« first day (914 days earlier)      last day (1299 days later) » 

4:00 PM
sd fp-
 
@AshishAhujaツ Too much character entropy?
It's not just two or three unique chars.
 
@PhMgBr Maybe
 
@AshishAhujaツ Are you sure it didn't? That was Feb 16.
 
Let me check on metasmoke.
 
Can't find anything for it by URL
 
4:04 PM
@ArtOfCode No. sd didn't report it metasmoke.erwaysoftware.com/…
 
fair enough
 
@ArtOfCode Do you think it should have been detected?
 
I think it would be detected
 
Ideally, yes. Clearly our current criteria don't get it
 
it's hard to get everything on SO.
I suspect we never saw it
 
4:06 PM
!!/test aaaa bbbb sgvfb fdbdfbgddfgbvdf dfgbdfg fsg
 
> Would not be caught for title, body, and username.
 
!!/test aaaa bbbb sgvfb fdbdfbgddfgbvdf dfgbdfg fsg
 
> Would not be caught for title, body, and username.
 
Nope, just wouldn't get caught
 
4:06 PM
too many unique characters
 
a whole 7
 
Hmm
I see
 
OMFG
 
We could probably increase that threshold a little
Any legit post is going to have more than 7 uniques
 
What's the current threshold?
 
4:07 PM
shrug
 
[ SmokeDetector ] Bad keyword with email in answer, email in answer: Wifi hack and computer hack? by nicole kniffen on security.stackexchange.com
 
Shrug is six.
 
sd k
@Ferrybig thanks
 
I always keep a tab open just for these quick lookups
 
4:08 PM
@ArtOfCode Dunno. "Try trimming it"
 
I probably know to much of smokey's source than is healty to me
 
@Undo crap answer, though
 
sure, but not necessarily deletable
 
@Ferrybig See I know very little of the source beyond the blacklisted and pattern websites, and the privilege lists.
Metasmoke, on the other hand...
@Undo I'd probably convert to comment.
But the majority of posts are going to have more
 
I've been cleaning up smokey for the last little while
 
4:10 PM
Heh. Good luck with that.
 
I should have a PR coming tomorrow (it's 2am now)
 
@Quill like as in comments and such? Yay!
 
Didn't we think about moving all the blacklist config stuff to metasmoke?
at some point
 
yes, but IIRC we decided something between "meh" and "too reliant on metasmoke"
I'd still like to do it, or at least move it out of code, but meh
 
Has that changed at all, since metasmoke is way more stable these days?
 
4:12 PM
The problem with metasmoke was that it was too many times down, and it had the drawback of making smokey depending on a other server
 
I personally think we could do it without problems, just be defensive about MS being down.
 
There must be some arrangement of requesting the data and caching it in files that would make it work
 
There is
 
we could even cache it in a database, Python's got some good database libraries
 
we could cache it in files, then automatically commit said files to github.
 
4:13 PM
metasmoke has been quite reliable these days, so I think we can make sd depend on it
 
Pushing to GH is still a good idea, because then we keep the source of truth on GH.
But yeah, I'm sure we could do it.
 
Can't we make a command to blacklist websites?
 
If we wanted to do that, I probably should get websockets working :/
 
@Undo meh, add a Smokey command to pull from MS
 
I always have to ask someone to blacklist a website
 
4:15 PM
@AshishAhujaツ not unless you want to write something to parse and write Python code right now, which is icky at best.
 
@AshishAhujaツ as of right now, no.
 
@AshishAhujaツ You could always send in a PR, those are fast :)
 
That would require writing code to edit code, which doesn't sound sane
 
@Undo I don't know python
 
4:15 PM
on a side note, these functions have like 15 parameters
 
@ArtOfCode At least we have eval, :)
 
what did you just say
2
 
@Quill I try to avert my eyes, or at least squint really hard.
 
