A FAQ on our Likely new Usenet spam notices

Among other things, our Usenet despamming software notices excessive posting of the same message; it finds 120 or more new cases of this every day. As a courtesy to ISPs involved, and as an attempt to help keep the spam on Usenet down to a dull roar, we spend some spare time sending out form letters about these new cases to the ISPs and sometimes the poster. We consider these excessive postings to be spam and generally label them as such in commentary.

Such (new) excessive postings are rejected by our news server and appear in our daily reports on our filter's activities. We do not issue cancels for these. However if a case of excessive posting qualifies as cancellable spam under the standard Usenet criteria it has almost certainly been cancelled by one of the spam cancellors. A spam cancellor may or may not have sent you mail about it; many don't, for various reasons.

More detail about what the notice means

Our software computes a signature for every article body using MD5, a standard cryptographic hashing function (these are carefully designed to produce unique output for every different input). It keeps track of the cumulative SBI for every unique signature it has seen recently. When this cumulative SBI reaches 20 or more it classifies the signature as excessively posted and saves a copy of the article that drove the cumulative SBI to or over 20.

Our notices are generating using only this single saved copy; it is all the information we have available. We know the BI and the SBI of this copy for sure. It is usually the case that other copies have been posted to as many newsgroups as this copy; using this explicitly mentioned assumption the notice says how many other articles would be necessary to hit either our criteria or the standard cancellable spam criteria.

When the BI and the SBI are the same, our criteria for spam coincide with the standard cancellable spam criteria; this happens when all the articles involved were posted to a single newsgroup each. When it appears that this has happened, based on the available copy being posted to only one newsgroup, we generate a stronger notice that explains this and states that the article may well have been cancelled as cancellable spam by one of the spam cancellors.

What do we want you to do?

We don't demand that you do anything in particular in response to these notices. On one level you need do nothing at all; our filters will silently and automatically discard all further copies of the article that we receive. On another level we hope that you will take appropriate action to curb any Usenet abuse that's going on.

If you are a service provider, we'd like you to look into the issue (don't just take our word for what's going on) and then make a decision that's in accord with your acceptable usage policies. If the sender is really spamming, we do hope that you will make sure that it doesn't happen again from you.

If you are a poster, please consider posting to fewer newsgroups or less often or both; if you aren't crossposting, please do, because it is far less annoying and damaging than posting a separate article to each newsgroup. If you are crossposting each copy but posting several copies, you are either posting to too many newsgroups or should post just one copy to all the newsgroups with a Followup-To:. It will probably help increase how many people see your message; certainly it will help you get them read here. It may also help you avoid having your current account cancelled for spamming.

Frequently Asked Questions

Here are some frequently asked questions and replies to comments that we receive in response to our notices. In general you may want to read the spam FAQ and the cancel FAQ, which together answer many common questions about spam on Usenet. We're aware that that's a lot of reading, but there's a lot of common questions.

Why did I receive a copy of this?

We send copies to the apparent administrators of some or all of the following places:

• the domain the article was posted from (or as close as we could determine).
• the domain named in the From: header when it doesn't seem to be forged.
• a web site that the spam advertises.

We send a copy to the apparent poster if either we think that someone may be forging your name to cause you problems, or we think that you may have made an innocent mistake and would appreciate the opportunity to correct it so that your message will receive greater propagation.

You should contact the poster first or
Why did you send this to so many addresses?

We send out notices in our spare time, using as little of it as possible. We have neither the time nor the interest to track notices once we've sent them, which completely precludes any attempt to first send them to addresses (the poster or otherwise) that may require resending the notice later if the first attempt bounces or the issue isn't dealt with.
If you want us to send future notices to fewer addresses, just let us know what address we should use to report Usenet abuse to you (an autoreply from your abuse account will do it; when we get one of those we switch to sending only to abuse).

You should always send a copy to the poster

Most serious spammers usually become abusive when notified of this sort of thing. We are uninterested in being abused and so send copies only when we think it likely that we won't be. Nor are we interested in attempting to convince spammers that what they are doing is wrong; we leave that up to people with more time and energy than us.

You sent us several notices about the same spam

Because our filter only triggers on absolutely identical article bodies, it can happen that someone uses several minor variations of the same spam and that each variation is posted often enough to trip our limits. We usually try to manually weed out the duplicates, but this is subject to error.

Why didn't you send your notice sooner?

Although the content of our notices is composed by software, a human sends them out (among other reasons, to apply human judgement to the process). This only happens once in a while. It may also take time to propagate an article across Usenet to us.

Can we count on you to send us notices about our users spamming?

