[Comp.Sci.Dept, Utrecht] Note from archiver<at>cs.uu.nl: This page is part of a big collection of Usenet postings, archived here for your convenience. For matters concerning the content of this page, please contact its author(s); use the source, if all else fails. For matters concerning the archive as a whole, please refer to the archive description or contact the archiver.

Subject: [ADMIN] Welcome to news.admin.net-abuse.sightings!

This article was archived around: Wed, 15 Apr 2009 00:03:02 -0700

All FAQs in Directory: usenet/news-admin-net-abuse-sightings
All FAQs posted in: news.admin.net-abuse.sightings
Source: Usenet Version


Archive-name: usenet/news-admin-net-abuse-sightings/welcome Posting-Frequency: twice monthly Last-modified: 2004/11/18 Version: 1.1 URL: http://wiki.killfile.org/projects/usenet/faqs/nanas/
news.admin.net-abuse.sightings (NANAS) is a newsgroup for reporting net-abuse in a semi-formalized manner. It is a robo-moderated forum, controlled by a moderation 'bot that automatically approves anything that it thinks is an on-topic post. FREQUENTLY ASKED QUESTIONS ========================== Q: Can you delete this post for me? A: While I can legitimately issue a cancel message for anything that went through the bot (http://wiki.killfile.org/projects/usenet/faqs/nanas/), this won't do much good since the message will already be archived on thousands of servers by the time I issue it, and most sites don't honor cancels in nana.* anyway. Q: Some site has decided that my messages are spam because I was mentioned in your group. Help! A: If this site is just looking for IP blocks or email addresses in NANAS and proclaiming them all 'spam sites'... well, this site is just plain foolish. All information in NANAS is unconfirmed. Some addresses have all incoming email forwarded to NANAS, spam or not. And spammers tend to forge that kind of information anyway. I am willing to contact the admins of any site that are using NANAS reports to block sites or addresses. Contact me personally (nanas-req@killfile.org) if you need help. Q: Do you spamblock addresses that go through your bot? A: No, and I don't have any plans to do so. Take it up with submitters of the abuse reports. I won't comment on my opinions on spamblocking... Q: I can forward all... A: Stop right there. I'd rather you didn't send me every email that comes to a certain address; this tends to lead fairly rapidly to an effective mailbomb, with hundreds of megabytes of forwarded traffic blocking both the network pipe and the local resources of the moderation box. As such, I have taken a fairly hard-line approach to the problem: if any problems with the volume of your posts come to my notice, I will immediately stop accepting your submissions, probably without notice. You have been warned. HOW TO POST =========== (This section assumes that you already know how to post to Usenet newsgroups in general.) As NANAS is a robomoderated forum, all messages must pass through the moderation bot before they hit the network. Unlike most such moderated groups, though, NANAS is only meant for reports; discussion of the reports should take place in the appropriate news.admin.net-abuse.* group. The robot moderator's posting criteria are simple: followups must be set to an appropriate newsgroup, and a subject tag must be set accordingly. Methods of determination: o A 'Followup-to' header pointing at 'news.admin.net-abuse.email' will add an [email] subject tag; 'news.admin.net-abuse.usenet' will add a [usenet] tag. o An existing subject tag. If the following tags are set, then followups will be set appropriately: [(e?[- ]?mail)] news.admin.net-abuse.email [(news|usenet)] news.admin.net-abuse.usenet [(icq|chat|irc|misc)] news.admin.net-abuse.misc Additional tags have been added recently (late 2004): [(phish|worm)] news.admin.net-abuse.email [(virus|relay|proxy|ssh|aim|scam)] ....misc The body of the message should contain a full copy of the reported abuse, both headers and body. If the message passes the posting criteria, then the message is approved and an approval notice is sent back to the poster. If the post is not approved, then a rejection notice is sent back to the poster. Note that these notices will not arrive if the return address is faked; as such, use of spamblocked addresses is discouraged. WHAT TO POST ============ Abuse reports regarding actual abuse of a shared public network such as the Internet, Usenet, IRC, AIM, or other similar networks is on-topic in NANAS. This includes spam of all sorts, mailbombings, breakin reports, lawsuit announcements, and anything related to topics that would be on-topic anywhere in the news.admin.net-abuse.