Last-Modified: 03 februari 2002
Maintainer: Rosalind Hengeveld

Frequently Asked Questions (FAQ):

The Newsgroup Care Cancel Cookbook

Contents

> I'm just so tired of all the spam in my favorite newsgroup.
> Doesn't anyone cancel spam anymore?

Well, they do – but, why don't you?

> Who, me? But I'm not a sysadmin or so!

You need not be. Once an article is really spam – i.e., has a high Breidbart Index – or is otherwise legitimately cancelable, anyone can cancel it, provided they do it properly.

> But I'm just accessing the Net from my home pc.

It doesn't take more.

> But I'm not a techie.

Neither am I. What it takes to know and understand, however, is maybe ten percent technical and ninety percent social.

> But what about a UUCP node, Unix shell, Perl script?

Does any of that have garlic in it?

> Well, maybe you have something there! Wait a minute ... There's this
> flame war going on in the newsgroup. If I would cancel the nastiest
> posts from our notorious flame queens, that would surely clean up!

Oops – if that's what you think, you'd better not take up canceling.

Contents

0. Preamble
1. Introduction
1.1. Object and scope of this FAQ
1.2. Conventions
2. Make Sure You Know What You're Doing
3. Equipment
3.1. Hardware
3.2. Software and customizing
3.2.1. News Xpress
3.2.2. Forte Free Agent and Forte Agent
3.2.3 NewsWatcher for Mac
4. Making Properly Formatted Cancel Messages
5. Reasons For Cancellation
5.1. General principles
5.1.1. Metacriteria
5.1.2. Miscellaneous principles
5.2. Commonly accepted reasons for cancellation
5.3. Reasons for cancellation under discussion
5.4. What Not To Cancel
6. Accounting For Your Cancels
6.1. Cancel reports
6.2. Cancellation notices
6.3. Archiving cancel messages
6.4. Keeping canceled articles
7. Miscellaneous Questions And Answers
8. Acknowledgements
9. Index

1. Introduction

1.1. Object and scope of this FAQ

The object of this FAQ is to:

This FAQ is not a cancel primer. It is in places redundant with certain other FAQs for clarity, but it takes familiarity with them for granted. It merely takes up where other FAQs leave off: how to ‘write your own cancelbot’ with nothing more than your home pc and common software, only thorough understanding of what can and what cannot be canceled.

Please first familiarize yourself with the basics of the cancel protocol by studying the following FAQs:
Cancel Messages: Frequently Asked Questions (‘The Cancel FAQ’) by Tim Skirvin
FAQ: Current Usenet spam thresholds and guidelines (‘Usenet spam thresholds’) by Chris Lewis and Tim Skirvin
The Net Abuse FAQ by Scott Southwick and J.D. Falk
Fight Spam on the Internet! by Scott Hazen Mueller

The following subjects are outside the scope of this FAQ:

1.2. Conventions

Text between [ ] is optional.
Text between { } is ‘metatext’ and is not to be copied verbatim.

In keeping with the wording in other FAQs, this document uses the following three levels of requirement (for clarity rendered in bold ‘traffic light’ colors):

Text preceded by ‘> ’ and thereby appearing quoted is only really quoted if that is explicitly indicated.

2. Make Sure You Know What You're Doing

> Are you sure I should go into this?

Actually, no.

While newbie posters are usually given a lot of leeway with their first articles, new cancelers cannot expect such leeway. You've got to issue only legitimate and properly formatted cancels, and get it right from the start. If you mess up royally, you will likely not get another chance.

When in doubt, don't do it. Illegitimately or improperly canceling a post (any post) will not only jeopardize your access, it will definitely reduce your credibility in the Usenet community.

Before you start canceling, you should at least do the following:

> Will the people whose articles I cancel, take it nicely?

Some will and some will not ...

(This is a manual for volunteer troopers against the Dark Forces of Usenet, so you don't expect it to list what the enemy may do with you, now do you?)

3. Equipment

3.1. Hardware

Any home or office pc that is able to handle Usenet and the WorldWide Web, will be adequate to issue properly formatted third-party cancel messages. For connection, a 28k8 modem will do. An ISDN (or ADSL) line is an advantage, but is not necessary.

Unless stated otherwise, instructions and examples in this FAQ will be based on an IBM pc compatible hardware platform running under the Microsoft Windows 95 operating system.

3.2. Software and customizing

At least the following common newsreaders are suitable for making properly formatted third-party cancel messages:

3.2.1. News Xpress

This newsreader is freeware, download it from:
CWSApps – News Xpress

Creating necessary headers:
From the main menu, choose File/Options/Compose, section Template/Post headers. This will allow you to create any header you fancy – however: News Xpress will, when posting, override the contents of a few standard headers you may have created and filled out. These, unfortunately, include the Path header.

All the headers needed for cancel messages (see chapter 4), except for the Path header, you can just create as explained above and News Xpress will honor the contents you fill out. You can put your headers in any convenient order and you can supply default values, for example ‘Subject: cmsg cancel ’.

