On Sun, 23 Mar 2008 22:55:54 +0100 'Sebastian G.'
wrote this on alt.comp.freeware:

You're being presumptuous. The poster may have a good reason to fake
his headers ... wait until he responds.

hummingbird wrote:


There is no good reason to fake headers, especially if it introduces
compatibility problems. Even further, why should anyone choose "Outlook
Express"?

On Mon, 24 Mar 2008 02:05:41 +0100 'Sebastian G.'
wrote this on alt.comp.freeware:

There are reasons to fake headers to hide from public view what
posting s/w he uses to deter stalkers, and the poster may have
chosen OE for no particular reason (ie a random choice). I'm not
aware of the compatibility problems you refer to.

"Nomen Nescio" <nomen.nescio@nomen.nescio> wrote in message
news:fs6fiq$b70$2@aioe.org...
Hi "Unknown Name":

MID Xns9A18D83EF64ABHummingbirdisak00k@0.0.0.0

seems to have the same aioe NNTP Posting Host as this post. Since you place
such confidence in tracking Hunmingbird's sock puppets this way, you'll
probably want to confess that this is actually you, Franklin.

hummingbird wrote:



Nonsense.


A static header means that the posting still has always the same
characteristic. The only sane choice would be to randomize it for each posting.

Then again, one can simply omit all irrelevant headers.

I am. Various servers detect OE by the header and then apply protocol
changes to make it work, which in turn break the real clients.

On Mon, 24 Mar 2008 04:10:59 +0100 'Sebastian G.'
wrote this on alt.comp.freeware:

That response from you sure is.
I refer you to my previous comments.

Maybe the other poster does that. Do you know otherwise?

.... ... ...

Sorry, I know nothing about this.

hummingbird wrote:



If you can tell me any logical connection between header faking and detering
stalkers... but well, you can't, since there is none.


Obviously "Microsoft Outlook Express 6.00.2900.3138" is not a random string,
especially not if it's repeated among two postings.

"5-cfpsl4io7roUHp4FlfX4evXS4RHA6wudmVnB-qKISihnjUHFIUBz1Pn5MGX5FC" would be one.

On Sun, 23 Mar 2008 20:46:34 -0000, Nomen Nescio wrote:

Hi Franklin. LOL
--
See Brenda's UniWorldWare
http://tinyurl.com/nm2yt

On Mon, 24 Mar 2008 13:37:04 +0100 'Sebastian G.'
wrote this on alt.comp.freeware:

I never used the term "detering", you did. Anyway ....
If you don't know then you obviously haven't been around for very
long -or- you haven't been paying attention.

Suffice it for me to say that the contents of one's headers can be
used by stalkers and troublemakers against you. It therefore makes
some sense to prevent them from doing that. I realised that many
years ago and took action to protect myself early on in Usenet.


I meant that the other poster may insert a random news client string
into his header each time he posts (or whenever he wants to) to help
anonymise himself better.

So today he might insert OE and tomorrow he might use Thunderbird.
The day after tomorrow he might insert some other news client.

Get the picture?


HOWEVER, it has come to my attention that in this particular case,
the person posting as Nomen Nescio is none other than the village
idiot called ***Franklin*** who hangs out on alt.comp.freeware.
Somebody has examined his headers and caught him red-handed.

Can you believe it................
Here's a list of Franklin's sockpuppets and nyms used since
July 2007 on <alt.comp.freeware>:

--
Franklin's whopping BIG LIE of 2007:
"I do not post with deliberate and misleading errors"
<Franklin>, ACF, 23-Nov-2007

....but...but...but...

Here's the complete(?) list of Franklin's sockpuppets used on ACF
since July 2007 (65+ and rising) to deliberately deceive people:

-Mar/2008-:
Franklin <no-user@nntp.invalid>
Bare Bosoms <Bare.Bosoms.2008@gmail.com>
Nomen Nescio <nomen.nescio@nomen.nescio>

-Feb/2008-:
Franklin <no_user@www.invalid>

-Jan/2008-:
Franklin-post7

-Dec/2007-:
cc to Hummy <franklin.says@no.mail.invalid>
"Franklin (ACF)" <franklin@nomail.invalid>
Frank to Humbug <frank@mail.invalid>
"carbon copy -> Chris" <franklin.says@no.mail.invalid>
carbon copy to Humbug <franklin.says@no.mail.invalid>
"Frank (inc Humbug)" <franklin@nomail.invalid>
cc T0 Hummingberk <franklin.says@no.mail.invalid>
Poppinjay <noone@nowhere.invalid> (unconfirmed)
Cecil SeaSerpent <cecil@beanyland.net>
FrankIin writes <frankIin@nomail.invalid>
4Hummingbird
The Angel of Evil <franklin.says@no.mail.invalid>
Franklin-post1
Franklin-post2
Franklin-post3
Franklin-post4
Franklin-post5
Franklin-post6
Humming brain <franklin.says@no.mail.invalid>

