NNTP gateway lost its mind

DenverD · June 19, 2010, 10:21am

saturday morning here, reading via nntp and i find three messages in
opensuse.org.news.tech-news which are evidence something went bad
wrong in the forum > nntp gateway machinery on or about 18 Jun 2010
18:13 GMT…

for one thing, all three messages where previously posted to tech-news…

secondly, each carries the usual “View this thread:” [on the web side]
link…but in all three cases the link given points to a totally
unrelated thread–a bug i’ve not seen before…

third, as far as i can tell these three messages do not appear on the
html side…

each of the below THREE headers include the first couple of lines in
the message and then the “View this thread:” link, with the rest of
the message SNIPed away…(i can provide full messages if needed):

xxxxxxxxxxxx msg 1 below xxxxxxxxxxxxxxxxxxxx

Path:
kozak.provo.novell.com!kortar.provo.novell.com!kovat.provo.novell.com.POSTED!18036d74!not-for-mail
From: forumsadmin <forumsadmin@no-mx.forums.opensuse.org>
Newsgroups: opensuse.org.news.tech-news
Subject: openSUSE @ LinuxTag 2010 – We want to meet you!
Message-ID: <forumsadmin.4crkzz@no-mx.forums.opensuse.org>
Organization: forums-opensuse.provo.novell.com
User-Agent: vBulletin USENET gateway
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Lines: 19
Date: Fri, 18 Jun 2010 18:13:42 GMT
NNTP-Posting-Host: 137.65.234.114
X-Trace: kovat.provo.novell.com 1276884822 137.65.234.114 (Fri, 18 Jun
2010 12:13:42 MDT)
NNTP-Posting-Date: Fri, 18 Jun 2010 12:13:42 MDT
Xref: kortar.provo.novell.com opensuse.org.news.tech-news:4835
[SNIP]
View this thread: http://forums.opensuse.org/showthread.php?t=438293

openSUSE @ LinuxTag 2010  We want to meet you!
01-Jun-2010 10:43

xxxx msg 1 above/ msg 2 below xxxxxxxxxxxxxxx


Path:
kozak.provo.novell.com!kortar.provo.novell.com!kovat.provo.novell.com.POSTED!18036d74!not-for-mail
From: forumsadmin <forumsadmin@no-mx.forums.opensuse.org>
Newsgroups: opensuse.org.news.tech-news
Subject: openSUSE Strategy Meeting – wrap up
Message-ID: <forumsadmin.4crl01@no-mx.forums.opensuse.org>
Organization: forums-opensuse.provo.novell.com
User-Agent: vBulletin USENET gateway
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Lines: 20
Date: Fri, 18 Jun 2010 18:13:43 GMT
NNTP-Posting-Host: 137.65.234.114
X-Trace: kovat.provo.novell.com 1276884823 137.65.234.114 (Fri, 18 Jun
2010 12:13:43 MDT)
NNTP-Posting-Date: Fri, 18 Jun 2010 12:13:43 MDT
Xref: kortar.provo.novell.com opensuse.org.news.tech-news:4837

openSUSE Strategy Meeting  wrap up
31-May-2010 22:38
[SNIP]
View this thread: http://forums.opensuse.org/showthread.php?t=438295

xxxx msg 2 above/ msg 3 below xxxxxxxxxxxxxxx


Path:
kozak.provo.novell.com!kortar.provo.novell.com!kovat.provo.novell.com.POSTED!18036d74!not-for-mail
From: forumsadmin <forumsadmin@no-mx.forums.opensuse.org>
Newsgroups: opensuse.org.news.tech-news
Subject: openSUSE approaching destination – please fasten your seat
belts – openSUSE 11.3 RC1 is available
Message-ID: <forumsadmin.4crl08@no-mx.forums.opensuse.org>
Organization: forums-opensuse.provo.novell.com
User-Agent: vBulletin USENET gateway
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Lines: 20
Date: Fri, 18 Jun 2010 18:13:47 GMT
NNTP-Posting-Host: 137.65.234.114
X-Trace: kovat.provo.novell.com 1276884827 137.65.234.114 (Fri, 18 Jun
2010 12:13:47 MDT)
NNTP-Posting-Date: Fri, 18 Jun 2010 12:13:47 MDT
Xref: kortar.provo.novell.com opensuse.org.news.tech-news:4844


openSUSE approaching destination  please fasten your seat belts 
openSUSE 11.3 RC1 is available
17-Jun-2010 07:34
[SNIP]
View this thread: http://forums.opensuse.org/showthread.php?t=438306

xxxxxxxx msg 3 above xxxxxxxxxxxxxxx

user · June 19, 2010, 7:52pm

DenverD wrote:

> saturday morning here, reading via nntp and i find three messages in
> opensuse.org.news.tech-news which are evidence something went bad
> wrong in the forum > nntp gateway machinery on or about 18 Jun 2010
> 18:13 GMT…
>
> for one thing, all three messages where previously posted to tech-news…
>
> secondly, each carries the usual “View this thread:” [on the web side]
> link…but in all three cases the link given points to a totally
> unrelated thread–a bug i’ve not seen before…
>
> third, as far as i can tell these three messages do not appear on the
> html side…
>
> each of the below THREE headers include the first couple of lines in
> the message and then the “View this thread:” link, with the rest of
> the message SNIPed away…(i can provide full messages if needed):

I got a bunch of weird stuff yesterday as well from the NNTP feed.
Remember, they transferred servers a few days ago at openSUSE.org so I
would expect a few hiccups.