@Ferrybig My suggestion: Store the data in MS. When Smokey starts, it tries to pull the data from MS and if successful creates a local file cache of the config. If MS is down, it then uses that latest cache. Additionally, give smokey a new command (!!/refreshcache?) which does the pull of data from MS and creates the local file if successful.
This protects against MS down time by keeping a local copy of the cache
 
@Undo I'm planning to implement a model like system in a later PR to clean that up a bit... for now is mainly syntax changes, adherance to PEP8, etc
 
4:16 PM
@Andy and it means we get to push to GH
 
@Andy And commit said cache to GitHub for when both MS and my Smokey copy are down.
 
It also allows easier updates (ie. No git push/pull/CI/build/deploy/etc)
 
The refresh cache command is definitely something we should do
 
Getting the CI step out of blacklist changes would be awesome
 
otherwise we're looking at websockets or waiting for polling
 
4:17 PM
We could probably start with the big website blacklist, that's just a bag of strings.
And easy to throw in a Pickle file or something
 
And the patterns, for that matter
just strings that you have to parse into regexes
 
@Undo Pickle...bad.
 
Those types are just regexes, we could write a test funtion on metasmoke to test the regexes before publishing
 
@Andy csv, whatever :p
 
Would require some creative thinking on the metasmoke end... either we make more people admins, or we need a new level of user
between reviewer and admin
 
4:19 PM
@ArtOfCode latter would work
It'd force @sandwich to make another metasmoke account, but that's okay
;)
 
@Undo Yeah, just yet another attribute on the user model :)
what is it now, like 25?
 
noooo
 
That push to Github step...I have a suggestion that makes the smokey project slightly more complicated, but just slightly
 
[ SmokeDetector ] Few unique characters in answer: How to properly style an infowindow? by Angelo on stackoverflow.com
 
We probably also need more account levels on smokedetector, 1 people saying "...stopit" or "...clearbl" and we have trouble
 
4:20 PM
sd k
 
@SmokeDetector k
 
@Andy Aye?
 
@SmokeDetector k
 
@Ferrybig Like level 2: wizard?
 
@Ferrybig Yeah, I've been wondering about the clearbl command... do we really need it?
 
4:21 PM
Level 3: Grandmaster
 
@ArtOfCode I have the same wonderings
 
@Ferrybig If someone can't keep themselves from messing with that stuff, they don't need access.
 
Level 4: God AKA admin
 
level 4: Overlord
 
@ArtOfCode probably not
 
4:21 PM
level 5: Overflow
level 6: Mod God
 
Level 5: Undo
 
level 7: Undo
 
In the refreshcache function (runs on start up and on command), if something is new, commit to a new repository. This repository is a subproject of smokey. Only Undo (or whoever hosts it now) can commit there and there is a policy to only let the bot do it. This keeps the project clean and you don't have to worry about pulling updates each time.
 
level 8: redo
 
@ArtOfCode Too many levels
@Ferrybig That would be Madara, right?
 
4:22 PM
So, the Smokey project has a subproject called config
 
level 9: overdo
 
level 10: underdo
 
The bot itself pushes the cached config files there
 
@ArtOfCode This Brad
 
@Andy Possible, yeah
 
4:22 PM
level 10: Shog
 
Not thrilled about giving it my GH credentials, but that can be worked around
 
Other users then just need to git update submodules (or whatever the real command is)
Noooooo
And...
 
level 11: smokey
 
@Undo Smokey's got a GH account
 
yeah
 
4:23 PM
@Undo In environment variables, or a file that doesn't get committed, etc.
 
Env vars is more secure from accidental commits
 
This will be another config file for the git credentials, and optionally environment variables
 
@Andy Smokey would still need to have access to it somehow, and Smokey is a giant remote-execution-vulnerability-as-a-feature
 
REVaaF
 
I feel so dumb right now :P
 
4:24 PM
Almost sounds like I'm Dutch
 
@Undo If it's not your smokey, it doesn't need to push to github. The other ones are temporary.
 
Why does the subproject even need to be code? Can't it be just plain text files?
 
