From Newsgroup: news.software.nntp

Hi all,

I am publishing the first public release candidate of Postfilter-NG:

Postfilter-NG 2026.07.5-rc2

Repository and release:

https://github.com/infybofh/postfilter-ng

Postfilter-NG is a modernized continuation of the original Postfilter
Perl hook for INN nnrpd.

The original philosophy remains unchanged: inspect articles submitted by users, apply local posting policies, reject abusive or malformed
content, normalize selected headers, protect private information and
provide useful logs to the newsmaster.

The implementation, however, has been extensively rewritten and reorganized.

Among the main additions:

- modular Perl code instead of a single large script;
- TOML configuration and configuration fragments;
- separate handling of text and binary hierarchies;
- explicit protection against mixed text/binary crossposts;
- MIME parsing and attachment detection in text groups;
- detection of yEnc, UUencode and large Base64 blocks;
- configurable exemptions for PGP signatures, keys and certificates;
- header replacement, removal and pseudonymization;
- structured syslog logging with symbolic result codes;
- audit mode, quarantine and rejected-article storage;
- SQLite-backed history and audit information;
- last-known-good and emergency configuration fallback;
- command-line administration through postfilterctl;
- safer installation and manual activation;
- extensive documentation, examples and more than one thousand automated tests.

Postfilter-NG can distinguish the text and binary worlds from the target newsgroups. A binary article posted to a binary hierarchy can therefore
be accepted, while the same content posted to a text group can be rejected.

It can also remove or pseudonymize sensitive information from
Injection-Info while preserving local traceability for the server operator.

Performance has improved considerably. In the development benchmark, the
same workload required approximately:

Original Postfilter: 1200 ms
Postfilter-NG: 201 ms

This is about 5.5 times faster, despite the additional checks and
features. Naturally, real performance depends on configuration, article
size, enabled modules, logging and storage.

The installer does not automatically replace the active INN posting
hook. It installs a candidate named:

filter_nnrpd.pl.ng

The newsmaster can verify the configuration, permissions, database and embedded Perl loading before manually activating it as filter_nnrpd.pl.

Please note that Postfilter-NG is an nnrpd posting filter. It is not
reloaded by:

ctlinnd reload filter.perl

That command applies to filter_innd.pl. Postfilter-NG is loaded when a
new nnrpd process starts.

This release candidate has been tested with real posts from Thunderbird
and raw NNTP sessions, including header transformations, anonymous
users, pseudonymization, SQLite concurrency and embedded-INN loading.

I still recommend starting in audit mode and checking the results
against real traffic before enabling rejection in production.

Bug reports, false-positive reports, performance results, unusual MIME examples, documentation corrections and pull requests are welcome on GitHub.

The original Postfilter had a useful idea worth preserving.

The old guard at the posting gate is still there rCo it simply received a rather extensive upgrade.


Special thanks to Paolo Amoroso (Aioe) to mantain it until 2018.


Sincerely
--
Ivo Gandolfo

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.software.nntp

In article <113opai$3rh24$2@paganini.bofh.team>,
Ivo Gandolfo <usenet@bofh.team> wrote:

Hi all,

I am publishing the first public release candidate of Postfilter-NG:

Postfilter-NG 2026.07.5-rc2

Repository and release:

https://github.com/infybofh/postfilter-ng

Postfilter-NG is a modernized continuation of the original Postfilter
Perl hook for INN nnrpd.

The original philosophy remains unchanged: inspect articles submitted by >users, apply local posting policies, reject abusive or malformed
content, normalize selected headers, protect private information and
provide useful logs to the newsmaster.

The implementation, however, has been extensively rewritten and reorganized.

Among the main additions:

- modular Perl code instead of a single large script;
- TOML configuration and configuration fragments;
- separate handling of text and binary hierarchies;
- explicit protection against mixed text/binary crossposts;
- MIME parsing and attachment detection in text groups;
- detection of yEnc, UUencode and large Base64 blocks;
- configurable exemptions for PGP signatures, keys and certificates;
- header replacement, removal and pseudonymization;
- structured syslog logging with symbolic result codes;
- audit mode, quarantine and rejected-article storage;
- SQLite-backed history and audit information;
- last-known-good and emergency configuration fallback;
- command-line administration through postfilterctl;
- safer installation and manual activation;
- extensive documentation, examples and more than one thousand automated >tests.

Postfilter-NG can distinguish the text and binary worlds from the target >newsgroups. A binary article posted to a binary hierarchy can therefore
be accepted, while the same content posted to a text group can be rejected.

It can also remove or pseudonymize sensitive information from
Injection-Info while preserving local traceability for the server operator.

