Newsgroups: news.admin.net-abuse.sightings,news.answers
Approved: news-answers-request@mit.edu
Subject: [ADMIN] Welcome to news.admin.net-abuse.sightings!
From: tskirvin@killfile.org (Tim Skirvin)
Followup-To: news.admin.net-abuse.policy
Message-ID: <nanas-faq.20090415070302$2219@news.killfile.org>
X-Version: 1.0 (Sun Jan 11 16:24:22 CST 2004) - Initial Version
Date: Wed, 15 Apr 2009 00:03:02 -0700
Expires: Wed, 27 May 2009 07:03:02 GMT
Archive-name: usenet/news-admin-net-abuse-sightings/welcome
Posting-Frequency: twice monthly
Last-modified: 2004/11/18
Version: 1.1
URL: http://wiki.killfile.org/projects/usenet/faqs/nanas/
news.admin.net-abuse.sightings (NANAS) is a newsgroup for reporting
net-abuse in a semi-formalized manner. It is a robo-moderated forum,
controlled by a moderation 'bot that automatically approves anything that
it thinks is an on-topic post.
FREQUENTLY ASKED QUESTIONS
==========================
Q: Can you delete this post for me?
A: While I can legitimately issue a cancel message for anything that went
through the bot (http://wiki.killfile.org/projects/usenet/faqs/nanas/),
this won't do much good since the message will already be archived on
thousands of servers by the time I issue it, and most sites don't honor
cancels in nana.* anyway.
Q: Some site has decided that my messages are spam because I was mentioned
in your group. Help!
A: If this site is just looking for IP blocks or email addresses in NANAS
and proclaiming them all 'spam sites'... well, this site is just plain
foolish. All information in NANAS is unconfirmed. Some addresses have
all incoming email forwarded to NANAS, spam or not. And spammers tend
to forge that kind of information anyway.
I am willing to contact the admins of any site that are using NANAS
reports to block sites or addresses. Contact me personally
(nanas-req@killfile.org) if you need help.
Q: Do you spamblock addresses that go through your bot?
A: No, and I don't have any plans to do so. Take it up with submitters of
the abuse reports. I won't comment on my opinions on spamblocking...
Q: I can forward all...
A: Stop right there. I'd rather you didn't send me every email that comes
to a certain address; this tends to lead fairly rapidly to an effective
mailbomb, with hundreds of megabytes of forwarded traffic blocking both
the network pipe and the local resources of the moderation box. As
such, I have taken a fairly hard-line approach to the problem: if any
problems with the volume of your posts come to my notice, I will
immediately stop accepting your submissions, probably without notice.
You have been warned.
HOW TO POST
===========
(This section assumes that you already know how to post to Usenet
newsgroups in general.)
As NANAS is a robomoderated forum, all messages must pass through the
moderation bot before they hit the network. Unlike most such moderated
groups, though, NANAS is only meant for reports; discussion of the reports
should take place in the appropriate news.admin.net-abuse.* group.
The robot moderator's posting criteria are simple: followups must be set
to an appropriate newsgroup, and a subject tag must be set accordingly.
Methods of determination:
o A 'Followup-to' header pointing at 'news.admin.net-abuse.email'
will add an [email] subject tag; 'news.admin.net-abuse.usenet' will
add a [usenet] tag.
o An existing subject tag. If the following tags are set, then
followups will be set appropriately:
[(e?[- ]?mail)] news.admin.net-abuse.email
[(news|usenet)] news.admin.net-abuse.usenet
[(icq|chat|irc|misc)] news.admin.net-abuse.misc
Additional tags have been added recently (late 2004):
[(phish|worm)] news.admin.net-abuse.email
[(virus|relay|proxy|ssh|aim|scam)] ....misc
The body of the message should contain a full copy of the reported abuse,
both headers and body.
If the message passes the posting criteria, then the message is approved
and an approval notice is sent back to the poster. If the post is not
approved, then a rejection notice is sent back to the poster. Note that
these notices will not arrive if the return address is faked; as such, use
of spamblocked addresses is discouraged.
