From Newsgroup: news.admin.peering

We are going for an upgrade of the entire OS.
We are going to have some downtimes.
We will return to normal operations soon.

The admin
Gab Virebent
--
https://contact.virebent.art
https://www.virebent.art
https://news.tcpreset.net
https://jabber.tcpreset.net
https://virebent.noblogs.org/
https://infosec.exchange/@virebent
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Hello,

news.tcpreset.net has been upgraded from Ubuntu 22.04 to Ubuntu 24.04.4
LTS Noble, running the Linux 6.8 kernel and is back to normal operations

The upgrade also introduced new versions of the main service components:

- INN 2.7.2
- Perl 5.38.2
- Cleanfeed-NG 2026-07-03-rc1
- PHP 8.3
- MariaDB 10.11
- Postfix 3.8
- SpamAssassin 4.0

IPv4 and IPv6 connectivity, the external news spool, NNTP on port 119
and NNTPS on port 563 were verified after the reboot.
Mail, web and spam-filtering services are also operational.

The historical Cleanfeed filter has been replaced with Cleanfeed-NG
after checksum verification, configuration validation and successful
completion of all 130 upstream tests.

The new Cleanfeed-NG policies are initially running in audit mode.
New rejection policies will only be enabled after reviewing a sufficient
sample of real traffic.

New text-based statistics are available at: https://news.tcpreset.net/cleanfeed_parser.php

INN 2.7 no longer uses the deprecated -C flag.
It has been replaced with docancels: "none", preserving the previous
behaviour: cancel and Supersedes requests may be propagated, but are not locally executed to withdraw articles.

The maintenance also corrected INN log handling, the Certbot
configuration and the integration with PHP-FPM 8.3.

The server is currently operational with no failed systemd units.
Cleanfeed-NG behaviour and peer connectivity will continue to be
monitored over the coming days.

Please reply to this message if you notice any problems.

Gab
news.tcpreset.net

--- Digital Signature --- s4U6NJkufIeGHCcZ0c5zmNORa322gycgctnesmIDSR9MioY1LFt8bR1E9L77bB1w90zsQg7qXlh8RhOcUX2YAA==

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

In article <1173v1t$ai6$1@news.tcpreset.net>, Gabx <dev@nu.ll> wrote:

We are going for an upgrade of the entire OS.
We are going to have some downtimes.
We will return to normal operations soon.

Best of luck on the upgrade.

The admin
Gab Virebent
--
https://contact.virebent.art
https://www.virebent.art
https://news.tcpreset.net
https://jabber.tcpreset.net
https://virebent.noblogs.org/
https://infosec.exchange/@virebent

--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; 31 years in the ISP business!
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

The Doctor wrote:

Best of luck on the upgrade.

Thanks for the support.
There were some rough patches, but fortunately, it wasn't necessary to
use any files from the backup or the snapshot.

It is now fully operational, and the update went as planned.

The admin
Gab Virebent
--
https://contact.virebent.art--

https://contact.virebent.art
https://www.virebent.art
https://news.tcpreset.net
https://jabber.tcpreset.net
https://virebent.noblogs.org/
https://infosec.exchange/@virebent
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

On Mon, 31 Aug 2026 18:19:03 +0200
Gabx <victor@virebent.tcpreset> wrote:

The Doctor wrote:

Best of luck on the upgrade.

Thanks for the support.
There were some rough patches, but fortunately, it wasn't necessary
to use any files from the backup or the snapshot.

It is now fully operational, and the update went as planned.

I blinked and I missed it! Good job on the successful update.
--
End Of The Line BBS - Plano, TX
telnet endofthelinebbs.com 23


--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Nigel Reed wrote:

On Mon, 31 Aug 2026 18:19:03 +0200
Gabx <victor@virebent.tcpreset> wrote:

The Doctor wrote:

I blinked and I missed it! Good job on the successful update.

Thanks,
i adopted *infybofh* new [Cleanfeed-NG](https://github.com/infybofh/cleanfeed-ng)
it looks promising, which naturally prompted me to examine [Postfilter-NG](https://github.com/infybofh/postfilter-ng],
another of his projects.

From there, integrating NoCeM became a logical step.

https://news.tcpreset.net/nocem_stats.html

Postfilter-NG is still undergoing an audit, but the architecture is
ready, observable, and documented

Regards

Virebent

--- Digital Signature --- GtWXMm89L2P00ClAC/FUp4ERJRWmhFioAlYR13JNXdP5qyRIAWlKFdOZ3s/ppboAadZwVw97SnOUVsI76BYgAA==

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

On Mon, 31 Aug 2026 20:46:28 +0000
"Gabx" <usenet@tcpreset.invalid> wrote:

Nigel Reed wrote:

On Mon, 31 Aug 2026 18:19:03 +0200
Gabx <victor@virebent.tcpreset> wrote:

The Doctor wrote:

I blinked and I missed it! Good job on the successful update.

Thanks,
i adopted *infybofh* new [Cleanfeed-NG](https://github.com/infybofh/cleanfeed-ng)
it looks promising, which naturally prompted me to examine [Postfilter-NG](https://github.com/infybofh/postfilter-ng],
another of his projects.

From there, integrating NoCeM became a logical step.

https://news.tcpreset.net/nocem_stats.html

Postfilter-NG is still undergoing an audit, but the architecture is
ready, observable, and documented

I already have NoCeM configured, whether it's done properly I am not
exactly sure. I am planning to move to cleanfeed-NG this weekend since
I'll have some free time. I've not looked at postfilter-NG - I never
knew it existed.