To get the required pseudosites in your Path header (under Windows 95):

Note: The Registry Editor won't store values until you exit it. Also, News Xpress apparently reads the Registry Editor at start-up; it won't honor any changes made when it was already active.

Now that some sites (including the author's) are running NoCeM on spool and aliasing out the !cyberspam pseudosite, it has become inadvisable to leave any such pseudosites in your Path for articles other than cancel messages. Therefore, if you also post regular articles using News Xpress, you should update the Registry (and exit and restart News Xpress) every time both before and after you send off cancel messages, lest your regulars be deprived of the wisdom of your words.

3.2.2. Forte Free Agent and Forte Agent

This section was supplied by Theresia Soejono. Please direct to her any questions specifically on the use of Agent.

Forte Free Agent (FFA) is freeware, download it from:
Get Free Agent

Forte Agent (FA) is commercial ware, purchase it from:
How To Order Agent

You need a Hex editor to create the necessary headers:

Hints for issuing properly formatted third-party cancel messages using Forte Free Agent or Forte Agent:

3.2.3 NewsWatcher for Mac

This section was supplied by Doug Yanega.

NewsWatcher 2.0b27.1+ (for Mac; also known as ‘Value-Added NewsWatcher’).
From the ‘About’ file with the program:

Creating necessary headers:
From the File menu, choose Preferences, and under Message Options toggle the Show Details button ON. You should now automatically see the Extra Headers slot appear whenever you compose a new posting. All the headers needed for cancel messages (see chapter 4) can be typed in directly. Anything you type into the Extra Headers window will take precedence over any conflicting info in the normal headers section (so, if you have two From headers, the one you type in manually is the one that will be used).

You can put your headers in any order and if you wish to supply default values, you can do so in the Preferences settings under Extra Headers. I prefer to have a blank template file saved in my e-mail folder, and then cut and paste templates as needed (e.g., one for mmfcancels, one for bincancels, one for ECP/EMP, etc.), mostly so I don't have to type anything but the message ID prefix and the BI value, but also in order not to have all those extra headers appearing in all my normal postings to Usenet.

Note: the one problem with NewsWatcher is that there appears to be a ‘number of characters’ limit on the extra headers, so I use only the ones that chapter 4 specifies must be present, plus a Summary header (see example below).

Hints for issuing properly formatted third-party cancel messages using NewsWatcher:

1) When you find a cancelable article, hit Reply, which gives you the message ID and author's name right there in the text field, e.g.: ‘In article <638bjn$lb1$2@ramp2.tir.com>, Joe College <joe@tir.com> wrote:’

2) Cut and paste the message ID and author's name into the appropriate places in the headers (afterwards, select and delete everything else in the text field). This means a minimum of four lines: one in the regular headers, three in the extra headers – in this case:

3) Add the remaining necessary headers, including Reply-To in the regular headers section, and in the extra headers area as follows (for example):

4) With the original message in the active viewing window, hit Forward. This gives you a new window quoting all of the headers from the original posting. Then I just do a Copy on these headers, and paste those into the text window of the cancel message. If you do a Cut instead of a copy, you get an annoying ‘do you want to save changes’ dialog box when you close the Forward window. Sometimes I use the copy in the forward window to send a complaint directly to a spammer's ISP, as long as I've gone to the trouble of getting that far. ;-)

5) Add to the top of the text window any comments you feel pertinent, then send the cancel message. If you've got templates set up, the whole process can take less than a minute and require little or no typing – just cutting and pasting.

4. Making Properly Formatted Cancel Messages

Using a suitable and adequately customized newsreader, you can compose a properly formatted third-party cancel message much like you would any other Usenet post. You need a few additional headers, and some required information in certain headers. For small-scale ‘newsgroup care’ canceling, just fill the required headers out manually, mostly by copy and paste. (It is even feasible to copy and paste between two newsreaders, e.g., Netscape and News Xpress, using [Control-Insert] and [Shift-Insert] keys.)

In this chapter, we'll go over the elements of a properly formatted cancel message, header by header.

Subject: cmsg cancel <{message ID}>

A properly formatted third-party cancel message should contain a Subject header looking like this, with <{message ID}> the message ID of the canceled article (including the < >, excluding { } characters).

Control: cancel <{message ID}>

The cancel message must contain this header in order to work at all.

(Note: some servers will supply a Control header when one is absent but the Subject header starts with ‘cmsg’, so please never just for fun name one of your non-control articles ‘cmsg newgroup alt.sex.rosalind.hengeveld’ ...)

Message-Id: <cancel.{message ID}>

The cancel message must have such a message ID to be properly formatted: the message ID of the cancel message is equal to that of the canceled article but for a ‘cancel.’ prefix. This so-called $alz convention serves to avoid two cancels for the same article coexisting (because two articles on the same server cannot have the same message ID). For example:

Summary: {reason for cancellation}

You must specify a valid reason for cancellation in your cancel message for it to be legitimate. You may put it in the standard Summary header, which this FAQ considers to be as good a place as any. Alternatively, you can put it in the body text or in some X-Reason-For-Cancellation or similar header.

