In article <modemacDFr0qB.IyK@netcom.com>, Rt. Rev. Modemac writes:

Dr. Dimitri Vulis (dlv@bwalk.dm.com) wrote: : The National Alliance are not the first despicable racist net.abusers who forge : cancels for other people's articles critical of them on n.a.n-a.m. Ken Arromdee : has condemned one such forger, the graduate student Pyotr Vorobiev from Lehigh : University's Mechanical Engineering and Mechanics Department (+1 610 758 4100)

When Scientology began cancelling posts by their critics on alt.religion.scientology, Homer Wilson Smith wrote a program called "Lazarus" to track for cancels. The idea is simple: whenever a cancel message appears, Lazarus announces it on the newsgroup.

Mayhap a Lazaraus-type program can be put into effect on news.admin.net-abuse.misc?

Many other newsgroups are affected by such net.abuse (Vorobiev-style forged cancels based on contents); I just saw some messages on forged cancels in soc.culture.jewish and soc.culture.german. I think running Lazarus-like programs in _all_ newsgroups would be an extremely Good Idea. Alas, the time when people used to contribute their time and equipment for the public good of the net seems to be over. Peraps I'm just dreaming; or perhaps Dave Hayes will like the following idea enough to implement it. Also, I think it's a matter of time before some Cancelpoodle figures to put 'light' into the Path: of its Vorobiev-style forged cancels; then they will not be seen by lighlink.com where Lazarus now runs. This needs to be addressed. Anyway, here are my thoughts on this proposal: There would be a collection (at least 5 or 6) of cancel-watchers (sort of like the deamons that now watch misc.test) all over the world. They should be well-connected (preferrably, one hop away from sites like uunet, howland.reston.ans.net, etc). Each watcher would look at incoming articles in "control", and whenever it sees a cancel, it would replace its own uucp name in the path by something like ellipsis (to keep it confidential) and forward the cancel to a central cataloguer (singly or in batches). E.g., is a watcher at xyzz123.uucp saw a cancel with the header Path: xyz123!howland.reston.ans.net!someplace it would send it to the cataloguer with the Path: replaced by Path: ...!howland.reston.ans.net!someplace The cataloguer would wake up every few hours (for example), group the collected cancels by message-ids of the cancelled articles, and e-mail reports to the (distinct) addresses (other than "usenet@*" or "news@*") mentioned in the "From:", "Sender:", "Authorized:", and "X-Cancelled-By:" headers, and quoting the entire cancel and the Path's as seen at different sites by the cancel-watchers. This way, if the cancel is forged, its author will learn within hours that it has been fraudulently cancelled and will automatically receive enough Path: samples from all over the world to see where it was posted, by comparing the Path headers in several copies of cancels. A user or an entire site should be able to "opt out" of having its cancels reported by sending a command to the cataloguer. There should be a limit of, say, no more than 100 such notifications sent to a site in one batch (to prevent too much traffic in the event of really massive forged cancellation). I don't have the resources to do this right now, but I would be happy if some civic-minder netters took this proposal and ran with it. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps