Charcoal HQ

1:27 PM

[ SmokeDetector | MS ] Username similar to website in answer: ESP8266 WiFiClient simple HTTP GET by techtutorialsx on stackoverflow.com

tpu- by DavidPostill

That would've been declined on Drupal (┛◉Д◉)┛彡┻━┻

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, pattern-matching website in body, repeated URL at end of long post: Skin Novela Where to buy? by mohamedel3mros on apple.SE

tpu- by Glorfindel

[ SmokeDetector | MS ] Offensive body detected, offensive title detected: "Every Nigger is a Star" (acoustic version) guitar chords by user38327 on musicfans.SE

@M.A.R. Well it worked. He has added a disclaimer. Time to retract the flags. @Glorfindel @M.A.R.

thanks David.

fp- by Glorfindel

1:33 PM

David thanks

@DavidPostill Registered answer as false positive.

@SmokeDetector fp

Conflicting feedback on ESP8266 WiFiClient simple HTTP GET.

@DavidPostill I don't think you should change the feedback

What it caught was indeed fish at the time

You mean you mis-replied?

@M.A.R. Never mind.

1:35 PM

Never minds

Guys, I don't get this comment

@M.A.R., I care about feedback, but if my views make me indifferent b/c of my rep, why should that matter? — KyloRen 1 min ago

B/C is 'because', right?

@M.A.R. Yes

@M.A.R. on that thread there is much more I don't get

@rene It's OK. The OP doesn't get much if it either. That is clear from his comments :)

Yeah, I was not feeling left out or so ;)

Q: Is downvoting answers really a way of trying to correcting answers?

I'm wondering if language barrier is again to blame here

@rene You want something more confusing?

Meh, I'd just stick to a regular rant

-1

Forgive my ignorance, but Iam really shocked to see a developing trend where answers are just downvoted without justification. I thought it was more important that utilise the "edit" option that is included below each and every post if there is need for any modication and furthermore hovering ar...

discussion

clientsfromhell.net/post/159335510532/…

1:51 PM

@M.A.R. that could be at play, yes.

[ SmokeDetector | MS ] Bad keyword in answer: How to add comments to my java application(standard way) by Bakkar Mustapha on stackoverflow.com

tpu- by Glorfindel

@KyloRen "Where is the forum to post your frustrations" - somewhere other than SE. Reddit, maybe? I wouldn't know. Like I mentioned in another comment, I've learned that posting frustrations gets you nowhere on SE, but posting your concerns in a reasonable and constructive way might actually stand a chance of getting you what you want. — rand al'thor 2 mins ago

"Where is the forum to post your frustrations?" Duh -- YouTube comments

OK, fun's over.

Where you be, spammers?

Oh nice

> flagging & you

19 flags used today

BEAT THAT

Byte Commander

11 is the max I see on my autoflagging timeline

congrats.

Yvette Colomb

@Ferrybig thank you :)

2:31 PM

@Undo @ArtOfCode You have mail related to Metasmoke in your mailbox

@Ferrybig I do? Which address did you send it to?

@ArtOfCode The email you last used to commit to metasmoke, it was the first email I could find that was not a large mailing list

Ah, I'd've been looking in the wrong inbox then :)

@Ferrybig I can see how that looks, but those steps wouldn't get you into an account - this line makes sure you've authenticated with the username/password first.

Thanks for bringing it up, though :)

heh, shoulda checked chat first

But still, good catch @Ferrybig

2:47 PM

I didn't expect that that toke would survive a large number of page changes

@Undo you should only be getting the error you quoted if 2FA isn't enabled on your account

@ArtOfCode target_user is nil there

Although that should throw, right? Weird

or that

Yeah, I guess it should

should really have SNO'd that, but eh

weird edge case, good for confusing the haxx0rs

I also thought that it was a real exploit because it gave "That's not the right code." for some of the accounts i tried, and then it still worked on my account

2:50 PM

!!/report stackoverflow.com/a/43295507/5210517

[ SmokeDetector | MS ] Manually reported answer: New to Rich Snippets (html), how do I put them in my code? by vijay on stackoverflow.com

@Ferrybig Sure you're logged out? Sounds like some rouge cookies on your browser.