Chapter 5 of this FAQ sets out to enumerate all recognized reasons, but the wording is not standardized.

Newsgroups: {newsgroup(s)}

The cancel message must contain this header. When the article to be canceled was cross-posted, you should specify here the full set of newsgroups to which it was posted.

As to the latter point, here's an example showing why. Site A gets a feed from site B; it carries group X but not group Y. Site B carries both groups. A spam is cross-posted to groups X and Y. It propagates to site B, then to site A because it is cross-posted to group X. Someone in group Y sees the spam and issues a care cancel, posting it to group Y only. The cancel propagates to site B, but does not propagate to site A because it is only in group Y. A spam canceler issues a cancel for the spam, cross-posted to groups X and Y. Because of the $alz convention, it has the same message ID as the care cancel, and site B will refuse the spam canceler's version (since it already has an article with the same message ID). Since it never reaches site B, it never propagates onward to site A as it normally would (since it is cross-posted to group X) and the spam article will not get canceled at site A.

X-Canceled-By: rosalind@xs4all.nl (Rosalind Hengeveld)

This header must be present and contain your valid e-mail address. This should be repliable, i.e., not containing an anti-spam block. The header may also contain your name. It serves to unequivocally identify the canceler.

The header may be spelled either as above or as ‘X-Cancelled-By:’ (with double l).

Approved: rosalind@xs4all.nl

This header should be present and contain your valid e-mail address.

We shall treat the From and Sender headers in combination, as there are two ways of filling these headers out. The preferred way is presented first:

From: rosalind@xs4all.nl (Rosalind Hengeveld)
Sender: {original Sender header if present, else original From header}

Either the cancel message must contain a Sender header with the contents of the Sender header of the article canceled, if present, else its From header. These contents must be copied verbatim (just copy and paste). The From header should then match the X-Canceled-By header.

From: {original Sender header if present, else original From header}
Sender: {empty, or no such header}
[Reply-To: rosalind@xs4all.nl]

Or the cancel message must contain a From header with the contents of the Sender header of the article canceled, or, if none is present, of its From header. These contents must be copied verbatim (just copy and paste.) With this format, you must not fill out a Sender header. You may specify a Reply-To header with your own e-mail address.

For example, when canceling a spam by one cdr43a@aol.com, either:

or:

This latter format you can use if your ISP's news software strips Sender headers off articles. A practical disadvantage is that your newsreader may balk at badly malformed From header contents.

If your ISP's news software supplies a Sender header of its own, then you cannot cancel successfully from your site. In that case, you must not issue cancels, as malformed $alz-compliant cancels would only serve to block someone else's better cancels from canceling the spam off the newsgroup.

These intricate requirements for the From and Sender headers stem from the fact that, form a historical viewpoint at least, properly formatted third-party cancels are really just ‘forged’ own cancels. The originator of any message is equal to the Sender if present, else the From. The originator of the cancel message must be the same as the originator of the article canceled. The news software at some sites checks this.

X-Original-From: {original From (not Sender) header}

In an optional header like this, you may specify the original author of the canceled article, especially if it is not already in another header. This can be convenient in order to make cancel reports from message headers (see section 6.1).

X-Original-Subject: {original Subject header}

You should leave the original Subject somewhere in your cancel message. You may put it in a header like this, or in the body text.

Cc: {original Reply-To header if present, else original From header}

By filling out this header, you may send a copy of your cancel message as a cancellation notice to the original author of the canceled message (see section 6.2).

X-Remarks: {miscellaneous}

You may create such a header; we'll get to see some possible uses for it.

X-No-Archive: [yes]

This header, which is included here for completeness sake only, would serve to keep your cancel messages from being archived by search engines like Deja. Using this header, however, is probably a good idea for mass cancelbot cancelers only, not for small-scale cancelers; see also section 6.3.

Path: cyberspam[!{reason-specific pseudosite(s)}][!{canceler-specific pseudosite}]

A properly formatted third-party cancel message must contain in its Path header the !cyberspam pseudosite. This was originally a mark of spam cancels only, but is now required as a mark of any legitimate third-party cancel:

A third-party cancel message for most reasons other than spam should, in addition to the !cyberspam, also contain an applicable reason-specific pseudosite, such as: !mmfcancel, !bincancel or !spewcancel, for example:

Your cancel messages may contain at the end of the Path header a canceler-specific pseudosite. There are no standards for these and no guards against duplication. You can choose one named after the usual newsgroup abbreviation or after yourself, but anyone with a little Usenet spirit in their blood would make sure to have it end in ‘bot’:

The order of pseudosites is not significant. Pseudosites are separated by an exclamation point, but should not start with one nor end in one.

Body Text

There are no particular requirements for the body text of a cancel message. If you send a copy to the original author, you may use it for a notice text.

Though it is not vital for their working, cancel messages should contain something in the body text and not be headers only, for example:

or:

Language

Cancel messages should be in English, even if that is not the usual language of the affected newsgroup(s). Certain parts, especially any that are in the body text, may be in more than one language.

