Web Design Forums
| View previous topic :: View next topic |
| Author |
Message |
hummingbird
Guest
|
 Posted: Fri Jul 04, 2008 6:49 pm Post subject: Re: gmail posters |
 |
|
On Fri, 4 Jul 2008 02:41:11 -0500 'VanguardLH'
wrote this on alt.comp.freeware:
| Quote: |
Yes, I already said that I saw (from a partial selection of the provided
links) that the posts were made by someone using the name Brenda, that
Brenda posted through AIOE, and that AIOE doesn't include an IP address
in the NNTP-Posting-Host header (if the header is even present). I
noticed but didn't mentioned that Brenda always shows a Gmail addy in
the From header.
|
Some explanation...
I was the person who first blew the whistle on the AIOE game
by Brenda/Ari et al.
AIOE *does* add the header "NNTP-Posting-Host:* which contains
a hash of the users actual IP Address. That's how Paulo was able
to easily block that IP when someone complained.
| Quote: |
And that shows that Brenda is Little Luke and/or Ari how?
|
None of the evidence presented so far (afaik) categorically ties
all these nyms to being the same physical person. What it does do
is tie them all to the same IP Address. That probably means they
are in the same residence.
My guess is there's 1-4 people sharing a local LAN and they're
all posting to ACF and other newsgroups under different nyms
and changing their nyms frequently. I already posted a list of
nyms used on ACF up to early June through AIOE, since then
the number has increased a lot thru other servers.
(Comments above exclude that someone might be forging headers)
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer) |
|
| Back to top |
|
 |
| |
Ads |
Advertising
Sponsor
|
|
hummingbird
Guest
|
| Posted: Fri Jul 04, 2008 6:57 pm Post subject: Re: gmail posters |
|
|
On Thu, 03 Jul 2008 20:51:20 -0500 'Bear Bottoms'
wrote this on alt.comp.freeware:
| Quote: |
There is an abandoned freeware program called SpamAid (which I have a copy
of). It allows you to set a subject passcode and dumps those with out it
to the dustbin. Very easy to use, but a rather radical approach. I used to
use it a long time ago and I never ever got spam. You can also tell it to
just allow email from those in your contact list. Very easy to use and
does about the same thing.
|
Magic Mail Monitor can do all that too.
As you say, Subject password codes are a bit radical...
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer) |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
Bear Bottoms
Guest
|
| Posted: Fri Jul 04, 2008 7:12 pm Post subject: Re: gmail posters |
|
|
On Fri, 04 Jul 2008 08:57:22 -0500, hummingbird <hummingbird@127.0.0.1>
wrote:
| Quote: |
Magic Mail Monitor
|
Checking it out.
SSL support for gmail, yahoo etc.
Optional settings storage in ini file - create magic.ini file to activate
it;
Protected messages could not be deleted;
New filter actions: protect and friend-like;
Optional protection of messages from friends;
Message viewer can be selected;
"Jump to end" option for header view
Most important changes, made since last official version 2.9:
Filters!
Friends list
read/unread logic
Multilanguage interface
Ability to download just first N KB of message for preview
Ability to display raw headers in Mail properties
Support for KOI8 and UTF8 encodings
http://mmm3.sourceforge.net/
--
Bear Bottoms
Freeware website: http://bearware.info |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
Franklin
Guest
|
| Posted: Fri Jul 04, 2008 8:21 pm Post subject: Re: gmail posters |
|
|
On Fri 04 Jul 2008 09:27:48, hummingbird wrote:
| Quote: |
I might also add that during the sporge era (Sep/2007-Feb/2008)
I was lurking on several other groups where it was being debated
daily. 'Ari' was posting on a.p.a-s and getting a lot of stick.
Afaik sci.crypt was the first group to get hit with sporge and
received masses of it...much more than ACF. On one day alone
it was hit with 20,000 sporge posts.
I have no conclusive evidence of this but I had the strong feeling
at the time that Ari was responsible for the sporge ...or at least
involved in it. Given his big fall-out on sci.crypt over barcoding
encryption and given his track record on ACF recently, that view
remains.
|
Hummingbird,
That's a strange observation because several people on ACF have
formed the view that you and the ACF sporge at the beginning of this
year were not entirely unconnected.