It'll still be on MS for when yours comes back
@Ferrybig basically, yeah
 
@Andy What I'm getting at is this: GlobalVars.charcoal_hq.send_message(ENV['gh_password'])
 
I'm gonna head to bed... night everyone :)
 
4:25 PM
followed by !!/pull
 
@Quill Night
 
Not saying that anyone here would do that, but it's still there.
 
@Undo I vote that the first person to do that gets the longest chat suspension we can possibly impose. Also, set up 2FA on the GH account.
 
@Undo Instead of doing it there, set the gh_password to a variable earlier in the code. If it's None, don't run that command.
 
@ArtOfCode 2fa won't work as we need to let it login multiple times
Can't smokey push the settings to metasmoke and then metasmoke makes a git commit? We already have the metasmoke key inside smokey that can be exposed
 
4:26 PM
@Ferrybig I'm thinking more protection against humans logging into the account
 
@ArtOfCode Not necessarily traceable, though. git push --force is a thing, as is sending stuff to a server that isn't chat.
 
gh = ENV['gh_pass']
# STUFF HAPPENS!
if gh:
	send_message()
 
I have an audit trail that persists through force pushes, but still
 
4:28 PM
@Ferrybig people can turn that off
 
@Ferrybig That's GH Enterprise
 
@ArtOfCode IIRC it's a thing in classic GitHub too, but yeah
 
git push --force https://t.co/YrHoeXlKlr
 
@Undo Done slightly differently, but yeah. Branch protection.
 
just seemed relevant.
 
4:29 PM
I'm stepping out for my lunch walk - YAY! SUNSHINE! - I'll be back in about 30 min
 
@Undo Only if they have admin level access to the repo, right? And by default everyone in the organization is contributor?
@AshishAhujaツ Night!
 
although that could be fixed
 
[ SmokeDetector ] Few unique characters in answer, repeating characters in answer: Hyper-V, Is it possible to have a host in cluster whilst still have locally stored VMs by Jim Ohyea on stackoverflow.com
 
At some level, we just have to trust eachother not to the evil things. But it'd be nice if there was some technical limitation there too.
 
Who actually has access?
7 accounts.
1 of those is a bot.
4 of the rest are network mods.
 
4:31 PM
@Undo Don't ever make me an admin then
 
@ArtOfCode well, anyone on github.com/orgs/Charcoal-SE/people can theoretically push arbitrary Python to something on my local network
 
The thought is tempting
 
Yeah, I trust everyone on there. Do I trust some guy at an airport who happens to pick up their lost laptop? Maybe not.
 
The other 2 have been around this project for ages, and I'd vouch for them.
 
Can't you DMZ the PI to a separate network segment?
 
4:32 PM
could, but now it's harder for me to SSH to it
 
@Undo True. On the other hand, what are the chances of (a) losing a logged-in device AND (b) getting it nicked rather than handed in AND (c) getting it nicked by someone who's a decent Python programmer AND (d) one of us not picking up on the fact that some dangerous code went in AND (e) one of us pulling it?
 
97.8953%
 
@ArtOfCode insanely low
Just trying to figure out a way to have the least risk on this thing.
 
Also consider that the random decent python programmer might be a good and civil guy.
 
(and remember, if it's not possible for someone to do it it's not possible for someone to be accused of doing it, which is another factor here)
 
4:35 PM
I get that the arbitrary code execution vector is there and that it's a real security risk if it does happen, but that does have to be balanced against the changes of it actually happening to get a realistic perspective on security.
 
People with push right can already get access to the smokedetector account at the moment, if they print the correct variables
 
@ArtOfCode Still doesn't hurt to minimize possible damages.
 
@Undo Aye, I just don't want to see a potentially really useful feature hampered by security concerns that are small. It needs to be sufficiently secure, and no more.
 
Also, this is one of the reasons I want tighter SE integration to be through metasmoke; I hold the sole deployment keys to that. Far less risk.
@ArtOfCode Oh, don't worry about that. Unless it's something totally insane, I'm not gonna block features over these crazy-minor security things.
 
sweet :)
 
4:38 PM
Do you actually trust your PI? When you installed it, it came with some magic blob of binary code for the bootloader.
 
