In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

>
> It is strange that of my subscribed newsgroups, the GG spam is only in
>this group (comp.mobile.android). (The single spam article is
>comp.sys.hp.misc is an exception.)
>
> Do you/others also see the GG spam only in this group?

Yes, google groups spam only in comp.mobile.android. Not the other 5
groups I read regularly.

Again this morning, 1900 or so of spam.

But where does Forte agent 5 put them when it filters them out? The
only new ones in my trash are two posts from yesterday, both of which I
remember deleting myself. And there are none in Junk (Maybe I was
wrong when yesterday I said there was 1.)

What do the spammers get out of doing this? It seems like at least some
work is involved.

On 2023-12-09 18:13, micky wrote:
> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> <this@ddress.is.invalid> wrote:
>
>>
>> It is strange that of my subscribed newsgroups, the GG spam is only in
>> this group (comp.mobile.android). (The single spam article is
>> comp.sys.hp.misc is an exception.)
>>
>> Do you/others also see the GG spam only in this group?
>
> Yes, google groups spam only in comp.mobile.android. Not the other 5
> groups I read regularly.
>
> Again this morning, 1900 or so of spam.
>
> But where does Forte agent 5 put them when it filters them out? The
> only new ones in my trash are two posts from yesterday, both of which I
> remember deleting myself. And there are none in Junk (Maybe I was
> wrong when yesterday I said there was 1.)

I don't know in Forte Agent, but that's not how nntp works.

The client keeps an index of deleted messages, but it can not "move"
them anywhere. The indexes and probably the slots are there, unmoved.
Just that there is no cached content.

It is not as IMAP. You delete something, that post is deleted on the
server. Here, you can not delete anything, because you don't have an
account, space on the server.

> What do the spammers get out of doing this? It seems like at least some
> work is involved.

Done by scripts.

--
Cheers,
Carlos E.R.

In comp.mobile.android, on Sat, 9 Dec 2023 18:24:33 +0100, "Carlos E.
R." <robin_listas@es.invalid> wrote:

>On 2023-12-09 18:13, micky wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:
>>
>>>
>>> It is strange that of my subscribed newsgroups, the GG spam is only in
>>> this group (comp.mobile.android). (The single spam article is
>>> comp.sys.hp.misc is an exception.)
>>>
>>> Do you/others also see the GG spam only in this group?
>>
>> Yes, google groups spam only in comp.mobile.android. Not the other 5
>> groups I read regularly.

Maybe I misspoke. I don't see the many hundreds of spam in any other ng
but I did just see 8 spams in alt.home.repair. OTOH, they prbably were
not from GG.

I forgot to see if they came from Google-groups (and if they only went
to AHR.) and it seems to be too late now. Even thuogh the confirmation
question said it was going to send all 8 to the Trash folder, they are
not there. On the other hand, two that I just sent one at a time are
there. So Forte-Agent v.5 seems to have some complicated rules.
>> Again this morning, 1900 or so of spam.
>>
>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
>I don't know in Forte Agent, but that's not how nntp works.

Sorry. I wasn't suggesting that that part relates to the discussion of
deletion that preceded it. I added the Forte-agent group because I
thought they would be interested.

>The client keeps an index of deleted messages, but it can not "move"
>them anywhere. The indexes and probably the slots are there, unmoved.
>Just that there is no cached content.
>
>It is not as IMAP. You delete something, that post is deleted on the
>server. Here, you can not delete anything, because you don't have an
>account, space on the server.
>
>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
>Done by scripts.

Even with scripts, it must take some work. Who writes the subject
lines, all of which are little different? Who writes and/or maintains
the scripts?

micky <NONONOmisc07@fmguy.com> wrote:
> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> <this@ddress.is.invalid> wrote:
>
> > It is strange that of my subscribed newsgroups, the GG spam is only in
> >this group (comp.mobile.android). (The single spam article is
> >comp.sys.hp.misc is an exception.)
> >
> > Do you/others also see the GG spam only in this group?
>
> Yes, google groups spam only in comp.mobile.android. Not the other 5
> groups I read regularly.
>
> Again this morning, 1900 or so of spam.
>
> But where does Forte agent 5 put them when it filters them out? The
> only new ones in my trash are two posts from yesterday, both of which I
> remember deleting myself. And there are none in Junk (Maybe I was
> wrong when yesterday I said there was 1.)

