Sorry - I hope this does not lead to privileges getting revoked.

no real harm, the root cause is that Halflife missed that because it was not an exact match

!!/blacklist-keyword test\W?ultimate

@tripleee Blacklisted test\W?ultimate

@tripleee Where are you getting these keywords from?

[ SmokeDetector | MS ] Phone number detected in title: UnicodeEncodeError: 'ascii' codec can't encode characters in position 12476-12481: ordinal not in range(128) in pyspark by Jayasree on stackoverflow.com

fp- by DraconicPenguin

@bwDraco I posted a gist a couple of weeks ago, lemme dig that out for you

@SmokeDetector f

@SmokeDetector why

@tripleee Title - Phone number: 1247612481

huh

FWIW, that phone number detection routine, as unreliable as it may be, needs to stand because of spammers using aggressive techniques to try to defeat filters.

!!/report webapps.stackexchange.com/q/110813/45867

[ SmokeDetector | MS ] Manually reported question: Does Suit Underwear is very good for you? by halloween on webapps.SE

tpu- by DraconicPenguin

!!/watch suitunderwear\.com

@bwDraco Added suitunderwear\.com to watchlist

I see no commits to suggest that we no longer need to restart when the Git files are updated, so I presume something is broken ...?

> Note that as protocol-level issues, most or all correct implementations of the standard will be affected.

> The vast majority of existing access points aren't likely to be patched quickly, and some may not be patched at all. If initial reports are accurate that encryption bypass exploits are easy and reliable in the WPA2 protocol, it's likely attackers will be able to eavesdrop on nearby Wi-Fi traffic as it passes between computers and access points. It might also mean it's possible to forge Dynamic Host Configuration Protocol settings, opening the door to hacks involving users' domain name service.

arstechnica.com/information-technology/2017/10/…

!!/test-a example.spam/test-ultimate-review

!!/pull

Enjoy...also...your wireless connection is insecure

[ SmokeDetector ] SmokeDetector started at rev e38109a ([email protected]: Revert test.) (running on bwDraco/Linode)

Restart: API quota is 16257.

@bwDraco is this fully operational and on the right Git branch? it looks like it's not getting blacklist updates

!!/master

[ SmokeDetector ] SmokeDetector started at rev e38109a ([email protected]: Revert test.) (running on bwDraco/Linode)

Restart: API quota is 16253.

It's not pulling on its own.

!!/watch bitittan\.com

@tripleee Added bitittan\.com to watchlist

@bwDraco it's also not pulling recent updates even when you tell it to

@SmokeDetector that's a revision from 6 hours ago

Git says it's up to date. Not sure why.

It was on the wrong branch. Restarting...

!!/restart

[ SmokeDetector ] SmokeDetector started at rev 28721fc (SmokeDetector: Auto watch of bitittan\.com by tripleee --autopull) (running on bwDraco/Linode)

Restart: API quota is 16234.

There we go.

[ SmokeDetector | MS ] Bad pattern in URL answer: how to connect roadrunner using imap_open() by John on stackoverflow.com

tpu- by DraconicPenguin

[ SmokeDetector | MS ] URL in title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +3 more: www.revivalantiagingcream.com/derma-luminous/ by evan sevi on apple.SE

tpu- by DraconicPenguin

!!/watch email-technical-support\.com

@tripleee Added email-technical-support\.com to watchlist

Casting a wider net...

[ SmokeDetector | MS ] URL in title, link at end of body, pattern-matching website in body, pattern-matching website in title: www.puremusclefacts.com/ by Wooduousted on drupal.SE

tpu- by DraconicPenguin

[ SmokeDetector | MS ] URL-only title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +6 more: supplementstest.org/zmass-testo-boost/ by rjvsfgb on askubuntu.com

tpu- by DraconicPenguin

!!/blacklist-keyword (customer|tech|technical)-?(support|service)\.com

@bwDraco Blacklisted (customer|tech|technical)-?(support|service)\.com

32/33, below auto just now; see metasmoke.erwaysoftware.com/…

I really wish we could add exceptions to these keywords; paypal-techsupport.com is legit.

@QPaysTaxes Huh?

Yeah. That is really weird.

you can with negative lookarounds

I'm not great with this sort of regex. Can a dev edit this pattern with an exception?

