93.111.200
> * Drop nntp-posting-host:.*24.168.139.56
> #
> # This section kindly supplied by M.L. on January 26, 2008
> # to combat sporge
> * drop X-Complaints-To:.*interware.hu*
> * drop X-Complaints-To:.*infoave.net*
> * drop X-Complaints-To:.*telepac.pt*
> * drop X-Complaints-To:.*mchsi.com*
> * drop X-Complaints-To:.*proxad.net*
> * drop X-Complaints-To:.*rcn.net*
> * drop X-Complaints-To:.*telecomitalia.it*
> # * drop X-Complaints-To:.*rr.com*
rr.com is a major sporge gateway, if not currently *the* major one. Why
treat this filter differently from the others? The user can always
comment it out himself.
> * drop X-Complaints-To:.*suddenlink.net*
> * drop X-Complaints-To:.*usenetserver.com*
> * drop X-Complaints-To:.*http://netreport.virginmedia.com*
All regexp filters should begin and end with .*
And I also think the forward slashes should be escaped since / is a
special character, at least according to Perl regexps syntax.
* drop X-Complaints-To:.*http://netreport.virginmedia.com.*
or
* drop X-Complaints-To:.*virginmedia.com.*
> * drop X-Complaints-To:.*hanaro.com*
> * drop X-Complaints-To:.*cn99.com*
> * drop X-Complaints-To:.*retelit.it*
> * drop X-Complaints-To:.*usenet-mtu.ru*
> * drop X-Complaints-To:.*bigpond.net.au*
The above shows why more than one nfilter.dat file example is needed. A
lot of users won't have access to fields such as X-Complaints-To:,
nntp-posting-host:, path:, Control:, etc. since they are outside of
overview.fmt. Some users must depend on the Xref: field for most of
their filtering. I'd like a separate nfilters.dat for those users.
> #
> # Eliminate MI5 sporge
> * drop Subject:.*[Mm]*[Ii]*5.*
The correct regexp filter is * drop Subject:.*[Mm].[Ii].5.*
> #
> # Eliminate HTML messages
> * drop Subject:=?ISO*
> #
> # Drop cmsg cancel messages
> * Drop Subject:.*[Cc][Ms][Ss][Gg].*
> * Drop Control:.*cancel.*
That last filter is not needed.
> #
> # End NFilter.dat list