Better nfilter

[Bill Thomas]

Greetings,

I have worked on my nfilter with varying degress of success but stuff still gets through. Does nfilter really have case sensivity? What I have today, I have included below. If anyone has a better one, please post it.

Thank you, Bill Thomas

# # NewsProxy sample filter file # ============================ # # This is a sample filter file with comments. # # Note that lines that begin with a # are ignored. # # $Workfile: newsproxy.ini $ # $Archive: /NewsProxy/newsproxy.ini $ # $Date: 11/03/99 13:26 $ # $Revision: 1 $ # $Author: Mark Burkley $ # $Log: /NewsProxy/newsproxy.ini $ # # 1 11/03/99 13:26 Mark Burkley # Initial version # # ============================ # # Flag any posts in alt.animals.foo which are cross-posted to # newsgroup alt.fan.foo as JUNK # alt.animals.foo flag:JUNK xref:*alt.fan.foo* # # Flag any posts in any group starting with alt.disasters which are # cross-posted to any newsgroups that contain alt.aviation as XPOST # alt.disasters.* flag:XPOST xref:*alt.aviation* # # Drop any posts in any newsgroups that don't have an nntp-posting-host # header and that are cross-posted to a newsgroup that contains the # word flame. #

• drop nntp-posting-host:(none) xref:*flame* # # Flag any posts in any newsgroups that passed through the news site # news.foo.com as FOO #

• flag:FOO path:*news.foo.com* # # Drop any posts from i_am_a_flamer@domain that are posted to a rec # group. # In one of my edits, I lost the line that went here. # # Following added to stop stuff not caught by r.w FAQ rules rec.woodworking drop subject:*PUSSY* rec.woodworking drop subject:*c*ck* rec.woodworking drop subject:*COCK* rec.woodworking drop subject:*FUCK* rec.woodworking drop subject:*asshole* rec.woodworking drop subject:*swallow*cum* rec.woodworking drop subject:*cum*swallow* rec.woodworking drop subject:*uncu*penis* rec.woodworking drop subject:*joat*love* rec.woodworking drop subject:*JOAT*love* rec.woodworking drop subject:*JOAT*LOVE* rec.woodworking drop from: [e-mail] rec.woodworking drop from: [e-mail] rec.woodworking drop from: [e-mail] rec.woodworking drop from: [e-mail] rec.woodworking drop from: [e-mail] rec.woodworking drop from: [e-mail] # Following from rec.woodworking FAQ rec.woodworking drop xref:*rec.pets* rec.woodworking drop xref:*:*:*:* rec.woodworking drop from:*puppy* rec.woodworking drop from:*Al Kyder* rec.woodworking drop from:*LoxFather* rec.woodworking drop from:*bwa*ha*ha* rec.woodworking drop subject:*f*ck* rec.woodworking drop subject:*cocksuck* rec.woodworking drop subject:*sexy* rec.woodworking drop subject:*kyder* rec.woodworking drop subject:*sharpton* rec.woodworking drop subject:*Happy* rec.woodworking drop subject:*Ted Rumple* rec.woodworking drop subject:*GreaseBall Italian* rec.woodworking drop subject:*Spam Blocked*

[admin]

The following *three* rules catch almost everything that's been problematic _recently_:

rec.woodworking drop xref:*:*:* rec.woodworking drop nntp-posting-host:.*206.216.[456] rec.woodworking drop nntp-posting-host:.*205.184.1[23456789]

Note: the preceding rules _do_ require "regular expression" patterns enabled in the nFilter/NewsProxy 'config' screen.

These rules trap: Anything cross-posted to 3 or more groups Anything from the IP addess-space assigned to ICG.net, and used in their NY area facilities. this specifically targets the idjit posting as: [e-mail] [e-mail] [e-mail] [e-mail] [e-mail] [e-mail] *and* ANY OTHER NAME s/h/it might use.

_I_ haven't seen the p*ppywhiz, or kyder, or Lox, in a long time. those filters may be superfluous.

Filtering on the NNTP-Posting-Host header, if available, is an excellent way to knock out a particular poster, _regardless_ of the name he uses on the 'From: ' line. This is _always_ available, and *not* forge-able, when articles originate at Google.

If the NNTP-Posting-Host header is -not- available, then the name of the news-server that it was posted through is the 'next best thing' this is a "rec.woodworking drop path:.*{{servername}}" filter line

[todd]

problematic

I was just thinking today that I wish I could block the whole subnet of ICG.net. I guess this Nfilter is more versatile than I realized. Thanks for the tip.

todd