-Oct/2007-:
The Angel of Evil

-July 2007-:
Franklin .
Franklin.
Frankli n
To Laurie
Franklin to hummingbird
coco
Franklin ZORG
<frank.says@no.mail.please>
<frank.says@no.mail>
[each of the above used one of the e-mail addies]

Franklin Smith <frank.saiys@no.spam.please>
Franklin Smith <frank.says@no.no.to.spam.please>
Franklin Smith <frank.says@no.spam.please>
Franklin Smith <fran.k.says@no.spam.please>
[note the extra space added]

Franklin Smith <frank.says@nope.to.spam.please>
Franklin Smith <frank.sais@no.spam.please>
Franklin Srnith <frnk.says@no.spam.please>
[note letters rn used to look like m]

Franklin Smith <frank.says@onspam.please>
Franklin Smith <franksays@no.spam.please>
Franklin Smith <frank.says@no.sparm.please>
Franklin Smith <frahk.says@no.spam.please>
Franklin Smith <frank.says@smith.spam.please>
Franklin Srnith <frank.says@no.to.all.spam.please>
[note letters rn used to look like m]

Franklin Smith <ffrraannkk.says@no.spam.please>
Franklin Smith <frank.smith@no.spam.please>
Franklin S <frank.speaks@his.PC.invalid>
Franklin Smith <franno.says@no.to.spam.please>
Franklin <frank.says.so@no.spam.please>
Franklin Smith <frank.says.its.ok@no.spam.please>
Franklin Smith <frank.ontime@no.place>
Franklin Smith <frank.says@only.spam.is.killed>
Franklin likes freeware <frank.says@no.mail.please>
Franklin <franklin.asks@no.mail.please>
Franklin <franklinsays@gmail.com>
Franklin <frank.says@no.mail.please>

On Mon, 24 Mar 2008 13:37:04 +0100, Sebastian G. wrote:

1) Fucking around
2) Sock puppetry
3) Feeling of "technical superiority"
4) Fucking around
--
See Brenda's UniWorldWare
http://tinyurl.com/nm2yt

