Re: Name-Shifting ?

Discussion in 'Computer Support' started by VanguardLH, May 17, 2009.

  1. VanguardLH

    VanguardLH Guest

    Judith Smith wrote:

    > Please can anyone advise on the likely hood of these posts being from
    > the same machine/person - and what are the things to check on in order
    > to ascertain?


    > Path: ...!z5g2000vba.googlegroups.com!not-for-mail
    > From: Lou Knee <>
    > Date: Sat, 16 May 2009 09:34:18 -0700 (PDT)
    > NNTP-Posting-Host: 80.254.146.36


    > Path: ...!t11g2000vbc.googlegroups.com!not-for-mail
    > From: "Just zis Guy, you know?" <>
    > Date: Fri, 15 May 2009 09:27:38 -0700 (PDT)
    > NNTP-Posting-Host: 80.254.146.36


    Timezone in the datestamp is the same for both posts (-0700). Posted in
    less than 7 minutes apart. It is unlikely the poster had their IP
    expired AND then they unbind from it (expiration only makes the IP
    eligible for reassignment but the host hangs onto it until it unbinds
    from it).

    Same IP address for both posts (80.254.146.36). A reverse DNS lookup on
    it returns 50ob.scansafe.net which doesn't look like it's a dial-up user
    (that gets a different IP everytime they establish a session). That
    means the poster is likely using a broadband connection which means
    their IP address sticks with them for a long time. Although this domain
    does not include a ccTLD (country-code top-level domain), like .uk, this
    domain's registrant says they are in the UK (Scansafe Ops, 198 High
    Holborn, WC1V 7BD, London, United Kingdom). That the poster uses an ISP
    in the UK doesn't mean that is where the poster is physically located --
    although the poster is posting to a UK newsgroup their timezone puts
    them on the west cost of the USA.
    VanguardLH, May 17, 2009
    #1
    1. Advertising

  2. On Sun, 17 May 2009 16:23:18 -0500, VanguardLH <> wrote:

    >Timezone in the datestamp is the same for both posts (-0700). Posted in
    >less than 7 minutes apart.


    The timezone is GMT+1 (BST), not unexpected for posts to a UK specific
    newsgroup, and you're wrong, the posts are a day apart. Everything
    except the IP is different, including the OS version.

    50ob.scansafe.net is an outbound node of ScanSafe. See
    <http://openrbl.org/query?50ob.scansafe.net>.

    Guy
    --
    http://www.chapmancentral.co.uk/urc | http://www.nohelmetlaw.org.uk/

    "To every complex problem there is a solution which is
    simple, neat and wrong" - HL Mencken

    Newsgroup may contain nuts.
    Just zis Guy, you know?, May 17, 2009
    #2
    1. Advertising

  3. VanguardLH

    VanguardLH Guest

    Just zis Guy, you know? wrote:

    > VanguardLH wrote:
    >
    >> Timezone in the datestamp is the same for both posts (-0700). Posted
    >> in less than 7 minutes apart.

    >
    > The timezone is GMT+1 (BST), not unexpected for posts to a UK
    > specific newsgroup, and you're wrong, the posts are a day apart.


    My bad. I didn't notice the day of the month was different by one.

    ALL posts through Google Groups are biased to GMT. Don't go by the
    NNTP-Posting-Date X-Trace headers added by Google. I went by the Date
    header that the poster's newsreader added. It is unlikely the poster
    is changing their timezone before they post and then change it back.
    Changing the timezone on one's host is doable but trolls just used
    identities to nymshift.

    Poster -> Date: Sun, 17 May 2009 12:38:51 -0700 (PDT)
    Google -> X-Trace: ... (17 May 2009 19:38:52 GMT)
    Google -> NNTP-Posting-Date: Sun, 17 May 2009 19:38:52 +0000 (UTC)

    Since Google biases their timestamps to GMT, you can't use their headers
    to figure out where is the poster. I used the Date header that the
    poster's client added.

    > Everything except the IP is different, including the OS version.


    Where is the OS information specified in those headers in the example
    posts?

    > 50ob.scansafe.net is an outbound node of ScanSafe. See
    > <http://openrbl.org/query?50ob.scansafe.net>.


