From: Charles Lindsey (chl@clw.cs.man.ac.uk)
Date: Fri Sep 07 2001 - 04:24:25 CDT
In <87g0a0i6k8.fsf@erlenstar.demon.co.uk> Andrew Gierth <andrew@erlenstar.demon.co.uk> writes:
>>>>>> "Charles" == Charles Lindsey <chl@clw.cs.man.ac.uk> writes:
> Charles> Q2. Do cancellers try to catch a spew in real time, issuing
> Charles> cancels as fast as articles arrive (so that hopefully they
> Charles> arrive at sites before the cancelled articles)? ...
>At the moment that may be mostly backlog (incoming delays to the server
>that feeds the bot, which is getting a little long in the tooth now).
>I have a faster bot for dealing with the flooding incidents.
To what extent do you believe you are able to get your cancel to a
significant number of sites before the article itself arrives? Is it
significantly often to be a factor in our decisions as to how to proceed?
>practice on this varies - I issue one NoCeM notice for every event of type
>2) above, at the same time as the cancels. For ongoing incidents, I issue
>notices in batch at intervals of 5 or 6 minutes.
I am surprised you do it at so short an interval. I thought nocems were
mainly for cleaning up after the event, for which fewer but larger batches
would seem to do.
>The big problem with multiple-article cancels is the question of which
>newsgroups are affected. (note that news.lists.filters currently
>consumes, even with the useless "Astro" notices filtered out, a volume
>comparable to all of comp.*.)
I suspect that a cancel posted to a raft of alt.erotica.* groups would
work fine as a batch, since those servers which subscribe to any of those
groups probably subscribe to them all. But I could see some sense in
restricting each single multi-cancel to stay within one of comp.*, rec.*,
sci.*, uk.*, etc.
As to news.lists.filters, I think there is an urgent need to structure it
so that end users can make practical use of nocems (e.g for when their
supplier does not observe cancels). AIUI, nocems were originally devised
for the benefit of end users, with the expectation that ISPs would filter
out the cancelled stuff.
>I have experimented with grouping notices by hierarchy; the main
>effect of this has been to increase the number of notices, and
>generate a significant number of 1-article notices.
Essentially what I was suggesting above. But I expect the result would be
an improvement for any site taking only a limited set of hierarchies. BTW,
how common is if for major spams/spews to cross multiple hierarchies?
Also, how practical would it be for cancels to be PGP-signed (both with
and without the opportunity to issue multi-cancels). I presume nocems are
always signed already.
-- Charles H. Lindsey ---------At Home, doing my own thing------------------------ Tel: +44 161 436 6131 Fax: +44 161 436 6133 Web: http://www.cs.man.ac.uk/~chl Email: chl@clw.cs.man.ac.uk Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K. PGP: 2C15F1A9 Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5