It depends on what your filter rule *does* when it encounters a
matching header. The most sane action would be to drop the article - not
(download and) save it - and also dropping the header. So after that,
there's nothing left.

> What do the spammers get out of doing this? It seems like at least some
> work is involved.

That's the million dollar question. Who on earth is going to look at
such articles and where (on GG or Usenet)?

As to 'work': As with all spam, one or a few persons make the spamming
tools, the others just run them and sit back, watching the show.

In comp.mobile.android, on 9 Dec 2023 18:12:03 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

>micky <NONONOmisc07@fmguy.com> wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:
>>
>> > It is strange that of my subscribed newsgroups, the GG spam is only in
>> >this group (comp.mobile.android). (The single spam article is
>> >comp.sys.hp.misc is an exception.)
>> >
>> > Do you/others also see the GG spam only in this group?
>>
>> Yes, google groups spam only in comp.mobile.android. Not the other 5
>> groups I read regularly.
>>
>> Again this morning, 1900 or so of spam.
>>
>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
> It depends on what your filter rule *does* when it encounters a
>matching header. The most sane action would be to drop the article - not
>(download and) save it - and also dropping the header. So after that,
>there's nothing left.

Yep, you're right.

Well, what this one says is
400 Delete [comp.mobile.android] messsage-id: googlegroups.com

So it's not moving it anywhere. How about that. That accounts for why
it's not there. If I overstate what it should do, it's gone, but!!
can still be recalled with Get headers / Sample recent headers.

>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
> That's the million dollar question. Who on earth is going to look at
>such articles and where (on GG or Usenet)?
>
> As to 'work': As with all spam, one or a few persons make the spamming
>tools, the others just run them and sit back, watching the show.

On 2023-12-09 18:49, micky wrote:
> In comp.mobile.android, on Sat, 9 Dec 2023 18:24:33 +0100, "Carlos E.
> R." <robin_listas@es.invalid> wrote:
>
>> On 2023-12-09 18:13, micky wrote:
>>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>>> <this@ddress.is.invalid> wrote:

...

>>> What do the spammers get out of doing this? It seems like at least some
>>> work is involved.
>>
>> Done by scripts.
>
> Even with scripts, it must take some work. Who writes the subject
> lines, all of which are little different? Who writes and/or maintains
> the scripts?

Guessing, there would be a database of the things they would want
posted, and some process would take them randomly and generate the body.
Some other thing generates the subjects, also randomly with some rules.

--
Cheers,
Carlos E.R.

On Sat, 09 Dec 2023 12:49:56 -0500, micky <NONONOmisc07@fmguy.com>
wrote:

>>> What do the spammers get out of doing this? It seems like at least some
>>> work is involved.
>>
>>Done by scripts.
>
>Even with scripts, it must take some work. Who writes the subject
>lines, all of which are little different? Who writes and/or maintains
>the scripts?

There are basically two types of spammers.
The ones that just want to annoy people , whether it be one
person in particular or an entire group of people, or in this case a
large amount of groups of people.
Or.
Someone or a group that is attempting to shut down particular
groups or the entire Usenet. Usually to prevent illegal transmission
of copyrighted files. They have found through experience that the
Usenet is bad , and don't differentiate between good groups and bad
groups. It is also much easier to use an elephant gun on a mosquito.
and thereby do as many groups as possible- all at once- just to make
sure they have killed it.
As for ease, it is relatively simple to have an automated
script(which is easy to write, or even copy from somewhere else) to do
all the damage. Then just let it go and do its thing until the person
either learns that it is no longer effective, or gets bored,or in the
case of professionals they are no longer paid to do it.
"Some work" is a relative term. An hour of coding for a new
script, or copying code that has been around for almost a decade now,
and making a few minor alterations to make it "different" for some is
a very minor inconvenience. Well worth it to accomplish their task.
The subject lines and where they are coming from are all
generated randomly by the script itself, without input from the
poster. So no need to "monitor" or maintain, or for constant input.
Just run the script and walk away.
Me

On 2023-12-09 19:12, Frank Slootweg wrote:
> micky <NONONOmisc07@fmguy.com> wrote:
>> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
>> <this@ddress.is.invalid> wrote:

....

