[news.sysadmin] Forgery Funnies

weemba@garnet.berkeley.edu (Obnoxious Math Grad Student) (04/01/88)

These were the headers for try #1:

|From moss!ihnp4!exptools@uunet.uu.net Sat Feb 27 09:59:43 1988
|Received: from BBN.COM (bbn.com.ARPA) by pineapple.bbn.com id AA03321; Sat, 27 Feb 88 09:53:04 est
|Received: from uunet.uu.net by BBN.COM id aa09662; 27 Feb 88 9:50 EST
|Received: from moss!ihnp4.UUCP by uunet.UU.NET (5.54/1.14) with UUCP
|	id AA11977; Sat, 27 Feb 88 09:49:21 EST
|Received: by rutgers.edu (5.54/1.15) with UUCP
|	id AA19080; Sat, 27 Feb 88 09:29:27 EST
|Received: by mtune.ATT.COM (smail2.5)
|	id AA22110; 27 Feb 88 04:12:40 EST (Sat)
|Received: by cbosgd.MIS.OH.ATT.COM (4.12/smail2.1/12-11-86)
|	id AA17842; Sat, 27 Feb 88 04:11:13 est
|Received: by ihnp4.ATT.COM id AA23874; 27 Feb 88 02:39:23 CST (Sat)
|To: moss!cbosgd!comp-sources-unix@uunet.uu.net
|Path: ihnp4!ucbvax!garnet!weemba
|From: Obnoxious Math Grad Student <weemba@garnet.berkeley.edu>
|Newsgroups: alt.flame,news.admin,news.sysadmin,news.misc,comp.sources.unix
|Subject: Gnews
|Summary: mysteries and secrets of the Brahms Gang revealed
|Keywords: 287924658273563771861091
|Message-Id: <738O@agate.BERKELEY.EDU>

This one is a fake message-ID.

|Date: 25 Feb 88 10:35:08 GMT
|Sender: usenet@agate.berkeley.edu
|Reply-To: Obnoxious Math Grad Student <weemba@garnet.berkeley.edu>
|Organization: Brahms Gang Posting Central
|Lines: 87
|Status: R

And this, with a few editorial comments thrown in, was try #2:

|From garnet!weemba@rutgers.edu Sun Mar 20 08:16:09 1988
|Received: from RUTGERS.EDU by ucbvax.Berkeley.EDU (5.58/1.26)
|	id AA04020; Sun, 20 Mar 88 02:05:18 PST
|Received: by rutgers.edu (5.54/1.15) with UUCP
|	id AA25976; Sun, 20 Mar 88 01:34:51 EST
|Received: by mtune.ATT.COM (smail2.6)
|	id AA18414; 18 Mar 88 08:13:01 EST (Fri)
|Received: by ihnp4.ATT.COM id AA12301; 18 Mar 88 06:00:40 CST (Fri)
|Received: by att-ih.ATT.COM (smail2.5)
|	id AA00960; 18 Mar 88 05:41:35 CST (Fri)
|Path: ucbvax!garnet!weemba
|From: weemba@garnet.berkeley.edu (Obnoxious Math Grad Student)
|Newsgroups: alt.flame,news.admin,news.sysadmin,news.misc,comp.sources.unix

A real sap is hard to lick.  Our forger cross-posted to comp.sources.unix,
a moderated newsgroup!  Twice!!  Hence his article ended up in the mail,
with an audit trail to boot.  It's a sad day when we've got to do his work
for him.  He needs our help in order to get his wonderful work read by his
intended audience--before now, Richard Salz was the only benificiary of the
forger's latest efforts.

So the forger is apparently a Naperville person, who likes to crosspost
to many multiple newsgroups at a time, yet seems to lack basic knowledge
of newsgroups.  rjvaughn@ihlpf.att.com (Ron Vaughn) looks like a pretty
good candidate on all those counts; see <4157@ihlpf.ATT.COM>.  Typical.

|Subject: Gnews
|Summary: mysteries and secrets of the Brahms Gang revealed
|Keywords: 287924658273563771861091
|Message-Id: <7837@agate.BERKELEY.EDU>

This one is a real ID.

|Date: 15 Mar 88 10:35:08 GMT
|Sender: usenet@agate.berkeley.edu
|Reply-To: weemba@garnet.berkeley.edu (Obnoxious Math Grad Student)
|Organization: Brahms Gang Posting Central
|Apparently-To: mtune!rutgers!ucla-cs!ucbvax!*****

The actual apparent recipient has been censored, at Erik Fair's request.
It seems our forger needs a remedial course in basic RFCs.  Kind of sad.

|Status: R

The Lines: field disappeared this time around.  Such sloppiness.
----------------------------------------------------------------------
And now the fun begins.  Regular readers of news.sysadmin only should
probably hit their 'n' key.  Sycophants of the Big Bad Corporate World
out there, like System Adminstrator Man!, as he's called in alt.flame
and talk.bizarre, should get back to work, period.  Ford won't remain
"the most profitable corporation on Earth" if its Climate Control em-
ployees conduct unauthorized experiments, now will it?

