Charcoal HQ

6:12 AM

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, link at end of body, pattern-matching website in body, repeated URL at end of long post: Beard Czar Unbelievable facial hair organization free trial by Marreird38 on workplace.stackexchange.com

tpu- by angussidney

[ SmokeDetector | MS ] Bad keyword in body, pattern-matching website in body: From the best means, you don’t by janibani6 on stackoverflow.com (@dorukayhan)

tpu- by angussidney

[ SmokeDetector | MS ] Link at end of body, pattern-matching website in body, repeated URL at end of long post: when you need to treat your hair to turn by Ingther1972 on workplace.stackexchange.com

tpu- by angussidney

6:34 AM

[ SmokeDetector | MS ] Phone number detected in title: 8005929878 plenty of fish search not working by user69923 on drupal.stackexchange.com

[ SmokeDetector | MS ] Link at end of body, pattern-matching website in body: Follinique Growth Treatment Trial by follinique on workplace.stackexchange.com

[ SmokeDetector | MS ] Shortened URL in body: Clipping Path, Remove Background Service by Farhad Nur on photo.stackexchange.com

tpu- by angussidney on Follinique Growth Treatment Trial

tpu- by angussidney

@SmokeDetector wtf?

6:52 AM

tpu- by Wrzlprmft on 8005929878 plenty of fish search not working

7:12 AM

[ SmokeDetector | MS ] Offensive answer detected: What happened to the last of the sins in Se7en? by Gab on movies.stackexchange.com

fp- by Ashish Ahuja

[ SmokeDetector | MS ] Bad keyword in title, link at end of body, link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Iron Bull Edge Male Enhancement by user668465 on superuser.com

tpu- by Ashish Ahuja

[ SmokeDetector | MS ] Bad keyword in link text in answer, bad keyword with a link in answer, link at end of answer: How do I save my lenses of my spectacles from scratches by Panama Shaikh on lifehacks.stackexchange.com

tpu- by angussidney

[ SmokeDetector | MS ] Link at end of body, pattern-matching website in body: Yes, cianix has now been acquainted recently by Threpar1944 on workplace.stackexchange.com

[ SmokeDetector | MS ] Link at end of answer: Page template not displaying by Jane Yates on wordpress.stackexchange.com

[ SmokeDetector | MS ] Link at end of answer: Page editor missing Templates drop down by Jane Yates on wordpress.stackexchange.com

7:49 AM

[ SmokeDetector | MS ] Bad keyword with email in answer: redirect from example.com/forum to example.ir/forum by jameshaspy780 on stackoverflow.com (@dorukayhan)

@SmokeDetector k

8:51 AM

[ SmokeDetector | MS ] Offensive body detected, offensive title detected: What is the meaning of "be fucked up about something" by hooshmand on english.stackexchange.com

9:01 AM

fp- by DavidPostill

9:27 AM

API quota rolled over with 4563 requests remaining. Current quota: 9999.

stackoverflow: 729
askubuntu: 439
superuser: 317
math: 163
unix: 162
gaming: 151
english: 141
electronics: 119
drupal: 111
mathoverflow.net: 101
ell: 100
travel: 92
security: 85
mathematica: 75
movies: 68
physics: 67
apple: 67
meta: 64
academia: 63
stats: 60
wordpress: 58
tex: 58
es.stackoverflow: 57
gis: 57
android: 56
dba: 54
chemistry: 52
scifi: 52
ru.stackoverflow: 51
arduino: 47
worldbuilding: 47
cs: 46
diy: 46
magento: 44
gamedev: 43
webapps: 41
salesforce: 41
codereview: 38
softwareengineering: 38

9:55 AM

[ SmokeDetector | MS ] Blacklisted website in body, repeated URL at end of long post: supplement named as HL12 supplements by ghfgh65 on apple.stackexchange.com

tpu- by Jan Dvorak

[ SmokeDetector | MS ] Link at end of body, pattern-matching website in body: The fixings in it substances Cianix by Moself5 on workplace.stackexchange.com

tpu- by Glorfindel

Do we have a command to blacklist words?

Not that I know of.