* hierarchy, What is not on-topic is reports of abuse *on* the net, except in as much as it relates to abuse *of* the net, such as flamewars and off-topic posts. Specifically, ongoing personal fights and flamewars from other groups are not allowed in NANAS, and email flamewars should be kept away from the group. Note that even on-topic posts may be blocked if the volume from a specific person or site is too large. ORIGINAL CHARTER ================ The following charter was set down in 1996, when the group was created. It is not particularly accurate, but is presented here for historical reasons. News.admin.net-abuse.sightings is a forum for reports of sightings of net abuse. It is a robomoderated forum, allowing only properly formatted posts. Followups are required to be set strictly out of the group and into the appropriate group in the news.admin.net-abuse.* hierachy. News.admin.net-abuse.sightings is moderated by a robot moderator, run by a team of operators. The robot will automatically approve and post messages according to the following criteria: 1. The message is formatted for 78 or fewer characters per line, and is easily human readable. 2. The message follows a publicized template specified by the operator of the robot moderator. For example, the following format -may- be the standard for a Usenet abuse sighting: (headers) Subject: [usenet] (Standard Subject) Followup-to: news.admin.net-abuse.usenet From: (valid address) -or- Reply-to: (valid address) (other standard headers) (body) Abuse-spotted-in: (first group spotted) Abuse-Subject: (subject from abuse) Type-of-abuse: (EMP, ECP, binary, forgery, etc. No set rules here) Description: (description and/or comments) - (Full headers of the abuse) (Full body of the abuse) Messages may be automatically reformatted by the robot moderator for archival and standardization purposes, using procedures established by the operator of the robot moderator. For example, the following changes may be made, if deemed appropriate: 1. Only the first fifteen lines of the body of the abuse may be posted; the rest would be archived, but not posted. 2. The abuse may be reformatted to fit into 78 columns. 3. If the text of the abuse would cause technical problems with some newsreaders, the problem text may be replaced with X's; if the abuse would cause problems with most newsreaders, the article may not be posted at all. 4. Several headers may be added at the discretion of the operator of the robot moderator, such as the following: * X-Apparently-Complain-To: <postmaster@apparent.site.of.abuse> * X-Archive-Number: (a unique number) * X-Archives: (URL of site containing group archives) Messages that do not meet these criteria will be sent back to the sender with a copy of this charter and a listing of the published templates, though at most one copy of this information will be sent out per week. Forged approvals will be automatically cancelled. Changes to the robot moderator can only be enacted by a majority vote of the then-current operators; similarly, operators can be added or removed by a majority vote of the then-current operators. The news.admin.net-abuse.* hierarchy is for discussion of abuse of Usenet and/or the Internet; it is not for discussion of abuse of groups or individuals on such networks, such as flames, personal attacks, or off-topic messages. Binaries are specifically prohibited from all groups in the news.admin.* hierarchy, except as examples of other abuse. All messages removed by unauthorized cancels in the hierarchy will be automatically reposted by Dave the Resurrector or a similar program, at the discretion of the group moderator or, for the unmoderated groups, the operator of the resurrector program. Spams, gateway spews, and other attacks on the system itself will be removed as appropriate, following standard Usenet guidelines. While most of the limitations and requirements were never implemented, nobody complained. The group has served its purpose without getting more complicated than requiring Followup-to: headers. CURRENT MODERATION INFORMATION ============================== NANAS is run by 'Bob', a Verimod moderation bot written by Tim Skirvin back in 1996-97 and operated on killfile.org. While venerable, the bot still works years later. All posts that go through the moderation 'bot are signed with pgpmoose. If a post does not have a cryptographically sound X-Auth header, then the post was not approved by Elemental, and will be shortly cancelled by another bot. Tim Skirvin is currently the moderator of NANAS. Moderator: tskirvin@killfile.org (Tim Skirvin) Admin Contact Address: nanas-req@killfile.org Article Submission Address: nanas@killfile.org Archives are available through groups.google.com. Tim has also written a public web interface to the group, available at: http://news.killfile.org/