hummingbird wrote:


~~~~~


Ouch! The word "deter" even appears in the quoting above...


How so?


So that's why your headers are defective, as well as your mail address in
the From header...


No. It leaves an obvious trace over the cause of one day.

Even further, drawing it from a limited set makes it pretty void.

On Mon, 24 Mar 2008 20:53:04 +0100 'Sebastian G.'
wrote this on alt.comp.freeware:

Well you'll just have to accept my word on that Sebastian because
I'm not going to post stuff here which is of use to the small group
of sick stalkers we have on <alt.comp.freeware>. These people only
have to find one header in several posts that match, to declare they
were posted by the same person. Now, you and I may think that is
ridiculous and is only trivial or circumstantial evidence, but on
ACF it's more than enough for the dorks to declare proven guilt and
to accuse that person of sockpuppeting or spoofing to smear their
name and discredit them.

Thus, it can be useful for a person to be able to deliberately
manipulate their headers to *deter* stalker attack and to retain
a level of anonymity.


That's really a non-sequitur, but I'm not aware that my Headers and
From: field are defective. The only general rule I'm aware of is to
ensure a unique MID to avoid such things as hash collisions etc.
Otherwise if the news server accepts a post and propagates it, then
it's OK.


Well, maybe a person will change his headers for each post. Bear in
mind, he's only protecting himself against a dork-stalk attack, not
NSA or CIA etc. That would require more sophisticated measures.

I was only giving a simple example...in practice one might use a
more complex set of variants in the headers.

"hummingbird" wrote:

So what?

Who cares?

What tosh. Any regular poster keeps the same handle and is judged by
the articles they post, not by trolls.

I always post as "Ant" but you know nothing about me apart from the
ISP I use.

On Mon, 24 Mar 2008 22:49:02 -0000 'Ant'
wrote this on alt.comp.freeware:

Who are you? I was having a debate with Sebastian.

Ditto. If you don't care, why bother posting at all?

You obviously are a little naive about these matters.


You forgot these headers of yours which all help to ID you:

X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 80.189.16.24
X-Postfilter: 1.3.37
X-Newsreader: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200


Now what were you saying?

Ant, if you have some constructive views on this debate please
express them, otherwise go away.

"hummingbird" wrote:

I am anonymous.

You posted to usenet where anyone can join in.

Because I'd like you to explain what the problem is.

Pleas explain, then.

I post through giganews, along with many others, one of the largest if
not *the* largest news provider.

24.16.189.80.in-addr.arpa domain name pointer 189.16.24.fdial.global.net.uk.

Belongs to Brightview who are the resellers of bandwidth that my ISP
uses. So, in fact, you don't even know my ISP.

An old version of OE. So what?

See above.

Ant wrote:


Seems like you didn't even bother to read this thread, did you?

On Tue, 25 Mar 2008 02:00:58 -0000 'Ant'
wrote this on alt.comp.freeware:

True, but my comments were addressed to Sebastian and you know
how it is trying to hold two conversations at once and how muddled
things can get.

Ooh so you *do* care.

I think I posted enough clues for most folks to get the picture.
If either of you want more explanation, send an e-mail
to hellhole2007 AT libero.it

See my previous comments.

Indeed but your statement was that I only know who your ISP is.
I pointed out that your headers reveal more about you than that.
(not more about you personally but more about you on Usenet).

On Mon 24 Mar 2008 14:42:21, Krazee Brenda <brendaroguska@gmail.com>
wrote:


Hello Brenda, sorry to reply so late. I've been away and had a nice
very rest, thank you very much. Sorry no postcard but you know how
I'd rather not spend money on you. A bit like hubby maybe? Will
try and catch up with your weird postings shortly.

On Mon 24 Mar 03:02, Cecil SeaSerpent <cecil@beanyland.net>
wrote:

Hi Cecil

It doesn't even read like one of my posts. Looks more like
something from Hummingbird.

You say I have confidence in tracking Hunmingbird's sock puppets
through his posting host but that not quite right. I don't think
I've ever said I use that approach although there was an example
recently from another poster which seemed to say exactly that.
Maybe you could be mixing that up with what I've posted.

I don't identify Hummingbird's posts using servers because he has
become more adept at munging his headers and has recently taken to
openly discussing how he can fake any header with his tools.
http://preview.tinyurl.com/22x7xk

If you look at a my recent post http://tinyurl.com/2hbsnu you will
see a way I prefer to use to confirm Hummingbird's posts. It's
worhta quick look especially at the data part.

You might even wish to try the same approach on Aracari posting in
uk.politics.misc. If you interleave Aracari's posts with
Hummingbird's posts over the same period then you'll see a very
strong correlation in posting times. Try it and you can see the
result is persuasive.

Other Hummingbird's sockpuppets can be seen this way too. From
memory I think "Derald" is one. This approach means you don't need
to go thru Hummingbird's fake headers or follow newsreader names or
posting servers or any of that.

I used the headers so little that I hadn't noticed Aracari's posting
server and not even his giveaway ROT-13 header until someone listed
them here recently. Timestamp matching can be enough although some
relay servers will deliberately wait a random period of time.

In fact, I think I used that randomness for another sockpuppet.
Hummingbird and the sockpuppet were never posting at the same time
even though the posting times of each was quite irregular. Chance
alone would suggest that at some stage they would post at more or
less the same time. But it never happened. This negative
correlation was too high to ignore.

On Mon 24 Mar 2008 19:53:04, Sebastian G. <seppi@seppig.de> wrote:
At Monday 24th March 2008, Hummingbird wrote:


Sebastian,

In case you don't know him, Hummingbird sems to prefer to get his
revenge in before any transgressions have occurred.

In other words, he posts a spoof or uses a sockpuppet with fake
headers to attack a problem from another poster which does not yet
exist except in his predictions.

I too get someother defective headers from Hummingbird but in a
diffent way. It's in their very punctuation. I see spaces
appearing in the middle of Hummingbird's header text but I've tended
to attribute this to my newsreader and it's lack of UTF-8 support
because I've seen Hummingbird use both 7-bit and 8-bit encoding
recently.

However, I'm a bit surprised at the extent of messing up I see.
Google Groups also seems to get a bit muddled by some of
Hummingbird's "specially written" headers.