Performance has improved considerably. In the development benchmark, the >same workload required approximately:

Original Postfilter: 1200 ms
Postfilter-NG: 201 ms

This is about 5.5 times faster, despite the additional checks and
features. Naturally, real performance depends on configuration, article >size, enabled modules, logging and storage.

The installer does not automatically replace the active INN posting
hook. It installs a candidate named:

filter_nnrpd.pl.ng

The newsmaster can verify the configuration, permissions, database and >embedded Perl loading before manually activating it as filter_nnrpd.pl.

Please note that Postfilter-NG is an nnrpd posting filter. It is not >reloaded by:

ctlinnd reload filter.perl

That command applies to filter_innd.pl. Postfilter-NG is loaded when a
new nnrpd process starts.

This release candidate has been tested with real posts from Thunderbird
and raw NNTP sessions, including header transformations, anonymous
users, pseudonymization, SQLite concurrency and embedded-INN loading.

I still recommend starting in audit mode and checking the results
against real traffic before enabling rejection in production.

Bug reports, false-positive reports, performance results, unusual MIME >examples, documentation corrections and pull requests are welcome on GitHub.

The original Postfilter had a useful idea worth preserving.

The old guard at the posting gate is still there rCo it simply received a >rather extensive upgrade.

Special thanks to Paolo Amoroso (Aioe) to mantain it until 2018.

Sincerely

--
Ivo Gandolfo

Got you!
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; 31 years in the ISP business!
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.software.nntp

Il 21/07/2026 23:45, Ivo Gandolfo ha scritto:

Hi all,

Hi all again,

a short update following the Postfilter-NG announcement.

The current release candidate is:

Postfilter-NG 2026.07.5-rc3

Repository and releases:

https://github.com/infybofh/postfilter-ng

According to GitHub traffic statistics, the repository has currently
received:

33 clones
27 unique cloners
116 page views

I know that clone statistics may also include automated systems, but the project has clearly been downloaded and inspected by more than just one
or two people.

The slightly less encouraging part is that I have received almost few
feedback :-)

Meanwhile, Postfilter-NG has been running on a real public INN reader,
and I collected a complete day of verbose logs for debug

Results from 1172 submitted articles:

Accepted by Postfilter-NG: 1146 (77.8%)
Rejected by Postfilter-NG: 26 (22.2%)
Accepted by Postfilter but later
rejected by Cleanfeed-NG: 5 (6.9%)
Finally accepted by INN: 1141 (70.8%)

Postfilter-NG rejection reasons:

7 forbidden crossposts
4 multipost detections
3 cumulative group quota exceeded
4 cumulative ip quota exceeded
2 permanently closed group for posting (too many abuse)
1 oversized text article
2 binary on text-only server/group
3 bad MIME/type encoding

No crashes, configuration fallbacks, SQLite errors, SQLITE_BUSY events,
stack traces or internal failures were observed.

Overall processing times:

Median: 285 ms
Average: 466 ms
95th percentile: 988 ms
Maximum: 1.010 s

Accepted articles:

Median: 304 ms
Average: 525 ms
95th percentile: 785 ms
Maximum: 1.010 s

Rejected articles:

Median: 228 ms
Average: 260 ms
95th percentile: 513 ms
Maximum: 695 ms

Median timing of the main checks:

style: 46.2 ms
attachments: 0.34 ms
binary: 0.03 ms
user database: 0.01 ms
Tor lookup: 47.9 ms
RBL lookup: 18.0 ms
banlist: 0.94 ms
badwords: 0.25 ms
rate limiting: 0.96 ms
custom checks: 0.01 ms

The slowest occasional operations were external DNS lookups,
particularly URIBL queries (if the post contain a lot of url). The MIME attachment scanner itself remained below approximately 1 ms in this
workload.

SQLite rate counters also worked correctly across multiple independent
nnrpd processes. Multipost and cumulative posting limits were enforced
using shared persistent state, not only per-process memory.

Based on these results, rc3 also includes:

- configuration-generation deduplication and retention;
- a one-second total DNS lookup budget;
- a 2700 ms processing budget with fail-closed behaviour;
- additional timing information for configuration, profiles, headers,
database recording and finalization;
- improved Tor-marking logs;
- further installer privilege-drop hardening.

The current results are encouraging, but my own server is still only one installation. My goal it's to reach 95th percentile < 300ms to analize
the post and accept/reject.

I would therefore very much appreciate feedback from anyone who has
cloned, installed, reviewed or even only tested the configuration.