    See my other reply to you. I haven't trusted anything reported by
    OpenRBL for years.

    That multiple companies using ScanSafe for filtering so their web
    traffic may all appear to come from the same host at ScanSafe does not
    make their host an *open* proxy. It just means those posters are
    coming from downstream customers of ScanSafe. If Level3 masked out
    whomever used their service, all their customers (and their users)
    would look like they were coming from Level3, too.
    VanguardLH, May 18, 2009
    #3
  4. VanguardLH

    VanguardLH Guest

    VanguardLH wrote:

    > Just zis Guy, you know? wrote:
    >
    >> VanguardLH wrote:
    >>
    >>> Timezone in the datestamp is the same for both posts (-0700). Posted
    >>> in less than 7 minutes apart.

    >>
    >> The timezone is GMT+1 (BST), not unexpected for posts to a UK
    >> specific newsgroup, and you're wrong, the posts are a day apart.

    >
    > My bad. I didn't notice the day of the month was different by one.
    >
    > ALL posts through Google Groups are biased to GMT. Don't go by the
    > NNTP-Posting-Date X-Trace headers added by Google. I went by the Date
    > header that the poster's newsreader added. It is unlikely the poster
    > is changing their timezone before they post and then change it back.
    > Changing the timezone on one's host is doable but trolls just used
    > identities to nymshift.
    >
    > Poster -> Date: Sun, 17 May 2009 12:38:51 -0700 (PDT)
    > Google -> X-Trace: ... (17 May 2009 19:38:52 GMT)
    > Google -> NNTP-Posting-Date: Sun, 17 May 2009 19:38:52 +0000 (UTC)
    >
    > Since Google biases their timestamps to GMT, you can't use their headers
    > to figure out where is the poster. I used the Date header that the
    > poster's client added.
    >
    >> Everything except the IP is different, including the OS version.

    >
    > Where is the OS information specified in those headers in the example
    > posts?


    In another subthread, Beauregard showed me where folks were looking to
    identify the OS.

    X-HTTP-UserAgent: Mozilla/4.0 (... Windows NT 5.1; ...)
    X-HTTP-UserAgent: Mozilla/5.0 (... Windows NT 6.0; ...)

    Since the user-agent string can be whatever you want, I haven't used it
    to do much identifying of a troll or nymshifter. An add-on utility
    (http://www.ieaddons.com/en/details/other/UAPick_UserAgent_Switcher/)
    lets me pick whatever UA string that I want. I've used it at some sites
    to make it look like I'm using a different web browser (because they
    coded okay for something other than the one that I use). It comes with
    22 templates of different web browsers for different operating systems,
    all of which can be edited once selected. I'm so used to being to
    change the UA string that I never bother even looking at it to identify
    the web browser or OS for the poster since it can be easily changed. I
    suppose the nymshifter might not be as clever as for what I gave them
    credit. I figure if I knew someone was lying to me about who they are
    that I wouldn't trust the Lamborghini parked outside was theirs.
    VanguardLH, May 18, 2009
    #4
  5. VanguardLH

    Nuxx Bar Guest

    Oh just admit it will you? This is the kind of thing which makes you
    *so* despised: you don't just do the deed, you then lie about it, and
    sneeringly call anyone who dares to challenge you a "troll". It's
    pathetic. You're pathetic.
    Nuxx Bar, May 18, 2009
    #5
  6. Just zis Guy, you know?, May 18, 2009
    #6
  7. VanguardLH

    Mike Easter Guest

    posted to 24hshd only

    VanguardLH wrote:

    > ALL posts through Google Groups are biased to GMT. Don't go by the
    > NNTP-Posting-Date X-Trace headers added by Google. I went by the Date
    > header that the poster's newsreader added.


    GG stamps time/date in several places and they are identical adjusting for
    tz. These are excerpts from a normal GG header:

    Date: Thu, 14 May 2009 05:41:56 -0700 (PDT)

    That line is always expressed in PDT regardless of source.

    X-Trace: posting.google.com 1242304916 788 127.0.0.1 (14 May 2009 12:41:56
    GMT)

    That line is GMT and identical adjusted for tz offset.