Yeah, I'm not too concerned about that :P
 
Immutable Law of Security #1: If a bad guy can persuade you to run his program on your computer, it's not your computer any more.
The thing about security is how to define bad guy, and how to work out when to trust people.
Because at some point in the chain, you have to trust someone.
So is this something we actually want, and I should start modifying metasmoke?
 
I am neutral on the idea, so I skip this vote
 
@ArtOfCode Not entirely sure yet, would want to get @sandwich and @hichris123's opinions first.
 
aye
 
4:59 PM
sd f
 
:29764727 Wrong tags. Should be tagged with [RegEx-request]
 
[ SmokeDetector ] Messaging number in body: need help in code js by H.S on stackoverflow.com
 
Why is there not a "pile of steaming horse dung" close reason?
2
 
[ SmokeDetector ] All-caps answer, few unique characters in answer: java.lang.ClassCastException:fragment cannot be cast to android.support.v4.app.Fragment by user6357422 on stackoverflow.com
 
@ArtOfCode Because the question version of horse dungs don't steam.
 
5:23 PM
[ SmokeDetector ] Few unique characters in answer: Word for one who does not eat onions by bob on english.stackexchange.com
 
sd k
 
Sorry, lost track of conversation there and can't tell what the subject is. If it's about GH access, I'm very happy to have the lowest level that allows push.
 
@sandwich It was about moving the website blacklist and possibly patterns to metasmoke
 
Some patterns are in methods like email with keyword.
A big list of "these are strings to match" makes sense as an imported resource.
Regexes and associated details (sites to exclude, other rule parameters) are a but more complex and belong naturally in the code.
 
I agree that the regexes can stay in the code, at least for now
They're really code
 
5:30 PM
An alternative approach would be to move findspam to a submodule, with different set of users pushing there.
 
And probably should be run through CI
@sandwich This is more about eliminating the CI step when adding blacklisted websites, etc.
Because we really don't need it, it's mostly annoying
But yeah, I suppose a submodule would work there
 
Oh. I thought it was about security.
 
Security was tangent, talking about how we could have Smokey push to GH without revealing the creds.
 
@ArtOfCode there is. It is called "downvote".
 
Sadly, it does not enable deletion of answered questions.
 
5:45 PM
@Undo Can I have my stats, please?
 
@Undo Ah, I had missed it was made public. Thank you!
 
:)
 
5:58 PM
[ SmokeDetector ] Shortened URL in body: Que tan personalizable y agil es tu CMS by Tufik Chediak on es.stackoverflow.com
 
6:14 PM
[ SmokeDetector ] Offensive answer detected: "pros and cons" vs "advantages and disadvantages" by Nigerian on ell.stackexchange.com (@PhMgBr)
 
@SmokeDetector K
 
6:55 PM
[ SmokeDetector ] Phone number detected in title: 1-877-778-8969 Lenovo customer care by Jordan Mkt on askubuntu.com
 
SD K
 
@SmokeDetector k
 
7:32 PM
!!/test www.healthportalsite.com
 
> Pattern-matching website in body, pattern-matching website in title
----------
Title - Position 5-24: healthportalsite.co
Body - Position 5-24: healthportalsite.co
 
Thought so. I now can't help noticing such patterns, even in a site that's used by my doctor...
 
@sandwich Your doctor is a spammer
 
7:45 PM
What does he treat?
Spamophobia?
 
Backoff received of 10 seconds on request to http://api.stackexchange.com/2.2/questions/32886;32869?site=puzzling.stackexcha‌​nge.com&filter=!)E0g*ODaEZ(SgULQhYvCYbu09*ss(bKFdnTrGmGUxnqPptuHP&key=IAkbitmze4B‌​8KpacUfLqkw((
 
newline in the site again
where the heck would that come from?
 
Whitespace enforcing code in chat?
 
@Undo And it also seems wrong site, the api expects puzzling instead of puzzling.stackexchange.com
 
@sandwich Its in the key too
 
7:48 PM
@SmokeDetector This is undoubtedly the largest and most noticeable improvement to Smokey.
 
