[Sean Conolly]

"Chris Whealy" wrote in message
...
Cross posting to rec.music.makers.percussion and rec.audio.pro

snip

The following example is taken from a recent post to the
rec.music.maker.percussion newsgroup, but is representative of this
general category of abusive post.

Path:
news.sap-ag.de!news2!news1.dtag.de!newsfeed00.sul.t-online.de!t-online.de!news.k-dsl.de!aioe.org!not-for-mail
From: "Drmmr"
Newsgroups: rec.music.makers.percussion
Subject: Failed attemtps
Date: Fri, 3 Oct 2008 00:18:54 -0700
Organization: Aioe.org NNTP Server
Lines: 26
Message-ID:
NNTP-Posting-Host: 0Tn5kKu+uggfa8P+Hq9fGg.user.aioe.org
X-Complaints-To:
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-RFC2646: Format=Flowed; Original
X-Newsreader: Microsoft Outlook Express 6.00.2900.5512
X-Priority: 3
X-MSMail-Priority: Normal
Xref: news.sap-ag.de rec.music.makers.percussion:409867

FWIW, one of the tricks I've used in the past to out people posting under
different names or forged names, is to look at the 'signature' of their news
client. In your example, these two headers make up a fairly specific
combination of versions for the sender's news reader:

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Newsreader: Microsoft Outlook Express 6.00.2900.5512

This helps to identify that there's a common sender for a collection of
anonymous or forged messages. In some cases if the abuser also sends normal,
non-anonymous posts from the same client, then they can be linked to the
forged posts and exposed. Even though the signature is not going to be
unique to an indivudual news client, it's frequently unique among the active
members of a specific group.

Yeah, that's a lot of work by itself, but being a compusive programmer I
wrote a program to search a news group for a set of headers like this, and
download the matching messages. Chris, you may remember I used this on a
prominant troll a some years back.

Of course it's all too easy for the trolls to do their dirty work using
Google now, but it's also easy to block that noise.

Sean

[Richard Crowley]

"Soundhaspriority" wrote ...
You guys are far more into this than I am, even though McCarty does seem
to obsessively forge me. However, I feel the need to point out something
he All forgers of idiotic posts are not stupid. There's a punchline
about the person who loses all the wheel lugs for one flat tire outside an
insane asylum, and is helped to the solution by an inmate, who says, "I
may be crazy, but I'm not stupid." This applies to an individual like
McCarty in the following way. Although he has undoubtedly made stupid life
choices (strategy), he is capable of considerable ingenuity applied to
forgeries and "social hacks" (tactics).

If he was not already aware that someone would look at the news client,
he now is, which robs you of the ability to do some very interesting
detective work. I am quite sure he uses multiple aliases, and has even
stolen the ID of someone who infrequently posts in r.a.o., just as a dare!
McCarty has the ability of a script kiddie with respect to hacks. Several
cases have occurred that raise specific suspicion.

McCarty reads everything you write, and, since he has nothing else to do,
spends his hours spinning plots that ultimately have no purpose, but can
be annoying. He is not a mindless idiot; he's a mentally ill person with
some capacity for tactical thought. So, as I suggested to others, I
suggest to you: don't discuss issues such as the above publicly. Open
private lines of communication between yourselves. Secrecy will preserve
your power.

But none of that explains why he continues to use buzzardnews.
There appear to be no legitimate posters from buzzardnews (and
if there are, they deserve whatever fate we can arrange for this
slimy NNTP provider), so it makes it trivial to identify his posts,
at least those from buzzardnews.