Ayuck, yuck, yuck!

|After Gene and I both received many inquiries about the new netnews access
|program I am working on called 'Gnews' (which Gene mentioned in one of his
|articles), I have decided that it would be beneficial to everyone for me
|to post more information about the 'Gnews' program.

Just don't tell anyone about the Foothead virus that's in it, or you'll
ruin the big surprise.  The anniversery of his crucifixion by the Brahms
Gang on Good Friday is a-coming!  We can't wait!  Can't can't!

|						      Naturally, since it was
|intended for the use of Brahms Gang and friends here on Berkeley machines,
|it would need to be modified for use by other people.  So rather than giving
|away the source code which I've put a lot of effort into and revealing private
|and proprietary software techniques,

That's a-right.  If you try to anonymously ftp the stuff over from ucbvax,
a big bad bear is a-going to come over and eat you up!  A-works every time.

|				      I've chosen to simply summarize the
|features of Gnews for those who are interested in just how the Brahms Gang
|posts.  Anyone seeking to serve as a test site for the next version of 'Gnews'
|should contact me directly.

On second thought, just post to the net.  To make absolutely certain that
we see it, cross-post to the 15 zillion newsgroups that we are known or
suspected to read.  It's been done before, so don't be shy about it.

If you like--or even if you don't--we'll just break security at your machine
and install it for you.  We don't have to.  We're the Brahms Gang.

|The principle behind Gnews is simple.  I am a busy man.  I don't have the time
|to read the volumes of stupid articles posted to the net by intellectual
|zeroes *and* respond to them to let them know how stupid they are.

How true!  It's one or the other now.

|								     So I have
|created Gnews to relieve me of the need to spend all that wasted time reading
|the crap proliferated throughout the net, yet still providing a means for me
|to post as much as possible.

A simpler solution, of getting people to post forged articles in my name,
doesn't seem to be working any longer.  Sigh...  You'd think they'd know
better than to post to a moderated group using the "f" key.

|			       Gnews is driven by a very simple shell procedure:
|
|  find /usr/spool/news -type f -print | Gnews
|
|This finds all the articles I would want to respond to and passes their names
|to the Gnews program.  Of course the more selective posters out there might do
|something to narrow the field of choice a bit more.  A 'grep' step was later
|added to prevent this driver from accidentally responding to articles I had
|written myself.

Nope.  We supersede our own articles all the time.  In addition to being
able to now say, "I didn't write that, it's a forgery!", we have the added
capability of rewriting any and all of our articles retroactively.  Keen!
It makes it real easy to accuse people of being pathological liars, and we
don't even know anyone who lives in Florida!

|		  Earlier versions of Gnews, lacking this step, caused severe
|system overload problems on many of the Berkeley machines.
|
|The 'Gnews' program appropriates sections of the 'rn' source code to create
|followup articles from the original articles,

Ah yes, I bet you all were wondering just what those sections of the `rn`
source code were doing posted to comp.sources.mac.donald?  If you only had
a brain, you'd have known by now.  But nooooo....::::

"Here's a section, there's a section, everywhere a sectionsection.
 Ol' Doc Weemba had a Vax, EEE-I-EEE-I/O."

Oops, did I type rn up there with backquotes?  Just an old habit.

|					       doing things like rebuilding the
|references line, adding 're:' if necessary, adding a new attribution section
|and adding insert widgets.

Hahahaha.  rn is for vi dickie birds.  If you want to implement the kernel
as part of your editor, you just got to use Emacs!  Got got got!

|			     It then passes these article files through an
|automatic editor function that appends whatever I would normally say to the
|end of the article. (More advanced versions of the code sprinkle my words
|throughout the body of the article.)  The entire process looks like this.

Hah!  A petty flaming worthless bozo like you shouldn't bother offering his
opinion about cheeses because obviously he has had only the most pitiful
excuse for experience in the area of tyromancy.

|  gn_reform();		/* reformat the article */
|  gn_insert();		/* add appropriate flaming */
|  gn_inewspipe();	/* pipe to inews */
|
|The gn_insert function is similar to 'fortune' in that it pulls random lines
|from a text file containing typical Brahms Gang writing necessary for emphasis.

This is a part of the program that needs critical speed enhancement.  Does
anyone know of a good algorithm for scanning 100000000000000 megabyte files?

|A typical example of a line from this file would be "A petty flaming worthless
|bozo like %s shouldn't bother offering his opinion about %s because obviously
|he has had only the most pitiful excuse for experience in the area of %s."