    NNTP-Posting-Date: Thu, 14 May 2009 12:41:56 +0000 (UTC)

    That line is expressed as UTC; also identical.



    --
    Mike Easter
    Mike Easter, May 18, 2009
    #7
  8. VanguardLH

    VanguardLH Guest

    Just zis Guy, you know? wrote:

    > On Mon, 18 May 2009 00:06:34 -0500, VanguardLH <> wrote:
    >
    > <snip hypothetical stuff>
    >
    > Never heard of Occam's Razor, have you?
    >
    > Guy


    Depends on your personal experience. In the newsgroups that I visit and
    where trolls and nymshifters are truly a problem, they ARE smart enough
    to know how to alter almost all the headers. There's a few that they
    are stuck with if they don't operate their own NNTP server and peer it
    to other NNTP servers.

    I assumed the nymshifter was smart enough to know about UA strings. You
    ASSUMED the nymshifter was uneducated on changing their UA string.
    Those assumptions *do* have significant affect on the hypothesis derived
    as a cause of those assumptions, so Occam's Razor does not apply.
    VanguardLH, May 18, 2009
    #8
  9. VanguardLH

    VanguardLH Guest

    Mike Easter wrote:

    > posted to 24hshd only
    >
    > VanguardLH wrote:
    >
    >> ALL posts through Google Groups are biased to GMT. Don't go by the
    >> NNTP-Posting-Date X-Trace headers added by Google. I went by the Date
    >> header that the poster's newsreader added.

    >
    > GG stamps time/date in several places and they are identical adjusting for
    > tz. These are excerpts from a normal GG header:
    >
    > Date: Thu, 14 May 2009 05:41:56 -0700 (PDT)
    >
    > That line is always expressed in PDT regardless of source.
    >
    > X-Trace: posting.google.com 1242304916 788 127.0.0.1 (14 May 2009 12:41:56
    > GMT)
    >
    > That line is GMT and identical adjusted for tz offset.
    >
    > NNTP-Posting-Date: Thu, 14 May 2009 12:41:56 +0000 (UTC)
    >
    > That line is expressed as UTC; also identical.


    Which means that nothing of the poster's location can be deciphered from
    the timestamps.

    So we're back to just the NNTP-Posting-Host header. Yet that IP address
    is just whatever host was seen by the Google server and may not be the
    physical location of the poster. Considering that ScanSafe provides
    proxy service to do web filtering for several customers, those customers
    could be somewhere else geographically than the data centers operated by
    ScanSafe, and the users of those customers could be even more
    geographically diverse.

    So we can't tell where is the Google Grouper.
    VanguardLH, May 18, 2009
    #9
  10. VanguardLH

    Mike Easter Guest

    VanguardLH wrote:
    > Mike Easter wrote:


    >> Date: Thu, 14 May 2009 05:41:56 -0700 (PDT)
    >>
    >> That line is always expressed in PDT regardless of source.


    > Which means that nothing of the poster's location can be deciphered from
    > the timestamps.


    Correct. GG timestamps are only good for the time.

    > So we're back to just the NNTP-Posting-Host header. Yet that IP address
    > is just whatever host was seen by the Google server and may not be the
    > physical location of the poster.


    Correct.

    > Considering that ScanSafe provides
    > proxy service to do web filtering


    I'm not crystal clear on exactly what scansafe does. I've read their
    website and I've read what Guy Chapman said. I presume/accept that they
    provide something that results in the effect of a proxy IP.

    > for several customers, those customers
    > could be somewhere else geographically than the data centers operated by
    > ScanSafe, and the users of those customers could be even more
    > geographically diverse.


    That is what I'm thinking/believing/accepting.

    > So we can't tell where is the Google Grouper.


    Well, the original question is somewhat different from that.

    If I (or Judith Smith) were trying to derive/sleuth the persona of Lou Knee,
    I would consider the 'gestalt' -- the total body of information consisting
    of a posting history of 3 posts, 2 of which were made after the persona
    Judith Smith attempting to out the persona as Guy Chapman. So, some
    deception may have been afoot after the JS outing post.

    I would consider what I call the 'handwriting' of Lou Knee, which
    handwriting is also not 'consistent' between the 3 posts, but I also assume
    that LK is being deceptive.