NAA + irrelevant

[ SmokeDetector ] SmokeDetector started at rev aa9163a (Undo1: Merge pull request #631 from rschrieken/patch-1 --autopull) (running on ArtOfCode/EC2)

Can you repro in incognito?

2:50 PM

Plus emboldens the site link

Restart: API quota is 15860.

Woah-kay. Interesting. Exploit worked the first time I tried it in incognito, but failed the second.

and norepro in a new incognito window

O.o

@Undo Trying it with art's account (7) and code 123456 I get "That's not the right code." in an incognito window

@ArtOfCode is SE authentication supposed to bypass 2fa?

yes

@Ferrybig well to be fair that isn't the right code :)

At least we are confusing the attackers, :)

And we are leaking what codes are correct at what moment, helping them in reducing the possible keys that would generate codes

2:58 PM

@ArtOfCode got some kind of super-sticky cookie?

Try on mine. Ping for a code.

(I'm reasonably confident that there's no way this could possibly work)

@ArtOfCode That doesn't change the issue. You can trivially generate the sha hash of somebody else's ID and use it to get the other access token (and you can see the input for the hash just by looking at the code in tampermoney). Same problem as network id.

Need a secret that doesn't change across tabs or domains. IP address maybe.

IPs aren't very secret

What's my IP address?

Oh you're a mod

But it's secret enough

It'd be pretty easy to either (a) go look at it, or (b) entice you to visit some domain I control

Ip address change frequently with ipv6 you swap between ranges every hour or so, and you get the problem of proxies

3:03 PM

@Undo this one, for example.

It's still good enough for my thing

But not in general

@Undo don't think so

I could have the user manually enter a secret in the tampermonkey script

What's the application for this @Jason?

@Undo got a code?

3:05 PM

@ArtOfCode 606624

yeah, same error you quoted

@Undo Using artofcode's dss authentication thing without letting other users who know you're using the app grab your access tokens.

ah

@JasonC yeah, ask the user to enter a secret and use the SHA256 hash of it

I could onebox a self-hosted image here and look at the logs to collect a bunch of IPs

3:06 PM

just using the raw secret is a bad idea

@JanDvorak Fun fact: Onebox a self-hosted image with basic password protection and everyone's browsers asks for a password.

O_o That's ... not ideal

Lol that's awesome

Don't bug report that let's have some fun with it first

Can we see it live?

yeah, just a sec. Not set up to make that kind of exploit quickly

3:12 PM

@Undo here

Wait lemme make a new room

I suspect the bug report would be answered with "there's no good way around it. Instead, let's just kick everyone who does it"

Ban, actually. This has been reported before

@ArtOfCode Even that can be bypassed by using window.prompt = function()

aye

In that case

Nevermind

3:13 PM

a totally secure system in userscripts is hard

@JasonC This might be interesting nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/…

This will probably work ...

@TimStone Does it work on the main site?

@Glorfindel Huh, didn't work for me

@Glorfindel GET https://www.project3851.com/dailyonions/Gerwin.jpg 401 (Unauthorized)

Kyll

..?

3:15 PM

Why did that focus TNB rather than this room?

Kyll

Uh, just got a prompt for a password. That was noisy.

@Undo it asks me for username/password, but Firefox warns me explicitly that the username/password are not for the current site (i.e. chat.SE.com).

Kyll

That probably prompted 30~ish people for it.

@Glorfindel Behavior has improved, then

@Glorfindel Could you edit it so it no longer is in the transcript?

3:16 PM

I didn't get prompted at all - Chrome Canary.

Yeah, Chrome doesn't show the box

12

Q: What is this pop-up?