Sample cancel message

Below is what you may fill out for a properly formatted spam cancel message:

(Note: it is pointless filling out a Path header using News Xpress; instead it will supply pseudosites into the Path from the Registry.)

5. Reasons For Cancellation

5.1. General principles

5.1.1. Metacriteria

What should or should not be valid Usenet article deletion criteria, is always a subject for lively discussions. There is, however, consensus that any such deletion criterion should in turn meet at least the following ‘metacriteria’:

Canceling someone else's article is an unfriendly measure, which must not be used lightly against just any article that should not have been posted. We must have a very good reason to want to have an article deleted from servers worldwide.

For example, there is consensus that disproportionate use of resources generally constitutes such a significant disruption, as by taking up more than a fair share of bandwidth and disk space, articles can make other articles expire prematurely. This is the rationale behind canceling binaries in non-binary newsgroups, and also part of the rationale behind spam cancels. Likewise, a flooding is a disruption warranting cancellation, as it threatens to make a single newsgroup all but unusable.

This means that deletion criteria should not call upon judgment, or only to the least possible degree. Two people ascertaining whether a given article qualifies for deletion against a certain criterion should come up with the same answer.

‘Objective’ is not an absolutely binary (yes/no) metacriterion. Some concepts used in generally accepted deletion criteria, such as ‘substantively identical’, are fairly but not perfectly objective. However, a deletion criterion must never be highly subjective.

The principle of content-neutral canceling is generally believed to be what will protect free speech and prevent true censorship, while at the same time allowing us to keep our Usenet and our favorite newsgroups usable in the light of an ever increasing flood of spam and other abuse.

‘Content-neutral’ does not imply that we should never need a peek at an article's contents. We need to look at articles to ascertain that they are ‘substantively identical’ or that they ‘advertise the same service’. ‘Content-neutral’ means, however, that an article can never be cancelable because we disagree with or object to its contents.

‘Content-neutral’ is not an absolutely binary (yes/no) metacriterion. Some concepts used in generally accepted deletion criteria, such as ‘advertising [the same service]’ and ‘make money fast’, are not perfectly content-neutral. However, a deletion criterion must never be predominantly content-based.

5.1.2. Miscellaneous principles

A cross-posted article is cancelable if there is a valid reason for such in one of the newsgroups to which it is cross-posted. For example, a binary is cancelable if it is cross-posted to just one non-binary newsgroup.

There is a fair amount of consensus that follow-ups to cancelable articles are in turn cancelable if they quote the original in its entirety, or at least certain key parts of it. Reasons for this are:

A problem, though, with canceling such key-quoting follow-ups to cancelables is ‘selling’ it to the authors, who often posted them to disapprove of the original or ridicule it.

For the sake of completeness and clarity, the rest of this chapter deals with all commonly accepted, or at least recognized reasons for cancellation.

Appropriate pseudosites are given when other than just ‘!cyberspam!usenet’.

5.2. Commonly accepted reasons for cancellation

The following reasons for cancellation are the only ones that are currently accepted as legitimate by Usenet consensus.

Summary: EMP spam, BI = {value}

Spam, too many substantively identical copies of an article within too short a time, is by far the most common reason for cancellation. For an article to be cancelable as spam, it must have a Breidbart Index (BI) over ‘around 20’ (except in certain hierarchies where a lower limit and/or a different index is in effect, such as nl.* with SBI >= 10). A properly formatted spam cancel message should state the BI value (or applicable spam index value).

For excessive multi-posting (EMP) spam, the BI (or any spam index) is equal to the number of substantively identical copies within any 45-day time frame encompassing the posting dates of these copies. (When a set of articles crosses the spam limit, then all copies become cancelable, even those that were not yet spam when they were posted.) For more information, see the Usenet spam thresholds.

Search archives such as AltaVista can be used in checking for BI to ascertain whether an article is spam. Best go directly to the AltaVista: Advanced Query form. Here, proceed as follows to check on a particular author for spamming:

If the article has not yet made it into AltaVista, try again later. If BI < 20 – even if that surprises you – then don't cancel the article.

More and more often, spammers vary the contents of the From (and also the Subject) header per copy. In that case, you can use the clause in the Usenet spam thresholds that calls ‘advertising the same service’ a form of being substantively identical. URLs are the achilles heel of spams!

Lemma: articles that are obvious advertisements pointing to the same URL, can be considered to advertise the same service and, if there's too many of them, are spam and can be canceled as such.

(Note: articles merely containing the same URL, but short of pointing to it as advertisements, are not ipso facto to be considered substantively identical.)

If there is no URL, use a phone or fax number or ‘drop box’ e-mail address.

In the AltaVista: Advanced Query form, proceed as above, only in the query field enter the URL or other search argument. If the number of matches is only just over twenty, make sure they're not follow-ups (which don't count). You may leave the query argument used in the cancel message, for example:

The search archive Deja used to be the tool of choice in checking for BI, until they ceased archiving spam (understandably from their point of view, but unfortunately for the small-scale canceler). Deja is, however, still usable for checking BI for ‘slow spam’, which Deja itself does not recognize as spam. Best go directly to the Deja - Power Search form. Here, copy the URL or other query argument into the ‘Search for’ field, fill out a ‘Date from’ of up to 45 days ago and click on ‘Find’. For the rest, proceed as above.