A newcomer reading my statement might say,
"Oh but Hummingbird must be innocent of the ACF
sporge because he is posting about stopping a
sporge attack".
Oh dear What naivety! The newcomer obviously hasn't come across
the standard k00k tricks used to deflect attention.
http://www.searchlores.org/way_kook.htm |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
hummingbird
Guest
|
| Posted: Fri Jul 04, 2008 8:53 pm Post subject: Re: gmail posters |
|
|
On Fri, 04 Jul 2008 09:12:16 -0500 'Bear Bottoms'
wrote this on alt.comp.freeware:
| Quote: |
On Fri, 04 Jul 2008 08:57:22 -0500, hummingbird <hummingbird@127.0.0.1
wrote:
Magic Mail Monitor
|
| Quote: |
Checking it out.
SSL support for gmail, yahoo etc.
Optional settings storage in ini file - create magic.ini file to activate
it;
Protected messages could not be deleted;
New filter actions: protect and friend-like;
Optional protection of messages from friends;
Message viewer can be selected;
"Jump to end" option for header view
Most important changes, made since last official version 2.9:
Filters!
Friends list
read/unread logic
Multilanguage interface
Ability to download just first N KB of message for preview
Ability to display raw headers in Mail properties
Support for KOI8 and UTF8 encodings
http://mmm3.sourceforge.net/
|
Yep, it's a good program and I cut my regex teeth on it.
It also supports having FreePops plugged into it for handling
webmail accounts (hotmail/yahoo/gmail et al).
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer) |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
hummingbird
Guest
|
| Posted: Fri Jul 04, 2008 10:11 pm Post subject: Re: gmail posters |
|
|
On Fri, 4 Jul 2008 09:14:23 -0700 (PDT) 'Little Luke'
wrote this on alt.comp.freeware:
| Quote: |
http://tinyurl.com/6jdbd4
|
Sorry, I never hit such undisclosed links.
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer) |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 1:46 am Post subject: Re: gmail posters |
|
|
Sparky wrote:
| Quote: |
You're confused. AIOE certainly does include an NNTP-Posting-Host
header in posts made through that service, and that header includes all
the information needed to identify posters from the same IP address.
|
I saw:
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
Doesn't look like anything that would identify a particular poster.
However, based on your clue that this does identify the poster, I went
back to the list of message-IDs provided by Anonymous and sampled 5 of
them. While this header's value is not an IP address (or an IP name, or
both), it does seem to remain unique to an AIOE poster - but *only* to
an AIOE poster. Finding the encrypted value for the NNTP-Posting-Host
added by AIOE remains the same for a poster only further proves Brenda
is always posting through AIOE, something that I already conceded but
didn't find of value in equating her to Little Luke or Ari.
Okay, so this encrypted header remains the same for a poster through
AIOE. I already mentioned that it looked like Brenda was always posting
through AIOE. This header's value is not an IP address or IP name, so
how does that let me equate this AIOE poster to some other poster using
a *different* NNTP service that does show the IP address, like for
Little Luke's post through Comcast that show the IP address, or for a
*different* NNTP service that also uses their own uniquely generated
scrambled value in the NNTP-Posting-Host header? How do I convert
AIOE's encrypted NNTP-Posting-Host value to the IP address, IP name, or
scrambled value shown in this same header by *other* NSPs so I can see
the AIOE poster is the same as, say, a Comcast or Albasani poster?
| Quote: |
From headers have nothing to do with it beyond being a record of all the
abusive nyms the troll has used.
|
Since the NNTP-Posting-Host didn't look, to me, to be useful because it
was encrypted and only really identified the poster to AIOE, and because
Anonymous didn't bother to say that it was this header he was using to
base his conclusion, I didn't go try tracking on this encrypted string.
If indeed it does remain consistent to a poster despite its encryption
then, yes, it is possible to track a poster using it but only for
posters using the *same* NNTP service.