It's less frequent that blacklisting websites, so that might be why you need to do it manually.

[ SmokeDetector | MS ] Repeating characters in answer: How to use "sich" by nnnnnnnnnnnnnnnnnnnnn on german.stackexchange.com (@Wrzlprmft)

10:10 AM

@JanDvorak I was planning to make one today but.... that didn't happen. See the issue on GH here: github.com/Charcoal-SE/SmokeDetector/issues/305

This might be a good way (other than the thousands we already have) to catch the health product spam

tpu- by Jan Dvorak

Just tell me the keyword and I can blacklist it manually

Let me check. The last one is... Cianix

Not really worth the effort right now, but once there is an effortless way we might as well use it

While we are at it, does anyone know why diagra is blacklisted? I can understand blacklisting viagra ...

10:14 AM

TIL

I mean... I didn't know it was blacklisted

@DavidPostill I wonder who thought that was a good idea.... only about 1/3 of hits are TPs

CI on c40baef succeeded. Message contains 'autopull', pulling...

I might revert it while I'm at it

[ SmokeDetector ] SmokeDetector started at rev c40baef (angussidney: +Cianix --autopull) (running on ArtOfCode/EC2)

I've seen a few FPs recently for it ...

10:16 AM

Restart: API quota is 9809.

metasmoke.erwaysoftware.com/…

[ SmokeDetector | MS ] Pattern-matching website in body: intelleral Review - What is intelleral? by Marn1984 on workplace.stackexchange.com

What's the meaning of that second last keyword in the blacklist?

tpu- by Jan Dvorak

@JanDvorak The Beard czar?

10:19 AM

No, booty pop

@JanDvorak It's some cream for your bum "Booty Pop is a new skin cream made by the team at Apex Vitality."

@JanDvorak booty is another name for your backside.... but why the spammers stuck pop onto the end of it I have no idea. It catches spam, that's all that matters

"You can get a round, perky, big butt in as little as 2 weeks with this revolutionary topical cream. Increase your butt size and confidence with Booty Pop!"

Maybe it really opens your behind ... but then again the cure might be worse than the disease

I would be surprised if any of these pills/creams actually did anything apart from empty your wallet.

10:24 AM

They could empty your stomach

@DavidPostill can you give me a link to the last post with diagra? I cant seem to find the keyword anywhere in the code, may help if I can see the why info on MS

@angussidney I'll have to let you know when I see it again ... of course I could be misremebering - it happens at my age ... ;)

Of course, I could just not be looking hard enough ;)

[ SmokeDetector | MS ] Bad keyword in body, link at end of body, pattern-matching website in body, repeated URL at end of long post: Penetrex : 100% Free Trial No Side Effects! by kelvinbroxton on askubuntu.com (@ThomasWard)

tpu- by Jan Dvorak

Nov 15 at 1:09, by ArtOfCode

sd why

@angussidney Start here for clues

10:29 AM

ooh, a multicache

11:00 AM

Backoff received of 10 seconds on request to questions/132184;132174?site=mathematica at 11:00:11 UTC

11:18 AM

[ SmokeDetector | MS ] Pattern-matching website in body: intelleral Reviews | Advanced Brain Formula or Scam? by Acque1971 on workplace.stackexchange.com

tpu- by DavidPostill

^ keyword to blacklist

12:10 PM

[ SmokeDetector | MS ] URL in title, pattern-matching website in body, pattern-matching website in title: supplementranking.com/profit-maximizer/ by umondzui on apple.stackexchange.com

tpu- by Glorfindel

[ SmokeDetector | MS ] Offensive title detected: Rsa Solver. Fuck off bitches by Thomas N on crypto.stackexchange.com

tpu- by Jan Dvorak

12:37 PM

[ SmokeDetector | MS ] Bad keyword in body, link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Some other not unusual hassle that i have found by Nisha Khan on graphicdesign.stackexchange.com

tpu- by DavidPostill

@SmokeDetector More close votes needed

That's not worth closing

@JanDvorak It's gone now.