Summary: ECP/EMP spam, BI >= {estimate} ({number of} copies)

For excessive cross-posting/multi-posting (ECP/EMP) spam, the BI is equal to the sum over copies of the square root of the number of newsgroups; see the Usenet spam thresholds.

Proceed as for EMP spam, but unless it is a close case (say BI < 25), feel free to make a conservative estimate for the BI rather than hand-computing its exact value (especially if the number of copies is already over 20). For example: 43 copies each cross-posted to a zillion newsgroups; surely each is cross-posted to more than sixteen, which has a square root of 4; that times 43 is 172; let's round that down to 150:

Note: pure excessive cross-posting (ECP), a single copy of an article posted to a great many newsgroups, is not cancelable throughout most of Usenet under BI >= 20.

Summary: make money fast
Path: cyberspam!mmfcancel!usenet

Make money fast (MMF), also known as chain letter or pyramid scheme, is really a special case of spam (EMP or ECP/EMP). Unlike regular spam, however, it is cancelable ‘on sight’ without checking for BI.

An MMF typically contains a paragraph that begins like:

> Step 3. Post the article to at least 200 newsgroups. [...]

You may copy this piece of text into the cancel message body.

(One cannot post the same article to at least 200 newsgroups and stay within BI < 20. This is the main reason why MMF is cancelable on sight as ‘implicit spam’.)

A recent MMF variation is the multi-level marketing or MLM article, which is also a get-rich-quick pyramid scheme, but not so much a ‘classical’ chain letter.

Summary: UDP in force against originating site {name}
Path: cyberspam!udpcancel!{UDP-specific pseudosite}!usenet

The Usenet Death Penalty (UDP) is an ultimate measure against ‘rogue sites’ for continued massive abuse such as spamming or rogue cancellation. The object is to completely shun them off Usenet. As part of the measure, any and all message traffic – even when not in itself abusive – originating from the offending site is targeted for cancellation on sight. For example:

(This is just an example; the UDP against UUnet has long been lifted.)

Articles merely passing through the offending site but originating from other sites are not cancelable under the UDP.

For more on UDP, see the Usenet Death Penalty FAQ.

Summary: binary posted to non-binary newsgroup
Path: cyberspam!bincancel!usenet

‘A picture is worth a thousand lines.’

All binaries (pictures, executables, sound files et cetera) are cancelable in all Usenet newsgroups, except in hierarchies specifically devoted to binaries such as alt.binaries.*.

Though many cancelers cancel binaries only over a certain size, and while there is no upper size limit for a text-only post, there is no official lower size limit for a binary to be cancelable. You may or may not choose to cancel binaries that are smaller than this FAQ (which was once posted biweekly in its entirety.)

If you cancel binaries over a certain size only, you may state the size of the article canceled:

Exempted from cancellation in non-binary newsgroups are only ‘tiny binaries’ of totally negligible size, such as PGP signatures. (See also the section on html, which is deemed controversial.)

For more on canceling binaries, see:
The Bincancel Mini-FAQ by Shaun Davis-Gluyas
The Bincancel FAQ (full version) by Shaun Davis-Gluyas

Summary: accidental spew
Path: cyberspam!spewcancel!usenet

A spew is the result of any of a variety of incidents whereby several copies or corrupted versions of the same article are posted to the same newsgroup, usually as a result of malfunctioning software.

There's, for example, the traditional gateway spew, whereby a large number of old Usenet articles are reposted with mangled headers and new Message IDs.

When canceling on a spew, you should keep the first copy of any set of essentially identical articles, i.e., the original article, and cancel reposted or otherwise excess copies. You should presume a spew to be accidental.

Here's a recent attempt at definitions of the most common types of cancelable spew:

Summary: newsgroup flooding

A newsgroup flooding involves posting a huge number of articles to a newsgroup, typically with an intent to disrupt, silence or hostilely take over the newsgroup. (A flooding is not to be confused with a spam: the articles need not be substantively identical; also, it is not governed by spam indexes such as the BI.)

There is agreement that all copies of a flooding are cancelable, only not quite on what exactly qualifies as a flooding. A recent attempt at a definition (avoiding the subjective notion of ‘intentional’) of a cancelable flooding runs as follows:

Summary: own cancel by original author

This is what the entire cancel protocol was originally designed for. Nowadays, however, less than one percent of cancels are own cancels.

Own cancels or first-party cancels, where the original author cancels their own article, are not bound by any of the requirements for third-party cancels, except for those needed to make a cancel work at all. Most modern newsreaders can make them with push-button simplicity (which feature does not work – and rightly so – for any other than one's own articles).

An own cancel should not contain the !cyberspam pseudosite.