    IMO the deception did not extend to any effort at header modification,
    because GG posting doesn't lend itself to that. The deception efforts were
    to post via 2 different IP routes, 1 looks like a claranet dialup while 2
    were the scansafe IP.

    The useragent was also different between the 3; all were XP, one browser
    was IE8, the other two IE7.

    The business of trying to 'pin' those posts on Guy Chapman would be
    inconclusive, but I don't think that the scansafe route is 'open' -- so not
    very many people in the world are going to be accessing it.

    GC is a windows user. He has posted GG via the scansafe, his chapmancentral
    IP, and via individual net. His usual nntp agent is exactly the same as v
    as JS Forte Agent 5.00/32.1171.

    He has an extensive posting history and a website to judge his handwriting.
    He has posted to GG with a Vista running FF3 and from the scansafe IP.
    Maybe that is work related.

    Given that the nymshift isn't really very important except to JS, I would be
    inclined to let it slide and not try to sleuth it out, except for the
    hobbyist aspect of id sleuthing.


    --
    Mike Easter
    Mike Easter, May 18, 2009
    #10
  11. VanguardLH

    Rob Morley Guest

    On Mon, 18 May 2009 05:09:58 -0500
    VanguardLH <> wrote:

    > Depends on your personal experience. In the newsgroups that I visit
    > and where trolls and nymshifters are truly a problem, they ARE smart
    > enough to know how to alter almost all the headers. There's a few
    > that they are stuck with if they don't operate their own NNTP server
    > and peer it to other NNTP servers.
    >
    > I assumed the nymshifter was smart enough to know about UA strings.
    > You ASSUMED the nymshifter was uneducated on changing their UA string.
    > Those assumptions *do* have significant affect on the hypothesis
    > derived as a cause of those assumptions, so Occam's Razor does not
    > apply.


    Eh? Occam's Razor says that if it appears to be two different posters
    then it /is/ two different posters, i.e. there's no need to engage in
    lengthy discussion of what techniques the nymshifter may have employed
    because there is no nymshifting going on.
    Rob Morley, May 18, 2009
    #11
  12. VanguardLH

    Mike Easter Guest

    Rob Morley wrote:

    > Eh? Occam's Razor says that if it appears to be two different posters
    > then it /is/ two different posters, i.e. there's no need to engage in
    > lengthy discussion of what techniques the nymshifter may have employed
    > because there is no nymshifting going on.


    The (over-)simplest expression of Occam's Razor is "The simplest
    explanation for a phenomenon is most likely the correct explanation."

    The NPH is traditionally a very reliable nntp header, not lending itself to
    easy forgery.

    'Jumping' to the conclusion that two GG headers with the same IP were of the
    same poster nymshifting might be considered 'the simplest explanation' --
    but it makes unwarranted asssumptions.

    In reality, Occam's Razor in English might be expressed " ... the
    explanation of any phenomenon should make as few assumptions as possible,
    eliminating those that make no difference in the observable predictions of
    the explanatory hypothesis or theory."

    Analyzing GG headers can place some attention to lines other than those of
    nntp posting, because the opportunities for nntp client preloading are not
    the same.



    --
    Mike Easter
    Mike Easter, May 18, 2009
    #12
  13. VanguardLH

    VanguardLH Guest

    Mike Easter wrote:

    > Rob Morley wrote:
    >
    >> Eh? Occam's Razor says that if it appears to be two different posters
    >> then it /is/ two different posters, i.e. there's no need to engage in
    >> lengthy discussion of what techniques the nymshifter may have employed
    >> because there is no nymshifting going on.

    >
    > The (over-)simplest expression of Occam's Razor is "The simplest
    > explanation for a phenomenon is most likely the correct explanation."
    >
    > The NPH is traditionally a very reliable nntp header, not lending itself to
    > easy forgery.
    >
    > 'Jumping' to the conclusion that two GG headers with the same IP were of the
    > same poster nymshifting might be considered 'the simplest explanation' --
    > but it makes unwarranted asssumptions.
    >
    > In reality, Occam's Razor in English might be expressed " ... the
    > explanation of any phenomenon should make as few assumptions as possible,
    > eliminating those that make no difference in the observable predictions of
    > the explanatory hypothesis or theory."
    >
    > Analyzing GG headers can place some attention to lines other than those of
    > nntp posting, because the opportunities for nntp client preloading are not
    > the same.