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, +1 more: Detox Body Blast-Ultimate Weight Loss by dallajhon on meta.SE

tpu- by DraconicPenguin

pro: stays up even if your main infrastructure is dead. Con: looks like a phish site

@QPaysTaxes sure, if your DNS is working

@QPaysTaxes you can delegate a subdomain but if your DNS is dead, nobody can see that delegation

[ SmokeDetector | MS ] Pattern-matching website in body, blacklisted user: Do you know Wholesale Halloween Costumes? by halloween on webapps.SE

@QPaysTaxes you basically have to, though usually they will be two distinct servers in different address spaces operated by the same DNS provider

@tripleee: For some reason, when a change occurs, Smokey switches to the deploy branch. Why?

!!/restart

@bwDraco to the best of my understanding, the running Smoke Detector is supposed to be on the deploy branch

[ SmokeDetector ] SmokeDetector started at rev 5f1f39b (SmokeDetector: Auto blacklist of (customer|tech|technical)-?(support|service)\.com by bwDraco --autopull) (running on bwDraco/Linode)

Restart: API quota is 16107.

Hmm...

It's not pulling the changes.

@QPaysTaxes if you are on the scale of PayPal, your DNS servers are all part of the same attack surface

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad keyword in username, blacklisted website in body, link at end of body, +2 more: AndroForce X10: How Does it work? by AndroForce X10 on superuser.com

tpu- by DraconicPenguin

@QPaysTaxes nope, but a dDoS attacker will easily find them all

$ host -t ns paypal.com
paypal.com name server pdns100.ultradns.net.
paypal.com name server pdns100.ultradns.com.
paypal.com name server ns1.p57.dynect.net.
paypal.com name server ns2.p57.dynect.net.

probably looks different for you due to load balancing etc

Why isn't Smokey pulling the changes into the deploy branch?

!!/pull

[ SmokeDetector ] SmokeDetector started at rev e38109a ([email protected]: Revert test.) (running on bwDraco/Linode)

What?

This is getting frustrating...

Restart: API quota is 16085.

are we going full circle here? the one scenario where it doesn't work is when your tech intern hosed your zone file or a dDoS attacker is choking all lookups for your domain and its subdomains

!!/master

[ SmokeDetector ] SmokeDetector started at rev e38109a ([email protected]: Revert test.) (running on bwDraco/Linode)

headdesk

Restart: API quota is 16083.

[ SmokeDetector | MS ] Blacklisted website in answer: Merge PDF annotations from two files by Thomas on askubuntu.com

tpu- by DraconicPenguin

!!/watch wholesale-swimwear\.com

@tripleee That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; use !!/watch-force if you really want to do that.

@tripleee, any idea what's going on with these branch issues?

The changes are not getting merged into deploy.

@bwDraco not entirely no, I think you are supposed to be running on deploy and, uh, something is doing the merges into that

circleci.com/dashboard looks like no merges to deploy have happened so the problem doesn't seem to be on your end

Bleh, system glitch.

[ SmokeDetector | MS ] URL-only title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +7 more: freesupplementrial.com/alpha-hard-reload-reviews/ by wkvs on askubuntu.com

tpu- by DraconicPenguin

[ SmokeDetector | MS ] URL-only title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +4 more: lumalifteye.com/radiant-revive/ by user747950 on askubuntu.com

@SmokeDetector tpu-

[ SmokeDetector | MS ] Link at end of answer: Bootstrap Models Not working ASP.NET MVC by Mxi Coder on stackoverflow.com

issue #1154 submitted; master is not getting merged to deploy

!!/watch mxicoders\.com

@tripleee Added mxicoders\.com to watchlist

issue #1155 document build infrastructure

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, link following arrow in body, potentially bad keyword in body: Neulift (USA) - It improves the overall quality of your skin by Bio silk on apple.SE

tpu- by suraj

sd - k

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, +1 more: What we do know is that zmass testo boost works by Thath now on drupal.SE

tpu- by suraj

I also vaguely get the impression that they cycle domains and products they promote weekly, so Mondays tend to be more hectic with blacklist updates because they start a new wave

but I have not done any proper analysis to investigate this observation

[ SmokeDetector | MS ] URL-only title, bad keyword in body, blacklisted website in title: www.wellness350.com/memory-boost-xl/ by lony on askubuntu.com

@SmokeDetector k

[ SmokeDetector | MS ] Bad keyword in body, pattern-matching website in body: Some of the ingredients are listed below by eadejeret on askubuntu.com

tpu- by Tetsuya Yamamoto

!!/blacklist-website southafricasupplement\.co\.za

@tripleee That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; use !!/blacklist-website-force if you really want to do that.