Summary: forgery in author's account [and name]

The apparent author of an article always has the right to cancel it, even, nay even more so if someone else forged it.

An apparent author of an article is any holder of a valid e-mail address included in a From, Sender or Reply-To header.

Since such cancels by the apparent author count as own cancels, they should not contain the !cyberspam pseudosite.

Summary: canceled by explicit request of original author
X-Remarks: requested in <{e-mail id}>

Once you become known as your favorite newsgroup's spam canceler, people are going to ask you in e-mail to cancel their article. Instead of pointing out that they should be able to do that themselves, you may as well do it for them as a service. These are actually ‘second-party’ cancels.

No need to get paranoid, but you should be aware of the way-out possibility of a forged e-mail tricking you into an illegitimate cancel. Therefore, you should glance over the e-mail request to see if it appears genuine, and at least leave its e-mail id and maybe its full headers in your cancel message.

Summary: terms of service cancel by originating site administrator

A terms of service (TOS) cancel is a cancel by an administrator of the site from which the canceled article originated, or was forged to appear to originate. Such ‘second-party’ cancels are legitimate, with or without the author's consent.

Summary: forged approval canceled by moderator

An official moderator of a moderated newsgroup has the right to cancel any article ‘approved’ – i.e., containing an Approved header – by anyone else than one of the official moderators.

5.3. Reasons for cancellation under discussion

The following reasons for cancellation are recognized, but are currently under discussion as to whether or under what conditions or circumstances they should be accepted as legitimate.

Summary: moderator cancel of pre-approved article

These are cancels by an official moderator of a moderated newsgroup of articles in that newsgroup that they themselves, another official moderator, or their robo-moderation software had approved earlier. Such cancels are not highly controversial, but meet with less universal acceptance than those for forged approval.

Summary: chartered retromoderation: {newsgroup-specific reason}
Path: cyberspam!retromod!usenet

Retromoderation basically comes down to extending the range of accepted reasons for cancellation with chartered newsgroup-specific ones, which can range from ‘ECP without follow-up’ to ‘keyword-deficient’.

This FAQ will not go into the hotly contested topic of ‘the R-word’.

Summary: html posted to non-binary newsgroup
Path: cyberspam!bincancel!htmlcancel!usenet

There is currently no consensus as to whether articles formatted in html (hypertext mark-up language) are cancelable as binaries. Since such posts are only minimally disruptive to newsgroups, we'd say you may choose to not cancel them.

Summary: accidental stutter, canceling all but first of {number of} copies
Path: cyberspam!spewcancel!usenet

A stutter or newsreader spew is a spew-like incident whereby two or more copies of the same article, exactly identical but for certain headers such as Date and Message-Id, are posted to the same newsgroup within a short time, typically seconds apart, usually by a malfunctioning newsreader.

Though often everyone including the author appreciates it if you cancel a stutter down to one copy, this type of cancel is under discussion.

In line with other spew cancels, if you cancel articles from a stutter, you should keep the first copy, i.e., the one with the earliest Date header. If Date headers are exactly identical, keep the copy with the ascii-lowest message ID (digits before letters, uppercase before lowercase). This rule is to keep two or more people from inadvertently together canceling all copies.

You should presume a stutter to be accidental.

Summary: unauthorized copyrighted material

For this reason for cancellation, there is some degree of consensus that it can be legitimate, but disagreement as to what does or doesn't constitute an unauthorized use of copyrighted material on Usenet. Copying someone else's work isn't automatically copyright infringement (otherwise the entire Usenet would be illegal). Furthermore, consensus is emerging that this type of cancel can possibly be legitimate only if issued by the copyright owner or some other party with legal interest, or with their authorization.

Summary: content-devoid article

There are two common kinds of content-devoid articles:

Some interpret the Usenet spam thresholds in such a way that such articles, of which there will always be at least twenty around, are substantively identical to each other and can be canceled as ‘unintentional spam’. Others, however, hold that ‘content-free canceling’ is not to be taken this literally and that ‘spam’ implies intent. The fact that such articles are likely to be accidental and that the author is likely not to mind them being canceled weighs against their level of disruption being minimal.

Even if you do cancel content-devoid articles, then articles with very little yet some own content, such as ‘me too’, are never to be canceled as such.

Other reasons for cancellation?

There are no other valid reasons for cancellation than those enumerated above. Any that you may have heard of, are illegitimate and constitute net abuse.

5.4. What Not To Cancel

Just some examples of what you must not cancel (unless covered by one of the reasons for cancellation in this chapter):

6. Accounting For Your Cancels

Did you ever just happen to find out that an article of yours was canceled? If not, can you imagine how that tends to make one feel?

6.1. Cancel reports

You should publish reports of all your third-party cancels.

If you are a canceler on just one or a few individual newsgroups – which is the very target audience for this FAQ – you may publish reports of your cancels in the affected newsgroup and you may draw them up per newsgroup.