>> But where does Forte agent 5 put them when it filters them out? The
>> only new ones in my trash are two posts from yesterday, both of which I
>> remember deleting myself. And there are none in Junk (Maybe I was
>> wrong when yesterday I said there was 1.)
>
> It depends on what your filter rule *does* when it encounters a
> matching header. The most sane action would be to drop the article - not
> (download and) save it - and also dropping the header. So after that,
> there's nothing left.

There has to be an index entry. Either the index entry of the upstream
server, marking the post dropped or something, or the message-id.

>
>> What do the spammers get out of doing this? It seems like at least some
>> work is involved.
>
> That's the million dollar question. Who on earth is going to look at
> such articles and where (on GG or Usenet)?

I doubt on Usenet. Unless they don't monitor the places they spam and
have not realized that on Usenet their stuff is removed.

Mind, it could be a denial of service attack attempt.

The servers might run out of index numbers :-?

> As to 'work': As with all spam, one or a few persons make the spamming
> tools, the others just run them and sit back, watching the show.

--
Cheers,
Carlos E.R.

Carlos E. R. <robin_listas@es.invalid> wrote:
> On 2023-12-09 19:12, Frank Slootweg wrote:
> > micky <NONONOmisc07@fmguy.com> wrote:
> >> In comp.mobile.android, on 9 Dec 2023 13:02:33 GMT, Frank Slootweg
> >> <this@ddress.is.invalid> wrote:
>
> ...
>
> >> But where does Forte agent 5 put them when it filters them out? The
> >> only new ones in my trash are two posts from yesterday, both of which I
> >> remember deleting myself. And there are none in Junk (Maybe I was
> >> wrong when yesterday I said there was 1.)
> >
> > It depends on what your filter rule *does* when it encounters a
> > matching header. The most sane action would be to drop the article - not
> > (download and) save it - and also dropping the header. So after that,
> > there's nothing left.
>
> There has to be an index entry. Either the index entry of the upstream
> server, marking the post dropped or something, or the message-id.

Yes, the 'index' is the range of article numbers the newsreader has
downloaded versus the range of article numbers the server has.

The former is commonly known as the .newsrc file. Thunderbird also has
such a file, just with a different name and hidden from the user.

For example for this group, the entry in my .newsrc file is

comp.mobile.android: 1-87092,87094-87095

This means I've read articles with article numbers (see the numbers in
the Xref: headers of the articles in your newsreader) 1-87092, have not
yet read article 87093 (if that exists) and have not yet feteched
articles 87095 and above (if such (will) exist).

So the newsreader does not (read: does not have to) keep track of a
list of message-ids, but keeps track of a *range* (not list) of article
numbers on the respective news server (NIN in (y)our case).

[...]

> The servers might run out of index numbers :-?

That used to be a worry, but with 'modern' news servers / clients with
much, much bigger ranges, that should not be a problem.

But as my personal server is quite old, *I* may need to look into
that! :-(

[...]

In alt.usenet.offline-reader.forte-agent, on Sat, 9 Dec 2023 20:40:46
+0100, "Carlos E. R." <robin_listas@es.invalid> wrote:

>
>Mind, it could be a denial of service attack attempt.
>
>The servers might run out of index numbers :-?

That certainly could be a problem. It's a wider ranging problem than
just denial of service attacks.

Since Arabic numbers were invented, powerful people in Arab lands have
controlled their production. They made a very good living, but recently
the arrival of computers has greatly increased the world's use of
numbers. So now the Arab bigwigs make much more money (and they pay
enormous taxes to their governments). In fact Saudi Arabia, for
example, makes more from its share of the number export business than it
does from oil.

