Made out of people

Hunting Yenc: Tracing the Great Usenet Bump (Part IV)

Back in the first post, we found a large bump in Usenet traffic. On the second day, we showed that the bump was not due to an obvious flaw in our system--at least, it wasn't due to the same flaws we've run into before. On the third day, we traced the bump to alt.binaries, and from there found that it spread itself across a lot of groups. alt.binaries.dvd seemed to most dramatically have it.

Let's continue by tracing through and seeing individual authors.

I took a closer look at alt.binaries.dvd. The most frequent poster on alt.binaries.dvd is some guy calling himself yenc. yenc@power-post.org. Indeed, he has a great many names:

	yenc@power-post.org (Yenc-PP-A&A) 
	yenc@power-post.org (anonymous@anonymous.com)
        "Builder" <Yenc@power-post.org>
        "daathal" <Yenc@power-post.org>
        "Dognorah" <Yenc@power-post.org>

and oodles of others …

Here's a daily count of yenc's posts.

A quick web search points out that yenc@power-post.org isn't just one person. yenc is the default name generated by Power-Post software for yEncoding. Which means that what we're seeing here is a whole lot of people, posting at software defaults.

(yEncoding? That's the sequel to UUEncoding, and is another way of breaking up binaries and posting them to newsgroups.)

Now take a quick look at that peak there. That's 300,000 daily messages[1], pretty close to the size of the spike we're trying to account for.

So what did this Yenc have to say?

One person hypothesized that this was a spike generated by a movie release -- maybe this is a few thousand copies of Return of the King? Another suggested that this was a surge of some more-illicit material.

Here's a random selection of post titles from 2004 posted by yenc@power-post.org (Yenc-PP-A&A)

        ManxTT2002- "manxTT2002.part005.rar" yEnc (142/161)
	#alt.binaries.cd.image.xbox @ efnet + 28484 [09/32] - "ins-fn2k4x.r05" yEnc (094/201)
	(DERWI) [Twins] - "twins.part083.rar" yEnc FTD: 195277 (195/201)
	isleofmanTTextras1.- "isleofmanTTextras.part092.rar" yEnc (025/161)
	isleofmanTTextras1.- "isleofmanTTextras.part102.rar" yEnc (081/122)
	#alt.binaries.svcd@Efnet #5317 Garfield "vcd-garfieldts1.r16" yEnc (25/36)
	(www.abstartrek.org) 04 of 32 - "TOS - 101 - The Man Trap.part04.rar" yEnc (14/24)
	(199013) Mooimakertje.part05.rar (17/27)
	isleofmanTTextras1.- "isleofmanTTextras.part076.rar" yEnc (027/161)
	(DERWI) [Twins] - "twins.part082.rar" yEnc FTD: 195277 (051/201)
	Karperfilmpjes "CarpseX aflevering 05.wmv" By VanManiac (007/390)
	(DERWI) [verzoek repost ANNE] - "anne.part123.rar" yEnc FTD: 205123 (130/201)
	§ #alt.binaries.svcd@Efnet \/ Spiderman 2 TS CD1 \/ #5422 "vcd-spiderman2ts1.vol165+40.PAR2" § (01/54)
	(R.S.V.P. #208020) [06/94] - "rs0932.part05.rar" yEnc (051/201)
	Hajni from mikesapartment.com | The hottest women I have ever seen! [03/25] - "hajni-03.mpg" yEnc (08/19)
	§ #alt.binaries.svcd@Efnet \/ \/ #5394 "vcd-garfieldts1.r22" § (33/40)
	Karperfilmpjes "HollandseKarpersessies- 01-Pannekoek.wmv" By VanManiac (128/342)

I can send you a larger set if you want, but this is pretty much representative. It's … stuff. Games and movies and songs and pirated Dutch films and all the other things that look like the binary Usenet today.

Which tells me that it isn't content that's driving this spike. This is not a sudden surge of interest in anything in particular. Nor is it a particular person: I'm pretty sure that no individual is rolling out 300K messages per day. Yenc-PP-A&A is, I'm pretty sure, another aggregated alias.

So what is it? We need to explain two things. The up curve, or why binary posting took off like mad in early 2004, and the down curve, or why binary posting suddenly started to drop, out through October 2004.

A few notes:
· As far as I can tell, the YENC release notes suggest that no new versions of power post have come out since mid-2003. So it's probably not the excitement over a new software version.
· BitTorrent downloads have been rising steadily, but don't seem to have the sort of spike that would explain the drop…

Any other clever ideas?

--

1. Ok, full confession: looking back at the table, I'm no longer quite so sure what query our data guy used to get me this table. I need to double check my figures: I quietly suspect that this is weekly, not daily messages. I also quietly suspect that it's just Yenc-PP-A&A and not any of the other Yenc identities.

January 23, 2005 07:17 PM | TrackBack | in Data and Documents