Cancel reports should be (cross-)posted to at least one suitable net abuse newsgroup, preferably one specifically dedicated to reports, such as: news.lists.misc, alt.retromod (both unmoderated), or any such newsgroup for your geographical hierarchy (e.g., nl.internet.misbruik.rapport, which is auto-moderated). You can also (cross-)post them to the moderated news.admin.net-abuse.bulletins, or submit a pointer to one or more reports there.

Default follow-up should be set to one newsgroup only, preferably to news.admin.net-abuse.usenet (even though the reports themselves should not be posted there), for example:

If you also issue NoCeM notices for articles canceled, you may combine your cancel reports with the NoCeM messages containing the notices (which should be posted to at least news.lists.filters).

Cancel reports may be in English, even if that is not the usual language of the newsgroup(s) affected by the cancels. (NoCeM messages should be in English).

You can compose the body of your cancel reports from the articles canceled (if you saved them) or from your cancel messages. The latter may be more practical. The headers suggested in chapter 4 of this FAQ are geared for this second way. You can simply copy and paste, or you can develop some script or macro that munches up your Copy-Self file into the body of a cancel report.

Cancel reports should at least contain the following information for each article canceled:

Here's a sample cancel report entry made out of cancel message headers:

6.2. Cancellation notices

You may notify the author of an article you cancel by sending them an e-mail message (also called politegram) stating that you canceled their article, and why.

The simplest way to do that is to send a copy (CC) of the actual cancel message, with a (form) text in the body, to the e-mail address in the original Reply-To header if present, else the original From header (never the original Sender header).

If a notice to the address set out above bounces as undeliverable, you need not feel obliged to try any further, even if you think you know an address that may work (such as, by stripping an apparent anti-spam block).

Whether or not you, as a small-scale canceler, should try at all to send cancellation notices to megaspammers, especially to ones using what are most probably phony originator addresses, is debatable.

Cancellation notices may be in any language that the recipient is likely to understand. When in doubt, or when you don't feel like keeping sets of form notices in several languages, they may always be in English.

Cancellation notices should be matter-of-factly and polite, even helpful. Your choice is to either flame the abuser or cancel the abuse, not both.

Here's a possible example of a form notice for a binary: 

You posted a binary to a non-binary newsgroup. This is not allowed and 
is eligible for cancellation in all non-binary newsgroups.
Please post to newsgroups like this only plain ascii text and nothing 
encoded such as pictures, executables, sound files et cetera.
Appropriate newsgroups to post binaries are those in alt.binaries.*.
The reason most of Usenet disallows binaries is that they usually take up 
much more storage space than plain text articles (even though there is no 
upper size limit for the latter). Sites with limited storage capacity 
may choose to not carry the special binaries newsgroups.
This notice is a copy of a Usenet control message suggesting to sites 
or their administrators that they drop your post from the newsgroup.

6.3. Archiving cancel messages

Like other articles, cancel messages will normally be archived by search engines like Deja. This is a good thing, as it makes for an additional way of accounting for your cancels: any regular of your favorite newsgroup or anyone else who cares can always look up what you canceled and why.

(Note: if some of your cancel messages don't show up in search archives, it may be because they were ‘$alzed out’ by other cancels for the same articles.)

6.4. Keeping canceled articles

You may keep copies of articles you cancel. This can prove convenient if someone questions one of your cancels or if, for whatever reason, you find yourself wanting to reinstate an article canceled.

7. Miscellaneous Questions And Answers

> I have always posted to alt.sex.fetish.ears under a pseudonym, but now
> someone has outed my real name. Surely, while I'm at it, no one will
> miss one article ...

That's not nice of Someone, but you must not cancel it.

> And if my neighbor would cancel it anyway?

Cancels are being increasingly closely watched. Cancel analysis reports are now being published that break them down by individual canceler, even for single cancels. Your neighbor would be questioned and, for lack of a satisfactory answer, branded as ‘rogue’ and likely loose their account.

> Once I start canceling, am I obliged to cancel all that is cancelable?

No, just because you can cancel something doesn't mean you have to.

> Is canceling fun?

If you're human, you may find it a thrill to issue your first third-party cancel. However, it becomes dead boring by about the fifth.

> How can I practice before canceling on my favorite newsgroup?

If you want to practice a little before canceling on a ‘real’ newsgroup (or just plain want to try it), cancel away on alt.sex.cancel; that is a spam trap newsgroup chartered with a ‘retromoderation clause’ stating any and all articles in it – presumed spam – to be cancelable.

After issuing a test cancel, it's a good idea to lurk the newsgroup control or control.cancel to see if your cancel looks like you intended it to. Look especially for the presence or absence of Sender headers.

Note: the fact that your cancel message manages to get an article deleted from your own server, does not mean it is going to work properly worldwide!

It is also a good idea to look yourself up in Andrew Gierth's Cancel Analysis Report, posted daily to news.admin.net-abuse.bulletins. Are you among the ‘Properly formatted spam cancels’ elite?

> Are there alternatives for canceling manually with a newsreader?

Yes, you can use a little cancelbot. Chris Lewis has published one on:
http://www.vix.com/spam/tools/cancel.txt

Canceling with a cancelbot, however, is outside the scope of this FAQ.