    I took the definition from http://en.wikipedia.org/wiki/Ocam's_razor
    (which is what you cited in your English interpretation). The
    assumption that the nymshifter/troll knows or does not know how to alter
    the UA string does make a difference in the hypothesis (of what web
    browser and/or OS the poster was using).

    I had asked "Where is the OS information specified in those headers in
    the example posts?" That was my focus from that point forward in the
    subthread, not whether the 2 posts were by the same person.

    The poster does not know how to change the UA string.
    The poster does know how to change the UA string.

    Um, so with these being mutually exclusive, and with BOTH being
    assumptions, just how is either one a lesser number of assumptions than
    the other? They're both assumptions. They both count as 1 assumption.
    Neither can be eliminated from the argument. Ocam's Razor does NOT say
    "make a guess as to which assumption is the most often experienced
    case". Since trolls aren't the norm, they aren't the majority of
    posters, and (from what I've seen within this exception of posters)
    those that nymshifter do have more knowledge of headers than common
    posters.
    VanguardLH, May 18, 2009
    #13
  14. In article <gurc59$30v$-september.org>, VanguardLH wrote:
    >
    >Depends on your personal experience. In the newsgroups that I visit and
    >where trolls and nymshifters are truly a problem, they ARE smart enough
    >to know how to alter almost all the headers. There's a few that they
    >are stuck with if they don't operate their own NNTP server and peer it
    >to other NNTP servers.
    >
    >I assumed the nymshifter was smart enough to know about UA strings. You
    >ASSUMED the nymshifter was uneducated on changing their UA string.


    We've got personal experience of her. Either she's not that smart, or
    she's smart enough to consistent to consistently fake not being that
    smart when using the judith persona or the more obvious socks.
    Alan Braggins, May 18, 2009
    #14
  15. On Mon, 18 May 2009 15:31:06 -0500, VanguardLH <> wrote:

    >I took the definition from http://en.wikipedia.org/wiki/Ocam's_razor
    >(which is what you cited in your English interpretation). The
    >assumption that the nymshifter/troll knows or does not know how to alter
    >the UA string does make a difference in the hypothesis (of what web
    >browser and/or OS the poster was using).


    "Do not unnecessarily multiply hypotheses". In this case do not
    introduce hypothetical header-forging when the much more obvious
    explanation - two individuals sharing a widely-used proxy - also
    explains the observed facts. Nobody seems to have advanced an
    explanation as to how I could also have been posting from a ClaraNet
    dialup account.

    Guy
    --
    http://www.chapmancentral.co.uk/urc | http://www.nohelmetlaw.org.uk/

    "To every complex problem there is a solution which is
    simple, neat and wrong" - HL Mencken

    Newsgroup may contain nuts.
    Just zis Guy, you know?, May 18, 2009
    #15
  16. VanguardLH

    Mike Easter Guest

    VanguardLH wrote:
    > Mike Easter wrote:


    >> The (over-)simplest expression of Occam's Razor is "The simplest
    >> explanation for a phenomenon is most likely the correct explanation."


    > I had asked "Where is the OS information specified in those headers in
    > the example posts?" That was my focus from that point forward in the
    > subthread, not whether the 2 posts were by the same person.


    I'm not clear on why you are returning to that question of yours at this
    time.

    > The poster does not know how to change the UA string.
    > The poster does know how to change the UA string.


    Do/Did you (earlier) mean 'where is the OS information specified
    *reliably*'? I assumed that you 'overlooked' where the OS/browser
    information was 'seen' when you asked the question - seen as reliable or
    not -- but I did not engage in 'informing' you where to find the UA
    information, nor did I engage in speculating - aloud, in a post here -
    whether the UA information was likely correct -- except that I did
    'personally' speculate that it was most likely correct rather than bogus --
    in my 'assumption' process. Razorishly.

    > Um, so with these being mutually exclusive, and with BOTH being
    > assumptions, just how is either one a lesser number of assumptions than
    > the other? They're both assumptions. They both count as 1 assumption.
    > Neither can be eliminated from the argument. Ocam's Razor does NOT say
    > "make a guess as to which assumption is the most often experienced
    > case".