WHAT TO POST
============
Abuse reports regarding actual abuse of a shared public network such as
the Internet, Usenet, IRC, AIM, or other similar networks is on-topic in
NANAS. This includes spam of all sorts, mailbombings, breakin reports,
lawsuit announcements, and anything related to topics that would be
on-topic anywhere in the news.admin.net-abuse.* hierarchy,
What is not on-topic is reports of abuse *on* the net, except in as
much as it relates to abuse *of* the net, such as flamewars and off-topic
posts. Specifically, ongoing personal fights and flamewars from other
groups are not allowed in NANAS, and email flamewars should be kept away
from the group.
Note that even on-topic posts may be blocked if the volume from a specific
person or site is too large.
ORIGINAL CHARTER
================
The following charter was set down in 1996, when the group was created.
It is not particularly accurate, but is presented here for historical
reasons.
News.admin.net-abuse.sightings is a forum for reports of sightings of
net abuse. It is a robomoderated forum, allowing only properly
formatted posts. Followups are required to be set strictly out of the
group and into the appropriate group in the news.admin.net-abuse.*
hierachy.
News.admin.net-abuse.sightings is moderated by a robot moderator, run
by a team of operators. The robot will automatically approve and post
messages according to the following criteria:
1. The message is formatted for 78 or fewer characters per line, and
is easily human readable.
2. The message follows a publicized template specified by the operator
of the robot moderator. For example, the following format -may- be
the standard for a Usenet abuse sighting:
(headers)
Subject: [usenet] (Standard Subject)
Followup-to: news.admin.net-abuse.usenet
From: (valid address) -or- Reply-to: (valid address)
(other standard headers)
(body)
Abuse-spotted-in: (first group spotted)
Abuse-Subject: (subject from abuse)
Type-of-abuse: (EMP, ECP, binary, forgery, etc. No set rules here)
Description: (description and/or comments)
-
(Full headers of the abuse)
(Full body of the abuse)
Messages may be automatically reformatted by the robot moderator
for archival and standardization purposes, using procedures
established by the operator of the robot moderator. For example,
the following changes may be made, if deemed appropriate:
1. Only the first fifteen lines of the body of the abuse may be
posted; the rest would be archived, but not posted.
2. The abuse may be reformatted to fit into 78 columns.
3. If the text of the abuse would cause technical problems with
some newsreaders, the problem text may be replaced with X's;
if the abuse would cause problems with most newsreaders, the
article may not be posted at all.
4. Several headers may be added at the discretion of the operator
of the robot moderator, such as the following:
* X-Apparently-Complain-To: <postmaster@apparent.site.of.abuse>
* X-Archive-Number: (a unique number)
* X-Archives: (URL of site containing group archives)
Messages that do not meet these criteria will be sent back to the
sender with a copy of this charter and a listing of the published
templates, though at most one copy of this information will be sent
out per week. Forged approvals will be automatically cancelled.
Changes to the robot moderator can only be enacted by a majority vote
of the then-current operators; similarly, operators can be added or
removed by a majority vote of the then-current operators.
The news.admin.net-abuse.* hierarchy is for discussion of abuse of
Usenet and/or the Internet; it is not for discussion of abuse of groups
or individuals on such networks, such as flames, personal attacks, or
off-topic messages.
Binaries are specifically prohibited from all groups in the
news.admin.* hierarchy, except as examples of other abuse. All
messages removed by unauthorized cancels in the hierarchy will be
automatically reposted by Dave the Resurrector or a similar program,
at the discretion of the group moderator or, for the unmoderated
groups, the operator of the resurrector program. Spams, gateway
spews, and other attacks on the system itself will be removed as
appropriate, following standard Usenet guidelines.
While most of the limitations and requirements were never implemented,
nobody complained. The group has served its purpose without getting more
complicated than requiring Followup-to: headers.
CURRENT MODERATION INFORMATION
==============================
NANAS is run by 'Bob', a Verimod moderation bot written by Tim Skirvin
back in 1996-97 and operated on killfile.org. While venerable, the bot
still works years later.
All posts that go through the moderation 'bot are signed with pgpmoose.
If a post does not have a cryptographically sound X-Auth header, then the
post was not approved by Elemental, and will be shortly cancelled by
another bot.
Tim Skirvin is currently the moderator of NANAS.
Moderator: tskirvin@killfile.org (Tim Skirvin)
Admin Contact Address: nanas-req@killfile.org
Article Submission Address: nanas@killfile.org
Archives are available through groups.google.com. Tim has also written a
public web interface to the group, available at:
http://news.killfile.org/