From: Andrew Gierth (andrew@erlenstar.demon.co.uk)
Date: Thu Sep 06 2001 - 12:15:51 CDT
>>>>> "Charles" == Charles Lindsey <chl@clw.cs.man.ac.uk> writes:
Charles> Well let us at least gather some issues together regarding multiple cancels.
Charles> Q1. Is is the case that typical spews and spams get posted
Charles> over relatively short timescales, so that the
Charles> canceller/nocemer is in a position to grab the whole batch
Charles> and deal with it as a single entity?
[...]
"It depends".
Charles> Q2. Do cancellers try to catch a spew in real time, issuing
Charles> cancels as fast as articles arrive (so that hopefully they
Charles> arrive at sites before the cancelled articles)? Looking at
Charles> some recent cancels by Andrew, it seemed that the cancel was
Charles> issued typically one hour to three hours later than the
Charles> spam, which does not seem like a real time operation.
At the moment that may be mostly backlog (incoming delays to the server
that feeds the bot, which is getting a little long in the tooth now).
I have a faster bot for dealing with the flooding incidents.
My cancels are of three kinds:
1) auto-cancels for ongoing incidents, which are issued as articles arrive
2) cancels for auto-detected binary spams, which are issued in batches at
the point where the accumulated BI reaches 20, and may include articles
up to 10 hours or so old
3) manually generated cancels (which may be for articles of any age, but
not usually more than a few days, and are usually generated in batches)
Charles> Q3 Are Nocems typically issued at the same time as cancels,
Charles> or are they usually saved up for largish batches?
practice on this varies - I issue one NoCeM notice for every event of type
2) above, at the same time as the cancels. For ongoing incidents, I issue
notices in batch at intervals of 5 or 6 minutes.
Charles> Depending on the answers to these questions, one can see
Charles> whether issuing multiple cancels in one go would help.
The big problem with multiple-article cancels is the question of which
newsgroups are affected. (note that news.lists.filters currently
consumes, even with the useless "Astro" notices filtered out, a volume
comparable to all of comp.*.)
I have experimented with grouping notices by hierarchy; the main
effect of this has been to increase the number of notices, and
generate a significant number of 1-article notices.
-- Andrew.