The problem now becomes on how to search for posts where the value of
the NNTP-Posting-Host header has the same specified value. I don't keep
a personal archive of old posts. I don't waste time downloading all
really old posts since I won't be reading them. You can't search Google
Groups on the value of any header other than From and Message-ID. A
Google Groups search on "RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org" only
turns up those posts where this string is in the body of the post, not
in the headers.
Based on the claim that Brenda is Ari [Silverstein], I search on Ari's
posts in this newsgroup. Ari posted through individual.net and those
posts have no NNTP-Posting-Host header. Ari posted through
highwinds-media.net (Cox) which does have that header but its value is
an IP address (and obviously they wouldn't generate the same encrypted
value for this header as does AIOE if Cox did use an encrypted value).
Ari posted through Albasani.net which adds an X-NNTP-Posting-Host header
but is encrypted and is unique to Albasani so it cannot be equated to
the encrypted value used by AIOE. I went back to posts where he used
"Ari Silverstein" as his moniker. One was him posting through
bellsouth.net but, alas, no NNTP-Posting-Host header.
Because all of Brenda's posts were through AIOE, and because an
encrypted value is used by AIOE in the NNTP-Posting-Host header (which
is, I assume, unique to AIOE since they generated the value), I would
have to find a post by Ari that went through AIOE to see his
NNTP-Posting-Host header matched on Brenda's. Got a post by Ari that
went through AIOE?
The scrambled value generated by AIOE for Brenda cannot be equated to
the scrambled value for Ari generated by Albasani or the IP address
shown by Cox (or to the IP address for Little Luke at Comcast). I'd
have to find a post by Ari that went through AIOE to see if his
NNTP-Posting-Host header's scrambled value matched up with Brenda's
posts that all go through AIOE.
| Quote: |
If you'd be so kind as to let go of your arrogance for just long enough
to reread the very first sentence I typed in the message you just
replied to, the 14 simple English words quoted above, you'll have your
answer.
|
Anonymous shoved a bunch of data at me as though that would make me come
to whatever conclusion was based on this data. I could shove a handful
of sand in your face and say it was from the shores of the state of
Maine but that doesn't explain why that is so. Data is not truth.
Making a claim but being too lazy to prove it or explain your conclusion
means no one is going to bother accepting your claim.
| Quote: |
The tie is the fact that they all came from the same IP address. And a
host lookup will show that it's from a pool of residential addresses.
|
Um, how do you convert the scrambled value in the NNTP-Posting-Host
header added by AIOE to equate it to:
- The scrambled value in the NNTP-Posting-Host header added by Albasani
for Ari's posts?
- The IP address shown in the NNTP-Posting-Host header added by Cox for
Ari's posts?
- The different IP address in the NNTP-Posting-Host header added by
Comcast for Little Luke's posts (and which was different that the IP
address for Ari)?
[X-]NNTP-Posting-Host header values:
Brenda via AIOE = RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
Ari via Albasani = VL3YzPDvYGUe7M36F4vAN7sKwEhNfo1N2r9HpS+i5s=
Ari via individual.net = <no header>
Ari via Highwinds/Cox = <some IP address> (can't find the post again)
Ari via bellsouth = <no header>
How do I convert the scrambled value to an IP address? How to I convert
the IP address to a scrambled value? Why would the scrambled value be
the same for different NSPs? If none of that is possible, where is a
post from Ari that went through AIOE?
| Quote: |
What "insight"? It doesn't take a rocket scientist to figure out what
"NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org" being 100%
consistent throughout hundreds of posts means.
|
Please show a post by Ari that went through AIOE to show that unique
scrambled value added by AIOE. The Google Groups search on this value:
http://groups.google.com/groups?scoring=d&q=group:alt.comp.freeware+"RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org"
returns 4 results, none of which will have that string as a value of a
header (since Google Groups won't search there). Through which
newsgroups archive are you searching that lets you search on the value
of the NNTP-Posting-Host header - and which is also available to me - to
find all posts with that value in this header? |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 2:02 am Post subject: Re: gmail posters |
|
|
hummingbird wrote:
| Quote: |
On Fri, 4 Jul 2008 02:41:11 -0500 'VanguardLH'
wrote this on alt.comp.freeware:
Yes, I already said that I saw (from a partial selection of the provided
links) that the posts were made by someone using the name Brenda, that
Brenda posted through AIOE, and that AIOE doesn't include an IP address
in the NNTP-Posting-Host header (if the header is even present). I
noticed but didn't mentioned that Brenda always shows a Gmail addy in
the From header.