They haven't been able to increase production as fast as demand has gone
up. That leads to price increases but soon will lead to serious
shortages, not just for those who like to play number games but in
health care, national defense, education. Already in some hospitals
and especially clinics in small American town, they are running out of
numbers, so they've devalued the numbers they report by a factor of 10.
That means for example that normal blood pressure is no longer reported
as 120/80 but as 12/8. Two numbers saved, and it won't be long until
such cost cutting measures come to the parts of the US where the posters
here live, and to Spain.

If you want to stem this problem, send your tax-deductible contributions
to PCANI: The President's Counsel on Arabic Number Imports

www.pcani.org.

Carlos, even you can contribute but I'll try to find some Spanish or
European group working on the same problem.

Frank Slootweg <this@ddress.is.invalid> wrote

> That's the million dollar question. Who on earth is going to look at
> such articles and where (on GG or Usenet)?

I think they're smarter than we might think, Frank.

I suspect they only want to get into the Google Groups search engine.
Many results on Google groups show up in a "normal" Google search.

If they put out a billion spams, some will eventually show up in a "normal"
Google search (i.e., using the main google.com search engine as opposed to
groups.google.com search engines).

I haven't looked extensively but they don't seem to be spamming groups
(such as the Windows 10 and 11 newsgroups you and I post to) which aren't
auto-archived - but that could also be because the portal might not work.

Dunno what they're doing for real, but micky isn't correct that it's only
this newsgroup as it's certainly other newsgroups getting the same spam.
<https://groups.google.com/g/alt.internet.wireless>
<https://groups.google.com/g/alt.comp.microsoft.windows>
<https://groups.google.com/g/uk.telecom.mobile>
<https://groups.google.com/g/rec.photo.digital>
<https://groups.google.com/g/alt.home.repair>
etc.

In alt.usenet.offline-reader.forte-agent, on Tue, 12 Dec 2023 21:33:39
-0400, Wally J <walterjones@invalid.nospam> wrote:

>Frank Slootweg <this@ddress.is.invalid> wrote
>
>> That's the million dollar question. Who on earth is going to look at
>> such articles and where (on GG or Usenet)?
>
>I think they're smarter than we might think, Frank.
>
>I suspect they only want to get into the Google Groups search engine.
>Many results on Google groups show up in a "normal" Google search.
>
>If they put out a billion spams, some will eventually show up in a "normal"
>Google search (i.e., using the main google.com search engine as opposed to
>groups.google.com search engines).
>
>I haven't looked extensively but they don't seem to be spamming groups
>(such as the Windows 10 and 11 newsgroups you and I post to) which aren't
>auto-archived - but that could also be because the portal might not work.
>
>Dunno what they're doing for real, but micky isn't correct that it's only
>this newsgroup as it's certainly other newsgroups getting the same spam.
> <https://groups.google.com/g/alt.internet.wireless>
> <https://groups.google.com/g/alt.comp.microsoft.windows>
> <https://groups.google.com/g/uk.telecom.mobile>
> <https://groups.google.com/g/rec.photo.digital>

I don't read any of these groups.

> <https://groups.google.com/g/alt.home.repair>
> etc.

But I do read this one and I get very little spam, what I do get (3 or 4
every day or 2 or 3) is the same I've been getting for months before the
recent onslaught in CMA, and ttbomr, they don't resemble what I got in
the Android group, CMA.

My filter is only for the Android group, but it's possible my news
server is filtering them out for AHR but not CMA.

I will pay more attention to what I've been getting and see if they are
from google groups and see if the style resembles CMA's

micky <NONONOmisc07@fmguy.com> wrote

>>Dunno what they're doing for real, but micky isn't correct that it's only
>>this newsgroup as it's certainly other newsgroups getting the same spam.
>> <https://groups.google.com/g/alt.internet.wireless>
>> <https://groups.google.com/g/alt.comp.microsoft.windows>
>> <https://groups.google.com/g/uk.telecom.mobile>
>> <https://groups.google.com/g/rec.photo.digital>
>
> I don't read any of these groups.

