| 
"Sporge" is a made up word used to describe a forgery-flood intended to disrupt a newsgroup. It's origins are from spam and forge. Such messages usually have the pseudonyms of posters in the targeted, or other, groups and can have any kind of subject line- from garbage to copied subject-lines from the targeted group. The line-count is usually bogus, and the sporge is almost always posted using one or more proxies- thus protecting the disruptor from any ramifications. Various filters can be used in your newsreader to deal with the floods, but the best all-around method to filter-out this static is a little freeware program called NewsProxy by Mark Burkely and Glen Harmon. It is also called NFilter. The developers used to have a website for it: at nfilter.org, but that site is defunct at this writing. You can get the last released version of the Windows binary from the downloads page of the WarezFAQ. The source code is now available thanks to WarezFAQ readers giving us the "heads-up". The source has been downloaded from several sources and the zips compared using a binary comparison (bit for bit) and were identical-indicating that they were the original distribution-zip of the source. The code has been examined for malicious code and none was found. There are altered binaries of NFilter/NewsProxy being distributed on UseNet and on the Web-- any such should be considered suspicious. The way NewsProxy operates is to place itself between your news-client and your news-server, acting as a news-client to your news-server, and a news-server to your news-client. You "connect" to NewsProxy on port 119 (adjustable) by setting the news-server to 127.0.0.1 in your news-client, leaving your login/password the same. NewsProxy in turn connects to your news-server. When you request headers in a group NewsProxy relays the command, but doesn't send all the headers directly to your news reader. Instead it reads them itself, scanning them for matches to the filter expressions you have created. Any matches it finds will cause it to execute the command you have given for that filter- i.e. "drop"- will cause NewsProxy to simply drop that message, not even sending the header along to your news-reader. Thus any sporge can be filtered-out. Care must be taken, however, in crafting filters that remove only the sporge and not desired headers. One such filter might use the IP of the sporger's proxy. An example filter would look something like this: alt.binaries.warez* drop NNTP-Posting-Host:*24.255.255.255* That filter would work for all the alt.binaries.warez groups and would drop all posts that had an NNTP-Posting-Host of 24.255.255.255, with or without leading or trailing spaces (that is what the asterisks are for.) But that filter exceeds the normal overview fields, and could fail if the server doesn't send the extra header, or it could cause excessive downloads on your part, if NewsProxy must take the body (first segment) of all the messages in order to get more than the overview fields. See below for a more detailed explanation. Click to see a copy of the <NFilterFAQ> with full instructions and example, but read the following paragraph first! A last word about filters. News-readers use what is called the "overview" from the news-server for the headers. The exact fields included in the overview will vary a bit from news-server to news-server. Any filter expression that relies on a field that is not in that overview will fail if it requires that NewsProxy download the message itself in order to get all the header fields so that it can filter the message! You do NOT want to download 10,000 (or more) message bodies (especially in a binary newsgroup!) in order to filter-out some sporge. Determine what your news-server uses for its overview and confine your filter expressions to those fields. Every server includes Subject, From, Date, Message-ID, References, Bytes, Lines, and XRef in the overview. Some also include the Sender, NNTP-Posting-Host, and/or other fields. You will be most effective and efficient if you find out exactly which fields are included by your server for the overview. and craft your filters accordingly. You can either telnet to your newsserver and ask: Start/Run telnet mynewserver:119 Then, when connected to your news-server, type "list overview.fmt". Some servers will require your username and password, some won't. To enter your user/pass type authinfo user yourusername press ENTER, it should ask you for more authentication, type authinfo pass yourpassword, then it should say something like "Authentication accepted". But it's easier (and safer!) to email your ISP or NSP at support and simply ask them to email you the news-server's overview fields, so you can create filters for UseNet. |