I do have a feeling that cleanfeed may have dumped some legitimate
posts so maybe cleanfeed-NG will be better. Did you use stock or did
you tweak it?
--
End Of The Line BBS - Plano, TX
telnet endofthelinebbs.com 23


--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Nigel Reed wrote:

On Mon, 31 Aug 2026 20:46:28 +0000
"Gabx"<usenet@tcpreset.invalid> wrote:

https://news.tcpreset.net/nocem_stats.html

I already have NoCeM configured, whether it's done properly I am not
exactly sure. I am planning to move to cleanfeed-NG this weekend since
I'll have some free time. I've not looked at postfilter-NG - I never
knew it existed.

You could check whether NoCeM notices are arriving, whether their
signatures validate against the trusted issuer keys, and whether the referenced Message-IDs are actually being processed.

Logs are more important than the statistics page alone.

I do have a feeling that cleanfeed may have dumped some legitimate
posts so maybe cleanfeed-NG will be better. Did you use stock or did
you tweak it?

For Cleanfeed-NG, i started from the stock version and adapted the local configuration and policies, without modifying its core.

I am monitoring rejection data carefully because false positives are
also my main concern.

Postfilter-NG is currently running in audit mode, so I can observe its decisions before allowing it to reject anything.

I would be interested to hear how your Cleanfeed-NG migration goes and
to compare results.

Best regards

Gabx
--
https://contact.virebent.art
https://www.virebent.art
https://news.tcpreset.net
https://jabber.tcpreset.net
https://virebent.noblogs.org/
https://infosec.exchange/@virebent
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Gabx wrote:

Nigel Reed wrote:

On Mon, 31 Aug 2026 20:46:28 +0000
"Gabx"<usenet@tcpreset.invalid>-a wrote:

https://news.tcpreset.net/nocem_stats.html

I already have NoCeM configured, whether it's done properly I am not
exactly sure. I am planning to move to cleanfeed-NG this weekend since
I'll have some free time. I've not looked at postfilter-NG - I never
knew it existed.

You could check whether NoCeM notices are arriving, whether their
signatures validate against the trusted issuer keys, and whether the referenced Message-IDs are actually being processed.

Logs are more important than the statistics page alone.

I do have a feeling that cleanfeed may have dumped some legitimate
posts so maybe cleanfeed-NG will be better. Did you use stock or did
you tweak it?

For Cleanfeed-NG, i started from the stock version and adapted the local configuration and policies, without modifying its core.

I am monitoring rejection data carefully because false positives are
also my-a main concern.

Postfilter-NG is currently running in audit mode, so I can observe its decisions before allowing it to reject anything.

I would be interested to hear how your Cleanfeed-NG migration goes and
to compare results.

Cleanfeed-NG is actively processing production traffic.

It has evaluated about 5,700 articles, rejected 199 through the
established Cleanfeed rules, and recorded six new-policy findings in
audit mode.

https://news.tcpreset.net/cleanfeed_parser.php

NoCeM is also receiving notices and correctly ignoring issuers or notice
types outside our trust policy.

No trusted and applicable notice has arrived yet, so there have been no cancellations.

I need to improve the status page because it currently does not display notices excluded by policy.

https://news.tcpreset.net/nocem_stats.html

Postfilter-NG is not active in production yet, as i already said.

Its two displayed events are offline validation tests, including one
simulated rejection accepted in audit mode.

https://news.tcpreset.net/postfilter_stats.html

I will keep it staged until there is enough evidence to activate it safely.

Best regards

Gabx

--
https://contact.virebent.art
https://www.virebent.art
https://news.tcpreset.net
https://jabber.tcpreset.net
https://virebent.noblogs.org/
https://infosec.exchange/@virebent
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Hi Gabx,

For Cleanfeed-NG, i started from the stock version and adapted the local configuration and policies, without modifying its core.

Same for me.

I am monitoring rejection data carefully because false positives are
also my-a main concern.

Like Postfilter-NG, you can try some filters in audit mode first.

I would be interested to hear how your Cleanfeed-NG migration goes and
to compare results.

The migration was straight-forward. Just follow the steps in the
README.txt file.
--
Julien |eLIE

-2-aEn voyant |a quel point mon fils est ingrat envers moi, je me rends
compte que j'ai bien fait de ne pas m'en occuper.-a-+

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.peering

Julien |eLIE wrote:

Hi Gabx,

For Cleanfeed-NG, i started from the stock version and adapted the
local configuration and policies, without modifying its core.

Same for me.

Today I changed these options:

- pseudonymized posting hosts and posting accounts;
- Sender, X-Trace, mail header and X-No-Archive eliminated;
- encrypted identities;
- accepted events not registered;
- private retention 30 days;
- external Tor lookup disabled;
- zero records still preserved in clear text;
- exclusively aggregate public report.

at the same time
INN:
readertrack=false
logipaddr=false.

Installing and configuring Postfilter-NG motivated me to a truly
consistent privacy policy: identity encryption, pseudonymization,
elimination of related headers, limited retention, public reports drawn
up, disabling unnecessary Tor lookup.

I then extended the same logic to INN, Apache, journald, Mail2News, SpamAssassin, Rspamd and Redis, eliminating old data out of retention.

Finally I put everything in black and white in the Privacy Policy (https://news.tcpreset.net/privacy.html)

Tout s'est d|-roul|- comme pr|-vu.
Il ne reste plus qurCO|a attendre lrCOarriv|-e des donn|-es et |a faire le point.
Monsieur, je vous souhaite une merveilleuse journ|-e .

Gabx
--

--- Digital Signature --- Gizi/QakaXDNMe6GzbVrNM0qFeC4FLRh9sNpm2G8pNtVddrYokiIFie1rIZTh3Bnpr9WpUqZ7fiYZUvAen6bAA==

--- Synchronet 3.22a-Linux NewsLink 1.2