When I looked at the chat FAQ and clicked the link to take me to Sandbox I got this pop-up, which seems a little bit odd: Now, when I Googled plzz.de, I found a website about Stefano Palazzo, who happens to be a Stack Exchanger. When I added :9993 to the web address, I got the same pop-up. So...

support chat popups sandbox

Yeah chrome doesn't show it I just tested in another room

:36589684 That's why I said "wait lemme make another room", like a polite person, lol :P

It was fixed in Firefox and then the change was reverted for some reason?

This is what's shown in Firefox.

Yes that'd be a password dialog

3:18 PM

@JasonC this is Charcoal HQ, we test in production. If we test at all.

http basic authentication has its advantages and disadvantages

Wrong kind of test :P

@Ferrybig Kinda sorta

!!/alive

@ArtOfCode Another approach could be to have DSS key by IP as well as key id on its end, or otherwise verify that you're requesting from the same ip you created the key with.

You'd lose your token when your ip address changed but

It could probably be made an option in the authorization request if you wanted to enable it or not. Maybe I'll make a pr for that too. Some day. "Next week."

Oh but

It doesn't know the ip you created the key with because it only gets the request forwarded from oauth

3:24 PM

[ SmokeDetector | MS ] Link at end of answer: apache - DirectoryIndex - php page with arguments by Andrey on stackoverflow.com

nevermind

I don't think it's ok for a system to reset its settings every hour, or with every request if you are using the company's load balancing proxy

Yeah but in my crappy little userscripts I also don't care. Plus SE API token expirations.

But you're right in general that's not ideal either.

@SmokeDetector F

If everyone went to ipv6 much earlier then the trouble would be far smaller, just thrust the range of /64 addresses for everyone and you are set

3:28 PM

This would suck less if SE put a blank proxy page on every site, just for API usage.

Could you pull something from stackauth?

The only safe thing be writing a browser extension (instead of a userscript), because they have their own private storage

@Undo The proxy page has to be on the same domain as the request came from

I mean they've got one at api.stackexchange.com/docs/proxy for demos

they could just add one to every site.

ah, right

@TimStone Is there a secret blank page that currently exists on every se site?

3:38 PM

@JasonC You could try to use one of the following: meta.stackexchange.com/a/76569/215067

3:57 PM

@JasonC mm, I don't think so, no. The closest you'd get to a full HTML page with no content is the revisions route which returns a full page with nothing in the header but the title and just a <pre> in the body, and then obviously it's not a shared URL across all sites due to the GUID/possibility of any given post being deleted

Hm. /reputation kind of fits that description, I wonder if that would work.

I'll test later. For now, breakfast. Later all.

Thomas Ward

noms double chocolate chip cookies

^ that's MY breakfast lol

@Undo if I put type hints into Smokey code can I add a module to the requirements.txt? (the typing module from Py3 backported and available in pip heh...)

If it benefits us

Thomas Ward

PEP 484 compliance, and Python 3 reverse compat compliance (PEP 484 as well)

we don't test it in flake, but 484 strongly suggests having type hints for py2

and, i already have them in the Post object code, but with invalid syntax :P

Cerbrus

4:27 PM

@Ferrybig Thanks, will do

Q: What to do about these set theory questions

I'm starting an internship on 2017-04-10. Unsure yet, but it probably means I won't be lurking here as much. So if there's someone else who can help, it'd probably be faster to ping them than me, at least for the next week or so while I figure out what I'm doing.

8

Processed Meat

0

There have recently been a number of set theory questions of very low quality - many of these (most?) appear likely to have been asked by the same person under different accounts (the username is always [oneletter].[lastname], and the question almost always ends with "Please help me.." (including...

discussion low-quality-posts spam

4:55 PM

!!/alive

@JF You doubt me?

Several times now, Smokey has replied before the message is posted. Any ideas about why?

Before what message is posted?

5:11 PM

2 hours ago, by SmokeDetector

@Ferrybig Kinda sorta

He's fast

5:25 PM

[ SmokeDetector | MS ] Pattern-matching website in body: Frequency Data, Model Choice (Poisson with Offset, Fractional Regression) by JBN on stats.SE

5:43 PM

OK. The transcript is popping up that login. Can a room owner delete from the transcript?