[ SmokeDetector | MS ] Manually reported question: captain america civil war (2016) Movie Hd Download English Hindi Dubbed by user7127860 on meta.stackexchange.com (@dorukayhan)

tpu- by Jan Dvorak

1:02 PM

[ SmokeDetector | MS ] Offensive body detected, offensive title detected, blacklisted user: Rsa Solver. Fuck off bitches by Thomas N on crypto.stackexchange.com

tpu- by Ferrybig

1:14 PM

[ SmokeDetector | MS ] Few unique characters in body: Whats the best mongo or sql by johnpolqkov on stackoverflow.com (@dorukayhan)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad keyword in username, link at end of body, pattern-matching website in body, repeated URL at end of long post: This supplement has safely cianix reviews by cianix reviews on workplace.stackexchange.com

@SmokeDetector vandalism

tpu- by DavidPostill

[ SmokeDetector | MS ] Manually reported answer: How big can the input to Pythons input() function be? by lara137 on stackoverflow.com (@dorukayhan)

[ SmokeDetector | MS ] Blacklisted user: Eclipse crash with error JVM terminated. Exit code=11 by lara137 on stackoverflow.com (@dorukayhan)

[ SmokeDetector | MS ] Blacklisted user: How big an RSA key is considered secure today? by Thomas N on crypto.stackexchange.com

[ SmokeDetector | MS ] Blacklisted user: Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid by Thomas N on crypto.stackexchange.com

tpu- by DavidPostill on How big an RSA key is considered secure today?

tpu- by DavidPostill

2:17 PM

[ SmokeDetector | MS ] Link at end of answer: How to "manipulate" google bot to use dynamic content loading? by Edi on stackoverflow.com (@dorukayhan)

[ SmokeDetector | MS ] Bad keyword in body: FULL FACTORIAL EXPERIMENTAL DESIGN by Bobo on stats.stackexchange.com

fp- by Kyll

@SmokeDetector k

[ SmokeDetector | MS ] Bad keyword with email in answer: How to access all files in folder in google drive using url of one file by user7216425 on stackoverflow.com (@dorukayhan)

2:37 PM

[ SmokeDetector | MS ] Few unique characters in answer, offensive answer detected: Add a JFreeChart in to JPanel by Patrick on stackoverflow.com (@dorukayhan)

tpu- by Kyll

3:16 PM

Backoff received of 10 seconds on request to questions/745;132209?site=mathematica at 15:16:42 UTC

[ SmokeDetector | MS ] Offensive answer detected: Fontsize is too small by reza on mathematica.stackexchange.com

DJMcMayhem

@SmokeDetector k

4:16 PM

Restart: API quota is 8270.

tpu- by DavidPostill

hichris123

@SmokeDetector fp-

Conflicting feedback on How to Parse html and javascript using Jsoup to android.

hichris123

It's just a terrible programming question.

@SmokeDetector Seems to be false positive to me

4:39 PM

[ SmokeDetector | MS ] Bad keyword with email in body: Idea pitching and calling for making a team for app idea development by Maxyo Lee on ux.stackexchange.com

dorukayhan

@SmokeDetector why

@dorukayhan Post - Keyword interests with email mmaaxxyyoo@outlook.com

dorukayhan

i believe that's just a tagline

Nick Volynkin

4:54 PM

@dorukayhan the whole post looks like a self-promotion

and it should be in the user's CV, not in the question

[ SmokeDetector | MS ] Manually reported question: how to reset samsung galaxy s7 by mobiles6 on stackoverflow.com (@dorukayhan)

M.A.R.

@SmokeDetector k

Sometimes I wonder what happens when a spammer not nuked posts after a couple of hours.

Did they go to sleep?

Let me suggest a "mod-report" command/script that logs a spam post in MS but doesn't report it anywhere.

!!/report scifi.stackexchange.com/a/145983/31394

[ SmokeDetector | MS ] Manually reported answer: Was tiny guy role in Captain America also played by Chris Evans? by mahresult on scifi.stackexchange.com

5:08 PM

Have any other sites been seeing an unusual amount of spam/nonsense posts today?