5/5 over 5 months; below auto repeatedly, incl. just now

!!/blacklist-website-force southafricasupplement\.co\.za

@tripleee Blacklisted southafricasupplement\.co\.za

!!/blacklist-keyword memory\W?boost\W?xl

@tripleee Blacklisted memory\W?boost\W?xl

[ SmokeDetector | MS ] URL in title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +6 more: freesupplementrial.com/alpha-hard-reload-reviews/ by user259864 on apple.SE

tpu- by suraj

there's a merge conflict between master and deploy

What's wrong?

!!/pull

@tripleee CI build is still pending, wait until the build has finished and then pull again.

[ SmokeDetector | MS ] URL in title, bad keyword in body: belladermsite.com/radiant-revive/ by Yakinla on graphicdesign.SE

@angussidney circleci.com/gh/Charcoal-SE/SmokeDetector/11535

@SmokeDetector k

@quartata you can have code privs, I've toggled the setting in MS but remind us to fix the pullapprove issues once all of this is fixed

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, pattern-matching website in body: Alpha Hard Reload Execution by susasborchers on askubuntu.com

there was a test\.test\.test commit which was blocking automatic merge

@SmokeDetector k

CI on 8bb7a4f succeeded.

So is everything sorted now?

looking better immediately but let's check with something

Good morning fellow carbon based lifeforms

(badly done charcoal pun)

!!/watch merged-master-and-deploy.test

@tripleee Added merged-master-and-deploy.test to watchlist

I wonder

hmmm, still don't look like it's merging to deploy

Is there a chat command to remove watch and blacklist entries?

If not, should there be?

@Magisch it's rare enough that manually submitting a PR (or a commit if you have the privileges) is acceptable IMHO

for orthogonality it would be nice to have an "undo" for when you are first getting to know the system but I don't think it's worth the effort

Well getting to know the system doesn't really apply for code privileges does it

When you get code admin you've had plenty of time before to try out the commands

And when you're not code admin the undo button is simply not merging the pull request...

yeah, pretty much

@angussidney nope

and again musconv

!!/report webapps.stackexchange.com/a/110817/45867

[ SmokeDetector | MS ] Manually reported answer: How do I import Playlists to Amazon Music? by Bangelica Damich on webapps.SE

[ SmokeDetector | MS ] Few unique characters in body, no whitespace in body, repeating characters in body, repeating characters in title: mnmmmmmmmmmmmmmmmmm by Maggy655 on quant.SE

Maybe it's time to blacklist the keyword musconv

I can't see legit usage on SE from the SE wide custom search

And MS is 4/4

tpu- by Magisch on How do I import Playlists to Amazon Music? [MS]

!!/blacklist-keyword musconv

@tripleee Blacklisted musconv

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, pattern-matching website in body, +1 more: Totally Ingredients of zmass testo boost by Sued19 on graphicdesign.SE

tpu- by Magisch

tp- by Glorfindel on mnmmmmmmmmmmmmmmmmm [MS]

[ SmokeDetector | MS ] URL in title, bad keyword in body, blacklisted website in body, blacklisted website in title, link at end of body, +2 more: alphajackedhelp.com/blue-fortera/ by ugjhghhh on meta.SE

@SmokeDetector k

!!/blacklist-keyword blue\W?fortera

@tripleee blue\W?fortera already blacklisted on bad_keywords.txt line 812

"This branch is 2 commits ahead, 3 commits behind master." github.com/Charcoal-SE/SmokeDetector/tree/deploy

I guess I screwed something up

what if I force push now?

@Magisch I like that :)

@tripleee if you force push to delete stuff, you could always take the affected instances offline and ask the owners to re-clone etc

@angussidney I suppose we would like to avoid that if at all possible

not sure how I painted myself into this corner, the slate looked clean when I performed the merge

Art did something last time that worked and didn't require anything more than a manual pull

can I do a PR against deploy to bring it back into sync?

You'll have to do everything from the command line, since using PRs will add merge commits which will take it out of sync again

@Magisch heh

2 mins, I'm reading the transcript

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, +2 more: zmass testo boost final by Yousbaee on workplace.SE

@SmokeDetector k

mmm what if I merge deploy to master? that should fix it, right?