[ SmokeDetector | MS ] Link at end of answer: .htaccess RewriteCond by Muhammad Rizwan on stackoverflow.com

[ SmokeDetector | MS ] Username similar to website in answer: Fetching encoder value with SimpleMotion library by Granite Devices by Granite Devices on robotics.SE

fp- by DavidPostill on Frequency Data, Model Choice (Poisson with Offset, Fractional Regression) [MS]

[ SmokeDetector | MS ] Link at end of answer: RewriteCond Exception with REQUEST_URI to RewriteRule with new Domain does not work by Muhammad Rizwan on serverfault.com

naa- by DavidPostill on .htaccess RewriteCond [MS]

naa- by DavidPostill on Fetching encoder value with SimpleMotion library by Granite Devices [MS]

[ SmokeDetector | MS ] Bad keyword with email in answer: Manually calculating logistic regression coefficient by Henk de Swaan Arons on stats.SE

naa- by DavidPostill on RewriteCond Exception with REQUEST_URI to RewriteRule with new Domain does not work [MS]

naa- by Ferrybig

Andy

@Undo Good luck in the new position

Can you share where it is? No biggie if not, I'm just curious

@DavidPostill are you referring to my message? I thought I deleted it?

@Undo good luck!

5:59 PM

@Glorfindel Yes. But it's still visible in the transcript (at least for me)

@Glorfindel Never mind - it's a user script "Show deleted chat messages for Stack Exchange" :)

[ SmokeDetector | MS ] Bad keyword in body, link at end of body, pattern-matching website in body, repeated URL at end of long post: The other elements in the ingredients by Liam Lily on superuser.com

tpu- by Ferrybig

6:20 PM

[ SmokeDetector | MS ] Link at end of answer: In the Base + Offset addressing, Offset address is also known as by Fiha jamshaid on stackoverflow.com

6:33 PM

naa- by Ferrybig

[ SmokeDetector | MS ] Few unique characters in body: result from get method is not displaying in View angular 2 by user3431310 on stackoverflow.com

Wrzlprmft

6:49 PM

!!/report graphicdesign.stackexchange.com/a/88266/19174

[ SmokeDetector | MS ] Manually reported answer: In gimp, anyone know how to remove the background of text logo with image inside it? create a watermark by Background Removal Service on graphicdesign.SE

tpu- by Jan Dvorak

@SmokeDetector v

@DavidPostill ah, I blamed it on mod powers. Sorry for the inconvenience, it turned to be a little more annoying than I thought.

@DavidPostill can I get a link to the userscript?

Also, FR: add an indication whether the message is deleted

7:04 PM

@JanDvorak Only room owners and moderators can see the deleted transcript

I meant outside of transcript

[ SmokeDetector | MS ] Manually reported answer: Python exit from all function and stop the execution by pdbu on stackoverflow.com

tpu- by Glorfindel

@SmokeDetector K

@JanDvorak The script only work for mods and room owners. You can get it at meta.stackexchange.com/a/246765/267099

quartata

7:20 PM

ROs can see deleted messages?

never mind then. I'm neither.

@quartata Yes.

o.O

7:53 PM

[ SmokeDetector | MS ] Username similar to website in answer: Granite devices IONI servo drive by Granite Devices on robotics.SE

@SmokeDetector f

8:05 PM

API quota rolled over with 14499 requests remaining. Current quota: 19999.

stackoverflow: 213
askubuntu: 77
superuser: 64
chemistry: 49
math: 46
unix: 45
electronics: 42
english: 37
academia: 36
stats: 30
apple: 26
gaming: 25
drupal: 24
mathoverflow.net: 24
cs: 21
ell: 19
wordpress: 17
webapps: 16
physics: 16
mathematica: 15
ru.stackoverflow: 14
es.stackoverflow: 14
worldbuilding: 14
patents: 14
arduino: 13
raspberrypi: 13
travel: 13
salesforce: 13
gis: 12
scifi: 12
android: 12
diy: 12
dsp: 11
expatriates: 10
money: 10
tex: 10
rpg: 10
gamedev: 9
softwareengineering: 9

Don't really like sharing the actual company because it's pretty much location-identifying combined with my state

8:19 PM

45 minutes if you take the bus ...