Our latest enhancements key on articles written by past and future Maroney
Award winners.  We're trying to find out what it takes to get Captain Carnage
to sue us for real, instead of just crying about how awful we are for point-
ing out his extreme lack of reading ability.  Just how is the man who dared
Michael Berch, that awful, uh, Brahms Gangster he, to find even the tiniest
of flaws in that micranial Maroney mind, going to prove in court that he is
neither stupid nor insane is beyond even our mighty kens.

|But instead of just extracting a single line like 'fortune' does, gn_insert
|picks a random number (between 100 and 4000) to determine the number of random
|lines to be extracted and added to the article, ensuring that no text line is
|selected more than once.  (We are mathematicians, we know how to do this.)

Hah!  We are self-proclaimed geniuses, so we know how to do everything.

|All the processed articles are then piped directly to inews which effectively
|posts them to the net.

Actually, 2/3 of them go into e-mail.  This is a little known FACT.

|So, to sum everything up, the process flow for Gnews is very simple.
|
|1. Find all articles in the news spool directory.
|2. Check to see that I didn't write them.
|(Actually we now check to see that neither Gene nor I wrote them,
|since we don't want to step on each other too much unnecessarily.)

Actually, the hard part is checking that Rich Rosen didn't write them.  By
the terms of the Organian peace treaty, we are forbidden from flaming Rich
more than once a year.

|3. Pass all selected articles through the modifier, which reformats them
|into files suitable for inews submission.
|4. Use the insert function to select appropriate necessary text for insertion
|into the new articles.  This includes the insertion of a signature.
|5. Pass all the processed articles to inews.

inews?  INEWS?  Everyone knows that inews is for real diphead stumpfaced
zero-brained, one-legged, two-nosed, three-fingered forborn losers like
yourself who haven't rewritten their kernels in Emacs.  It makes things
so much easier.

|Future enhancements to the program are expected to include rewriting it in
|FORTRAN to make it more self-contained,

We have an untested COBOL version.  We figure that there's a vast untapped
market for morons out that just needs our help to get going.

|					 adding security functions to make
|sure only appropriate articles are posted, and adding timer functions to
|monitor when new articles come in to be tested, modified, and flamed at.

Good news!  My xnewsbiff is almost ready for release.  As soon as an arti-
cle shows up on any topic, the little window starts flashing, the ^Gs are
beeped in every open window, and an xbob is started, just to make sure I
notice.  If I hit all of the bouncing xbobs within XBOBFLAME seconds, an
interesting followup is posted.  But if I miss that, but I hit all of them
within 2*XBOBFLAME seconds, a nasty letter is sent.  And if I miss even
that, but I hit them all within 3*XBOBFLAME seconds, an extremely nasty
letter is sent to the wrong person.  Failing that, I end up ignoring the
article.

Future enhancements--just in the planning stage, based on feedback from
some of those less athletic beta testers out there--will enable the user
to restrict biffing to particular newsgroups.

|Currently it is set off by a crontab entry on ucbvax to execute three times a
|day, but this poses problems when articles already followed up get reflamed.
|Although this is obviously a useful facet of the program in that it serves to
|overwhelm and gag the stupider flamers on the net, being the good net citizen
|that I am I would not want to be held responsible for too much of an
|outrageous network traffic overload.

That's why we usually post forgeries now under other people's names.  We've
gotten it down to nobody noticing.  Or caring.

|I should point out that several people have made suggestions to 'improve' the
|program by narrowing the article search space, preventing the posting of
|followups to crossposted articles in multiple groups, or other criteria beyond
|my ken.

Such grammar.  The correct English is "other criteria beyond Ken Arndt".

|	  But limiting the number of articles posted would obviously be
|counterproductive to the basic purpose of Gnews!  Please keep this in mind
|when making suggestions for improvements to the program.

The most basic enhancements at the moment center around the implementation
of VUSENET, ie, Virtual USENET.  Real people and machines are swapped in
and out at high frequency, leading to vastly improved article thruput.

|ucbvax!garnet!weemba		Matthew P Wiener/Brahms Gang/Berkeley CA 94720
|"I do not find it necessary to call people names and insult their intelligence."
|					-- innocent bystander

By the way, does anyone remember who this "innocent" bystander was?  We're
just aksin', curiosity's sake and all that.

|"Well, I must be different from you, then.  Possibly you can learn to live with
|it."					-- Gene Ward Smith

ucbvax!garnet!weemba	Matthew P Wiener/Brahms Gang/Berkeley CA 94720
    "Take 2*3*5*7*11*13.  It's divisible by 59." --Matt Crawford

apeed@ihlpg.ATT.COM (Andrew B. Peed) (04/02/88)

In article <9l7O@ingrate.BERKELEY.EDU>, weemba@garnet.berkeley.edu (Obnoxious Math Grad Student) writes:
            ^^^^^^^^^^^^^^^^^^^^^^^^^


> |Message-Id: <738O@agate.BERKELEY.EDU>
                ^^^^^^^^^^^^^^^^^^^^^^^
> 
> This one is a fake message-ID.
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> ucbvax!garnet!weemba	Matthew P Wiener/Brahms Gang/Berkeley CA 94720
>     "Take 2*3*5*7*11*13.  It's divisible by 59." --Matt Crawford

	Okay, folks. Look at the things which are "highlighted". Do the first
two look similar? I am not an expert on the use of Netnews, and certainly not
on the techniques of forgery, but it looks VERRRRY suspect to me.