I'm sure you don't so I was just being clear that it's many newsgroups.

For example, Dave Royal pointed out this newsgroup is being spammed:
<https://groups.google.com/g/rec.music.makers.squeezebox/>

Suffice to say they're spamming a _lot_ of newsgroups; but not all. :)

>> <https://groups.google.com/g/alt.home.repair>
>> etc.
>
> But I do read this one and I get very little spam, what I do get (3 or 4
> every day or 2 or 3) is the same I've been getting for months before the
> recent onslaught in CMA, and ttbomr, they don't resemble what I got in
> the Android group, CMA.
>
> My filter is only for the Android group, but it's possible my news
> server is filtering them out for AHR but not CMA.
>
> I will pay more attention to what I've been getting and see if they are
> from google groups and see if the style resembles CMA's

Upon closer inspection, the spam on a.h.r is the kind of spam that forced
good people out of that newsgroup long ago, as Steve, badgolferman and I
used to post regularly there until you guys (yes, you too micky) turned it
into a political cesspool of jewish-hating political rants, micky.

So you may be right on a.h.r and I might be wrong, as it's unusable even
before the anonymous spammers get their paws on that specific portal.

In alt.usenet.offline-reader.forte-agent, on Wed, 13 Dec 2023 11:20:43
-0400, Wally J <walterjones@invalid.nospam> wrote:

>micky <NONONOmisc07@fmguy.com> wrote
>
>>>Dunno what they're doing for real, but micky isn't correct that it's only
>>>this newsgroup as it's certainly other newsgroups getting the same spam.
>>> <https://groups.google.com/g/alt.internet.wireless>
>>> <https://groups.google.com/g/alt.comp.microsoft.windows>
>>> <https://groups.google.com/g/uk.telecom.mobile>
>>> <https://groups.google.com/g/rec.photo.digital>
>>
>> I don't read any of these groups.
>
>I'm sure you don't so I was just being clear that it's many newsgroups.

Sure. I'm just saying I woudln't have seen them there.

>For example, Dave Royal pointed out this newsgroup is being spammed:
> <https://groups.google.com/g/rec.music.makers.squeezebox/>
>
>Suffice to say they're spamming a _lot_ of newsgroups; but not all. :)

That's it!

>>> <https://groups.google.com/g/alt.home.repair>
>>> etc.
>>
>> But I do read this one and I get very little spam, what I do get (3 or 4
>> every day or 2 or 3) is the same I've been getting for months before the
>> recent onslaught in CMA, and ttbomr, they don't resemble what I got in
>> the Android group, CMA.
>>
>> My filter is only for the Android group, but it's possible my news
>> server is filtering them out for AHR but not CMA.
>>
>> I will pay more attention to what I've been getting and see if they are
>> from google groups and see if the style resembles CMA's

Upon paying more attention, about half of them, 4 out of 8 every day or
two, were from google groups and did have some resemblance to the ones
on the android group, althogh since I delete all the ones on the Android
group I'm going by memory.
>
>Upon closer inspection, the spam on a.h.r is the kind of spam that forced
>good people out of that newsgroup long ago, as Steve, badgolferman and I
>used to post regularly there until you guys (yes, you too micky) turned it

They got my goat and I replied but for a long time I didn't start any
threads. Except a couple times I forgot, I was careful to mark mine OT
so it's easy enough to filter them out.

>into a political cesspool of jewish-hating political rants, micky.

One could take this last line to mean I was part of the Jew-haters, and
nothing could be farther from the truth. But you can tell which ones
most of those are by the From: name, and I very rarely even read them,
let alone replied to them. I think they're too sick to reason with, and
I hope everyone else is smart enough to know a sicko when he sees one.
>
>So you may be right on a.h.r and I might be wrong, as it's unusable even
>before the anonymous spammers get their paws on that specific portal.