[ SmokeDetector | MS ] Bad keyword in body, link at end of body, link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Retaining your recognition and reminiscence in senior by Nisha Khan on drupal.stackexchange.com

tpu- by Yvette

@SmokeDetector k

@SmokeDetector k

@SmokeDetector k

@SmokeDetector k

5:13 PM

why is everyone king that post?

@SmokeDetector k

Yvette Colomb

alright that's enough ks on that post, I'm going to bed.

Good night!

night ;)

k

5:18 PM

chat.stackexchange.com/…

5:41 PM

[ SmokeDetector | MS ] Few unique characters in body: Variance of time series expression by sonoro on math.stackexchange.com

@SmokeDetector vandalism

5:53 PM

@andy If you have time, could you run a check on your comments database to see how many comments match "^Thanks [a-zA-Z]*, appreciated\.?$" pattern, I just flagged a few on SO that I found

@Ferrybig at most 118: data.stackexchange.com/stackoverflow/query/585085

I'm not sure if I can do a regex search on SEDE.

Andy's database might contain comments which he (or others) already deleted, though.

6:19 PM

[ SmokeDetector | MS ] Manually reported answer: Link between the Brun-Titchmarsh inequality and $L_q(1,\\chi)$ for small $\\chi$ by modikinews on mathoverflow.net

tpu- by Glorfindel

Q: Dealing with a troll that's flooding the site with plagiarized answers

6:50 PM

[ SmokeDetector | MS ] Bad keyword in answer: Can I upgrade to Windows 10 with BitLocker Enabled? by ammara on superuser.com

bwDraco

Marlin Woods is no longer a mystery:

32

Over the last several days, we've been seeing a novel trolling attack on Super User: a flood of answers containing plagiarized content posted by a user called "Marlin Woods": The user creates a new account for every post; however, the same Gravatar appears on each post so it's apparent that it...

> New posts with this username are now almost universally spam

How the heck has this spam answer lasted 11 hours with a score of only -4?

Even after being caught by Smokey.

Does Lifehacks not have mods? Do CHQ people not have Lifehacks accounts?

naa- by rene

7:07 PM

@bwDraco yeah, we noticed that about a week ago. Still, his/her posts are easily detected so I'm not worried in the least.

7:20 PM

@Randal'Thor Sunday is a quiet time for spammers, so for us as well. Besides, most of us don't look two pages up the transcript for posts which still aren't gone.

@Glorfindel This Sunday has been unusually busy for spammers, at least on my site.

MS has only one hit. So either you're a really lucky bastard, or there's been a lot of spam which Smokey didn't catch. In the latter case, we'd be really interested in the contents of those posts.

@Glorfindel Well, there were a couple of nonsense gibberish posts (not literally spam by SE's definition), and then an abusive post just now. I can post links and contents if you guys are interested in that stuff too.

SmokeDetector catches a lot of gibberish posts as well. It never hurts having more information to improve its filters.

@Randal'Thor I do. But that was posted while I was offline. I usually check the last half-dozen or so, but no further back.

7:34 PM

@Glorfindel OK, two gibberish answers to this question (posted by two different users, but both with the same email address and gravatar):

And then an abusive answer here:

> it doesnt matter u f.uckin nerds LMAO.

> XD

(Probably not caught by Smokey because of the dot in the middle of "fuck"?)

!!/report scifi.stackexchange.com/a/145996/31394

[ SmokeDetector | MS ] Manually reported answer: Is Hagrid mentally unstable? by Hagreg fan on scifi.stackexchange.com

Wow.

Five answers in one day flagged as spam or offensive?

I haven't seen that many for weeks!

@Randal'Thor correct. And Smokey detects most gibberish of the form asdfasdfasdfasdfasdf but not the colorless green ideas sleep furiously variety.

@Randal'Thor Again, lucky bastard. You should ask the Drupal moderators...

@Glorfindel Colourless and green? Flagged for contradiction!

O.o I just discovered that the production log on my webserver has got to 54 MB

That's 54 MB of text.

7:43 PM

@Randal'Thor Is that a special mod flag I don't know about o.O

bwDraco

Probably some sort of Markov chain algorithm these bots use.