Some explanation...
I was the person who first blew the whistle on the AIOE game
by Brenda/Ari et al.
AIOE *does* add the header "NNTP-Posting-Host:* which contains
a hash of the users actual IP Address. That's how Paulo was able
to easily block that IP when someone complained.
And that shows that Brenda is Little Luke and/or Ari how?
None of the evidence presented so far (afaik) categorically ties
all these nyms to being the same physical person. What it does do
is tie them all to the same IP Address. That probably means they
are in the same residence.
My guess is there's 1-4 people sharing a local LAN and they're
all posting to ACF and other newsgroups under different nyms
and changing their nyms frequently. I already posted a list of
nyms used on ACF up to early June through AIOE, since then
the number has increased a lot thru other servers.
(Comments above exclude that someone might be forging headers)
|
Assuming that the *dynamic* IP address assigned to someone doesn't get
released after it has expired and they end up getting assigned a
different one, and one that was previously used by the "abuser". Even
broadband users occasionally end up with a different IP address when
they renegotiate their session. I have cable and am now on my 3rd
different IP address this year and the year is only half over. You
might renegotiate the IP lease with the DHCP server to get the same IP
address from their pool but there's no guarantee that you'll get the
same one. Dial-up users always get a different dynamic IP address in a
new session.
Since the scrambled value in AIOE's NNTP-Posting-Host header for Brenda
remained the same (in my sampling of the posts listed by Anonymous), she
probably has an always-on (broadband) connection. Ari is bouncing
between multiple NSPs, none of which that I could find were AIOE, so I
could not equate their scrambled mess with AIOE's scrambled mess or
equate their IP address to AIOE's scrambled mess. I'd have to see a
post by Ari that went through AIOE to see the scrambled mess in his
NNTP-Posting-Host header matched up with Brenda's who posts through
AIOE.
Or is there some way to descramble AIOE's NNTP-Posting-Host header to
determine the IP address of the poster so it could be matched up with
the descrambled or IP address in that header on other NSPs?
Google Groups searching won't look in but the From and Message-ID
headers. I cannot search on Brenda's value in the NNTP-Posting-Host
header to then go see who else is using that same value in their
NNTP-Posting-Header. How did you do a search to find everyone using the
same scrambled value from AIOE in the NNTP-Posting-Header? Did you
search your own local archive to search on a value in that header?
Since NNTP-Posting-Host is not included in the set of overview headers,
all posts would have to be downloaded to get at that header in each post
and that would probably consume all my monthly quota although I only
subscribe to text groups. |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
iNcReDuLoUs
Guest
|
| Posted: Sat Jul 05, 2008 2:54 am Post subject: Re: gmail posters |
|
|
VanguardLH <V@nguard.LH> wrote:
| Quote: |
Since the scrambled value in AIOE's NNTP-Posting-Host header for Brenda
remained the same (in my sampling of the posts listed by Anonymous), she
probably has an always-on (broadband) connection. Ari is bouncing
between multiple NSPs, none of which that I could find were AIOE, so I
could not equate their scrambled mess with AIOE's scrambled mess or
equate their IP address to AIOE's scrambled mess. I'd have to see a
post by Ari that went through AIOE to see the scrambled mess in his
NNTP-Posting-Host header matched up with Brenda's who posts through
AIOE.
