Better nfilter

In article <[email protected]>,
Bill Thomas <[email protected]> wrote:
>
>
>Greetings,
>
>I have worked on my nfilter with varying degress of success but
>stuff still gets through. Does nfilter really have case
>sensivity? What I have today, I have included below. If anyone
>has a better one, please post it.
>
>Thank you,
>Bill Thomas
>
>#
># NewsProxy sample filter file
># ============================
>#
># This is a sample filter file with comments.
>#
># Note that lines that begin with a # are ignored.
>#
># $Workfile: newsproxy.ini $
># $Archive: /NewsProxy/newsproxy.ini $
># $Date: 11/03/99 13:26 $
># $Revision: 1 $
># $Author: Mark Burkley $
># $Log: /NewsProxy/newsproxy.ini $
>#
># 1 11/03/99 13:26 Mark Burkley
># Initial version
>#
># ============================
>#
># Flag any posts in alt.animals.foo which are cross-posted to
># newsgroup alt.fan.foo as JUNK
>#
>alt.animals.foo flag:JUNK xref:*alt.fan.foo*
>#
># Flag any posts in any group starting with alt.disasters which are
># cross-posted to any newsgroups that contain alt.aviation as XPOST
>#
>alt.disasters.* flag:XPOST xref:*alt.aviation*
>#
># Drop any posts in any newsgroups that don't have an nntp-posting-host
># header and that are cross-posted to a newsgroup that contains the
># word flame.
>#
>* drop nntp-posting-host:(none) xref:*flame*
>#
># Flag any posts in any newsgroups that passed through the news site
># news.foo.com as FOO
>#
>* flag:FOO path:*news.foo.com*
>#
># Drop any posts from i_am_a_flamer@domain that are posted to a rec
># group.
># In one of my edits, I lost the line that went here.
>#
># Following added to stop stuff not caught by r.w FAQ rules
>rec.woodworking drop subject:*PUSSY*
>rec.woodworking drop subject:*cock*
>rec.woodworking drop subject:*COCK*
>rec.woodworking drop subject:*FUCK*
>rec.woodworking drop subject:*asshole*
>rec.woodworking drop subject:*swallow*cum*
>rec.woodworking drop subject:*cum*swallow*
>rec.woodworking drop subject:*uncu*penis*
>rec.woodworking drop subject:*joat*love*
>rec.woodworking drop subject:*JOAT*love*
>rec.woodworking drop subject:*JOAT*LOVE*
>rec.woodworking drop from:[email protected]
>rec.woodworking drop from:[email protected]
>rec.woodworking drop from:[email protected]
>rec.woodworking drop from:[email protected]
>rec.woodworking drop from:[email protected]
>rec.woodworking drop from:[email protected]
># Following from rec.woodworking FAQ
>rec.woodworking drop xref:*rec.pets*
>rec.woodworking drop xref:*:*:*:*
>rec.woodworking drop from:*puppy*
>rec.woodworking drop from:*Al Kyder*
>rec.woodworking drop from:*LoxFather*
>rec.woodworking drop from:*bwa*ha*ha*
>rec.woodworking drop subject:*fuck*
>rec.woodworking drop subject:*cocksuck*
>rec.woodworking drop subject:*sexy*
>rec.woodworking drop subject:*kyder*
>rec.woodworking drop subject:*sharpton*
>rec.woodworking drop subject:*Happy*
>rec.woodworking drop subject:*Ted Rumple*
>rec.woodworking drop subject:*GreaseBall Italian*
>rec.woodworking drop subject:*Spam Blocked*
>

The following *three* rules catch almost everything that's been problematic
_recently_:

rec.woodworking drop xref:*:*:*
rec.woodworking drop nntp-posting-host:.*206.216.[456]
rec.woodworking drop nntp-posting-host:.*205.184.1[23456789]

Note: the preceding rules _do_ require "regular expression" patterns enabled
in the nFilter/NewsProxy 'config' screen.

These rules trap:
Anything cross-posted to 3 or more groups
Anything from the IP addess-space assigned to ICG.net, and used in their
NY area facilities. this specifically targets the idjit posting as:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
*and* ANY OTHER NAME s/h/it might use.

_I_ haven't seen the p*ppywhiz, or kyder, or Lox, in a long time. those
filters may be superfluous.


Filtering on the NNTP-Posting-Host header, if available, is an excellent
way to knock out a particular poster, _regardless_ of the name he uses on
the 'From: ' line. This is _always_ available, and *not* forge-able, when
articles originate at Google.

If the NNTP-Posting-Host header is -not- available, then the name of the
news-server that it was posted through is the 'next best thing' this
is a "rec.woodworking drop path:.*{{servername}}" filter line

<[email protected]> wrote in message
news:[email protected]...
> In article <[email protected]>,

<snip>

> The following *three* rules catch almost everything that's been
problematic
> _recently_:
>
> rec.woodworking drop xref:*:*:*
> rec.woodworking drop nntp-posting-host:.*206.216.[456]
> rec.woodworking drop nntp-posting-host:.*205.184.1[23456789]

<snip>

I was just thinking today that I wish I could block the whole subnet of
ICG.net. I guess this Nfilter is more versatile than I realized. Thanks
for the tip.

todd