> What about NoCeM?

NoCeM – pronounced: [,nou'si:&m] or as if No See 'Em – is a protocol enabling authenticated third parties to issue notices which site administrators can use to delete unwanted articles from their news spool, or which end users can use as a ‘third-party killfile’. It is intended to eventually replace the protocol for third-party cancel messages. Other kinds of application are also possible. See (click on image):
NoCeM Now! The Cancelmoose[tm] Home Page.

For information on NoCeM issuers and their criteria, see:
The NoCeM Registry (by this FAQ's maintainer)

> Can third-party supersedes be legitimate?

A Supersedes header in a (non-control) article is used to cancel another article as soon as it arrives. This construction is typically used for regularly posted articles such as FAQs, in order to always have one and the latest arrived copy around on any server. Posters can also use it to update their already posted article. For example:

It is not quite clear if or when third-party supersedes can be legitimate. If someone else's article is not legitimately cancelable, then it surely is not supersedable, but even if it is cancelable, that does not automatically imply you can feel free to supersede it instead. Also, it is not clear what conventions would be in order.

For practical purposes, you should only supersede your own articles, or articles with explicit permission from the original author.

> Where can I read more on small-scale ‘newsgroup care’ canceling?

Ben Cantrick's ‘spamdog’ concept is rather similar, read about it on: The Spamdogs

> Who appointed you netcop?

I appointed myself.

> BTW, I saw that Roselind H. (not even going to attempt the spelling)
> cancelled a number of posts. For the most part, I feel that she made
> good calls. But, there was one cancellation that dealt with a bisexual
> subject that I would have liked to have read. Many times I have read
> articles about lesbianism on this ng that no one felt was off-topic.
> How many on s.s.t. have bisexual interests? My point is that someone
> else made a decision to keep me from reading something that may have
> bee of interest to me. And I'm not sure that I appreciate it.

(The above is quoted from an actual post, unaltered and unedited but for line wrap. The canceled article in question was an EMP spam for BI = 25.)

When something like this happens, offer to quit canceling on the newsgroup.

If the newsgroup audience accepts your offer, quit canceling on the newsgroup.

If newsgroup regulars beg you to please continue to cancel the spam off the newsgroup, you may consider doing so.

> The well-known Fluffy XVII <zeus@olympus.net> and other authorities
> have asked me to stop canceling.

Well, in that case it makes sense to stop canceling.

8. Acknowledgements

The following Net gods and goddesses have contributed to this FAQ in ways ranging from single suggestions to entire sections:

Kevin Blackburn, Phil Boswell, Deirdre Clausen, Richard E. Depew, ? the platypus {aka David Formosa}, Andrew Gierth, Kenneth Herron, Frans Jensen, Stan Kalisch III, Thijs Kinkhorst, Doug Mackall, Kevin Martin, Malcolm Mladenovic, Ron Newman, orionca, Stephen Poley, David Ramalho, Clifton Royston, Wolfgang Schelongowski, Vincent Schonau, Chris Siebenmann, Tim Skirvin, Theresia Soejono, David R. Throop, Barbara A. Willette, Ben Wolfson, Doug Yanega

9. Index

accountability
accounting for cancels
advertising the same service
Agent
alt.sex.cancel
AltaVista
Approved header
binary
body text
Breidbart Index (BI)
Breidbart Index (BI) for ECP/EMP
Cancel analysis report
cancel message
cancel protocol, basics of ~
cancel report
cancelbot
cancellation notice
censorship
content-devoid article
content-neutral
contents (table of ~)
control or control.cancel
copyright
cross-posted article
cyberspam
Deja
Deja, cancel messages archived by ~
empty article
excessive cross-posting (ECP)
excessive cross-posting/multi-posting (ECP/EMP)
excessive multi-posting (EMP)
flame
flame the abuser
flooding
follow-up to cancelable article
forged approval
forged cancel
forgery in author's name
From header
hardware
html
key-quoting follow-ups
language of cancel message
large, excessively ~ plain ascii article
lemma on advertisements pointing to same URL
make money fast (MMF)
me too
metacriteria
moderator
must/should/may
netcop
News Xpress
Newsgroups header
NewsWatcher for Mac
NoCeM
objective
obscene or indecent article
off-topic
operating system
originator
outing
own cancel
Path header
PGP signature
politegram
pornographic material
practice canceling
properly formatted
provider
pseudonym
pseudosite
quote-only follow-up
reasons for cancellation
reasons for cancellation, commonly accepted
reasons for cancellation, newsgroup-specific
reasons for cancellation, place for ~
reasons for cancellation, under discussion
Registry Editor
request, canceled by explicit ~ of original author
retromoderation
$alz
sample cancel message
Sender header
significant disruption
software
spam
spamdog
spew
spew, newsreader ~
stutter
Supersedes
terms of service (TOS) cancel
test article
troll
Usenet Death Penalty (UDP)
X-Canceled-By header
X-No-Archive header

Free counter and web stats

Copyright © 1997-2002 Rosalind Hengeveld.