Useful feedback does not need to be a detailed technical report. Even something as simple as:

INN version:
Operating system:
Perl version:
Postfilter-NG mode: audit / enforce
Installed successfully: yes / no
False positives observed: yes / no
General result: works / does not work / still testing

would be genuinely useful.

Reports about unusual MIME messages, PGP or S/MIME posts, binary
hierarchies, custom readers.conf configurations, performance, false
positives, migration from the original Postfilter, or installer problems
are especially welcome.

Issues can be opened directly on GitHub:

https://github.com/infybofh/postfilter-ng/issues

So, to the people behind those clones: please do not be shy. :-)

A one-line rCLinstalled and working on INN x.yrCY is already valuable. A bug report is even more valuable. Silence is the only benchmark I cannot
analyse.


Thank you in advance.


Sincerely
--
Ivo Gandolfo
bofh.team
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.software.nntp


Il 21/07/2026 23:45, Ivo Gandolfo ha scritto:

Hi all,

Hi all again,

a short update following the Postfilter-NG announcement.

The current release candidate is:

Postfilter-NG 2026.07.5-rc3

Repository and releases:

https://github.com/infybofh/postfilter-ng

According to GitHub traffic statistics, the repository has currently received:

33 clones
27 unique cloners
116 page views

I know that clone statistics may also include automated systems, but the project has clearly been downloaded and inspected by more than just one or two people.

The slightly less encouraging part is that I have received almost few feedback ??

Meanwhile, Postfilter-NG has been running on a real public INN reader, and I collected a complete day of verbose logs for debug

Results from 1172 submitted articles:

Accepted by Postfilter-NG: 1146 (77.8%)
Rejected by Postfilter-NG: 26 (22.2%)
Accepted by Postfilter but later
rejected by Cleanfeed-NG: 5 (6.9%)
Finally accepted by INN: 1141 (70.8%)

Postfilter-NG rejection reasons:

7 forbidden crossposts
4 multipost detections
3 cumulative group quota exceeded
4 cumulative ip quota exceeded
2 permanently closed group for posting (too many abuse)
1 oversized text article
2 binary on text-only server/group
3 bad MIME/type encoding

No crashes, configuration fallbacks, SQLite errors, SQLITE_BUSY events, stack traces or internal failures were observed.

Overall processing times:

Median: 285 ms
Average: 466 ms
95th percentile: 988 ms
Maximum: 1.010 s

Accepted articles:

Median: 304 ms
Average: 525 ms
95th percentile: 785 ms
Maximum: 1.010 s

Rejected articles:

Median: 228 ms
Average: 260 ms
95th percentile: 513 ms
Maximum: 695 ms

Median timing of the main checks:

style: 46.2 ms
attachments: 0.34 ms
binary: 0.03 ms
user database: 0.01 ms
Tor lookup: 47.9 ms
RBL lookup: 18.0 ms
banlist: 0.94 ms
badwords: 0.25 ms
rate limiting: 0.96 ms
custom checks: 0.01 ms

The slowest occasional operations were external DNS lookups, particularly URIBL queries (if the post contain a lot of url). The MIME attachment scanner itself remained below approximately 1 ms in this workload.

SQLite rate counters also worked correctly across multiple independent nnrpd processes. Multipost and cumulative posting limits were enforced using shared persistent state, not only per-process memory.

Based on these results, rc3 also includes:

- configuration-generation deduplication and retention;
- a one-second total DNS lookup budget;
- a 2700 ms processing budget with fail-closed behaviour;
- additional timing information for configuration, profiles, headers,
database recording and finalization;
- improved Tor-marking logs;
- further installer privilege-drop hardening.

The current results are encouraging, but my own server is still only one installation. My goal it's to reach 95th percentile < 300ms to analize the post and accept/reject.

I would therefore very much appreciate feedback from anyone who has cloned, installed, reviewed or even only tested the configuration.

Useful feedback does not need to be a detailed technical report. Even something as simple as:

INN version:
Operating system:
Perl version:
Postfilter-NG mode: audit / enforce
Installed successfully: yes / no
False positives observed: yes / no
General result: works / does not work / still testing

would be genuinely useful.

Reports about unusual MIME messages, PGP or S/MIME posts, binary hierarchies, custom readers.conf configurations, performance, false positives, migration from the original Postfilter, or installer problems are especially welcome.

Issues can be opened directly on GitHub:

https://github.com/infybofh/postfilter-ng/issues

So, to the people behind those clones: please do not be shy. ??

A one-line "installed and working on INN x.y" is already valuable. A bug report is even more valuable. Silence is the only benchmark I cannot analyse.


Thank you in advance.


Sincerely
--
Ivo Gandolfo
bofh.team

--- Synchronet 3.22a-Linux NewsLink 1.2