    I think the 'parsimonious' nature of Occam's implies that all kinds of
    assumptions are going to be made in the name of efficiency.

    > Since trolls aren't the norm, they aren't the majority of
    > posters, and (from what I've seen within this exception of posters)
    > those that nymshifter do have more knowledge of headers than common
    > posters.


    It isn't clear to me whether you are debating/discussing something with *me*
    or with something that Rob Morley said to *you*.



    --
    Mike Easter
    Mike Easter, May 18, 2009
    #16
  17. VanguardLH

    Mike Easter Guest

    Just zis Guy, you know? wrote:

    > "Do not unnecessarily multiply hypotheses". In this case do not
    > introduce hypothetical header-forging when the much more obvious
    > explanation - two individuals sharing a widely-used proxy - also
    > explains the observed facts. Nobody seems to have advanced an
    > explanation as to how I could also have been posting from a ClaraNet
    > dialup account.


    I don't think Occam's holds the high ground here.

    From a 'legal' point of view, there is not sufficient evidence to be
    convincing beyond the shadow of a doubt -- that JS's implied allegation that
    LK is GC -- is true.

    However, from another perspective, it seems to me that the odds that some
    unknown stranger to urc with no posting history would pop into urc with you
    and the others and post from the same 'proxy' as yours is less than the odds
    that --- you might engage in a nymshift for tossing a trivial barb unlike
    your usual nature/self -- and that you might consider/presume or even
    overestimate the commonality or 'wide usage' of the scansafe IP which you
    use infrequently compared to your NIN/Forte posts.

    And further that you might underestimate JS's propensity to try to tie a
    (likely) nymshifted post to you.

    I think the odds are that the LK posts are nymshift. I think the odds are
    greater that they were posted by you than someone else urc who hasn't yet
    been accused. I don't think it is a 'bad' thing if you did and I think that
    JS is being 'overwrought' about it - in demanding an answer and making a
    case of it in urc and 24hshd as well.

    I'm sure that it must be trivial to be able to post from a claranet IP, but
    I'm not familiar with UK carriers. I have no idea how many different kinds
    of windows machines and browsers, XP, Vista, IE7, IE8, Tbird, you can put
    your hands on. I could certainly easily post from a lot of different OSes
    and browsers and IP sources and not have to forge any UA.



    --
    Mike Easter
    Mike Easter, May 18, 2009
    #17
  18. VanguardLH

    VanguardLH Guest

    Just zis Guy, you know? wrote:

    > On Mon, 18 May 2009 15:31:06 -0500, VanguardLH <> wrote:
    >
    >>I took the definition from http://en.wikipedia.org/wiki/Ocam's_razor
    >>(which is what you cited in your English interpretation). The
    >>assumption that the nymshifter/troll knows or does not know how to alter
    >>the UA string does make a difference in the hypothesis (of what web
    >>browser and/or OS the poster was using).

    >
    > "Do not unnecessarily multiply hypotheses". In this case do not
    > introduce hypothetical header-forging when the much more obvious
    > explanation - two individuals sharing a widely-used proxy - also
    > explains the observed facts. Nobody seems to have advanced an
    > explanation as to how I could also have been posting from a ClaraNet
    > dialup account.
    >
    > Guy


    Hmm, apparently you don't want to address my hypothesis that the UA
    string might've been forged. You're stuck on the "must've been from 2
    posters". Okay. So far, you have not proved that the UA string was
    forged -- and you can't.
    VanguardLH, May 18, 2009
    #18
  19. On Mon, 18 May 2009 14:20:45 -0700, "Mike Easter" <>
    wrote:

    >However, from another perspective, it seems to me that the odds that some
    >unknown stranger to urc with no posting history would pop into urc with you
    >and the others and post from the same 'proxy' as yours is less than the odds
    >that --- you might engage in a nymshift for tossing a trivial barb unlike
    >your usual nature/self -- and that you might consider/presume or even
    >overestimate the commonality or 'wide usage' of the scansafe IP which you
    >use infrequently compared to your NIN/Forte posts.