[ SmokeDetector | MS ] Blacklisted website in body: What is a good file extention for CLI PHP programs? by Sojib Khan on superuser.com

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad keyword in username, blacklisted website in body, link at end of body, +1 more: Elixir Neuro Pro - Quickly sharpen your mind and improve focus by Elixir Neuro Pro on arduino.SE

tpu- by angussidney

@tripleee I don't know

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, blacklisted website in body, link at end of body, pattern-matching website in body: Change in stamina and sexual life by Hilis1981 on askubuntu.com

@SmokeDetector k

@SmokeDetector k

(dentist's appointment, be back in an hour or so) ->

Why don't you try merging each branch into each other (master -> deploy first then deploy -> master) so that they are equal, then try doing whatever MS does to update the branches

I think it's called updating the refs

@ArtOfCode you fixed this last time, could you give us a hand once you wake up?

Does anyone know if custom mod flags age away?

They shouldn't AFAIK

They do not, as far as I know.

If they do someone could make a bunch of meta rep by posting a FR about it

Because I may or may not have over 80 of those pending

[ SmokeDetector | MS ] Username similar to website in answer: Is there a C#-like lambda syntax in JavaScript? by Paul Free on stackoverflow.com

If you feel like going through SFF and Lit I'd be interested in the results :p

[ SmokeDetector | MS ] URL-only title, bad NS for domain in body, bad NS for domain in title, bad keyword in body, bad keyword in title, +7 more: freesupplementrial.com/alpha-hard-reload-reviews/ by qinapan on askubuntu.com

tpu- by Tetsuya Yamamoto

@Mithrandir Pretty sure Lit and SFF don't have any

But I'll take a look once I'm done with my weekly tour of SO

only got about 25 flags to go on SO today

@Mithrandir First pass returns 19 incidents for 2017 on Literature.SE

Not sure how many of those have already been dealt with by the script

@Magisch SFF is certainly big enough to have them. I was surprised by the number of results on Ask Different (and I've only gone back as far as 2016 yet).

[ SmokeDetector | MS ] Few unique characters in answer, no whitespace in answer, repeating characters in answer: Django download image from ImageField by harshit verma on stackoverflow.com

tpu- by Glorfindel

@Glorfindel The question is if the literature mods want me to flag them

I don't want to go and earn like 25 declined flags in a day

Smart.

I'm somewhat self consicious about wanting to keep my declined % under 1%

This literature mod would appreciate it

[ SmokeDetector | MS ] Potentially bad keyword in body: cannot write csv file with python by Tanabata on stackoverflow.com

fp- by Glorfindel

[ SmokeDetector | MS ] Bad keyword with email in body: How do I donate to the amp? by CHEQUER on stackoverflow.com

We've got to have something to do :P

@SmokeDetector f

I think

@Magisch But protecting the vote is important, so the only things they can ask is 1) that you only flag cases you've already worked out, not just hunches 2) you don't flag too many cases at once.

@SmokeDetector f (off-topic, but deleted by user in the meantime)

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, link at end of body, pattern-matching website in body: The Scar Tissue Formation Consequences On Top Of That Aspects Related Acne by Peter wingfi on drupal.SE

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, blacklisted website in body, link at end of body, pattern-matching website in body: On the off chance that you are one of that individual by Sued19 on superuser.com

@Glorfindel I don't have the tools to be 100% sure

tpu- by Glorfindel

Basicly all my flags are educated guesses. They're 100% correct so far, but they're guesses nonetheless.

tpu- by Mithrandir on The Scar Tissue Formation Consequences On Top Of That Aspects Related Acne [MS]

@Magisch no, but you're using the tools you have to maximum extent. That's what counts.

(100% correct when it comes to serial voting)

@Magisch there's also a thing about not declining if they were flagged in good faith, so don't worry

Basicly my workflow is to manually look through the rep history of everyone that shows up in my script

If I think it's serial voting, I flag. If not, I make a note. I have a tally of FP/TPs in an excel spreadsheet so I can notice trends and improve the script

@SmokeDetector tpu

@bummi Blacklisted user and registered question as true positive.

Conflicting feedback on How do I donate to the amp?.

@bummi why?

I applied Hanlon's Razor here.

it looks like they're asking about using the SO logo

which should be on meta, but whatever

Also, the author deleted the post themself.