Perhaps we should start considering the "word" "u" abusive

@JanDvorak I suspect there'd be a lot of false positives: scifi.stackexchange.com/search?q=u

With spaces around?

7:58 PM

@JanDvorak Better not, there is a Wii U console ;p

darn :-D

Lowercase U?

"u shaped"?

Things like "the letter u" probably come up a fair bit on language sites.

The symbol 'U' is the chemical symbol for uranium.

In the context of Newtonian mechanics 'U' is the symbol for the potential energy of a system.

'u' is the symbol for the atomic mass unit and 'U' is the symbol for one Enzyme unit.

I want an NLP :-(

U is also a Burmese title of respect for men, equivalent to Mr

8:01 PM

[ SmokeDetector | MS ] Pattern-matching website in answer: Bayesian network for classification using PyMc or PyMc3 by arsenyinfo on datascience.stackexchange.com

'U' is the Dutch formal version of 'you'.

@DavidPostill well, that can't be confusing :-D

@Glorfindel citation needed

@Glorfindel Oh. How did I forget that one (having lived in NL for nearly 10 years) :/

@JanDvorak klik hier

I'm trying to teach my little nephews the importance of 'U'.

I don't want to live in Netherlands anymore :-D

8:03 PM

@JanDvorak Why not? (IMHO it's better that the UK where I'm now stuck)

@DavidPostill "You dunghead!" "That's U Dunghead to you."

Ehm ... back to business, Smokey's last post. What is happening here: metasmoke.erwaysoftware.com/…

@DavidPostill It could get really confusing because U is disrespectful in English

It's the only hit for healthyalgorithms.com, and somebody is really persistent in posting it.

@Glorfindel Worth mod-flag?

8:08 PM

Sorry, I'm reading MS the wrong way. It's the same post, reported three times. I suppose we need to un-blacklist healthyalgorithms.com - it looks like an fp- to me.

fp- by Glorfindel

... oh

Oh, and the Netherlands is not that bad. The music, the kitchen and the local speed limits are, but you can easily avoid or ignore them.

Dana Winner is from Netherlands, so that's at least someone to listen to

@JanDvorak nope, she's from Belgium.

8:13 PM

And Caro Emerald

oh

@DavidPostill that's right. She sings in English, so she's good.

I meant Dutch music as in 'music with Dutch lyrics'.

@Glorfindel Ah. Won't argue with that.

8:40 PM

[ SmokeDetector | MS ] Link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Disregarding the way that asks abou by sandmax11 on graphicdesign.stackexchange.com

tpu- by DavidPostill

8:53 PM

[ SmokeDetector | MS ] Email in answer: Asteroid as a generation ship by bob malcomb on worldbuilding.stackexchange.com

@angussidney FYI, I think we've figured out the permissions stuff. Okay to send creds to the email I used before?

CI on 8bcd950 failed.

> continuation line under-indented for hanging indent

Never send a password through email unless it's a temporary one

this sounds like the most pedantic error ever.

@JanDvorak Have any better ideas?

8:57 PM

A recovery password/code is fine if you force the user to change it afterwards

@Undo github.com/Charcoal-SE/SmokeDetector/commit/…

@JanDvorak meh

In theory, sure, it's insecure

In practice, meh, the likelihood is small enough that it's okay

In reality, the Real Harm potential is fairly low

as long as you're not doing it all the time

Even if someone tried to hijack the account, I'm probably going to just ping Shog or someone and get it restored to my control.

Fine then

8:59 PM

But yeah, valid concern

pretty sure we operate just about everything we do on a "secure enough" principle

like, for example, Smokey - the remote-code-execution-as-a-feature - running right along parallel to my kinda important server :)

CI on b83ffc3 succeeded. Message contains 'autopull', pulling...

[ SmokeDetector ] SmokeDetector started at rev b83ffc3 (Undo1: Fix under-indented hanging indent --autopull) (running on ArtOfCode/EC2)

@ArtOfCode yeah, I still don't like the principle of that

also, need to get that Pi fixed.

Restart: API quota is 6879.

You said you could spare the server?

9:00 PM

Better to be on my cheap hardware that's at least kinda protected.