Don't be late every day :)
My Dad used to live opposite the school gates. He used to wait until the bell rang for assembly and then run to school. He was late every day...

[ SmokeDetector | MS ] Blacklisted user: Precision to_double by fuzz on stackoverflow.com

fp- by Glorfindel

Conflicting feedback on Precision to_double.

@SmokeDetector I made a mistake there

[ SmokeDetector | MS ] Bad keyword with email in answer, email in answer: How can I earn money with torrents? by Olivia Miguel on gaming.SE

tpu- by Glorfindel

[ SmokeDetector | MS ] Bad keyword in answer: What would be the evolutionary pressures of horned simians? by creeon on worldbuilding.SE

fp- by Glorfindel

[ SmokeDetector | MS ] Shortened URL in body: NOOB NEEDs HELP in Choosing the Right Amp! by audiophile420 on sound.SE

fp- by Glorfindel

8:51 PM

Restart: API quota is 19816.

9:04 PM

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword in username: Change "logged in" link in (you must be logged in to post a comment) by Toko Obat Bius on wordpress.SE

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword in username, bad keyword with a link in answer: Change "logged in" link in (you must be logged in to post a comment) by Toko Obat Bius on wordpress.SE

tpu- by Glorfindel

naa- by Glorfindel on Change "logged in" link in (you must be logged in to post a comment) [MS]

tpu- by Ferrybig on Change "logged in" link in (you must be logged in to post a comment) [MS]

9:31 PM

[ SmokeDetector | MS ] Offensive answer detected: How to preemptively block a non-contact on whatsapp by user216414 on android.SE

tpu- by Glorfindel

[ SmokeDetector | MS ] Username similar to website in answer: You had me at hello by MarkSill on codegolf.SE (@quartata)

fp- by Glorfindel

9:50 PM

@SmokeDetector Any progress on ~~abusing~~ making productive use of the extra quota?

Mithrandir

10:08 PM

!!/report puzzling.stackexchange.com/questions/6321/…

[ SmokeDetector | MS ] Manually reported answer: Longest Calculator Word? by urmum on puzzling.SE

naa- by DavidPostill

tpu- by Wrzlprmft

[ SmokeDetector | MS ] Blacklisted username: How can one "under-average Joe" fight monsters? by Lololololol on worldbuilding.SE

fp- by Wrzlprmft

@JF @ArtOfCode has data IIRC, I've been too busy to look at it.

It's a simple task of adjusting thresholds, really. Just need to figure out which ones are beneficial to lower, then taking the ones we can afford with the quota, minus whatever buffer we want.

It's something anyone here could do, actually.

Mithrandir

I thought pulling the comments on the math sites was good, because the Thierno guy was putting the stuff in the comments to avoid detection.

Would be nice, but it'd pretty much need to be a fork of what we have. We're not set up to handle comments.

It'd be easy to just push them through the regexes, but the issue is that there's no good way to get realtime notifications network-wide.

If you're limiting it to a couple of sites, it's possible to just hit /comments every few minutes. Can't do that network-wide, though.

Mithrandir

:/

10:20 PM

@Undo Actually, maybe you could. Depends on what your target response time is

@Undo Talking to yourself again? Or are there two of you? ;p

Smokey already hunts spam on Aviation: metasmoke.erwaysoftware.com/… members can always hop into the charcoal chatroom to report possible spam that might have been missed. — rene 2 mins ago

We are definitely only one person.

@rene Looks good, thanks :)

yw

10:44 PM

@Undo yeah, need to do the final stage of figuring how much to change each site by

But I have data on which we should change

/me abuses mod edit powers because ISO8601

@Undo fyi, you've already given out enough information to identify it if I had 10 minutes to spare to look through the list