Still alive: 3dprinting.stackexchange.com/q/4709/4808 webapps.stackexchange.com/a/110817/136642

@Magisch if you want, you can give me a onetimesecret with the one's you're not sure about and flag the ones you are sure of

@Mithrandir I'll go through them shortly and see what I can see

I'm still not done with SO

Slacking / chatting instead of flagging ftl

!!/rmblu stackoverflow.com/users/8782735/chequer

@bummi User removed from blacklist (8782735 on stackoverflow.com).

but still not convinced, I've to admit

still alive android.stackexchange.com/questions/150527/…

and that site is still unreadable for me

for me too ....

it's been reported for 3 months and still nothing android.meta.stackexchange.com/q/2297/200791

Conflicting feedback on How do I donate to the amp?.

@Andy that.... looks like a bit of an issue. The article needs a 'what should I do' section

cool, 777 flags on Ask Ubuntu

[ SmokeDetector | MS ] Few unique characters in body: Prepared statement using Statement.RETURN_GENERATED_KEYS fails to execute by NitKrish on stackoverflow.com

@SmokeDetector f (but off-topic)

right now I'm done with SO, doing Lit.SE now

!!/status

@angussidney Running since 05:40:24 UTC (1 hour, 43 minutes, 35 seconds)

!!/gitstatus

well

There are three users on Lit.SE who make up nearly all the incidents

@Magisch could be a voting ring?

@Magisch one of which is named after a certain wizard from LotR :P

Well, that was worth a try

The git branch stuff is still stuffed up

CI on 7ef0ec2 succeeded.

Please don't blacklist/watch anything until the problem with deploy/master is fixed, I'm sorry about the inconvenience.

Note for whoever fixes this: make sure that you take bwDraco's instance offline when you do

hum, yeah, I think I've looked at these before

that's the issue with looking at data that's partly from private beta

Thing is too, my query is much less efficient on smaller sites

Much less accurate, even.

I rely on ID grouping to make sure the votes happened close together, so there'd need to be some fine tuning to make it work for lesser frequency sites then SO.

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, blacklisted website in body, link at end of body, pattern-matching website in body, +1 more: it can be utilized to treat any sort by Ovis ssed on drupal.SE

tpu- by Glorfindel

Is there anywhere I can go to talk to a mod about how a flag was handled without going to meta

Ping them in chat and ask for a private chatroom?

I don't know which mod handled the flag

But then you need to know which mod handled your flag.

I think there was an oversight, but I'm not 100% sure, and I don't want to put someone on blast on meta for it

You can ask Undo or Andy to find out who handled it (assuming it's on SO).

Not sure if they'd be allowed to tell me

They could ask the responsible mod (in their own mod chatroom) to contact you.

This is what I'm on about

The flag is marked helpful, but there definitely was serial voting on Sep 28, 2017 there imo

Are there no 'voting reversed' entries?

[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, link at end of body, pattern-matching website in body: Siberian Ginseng enhances ripeness and empower by jhotigal on askubuntu.com

tpu- by Glorfindel

[ SmokeDetector | MS ] URL in title, bad keyword in body, bad keyword in title, pattern-matching website in body, pattern-matching website in title, +1 more: www.puremusclefacts.com/alpha-hard-reload/ by parichen on astronomy.SE

tpu- by Glorfindel

!!/watch cozzy\.org

@Glorfindel Added cozzy\.org to watchlist

(potential spam on Ask Different)

@Glorfindel no

[ SmokeDetector | MS ] Blacklisted username: how to fake andriod app install from playstore or a publisher link? by wingding on stackoverflow.com

read the flag answer text :p

tpu- by Glorfindel

@Glorfindel cough cough

Can someone please fix that typo for me as well? Thanks

@Magisch apparently I can't read this morning.

@angussidney apparently I can't read this morning.

@SmokeDetector tpu-

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, bad keyword in username, link at end of body: What Is Neurovarium Brain Supplement by neurovarium on superuser.com

tpu- by Glorfindel

[ SmokeDetector | MS ] Blacklisted username: how to fake andriod app install from playstore or a publisher link? by wingding on stackoverflow.com

tpu- by Glorfindel

[ SmokeDetector ] Bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, potentially bad keyword in body, +1 more: This item utilizes CBD Hemp oil. This first skincare item to consolidate Retinol and CBD Hemp.Cellista Skin Collagen RetCellista Skin Collagen Re by RhonWilco on drupal.SE

tpu- by Owen Hines

[ SmokeDetector | MS ] Bad NS for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, +1 more: alpha hard reload goodbye to alcohol by Seercoee on workplace.SE

tpu- by Mithrandir