|
Fyi, and note the dates:
ari
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g33ihp$vq2$1@aioe.org>
http://preview.tinyurl.com/69ou5o
krazee brenda
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g35djn$mvq$1@aioe.org>
http://preview.tinyurl.com/5jtroq
ari
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g35sjn$ehl$1@aioe.org>
http://preview.tinyurl.com/5lpxjs
By the way:
NNTP-Posting-Host: 4EWbcYEJ25dHs/2NQA5EzA.user.aioe.org
http://preview.tinyurl.com/6mlrxm
http://preview.tinyurl.com/yuqmxk
http://preview.tinyurl.com/3dqtca
And finally:
http://preview.tinyurl.com/6pjt94
--
I lurk, therefore I am. If I post, I am iNcReDuLoUs. |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
hummingbird
Guest
|
| Posted: Sat Jul 05, 2008 3:15 am Post subject: Re: gmail posters |
|
|
On Fri, 4 Jul 2008 16:02:57 -0500 'VanguardLH'
wrote this on alt.comp.freeware:
| Quote: |
hummingbird wrote:
On Fri, 4 Jul 2008 02:41:11 -0500 'VanguardLH'
wrote this on alt.comp.freeware:
Yes, I already said that I saw (from a partial selection of the provided
links) that the posts were made by someone using the name Brenda, that
Brenda posted through AIOE, and that AIOE doesn't include an IP address
in the NNTP-Posting-Host header (if the header is even present). I
noticed but didn't mentioned that Brenda always shows a Gmail addy in
the From header.
Some explanation...
I was the person who first blew the whistle on the AIOE game
by Brenda/Ari et al.
AIOE *does* add the header "NNTP-Posting-Host:* which contains
a hash of the users actual IP Address. That's how Paulo was able
to easily block that IP when someone complained.
And that shows that Brenda is Little Luke and/or Ari how?
None of the evidence presented so far (afaik) categorically ties
all these nyms to being the same physical person. What it does do
is tie them all to the same IP Address. That probably means they
are in the same residence.
My guess is there's 1-4 people sharing a local LAN and they're
all posting to ACF and other newsgroups under different nyms
and changing their nyms frequently. I already posted a list of
nyms used on ACF up to early June through AIOE, since then
the number has increased a lot thru other servers.
(Comments above exclude that someone might be forging headers)
|
| Quote: |
Assuming that the *dynamic* IP address assigned to someone doesn't get
released after it has expired and they end up getting assigned a
different one, and one that was previously used by the "abuser".
|
Not exactly sure what you mean above...
Afaik when a dynamic addy is released, it goes back into the pool
for reallocation within seconds/minutes (most UK ISPs do this).
But I have no info whether the IP addy involved is dynamic or not.
All I know is that it is the same one because the AIOE hash was
the same.
The chances of the same IP addy being assigned to different
posters on ACF is pretty slim. Add to that the content of the
posts were in exactly the same vein. That points to it being the
same person -or- same group of likeminded people following the
same agenda. But I never discount any possibility.
| Quote: |
Even
broadband users occasionally end up with a different IP address when
they renegotiate their session.
|
Not in my case. But I guess it does happen for people who have
dynamic addies. I have always on ADSL.
| Quote: |
I have cable and am now on my 3rd
different IP address this year and the year is only half over. You
might renegotiate the IP lease with the DHCP server to get the same IP
address from their pool but there's no guarantee that you'll get the
same one. Dial-up users always get a different dynamic IP address in a
new session.
Since the scrambled value in AIOE's NNTP-Posting-Host header for Brenda
remained the same (in my sampling of the posts listed by Anonymous), she
probably has an always-on (broadband) connection.
|
That's my guess too.
| Quote: |
Ari is bouncing
between multiple NSPs, none of which that I could find were AIOE,
|
In another post, I gave you MIDs showing that Ari had used *the
same* AIOE hashed posting addy as Brenda and also a bunch of
other nyms. Therefore they all came from the same IP addy.
| Quote: |
so I
could not equate their scrambled mess with AIOE's scrambled mess or
equate their IP address to AIOE's scrambled mess. I'd have to see a
post by Ari that went through AIOE to see the scrambled mess in his
NNTP-Posting-Host header matched up with Brenda's who posts through
AIOE.
|
See at another post of mine to you which I posted earlier today.