No. We aren't a substitute for you paying attention to what your users are doing; you need to take responsability for that yourselves. We may not get around to it, or our software may discard their spam for various reasons that don't cause us to send out these notices.

I only posted this once

Perhaps your system (either the newsreader software, the news server, or both together) stuttered, repeating the same article several times. You should probably look into this to get it fixed. Please note that spam cancellors don't care why something exceeded the spam cancellation thresholds; deliberate, accident, or bug, they are likely to cancel it anyways.

But I put different subjects on each article!

Our filter doesn't look at the subject, only at the article body. Identical article bodies with different subjects will still trigger it. We attempt to not complain about cases where the subject has real content (although our filter still rejects them).

Why don't you base your notices on more information?

Our software's primary job is to remove spam from our Usenet newsfeed; it keeps around only the information necessary to do this. Saving, looking up, and using extra information would take too much time and disk space and thus does not interest us. In particular, in order to be able to list even all the message-ids involved in declaring something spam, we would have to log a number of details about all accepted articles and then (laboriously) look them up again for new spam, which would overstretch the amount of time we're willing to spend sending out notices and to some extent our disk space.

How dare you issue cancels for this?

We didn't. We do not issue cancels for spam that we reject; we are not associated with any spam cancellor that does. The only effect our rejections have is that the articles are not available on our news-reading news server.

But the articles were on topic

On Usenet it has been decided that what matters is not what is being said or where it is said but how often it is said. By analogy, it does not matter what you are saying if you are doing it with huge speakers at 120 db. More details are in the spam FAQ.

But my message is important

People don't care; it's not that important to them (and it's certainly not to us). If it really is, post it to one of the available moderated announcements groups (in cases of extreme importance, to news.announce.important). If the moderator doesn't think it that important after all, well.

What was posted wasn't spam

We consider anything we detect as excessive posting and send notices for to be spam. You are free to have a different opinion.

I'm not a spammer!

Possibly not; we agree that accidentally posting something that becomes spam does not make you a spammer. That is why our notices do not call anyone that.

The First Amendment of the US Constitution gives me a right to speak

The First Amendment gives you a right to speak with your own resources. Our news server is not your resource.

I think the standard Usenet criteria are wrong or
Issuing cancels for this is wrong

You can take it up with interested people in the newsgroups news.admin.net-abuse.usenet or news.admin.net-abuse.policy (moderated). If you don't want to be roasted for bringing up an old and hashed out issue you should carefully read the FAQs before posting. Frankly, it isn't likely that you're going to change anyone's mind.

Your criteria are wrong!

We disagree and it's our news server. We're not interested in arguments that we should change our criteria.

We're like a phone company and will do nothing

The phone company does not care about the content of your phone calls unless they become abusive. Phone companies will terminate customers for being, in their eyes and regulations, abusive. We are not asking you to monitor your customers, merely to deal with them when they become abusive of a shared resource.

We're not going to do anything about spammers

That's your choice; we certainly can't force you to do anything (although we may start refusing all articles from you). However, it has become a mark of a quality ISP to do something about spammers and the mark of a bad ISP that they do nothing. You may wish to think about what sort of a reputation you will gain by refusing to act.

Spam versus cancellable spam

Not all spam is cancellable. Because third party cancels are an easily abused tool, Usenet in general has decided that they should only be invoked on cases where there is no doubt that something is excessive (and they should be based on a strictly objective criteria). We reject what we consider to be spam, whether or not it would qualify as cancellable spam. Service providers may or may not agree with us in any particular case and take action.

What's the minimum number of articles it takes to trigger our spam recognition?

It takes at least three articles.
Because of how our Usenet despamming filter works, the largest SBI an article can contribute to a cumulative SBI is roughly 8.87. Articles with an SBI larger than this are discarded for being excessively crossposted; an article rejected for this reason (or any other of our canned ones) does not contribute to a cumulative SBI.

What do BI and SBI mean?

The Breidbart Index and the Skirvin-Breidbart Index, respectively. They measure the impact of an article (or series of them) based on how many newsgroups it was crossposted to. More details (including how they're calculated) are in the spam FAQ. Usenet spam cancellation uses the BI; we choose to use the SBI because we have opted to be aggressive and we are not issuing cancels.

Responding to a notice

If you wish to respond to a notice with questions or comments, please enclose a copy of the notice in question. We may have sent a large number of them to a particular ISP; without a copy to identify which you are writing about, we can do little or nothing.

Further information

Sending out these likely spam notices is only part of our general information on our Usenet work, our stance against all sorts of network spam and abuse, and of our policy of making much of our software and configuration data (such as our Usenet despamming code) available to the Internet community.