@Ferrybig no, you can pass the domain name
 
@Undo Doesn't seem to work when you copy the url smokey posted
 
because you copy it with zwnj I guess
 
what the heck
@sandwich no, this is weird. Copy http://api.stackexchange.com/2.2/questions/32886;32869?site=puzzling.stackexcha‌​nge.com&filter=!)E0g*ODaEZ(SgULQhYvCYbu09*ss(bKFdnTrGmGUxnqPptuHP&key=IAkbitmze4B‌​%E2%80%8C%E2%80%8B8KpacUfLqkw(( into your browser
 
I suspect that's just some quirk -- not an actual thing Smokey is experiencing.
 
7:49 PM
[ SmokeDetector ] Offensive answer detected: QtCreator hotkey to move selected block by aferriss on stackoverflow.com
 
Otherwise the call would fail and we should get an error message...
 
You can see the extra characters there @Undo. Copy it directly from here and you get it too:
3 mins ago, by SmokeDetector
Backoff received of 10 seconds on request to http://api.stackexchange.com/2.2/questions/32886;32869?site=puzzling.stackexcha‌​nge.com&filter=!)E0g*ODaEZ(SgULQhYvCYbu09*ss(bKFdnTrGmGUxnqPptuHP&key=IAkbitmze4B‌​8KpacUfLqkw((
 
True
I have no clue where those are coming from
 
Maybe send API URL as a formatted link?
 
@Undo Ok, its weird, if you go to the history of the message smokey posted, and copy the url from there, it works?
 
7:51 PM
API URLs break link formatting
@Ferrybig huh, that's interesting. So I guess we broke the chat formatter
 
Hm. But we don't need filter and apikey here every time.
Just cut off by the first &
 
Possible that the filter is invoking a bad query plan
 
Yeah, kind of defeats the purpose. Then again, what was the purpose?
 
[ SmokeDetector ] Repeating words in body: Why the transision doesnt work? by Angelo Nuho on stackoverflow.com
 
@Undo Ok, it is even weirder, according to notepad, both urls LOOK the same, but 1 works, the other not
 
7:53 PM
Purpose with printing the URLs that backoff was "maybe we're doing something crazy", but I don't think we are
 
Yes, and we also found that it's arbitrary sites that throw it, not just SO.
 
I usually see Shog coming to the SOcvr when a member made a app that didn't respect the backoff, maybe he can take a look at smokey api calls to see if he knows why it backoffs so frequently
 
It's been passed on to devs already, haven't heard anything back yet
(read: don't go ping Shog about this, he's busy enough already)
 
@ArtOfCode Looks good; I made a minor edit.
 
8:12 PM
Backoff received of 10 seconds on request to http://api.stackexchange.com/2.2/questions/29846;29822?site=mechanics.stackexch‌​ange.com&filter=!)E0g*ODaEZ(SgULQhYvCYbu09*ss(bKFdnTrGmGUxnqPptuHP&key=IAkbitmze4‌​B8KpacUfLqkw((
 
8:39 PM
[ SmokeDetector ] Few unique characters in body: why is this function not running by user5631466 on stackoverflow.com
[ SmokeDetector ] Few unique characters in body: Installing python using pip-3.2 by user5631466 on stackoverflow.com
 
sd 2tp-
 
[ SmokeDetector ] Few unique characters in body: Why is this not working in PHP? by user5631466 on stackoverflow.com
 
@SmokeDetector tp-
 
Restart: API quota is 2189.
 