I listed the MIDs from Ari and all the others which came through
AIOE using the same IP addy.
| Quote: |
Or is there some way to descramble AIOE's NNTP-Posting-Host header to
determine the IP address of the poster so it could be matched up with
the descrambled or IP address in that header on other NSPs?
|
Well, the NSP here is AIOE and Paulo can obviously unscramble
the hash to ID the IP addy.
| Quote: |
Google Groups searching won't look in but the From and Message-ID
headers. I cannot search on Brenda's value in the NNTP-Posting-Host
header to then go see who else is using that same value in their
NNTP-Posting-Header.
|
I can, and I did do that. I have a ACF messagebase of ~174,000
articles going back 12-18 months or more and I searched the whole
lot to produce the list I posted. The first post using that AIOE
posting host was a few months ago and quite a few since using
different nyms.
| Quote: |
How did you do a search to find everyone using the
same scrambled value from AIOE in the NNTP-Posting-Header?
|
Agent global search on: NNTP-Posting-Host:
| Quote: |
Did you
search your own local archive to search on a value in that header?
|
Yep.
| Quote: |
Since NNTP-Posting-Host is not included in the set of overview headers,
all posts would have to be downloaded to get at that header in each post
and that would probably consume all my monthly quota although I only
subscribe to text groups.
|
Yep, see above, I have 174,000 messages on my system.
There are some gaps in it due to killfiles.
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer) |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 3:46 am Post subject: Re: gmail posters |
|
|
iNcReDuLoUs wrote:
| Quote: |
VanguardLH <V@nguard.LH> wrote:
Since the scrambled value in AIOE's NNTP-Posting-Host header for Brenda
remained the same (in my sampling of the posts listed by Anonymous), she
probably has an always-on (broadband) connection. Ari is bouncing
between multiple NSPs, none of which that I could find were AIOE, so I
could not equate their scrambled mess with AIOE's scrambled mess or
equate their IP address to AIOE's scrambled mess. I'd have to see a
post by Ari that went through AIOE to see the scrambled mess in his
NNTP-Posting-Host header matched up with Brenda's who posts through
AIOE.
Fyi, and note the dates:
ari
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g33ihp$vq2$1@aioe.org
http://preview.tinyurl.com/69ou5o
krazee brenda
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g35djn$mvq$1@aioe.org
http://preview.tinyurl.com/5jtroq
ari
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org
MID: <g35sjn$ehl$1@aioe.org
http://preview.tinyurl.com/5lpxjs
By the way:
NNTP-Posting-Host: 4EWbcYEJ25dHs/2NQA5EzA.user.aioe.org
http://preview.tinyurl.com/6mlrxm
http://preview.tinyurl.com/yuqmxk
http://preview.tinyurl.com/3dqtca
And finally:
http://preview.tinyurl.com/6pjt94
|
Ah, thanks. That's what evidence I wanted to see. I noted in my other
post:
http://groups.google.com/group/alt.comp.freeware/msg/295dbf664a7d6a20
that I couldn't equate Ari's post on other NSPs using AIOE's scrambled
value in the NNTP-Posting-Host. So how do I search to find a particular
value for the NNTP-Posting-Host?
I had to find a post by Ari that went through AIOE to match up on the
NNTP-Post-Host header's value. I canot see a way to search Google
Groups to find past posts with a particular value in this particular
header. How did you find those old posts of Ari's that had this value
for that header?
I'd like to do the same analysis on Little Luke that Cyberiade claimed
is a sockpuppet for Ari aka Brenda aka Kazee but would need to find his
posts that also matched on the value of the NNTP-Posting-Host header.
I'd have to search on the "RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org" value
in the NNTP-Posting-Host header to see if Little Luke ever posted
through AIOE and had that value in that header. It seems odd that Ari
would have a conversation with himself through the persona of Little
Luke, as in:
http://groups.google.com/group/alt.comp.freeware/tree/browse_frm/thread/1691f57bb49a2f58/c896a1b695853ea5
A Google Groups search in this newsgroup found 44 posts from Little Luke
but who posts through Google Groups from Comcast (IP = 76.101.10.138).