@Undo well it is protected - it's on EC2, behind a good firewall, and running on another, non-root account. But you could probably still do something.

@ArtOfCode Oh, having it on another account helps a lot

@JanDvorak the web server? If it comes to it, I can nuke the server from orbit and be back online within 10 minutes, yeah. I'd just... rather not have to.

Would it be possible to give Chat Exchange a chat token instead of the real credentials? It would mean we have to login every time it has been offline for a while, but it prevents the credentials from leaking out (unless someone makes a fake shell in smokey...)

You've gotta give something the real credentials, somewhere in our code. Chat doesn't support token authentication, so any token auth we do would be on our side, which means you have to give it the creds at some point.

9:14 PM

What if we break smokey up into 2 parts, the startup code, and the detection code. The startup code is under a strict policy of code reviews and runs under user account 1, and the detection code gets called by code 1 after a (change user / sudo -u <user> / chroot) + wiping of passwords, but has more allowed contributers

In theory, yeah

there might be some other way to do it

Maybe make smokey use metasmoke to send chat messages, that moves the token to the somewhat more protected environment, and include "legacy" support to smokey in the terms of also being able to use the direct chat method (as opposed to metasmoke chat relay)

That makes us very reliant on metasmoke, which is a more specialized tool that in reality only two of us have the knowledge to run.

yeah, that'd be unadvisable.

(Not picking holes, but devil's advocate is important if we're gonna do something this big)

9:23 PM

What about a python sandbox (if they exists) to separate 2 main parts of the program? (I'm just trying to throw some ideas around that could help us toward the final solution)

fp- by DavidPostill

sd fpu-

@Ferrybig [:33770745] That message is not a report.

@SmokeDetector fpu-

Really, the only way to do token authentication is to have one program/server/etc that manages sending stuff to chat and issuing/validating tokens, and then one program that does the scanning.

Which is mostly the same as what Ferry said.

But, then the token server would have to be run by someone who has the actual credentials.

9:27 PM

copy/paste from a browser window?

Either we write a whole new Python service for that, which is fragile and unstable, or we use metasmoke, which not as many people can host.

@JanDvorak copy/paste what, though?

The auth token

And the token server should automatically reconnect if the websocket connection gets lost, and not stay disconnected like what sometimes happens with smokey

@JanDvorak Chat doesn't support token auth

@Ferrybig that would be down to the client, actually

I mean the fkey

9:29 PM

@ArtOfCode I only have to login at openid.stackexchange.com once, and then I can join as many chats as I want, with no time limit

@JanDvorak to post, that would work, but to read from a chat websocket you need to do websocket auth, which requires details you can only get through login

I guess you don't want to poll the transcript

[ SmokeDetector | MS ] Bad keyword with email in body: to verify an email address sent to me by james mcninch on ux.stackexchange.com

If I look at my cookies, I see SE has a cookie called acct(.stackexchange.com) and sechatusr(chat.stackexchange.com), both expiring in a year, so those are probably used for the remember me feature of normal login

[ SmokeDetector | MS ] Link at end of answer: Cheapest way to travel inside Europe by Darby on travel.stackexchange.com

[ SmokeDetector | MS ] Bad keyword with email in answer: Integrate kayako and tfs by Bluepen Software on stackoverflow.com (@dorukayhan)

tpu- by Ferrybig

9:40 PM

@JanDvorak we'd rather not, if we can have websockets

fp- by DavidPostill on to verify an email address sent to me

naa- by DavidPostill on Cheapest way to travel inside Europe

10:41 PM

[ SmokeDetector | MS ] Link at end of body, link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Absorption framework and blasting calories by sandmax11 on drupal.stackexchange.com

tpu- by Jan Dvorak

11:16 PM

[ SmokeDetector | MS ] Bad keyword with email in answer: Why do I need to hide my phone's IMEI by Jennifer Grant on security.stackexchange.com

tpu- by Jan Dvorak

[ SmokeDetector | MS ] Offensive answer detected: How can I determine the color of my magic? by Cunt face on worldbuilding.stackexchange.com

tpu- by Jan Dvorak