    Or it's a work colleague, or someone else.

    >And further that you might underestimate JS's propensity to try to tie a
    >(likely) nymshifted post to you.


    No, I am in no doubt as to her absolute determination to pursue
    everything to the bitterest end and beyond. I posted a link to a
    report a while back, she spent ages trolling (probably is trolling
    still) about some fantastic hypothesis involving a conspiracy of some
    sort, when all that actually happened was that she left a space in
    when she reassembled a wrapped link. She is as mad as a badger and
    utterly obsessed with scoring points over me, I don't think I'd want
    to risk something like that. If I wanted to nym-shift then I'd post
    from another country using a remote session to one of the servers I
    manage around the world. If I could even be bothered to go to such
    lengths to take pot-shots at the deranged "nuxx bar" and risk yet
    another spate of abusive phone calls.

    >I think the odds are that the LK posts are nymshift. I think the odds are
    >greater that they were posted by you than someone else urc who hasn't yet
    >been accused. I don't think it is a 'bad' thing if you did and I think that
    >JS is being 'overwrought' about it - in demanding an answer and making a
    >case of it in urc and 24hshd as well.


    You're missing a point: at least one comes from a completely different
    netblock belonging to an ISP with whom I have no connection
    whatsoever.

    This group has three long-standing and malignant trolls all of whom
    have made extensive use of nym shifting, and at least one of whom has
    also used header forgery in the past. They are "nuxx bar", "nully"
    (who has nym-shifted twice today already) and "judith". I post using
    my own identity rather than hiding behind a computer.

    Guy
    --
    http://www.chapmancentral.co.uk/urc | http://www.nohelmetlaw.org.uk/

    "To every complex problem there is a solution which is
    simple, neat and wrong" - HL Mencken

    Newsgroup may contain nuts.
    Just zis Guy, you know?, May 18, 2009
    #19
  20. VanguardLH

    Mara Guest

    On Mon, 18 May 2009 22:00:48 +0100, "Just zis Guy, you know?"
    <> wrote:

    >On Mon, 18 May 2009 15:31:06 -0500, VanguardLH <> wrote:
    >
    >>I took the definition from http://en.wikipedia.org/wiki/Ocam's_razor
    >>(which is what you cited in your English interpretation). The
    >>assumption that the nymshifter/troll knows or does not know how to alter
    >>the UA string does make a difference in the hypothesis (of what web
    >>browser and/or OS the poster was using).

    >
    >"Do not unnecessarily multiply hypotheses". In this case do not
    >introduce hypothetical header-forging when the much more obvious
    >explanation - two individuals sharing a widely-used proxy - also
    >explains the observed facts. Nobody seems to have advanced an
    >explanation as to how I could also have been posting from a ClaraNet
    >dialup account.
    >
    >Guy


    Voodoo. I thought everyone knew that.

    <waving at you from the SDM>

    --
    <rw-rw-rw-> I don't care if it can reproduce sound well enough for
    dolphins to talk to each other through it, if you can't grep it it's
    evil.
    Mara, May 18, 2009
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Beauregard T. Shagnasty

    Re: Name-Shifting ?

    Beauregard T. Shagnasty, May 17, 2009, in forum: Computer Support
    Replies:
    48
    Views:
    1,332
    Evan Platt
    May 28, 2009
  2. Paul - xxx

    Re: Name-Shifting ?

    Paul - xxx, May 17, 2009, in forum: Computer Support
    Replies:
    3
    Views:
    415
  3. a6dg6j3vcc45

    Re: Name-Shifting ?

    a6dg6j3vcc45, May 18, 2009, in forum: Computer Support
    Replies:
    3
    Views:
    499
    Just zis Guy, you know?
    May 18, 2009
  4. al Mossah

    Re: Name-Shifting ?

    al Mossah, May 20, 2009, in forum: Computer Support
    Replies:
    2
    Views:
    455
    Just zis Guy, you know?
    May 20, 2009
  5. Jim Newman

    Re: Name-Shifting ?

    Jim Newman, May 23, 2009, in forum: Computer Support
    Replies:
    11
    Views:
    604
    Mike Easter
    Jun 19, 2009
Loading...

Share This Page