	I assume that it's partially because of idiocy like this that AT&T
management is going on the warpath against Netnews. Much as I enjoy Netnews-
both the technical and entertainment aspects- I can't blame them. This sort of
thing wears REAL thin after a while.

	                                Andy

(I will give him/her/it credit for supplying the Followup: line correctly,
 however. Had to go 'round my elbow to get to my a** just to post this to
 news.sysadmin....)
-- 
=============================================================================
Andrew B. Peed                                        UUCP: ihnp4!ihlpg!apeed
AT&T Bell Laboratories              BITNET: ihnp4!ihlpg!apeed at rutgers.edu
=============================================================================

weemba@garnet.berkeley.edu (Obnoxious Math Grad Student) (04/02/88)

I hate to spoil the fun, but news.sysadmin is supposed to be boring.

In article <5121@ihlpg.ATT.COM>, apeed@ihlpg (Andrew B. Peed) writes:
>In article <9l7O@ingrate.BERKELEY.EDU>,
>            ^^^^^^^^^^^^^^^^^^^^^^^^^

>> |Message-Id: <738O@agate.BERKELEY.EDU>

>> This one is a fake message-ID.
>  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>> ucbvax!garnet!weemba	Matthew P Wiener/Brahms Gang/Berkeley CA 94720
>>     "Take 2*3*5*7*11*13.  It's divisible by 59." --Matt Crawford

>	Okay, folks. Look at the things which are "highlighted". Do the first
>two look similar? I am not an expert on the use of Netnews, and certainly not
>on the techniques of forgery, but it looks VERRRRY suspect to me.

Item #1: There really were two attempts to post forgeries in my name to
         comp.sources.unix.  If you don't believe me, you can check with
         Richard Salz, who forwarded them back to me--he thought it was
         real at first!--and Erik Fair, whom I asked about the headers
         long ago, who also thought I was pulling his leg at first.

Item #2: Except for the differing headers, the article was the same both
         times--namely the stuff that was |-quoted.  I didn't make that up.

Item #3: The reply to the |-material was my own stuff, and the phoney
         headers to the posted ARTICLE, etc, was all my stuff.  If I
         can't laugh at myself, I have no right to laugh at anyone else.

Item #4: Matt Crawford knows, from e-mail, about my adoption of the above
         signature quotation; I hadn't used it in public before, although
         a CC recipient did.  You may or may not have noticed (alt.flame)
         that Matt returned the favor and reminded everyone of a "gaffe"
         of my own.

>	I assume that it's partially because of idiocy like this that AT&T
>management is going on the warpath against Netnews.

Sadly, the idiocy seems to be from AT&T's own people.  I'm sure the forger
is just soooooo proud of his cleverness now.

>						     Much as I enjoy Netnews-
>both the technical and entertainment aspects- I can't blame them. This sort of
>thing wears REAL thin after a while.

The April Fools' stuff I don't mind.  It happens every year, and is usually
quite good.  Rather humorously, in another article, you didn't notice that
the Spafford warning about phoney messages was *itself* a forgery.  (Also,
the Message-ID was Avogadro's number, not Planck's constant.  SHeesh.)

I thought I'd perhaps pre-empt a bit with a double-level April Fools' of my
own.  I've posted several articles, in fact, that I wanted people to *THINK*
were phoney, but were actually genuine.  In talk.philosophy.misc, there was
the quotation from the incredibly obscure but genuine "Journal for the Philo-
sophy of Sport", and in rec.arts.sf-lovers the amazing revelation about the
real James Tiptree, Jr, although as expected, others read and posted the same
news story too.

Plus if anyone, say at ihnp4, wants to make sense out of the headers from
the comp.sources.unix forgeries, they can do so.  I don't really care; you're
right about it wearing thin.

>(I will give him/her/it credit for supplying the Followup: line correctly,
> however. Had to go 'round my elbow to get to my a** just to post this to
> news.sysadmin....)

You're welcome.  I try to think about where my articles are going.  I'm
sorry to hear that your software causes so much trouble--may I recommend
you try Gnews 1.4?

ucbvax!garnet!weemba	Matthew P Wiener/Brahms Gang/Berkeley CA 94720