So I cannot equate their IP address to the scrambled value in AIOE's
NNTP-Posting-Host header. |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 3:55 am Post subject: Re: gmail posters |
|
|
hummingbird wrote:
| Quote: |
On Thu, 03 Jul 2008 20:51:20 -0500 'Bear Bottoms'
wrote this on alt.comp.freeware:
There is an abandoned freeware program called SpamAid (which I have a copy
of). It allows you to set a subject passcode and dumps those with out it
to the dustbin. Very easy to use, but a rather radical approach. I used to
use it a long time ago and I never ever got spam. You can also tell it to
just allow email from those in your contact list. Very easy to use and
does about the same thing.
Magic Mail Monitor can do all that too.
As you say, Subject password codes are a bit radical...
|
Magic is what I use rather than leave my e-mail client always running
(Outlook).
Outlook has the nasty behavior that it downloads an e-mail *before* it
exercises any rules against it. I don't want to waste the bandwidth and
disk space on e-mails that the rules are going to delete based solely on
their headers. Magic, like Outlook Express and other personal e-mail
clients, let you download just the headers and exercise your rules on
them, so you can delete from server without downloading the body.
Another defect of Outlook is that it will popup the progress window when
there is a mail session error although I've configured it to not show
the progress window. If there is an error, it shows the progress window
despite the configuration. I'm still using OL2002 (no bang-for-the-buck
for me to get OL2003/2007). Magic may also have mail session errors but
it doesn't popup to get in my way. With 144 mail sessions per day
(every 10 minutes), I could care less if a dozen, or two, spread out or
altogether in a day failed to handshake properly. So I use Magic
because it stays out the way and gives me the headers-only download with
delete-at-server rule.
My guess is that SpamAid might generate a new passcode for each
recipient so that a particular recipient must use a unique passcode to
get their e-mails past your filtering. That's okay but a bit more
excessive than my needs. I only need a single passcode because the
account has a specific use: only for e-mails initiated from newsgroups
discussions. Everyone there will see the passcode so I only need one
passcode. Changing it in the rule and signature is very easy should
someone decide to somehow get me spammed that includes the passcode in
the Subject (which is not very likely). I haven't looked at SpamAid yet
to see just what exactly it does. |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 4:02 am Post subject: Re: gmail posters |
|
|
hummingbird wrote:
| Quote: |
On Fri, 04 Jul 2008 09:12:16 -0500 'Bear Bottoms'
wrote this on alt.comp.freeware:
On Fri, 04 Jul 2008 08:57:22 -0500, hummingbird <hummingbird@127.0.0.1
wrote:
Magic Mail Monitor
Checking it out.
SSL support for gmail, yahoo etc.
Optional settings storage in ini file - create magic.ini file to activate
it;
Protected messages could not be deleted;
New filter actions: protect and friend-like;
Optional protection of messages from friends;
Message viewer can be selected;
"Jump to end" option for header view
Most important changes, made since last official version 2.9:
Filters!
Friends list
read/unread logic
Multilanguage interface
Ability to download just first N KB of message for preview
Ability to display raw headers in Mail properties
Support for KOI8 and UTF8 encodings
http://mmm3.sourceforge.net/
Yep, it's a good program and I cut my regex teeth on it.
It also supports having FreePops plugged into it for handling
webmail accounts (hotmail/yahoo/gmail et al).
|
Another good e-mail monitor with rules (that support regex) is PopTray
except for one failing: it doesn't support SSL connects. It has a
module that you supposedly install to add SSL support but I never got it
working. SSL is demanded by Gmail to connect to those e-mail accounts.
Magic added SSL support in the latest version.
I'm using YahooPOPs to access my freebie Yahoo Mail accounts (through
Magic, Outlook, or any POP3 e-mail client). I remember trying FreePOPs
but had problems with it (can't remember them). What I recollect what
that FreePOPs was flaky (sometimes went unresponsive or continually
failed to establish a mail session) and that, at the time, it did not
support Windows Live Hotmail accounts (for either the classic or full
interface) and only the classic MSN Hotmail interface. Maybe the
Hotmail module has been updated since then.