–
Will Honea

hendersj · June 19, 2010, 9:07pm

On Sat, 19 Jun 2010 17:52:03 +0000, Will Honea wrote:

> I got a bunch of weird stuff yesterday as well from the NNTP feed.

Did either of you note anything other than the hiccup in the tech news
group? I did note that some old messages came through there, but I
didn’t see anything else.

Jim

–
Jim Henderson
openSUSE Forums Administrator

DenverD · June 19, 2010, 9:14pm

Jim Henderson wrote:
> Did either of you note anything other than the hiccup in the tech news
> group? I did note that some old messages came through there, but I
> didn’t see anything else.

i “reported” an obvious (to me) SPAM that was dated 9 June in the
tech-news group on the http side which i couldn’t find on the nntp side…

and, actually while i said the three messages had already been posted
to tech-news, it seems those that arrived in nntp actually were not
exactly the same and may have been a early draft…

the most worrisome thing (to me) was that an obvious spam had been
overlooked for TEN days…not likely with our GREAT mod team…so, i
had wonder if we had a cracking spammer sneak in…

hendersj · June 19, 2010, 9:19pm

On Sat, 19 Jun 2010 19:14:15 +0000, DenverD wrote:

> Jim Henderson wrote:
>> Did either of you note anything other than the hiccup in the tech news
>> group? I did note that some old messages came through there, but I
>> didn’t see anything else.
>
> i “reported” an obvious (to me) SPAM that was dated 9 June in the
> tech-news group on the http side which i couldn’t find on the nntp
> side…
>
> and, actually while i said the three messages had already been posted to
> tech-news, it seems those that arrived in nntp actually were not
> exactly the same and may have been a early draft…
>
> the most worrisome thing (to me) was that an obvious spam had been
> overlooked for TEN days…not likely with our GREAT mod team…so, i
> had wonder if we had a cracking spammer sneak in…

I saw the report - thanks for that. What I’m trying to determine is if
it’s more widespread than the tech news forum or not.

It could be that the spam in question got dealt with on the web side
only, and if the high message counter got messed up in tech news, the
posts fed through a second time, including those that had been previously
deleted from the web side only.

Jim

–
Jim Henderson
openSUSE Forums Administrator

user · June 20, 2010, 7:41pm

Jim Henderson wrote:

> On Sat, 19 Jun 2010 19:14:15 +0000, DenverD wrote:
>
>> Jim Henderson wrote:
>>> Did either of you note anything other than the hiccup in the tech news
>>> group? I did note that some old messages came through there, but I
>>> didn’t see anything else.
>>
>> i “reported” an obvious (to me) SPAM that was dated 9 June in the
>> tech-news group on the http side which i couldn’t find on the nntp
>> side…
>>
>> and, actually while i said the three messages had already been posted to
>> tech-news, it seems those that arrived in nntp actually were not
>> exactly the same and may have been a early draft…
>>
>> the most worrisome thing (to me) was that an obvious spam had been
>> overlooked for TEN days…not likely with our GREAT mod team…so, i
>> had wonder if we had a cracking spammer sneak in…
>
> I saw the report - thanks for that. What I’m trying to determine is if
> it’s more widespread than the tech news forum or not.
>
> It could be that the spam in question got dealt with on the web side
> only, and if the high message counter got messed up in tech news, the
> posts fed through a second time, including those that had been previously
> deleted from the web side only.

I didn’t pay a lot of attention to which group it was in but it was a single
group so it’s likely I saw the same thing as the others. I read the groups
only via nntp so I have no clue about what shows up otherwise. I’ve seen
no further oddities so I figured it was that server transition hiccuping.

–
Will Honea

hendersj · June 20, 2010, 9:03pm

On Sun, 20 Jun 2010 17:41:59 +0000, Will Honea wrote:

> I didn’t pay a lot of attention to which group it was in but it was a
> single group so it’s likely I saw the same thing as the others. I read
> the groups only via nntp so I have no clue about what shows up
> otherwise. I’ve seen no further oddities so I figured it was that
> server transition hiccuping.

Good to know, thanks Will.

Jim

–
Jim Henderson
openSUSE Forums Administrator

hendersj · June 21, 2010, 8:40pm

Problem identified - the gateway got restarted by mistake; human error,
so it shouldn’t happen again (at least not until the next time).

Jim

–
Jim Henderson
openSUSE Forums Administrator

DenverD · June 21, 2010, 10:26pm

Jim Henderson wrote:
> Problem identified - the gateway got restarted by mistake; human error,
> so it shouldn’t happen again (at least not until the next time).

those things happen…happy to hear it wasn’t a cracker sneaking around!!

thanks for helping…

hendersj · June 21, 2010, 10:30pm

On Mon, 21 Jun 2010 20:26:15 +0000, DenverD wrote:

> Jim Henderson wrote:
>> Problem identified - the gateway got restarted by mistake; human error,
>> so it shouldn’t happen again (at least not until the next time).
>
> those things happen…happy to hear it wasn’t a cracker sneaking
> around!!
>
> thanks for helping…

Thanks for reporting it.

Jim

–
Jim Henderson
openSUSE Forums Administrator

DenverD · June 21, 2010, 10:35pm

>> thanks for helping…
>
> Thanks for reporting it.

thanks for thanking me