9:34 PM
API quota rolled over with 1939 requests remaining. Current quota: 9999.
stackoverflow: 1563
askubuntu: 515
superuser: 404
drupal: 281
unix: 226
salesforce: 182
english: 157
math: 147
electronics: 140
mathoverflow.net: 133
wordpress: 128
sharepoint: 123
security: 117
dba: 112
gaming: 107
gis: 105
academia: 103
apple: 103
travel: 102
mathematica: 100
scifi: 93
magento: 93
ell: 90
programmers: 86
android: 80
physics: 77
worldbuilding: 76
meta: 74
puzzling: 72
rpg: 72
stats: 71
tex: 70
money: 65
ru.stackoverflow: 64
raspberrypi: 60
diy: 58
webapps: 54
pt.stackoverflow: 50
 
@ArtOfCode the wiki looks good, there's just one grammar error > Additionally, the chatrooms are a professional environment - we're friendly and laughing and joking are fine, but keep it professional.
we're friendly, laughing and joking are fine, but keep it professional.?
 
@Yvette I think you should be able to edit it directly.
@SmokeDetector k
 
@sandwich I'm not part of the repo team?
 
@Yvette fixed
@Yvette it's a wiki, anyone can edit
i think
 
9:46 PM
pretty sure you have to be affiliated with the project somehow
 
It'd be nice to find out...
 
ok I will try and edit it
ooh I can edit it.. That's not good, anyone can edit it
 
GH wikis are weird. There are no pull requests. Either it's closed or open to everyone.
 
ah
keep a copy of it somewhere
 
There's a revision history, of course.
Smokey's wiki has been editable for over a year.
in Tavern on the Meta on Meta Stack Exchange Chat, Jun 28 '15 at 19:12, by hichris123
@1999 I may come to regret this, but I opened editing of the wiki up to all.
Okay, slightly less than a year.
 
9:51 PM
Do you think 'Getting Privileges' should be 'Priviliges'?
 
Backoff received of 10 seconds on request to http://api.stackexchange.com/2.2/questions/29888;29900?site=fitness.stackexchan‌​ge.com&filter=!)E0g*ODaEZ(SgULQhYvCYbu09*ss(bKFdnTrGmGUxnqPptuHP&key=IAkbitmze4B8‌​KpacUfLqkw((
 
without the typo
 
Privileges is correct spelling, afaik
2
@SmokeDetector where is a cat in that? Hard to see
 
I made the typo lol. I mean just Privileges without the "Getting"
 
9:52 PM
@sandwich I count twelve.
 
@SmokeDetector looks like my house on a normal day
 
@Quill do you have a lot of cats?
 
I think the title of the wiki itself can be "Privileges" since there is a section of it called "Getting Privileged"
 
@Yvette I also hate that word because I also can't spell it
 
@Yvette yeah... my family has 7 of them
 
9:55 PM
They are too similar. Looks photoshopped.
 
in Tavern on the Meta on Meta Stack Exchange Chat, 2 days ago, by Quill
On a side note, I have a cat named smokey
 
@Quill wow, I thought we had a lot - 3
 
Is it spam if what they offer is "friendship"? apple.stackexchange.com/a/238908 Yep
 
@Ferrybig I made an edit to the wiki! I took out one word. Huge edit
 
Those weird characters in the backoff messages are obvious on mobile chat.
 
[ SmokeDetector ] Manually reported answer: Unread Messages Badge Wrong in Dock by Sanchez Vega Hector Tomas on apple.stackexchange.com
 
@sandwich the product is their friendship
 
@ArtOfCode Does this mean I wouldn't be able to tell Smokey spam or notspam if I wasn't a mod?
 
@Randal'Thor yep
ninja'd
 
Diamonds get implicit privileges.
 
9:57 PM
@Andy The weird characters only appear in the rendered view, not if you look at the message history. And I don't see them at all
 
I flagged as rude/abusive. We really need a Just ridiculous flag
 
I ran with implicit privileges for a good 4 months before I actually added myself to the privilege lists :)
 
no we do not. Heck no.
 
Huh. I just assumed anyone could use it.
 
 
9:58 PM
 
user image
3
 
@SmokeDetector k
 
we'd get this within a week on SO. Wouldn't be able to decline them fast enough
 
@Andy I think there's a rogue new line in the code... I'm working around this space at the moment, so I'll take a look
 
9:59 PM
lol
 

« first day (914 days earlier)      last day (1299 days later) »