I also have Hotmail accounts. Will FreePOPs still work with Hotmail
accounts whenever Microsoft decides to disable WebDAV support for the
free Hotmail accounts and switch to Deltasync? Does FreePOPs even use
WebDAV? Does FreePOPs work with the newer Windows Live Hotmail webmail
interface? |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
VanguardLH
Guest
|
| Posted: Sat Jul 05, 2008 4:19 am Post subject: Re: gmail posters |
|
|
VanguardLH wrote:
| Quote: |
My guess is that SpamAid might generate a new passcode for each
recipient so that a particular recipient must use a unique passcode to
get their e-mails past your filtering. That's okay but a bit more
excessive than my needs. I only need a single passcode because the
account has a specific use: only for e-mails initiated from newsgroups
discussions. Everyone there will see the passcode so I only need one
passcode. Changing it in the rule and signature is very easy should
someone decide to somehow get me spammed that includes the passcode in
the Subject (which is not very likely). I haven't looked at SpamAid yet
to see just what exactly it does.
|
Uh oh, an update after finding more about SpamAid. It is an add-on for
Outlook. Although I use Outlook, I don't want a client-side anti-spam
solution that is effective in only one e-mail client. That's why I use
SpamPal which runs as a local proxy to tag the suspect e-mails (and then
I decide via rules in whatever e-mail client that I choose to use as to
what to do with those tagged e-mails).
http://www.spamaid.com/
"SpamAid 4.0 is an easy-to-use Microsoft OutlookŪ add-on ..."
It mentions only using Bayesian filtering. That's only one method of
detecting spam - and should be the last or catch-all method. SpamPal
also has a Bayes add-on which I use. Some argue against using the
guessing scheme and some like it. I'm on the fence as it really hasn't
helped much but hasn't hurt much, either. The blacklists and other
schemes find all the spamso very little is left to leak past to get
caught by the Bayes filter. In SpamPal, you can option the Bayes
plug-in to learn from the other detection schemes; i.e., its database
will get update to reflect the good/bad e-mail decisions by the other
anti-spam schemes employed in SpamPal. This helps in updating your
local Bayes database.
As I recall, SpamBayes (at sourceforge.net), also a Bayes-only filter,
can run as both an Outlook plug-in and also as a local proxy. So you
could add it to just Outlook or you could have it available to any
e-mail client that you might use by using SpamBayes as a local proxy.
The add-in is probably easier to setup versus having to configure the
e-mail clients to connect to whatever is the listening port for the
proxy and encode the targeted mail host in one of the e-mail fields,
like the username field normally used for login. It is not that hard to
setup using the proxy but many users just want an install-and-go
solution (and then come to newsgroups asking why it isn't working).
For me, SpamAid is a bit too narrow as to what e-mail clients are
supported (just Outlook) and too narrow regarding what anti-spam schemes
it employs (just Bayes). They also mention non-English character set
blocking (but I do that with rules) and a whitelist (which can be done
in almost any e-mail client via rules, address books, or safe sender
lists).
I was thinking that SpamAid did something with passcodes since that was
this subthread's discussion but, nope, it just does Bayes filtering and
works only as an Outlook add-on. |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
iNcReDuLoUs
Guest
|
| Posted: Sat Jul 05, 2008 4:45 am Post subject: Re: gmail posters |
|
|
VanguardLH <V@nguard.LH> wrote:
| Quote: |
I canot see a way to search Google Groups to find past posts with a
particular value in this particular header. How did you find those
old posts of Ari's that had this value for that header?
|
I searched a local acf archive.
| Quote: |
A Google Groups search in this newsgroup found 44 posts from Little
Luke but who posts through Google Groups from Comcast (IP =
76.101.10.138). So I cannot equate their IP address to the scrambled
value in AIOE's NNTP-Posting-Host header.
|
Note the dates:
NNTP-Posting-Host: 76.101.10.138 <-- December
http://preview.tinyurl.com/6rykmm
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org <-- December
http://preview.tinyurl.com/5q3x2u
NNTP-Posting-Host: RgfXpB6aZYrDTuodi/Ad0w.user.aioe.org <-- June
http://preview.tinyurl.com/6xgng5
NNTP-Posting-Host: 76.101.10.138 <--July
http://preview.tinyurl.com/56uhua |
|
| Back to top |
|
|
| |
Ads |
Advertising
Sponsor
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
59 Attacks blocked
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
