@SmokeDetector this still alive, 27 minutes

@ArtOfCode It hasn't been on

@quartata Yes

@thesecretmaster uhhh you sure

because

the logs say otherwise

it was coming from your IP

Lemme check something

obviously it was your little brother

Those Hinduism posts are still alive, they were even autoflagged...

@Rob If AdvancedFlagging is gonna make a bunch of requests for a whole load of different posts... could it bunch them up into one instead of a request per post?

@ArtOfCode Ooh, yes, that's me sorry

I click buttons very quickly

hmm... although I haven't been visiting SO

You click three buttons a second? I doubt it :P

well it checks on page load

all the answers

@quartata Was testing my load testing script on local MS

@thesecretmaster ....ah

Ah I'm dumb

@thesecretmaster that... was not local :P

I added url: localhost:5000 to my config file, but that's not what actually sets the url

My bad, sorry y'all

But, your local MS came through with flying colors. Didn't slow down at all. :-)

@thesecretmaster Heh. I have an adaptation of the script that lets you set it in config. Wanna throw it in a repo and I'll send you a PR?

@Makyen I have to admit, I was confused by the (lack of) logs

@quartata definitely not you, the IP is Australian

gonna assume it's Rob :P

I'll just go and add that to config. But I'll toss the whole thing in a repo later tonight.

@ArtOfCode what if I'm behind 7 trillion proxies

then you couldn't get requests through that fast :P

anywho you'll probably get a faster response on chat.SO if he's online now

he should definitely fix that, just do one batch on page load

although that raises trouble with browser caching -- if a new answer pops up all of them have to be fetched

ehhhh

probably not a big deal

I'm my third band-aid for the same cut... maybe it's time to panic ask a question on Health

(xmlhttprequest can hit the browser cache right?)

PANIC

Also, Art/Undo, do you want to setup some ip rate limits for MS?

Actual command I just ran: rails g controller AbuseComments

Because I shouldn't be able to accidentally DOS metasmoke.

@thesecretmaster eeeeeeh. nginx IP rate limiting is kinda painful.

Needs @Undo, though, so I don't have to make the decision :P

Not if the pain has already happened, so you're just copy pasting :)

pretty sure I still have SCOT entries in my nginx config somewhere

I definitely have them

...huh, that's less painful than I remembered

[ SmokeDetector | MS ] Offensive title detected, potentially bad keyword in title: FUCk FUCk FUCK? by AnnoyingQuestions on stackoverflow.com (@Zoe)

You just allocate some memory and give it reqs/sec.

@thesecretmaster Depends. If it's a new cut, it may require some pressure. OTOH, it could be indicative of the cut being more severe than you should handle on your own, or of issues with you blood clotting, both of which would mean you should seek medical help. Depending on how bad, you might want to do so immediately.

@SmokeDetector That doesn't sound like a question to me...

@SmokeDetector vandalism but we should still Blacklist user

@WELZ Registered question as true positive. If you want to blacklist the poster, use trueu or tpu.

tpu- by ByteCommander

@Makyen Also depends what the cut is and how it was done. Three plasters is not necessarily an issue.

@thesecretmaster?

@thesecretmaster plus specify burst and tell nginx which app to apply it to

@ArtOfCode Very true, but over the internet, particularly without any more information, I'd rather error on the side of caution.

@ArtOfCode 19 degree lens tube

@thesecretmaster Lacerated or incised?

I think I'm fine. It's just weird.

@ArtOfCode Time for tsm to google some words!

@thesecretmaster Is it like you cut yourself with a really blunt rock (messy), or with a really sharp knife (dead straight)

@ArtOfCode The former

@thesecretmaster how big?

@ArtOfCode o/

Por que?

!!/report travel.stackexchange.com/a/114602/38308

[ SmokeDetector | MS ] Manually reported answer: Which are the quietest seats on these aircraft? by Kate Williamson on travel.SE

@DJMcMayhem was attempting to work out who was hitting MS

@SmokeDetector Code golf got this same link, which is why I'm more inclined to think it's spam

@DJMcMayhem that site just posts polls.

I'm not so sure, but it's definitely naa - should be a comment

@ArtOfCode 3/4 of an inch (I'm sorry, I'm in the US) long, pretty shallow. explanation

@DJMcMayhem good catch - will require a custom flag though

!!/watch metropollitan

@DJMcMayhem You don't have code privileges, but I've created PR#2147 for you.

@thesecretmaster sounds approximately normal. You should be worried if the flow isn't slowing down (compare how soiled the previous plaster is to the current plaster), or if it gets excessively red and inflamed.

@DJMcMayhem metropollitan\.com so we don't catch random usage of the word "metropollitan"

@DJMcMayhem That's way too broad of a watch. Try !!/watch metropollitan\.com

@ArtOfCode That's good. I don't think I'm gonna die. I was wearing a hard hat at the time, so I know I was being safe...

@ArtOfCode I think there are some Rails middleware solutions for that. Likely less painful, can distinguish between authenticated and not, etc.

Alright alright

@thesecretmaster reminds me of the Top Gear rail crossing safety video...

!!/watch metropollitan\.com

@DJMcMayhem You don't have code privileges, but I've created PR#2148 for you.

@thesecretmaster this one

@Undo nginx isn't all that bad, actually. I can give you config for it if you want.

Just realized it's "Metropollitan" probably wouldn't have mattered -_-

If you've got it handy, but I am kinda partial to the idea of something we can turn on/off with a SiteSetting

You definitely want this done at the Nginx level

@Undo that... could be useful, but likely also slower

Nginx is async -- if you do it at the Rails level, it means it has to be dispatched to a worker to handle it even if it's just going to throw a 403, making it pointless

nginx config: outside your server block, add limit_req_zone $binary_remote_addr zone=metasmoke_app:1m rate=2r/s;

Inside the server block's location / block, add limit_req zone=metasmoke_app burst=5 nodelay;

[ SmokeDetector | MS ] Link at end of answer: svn branching/tag gui tool for linux? by Lazy Badger on stackoverflow.com (@Zoe)

is pullapprove broken?

no?

Everyone: please be sure to use the new "reason" operator so it's clear to those in other chat rooms why you filed a manual report. @DJMcMayhem I didn't think it was spam until I bothered to check this room; I generally check in Tavern on the Meta.

@gparyani Oh, sorry. I didn't know about that. What's the syntax?

@ArtOfCode Ouch

!!/report [link1] [link2]... "reason"

Reason must be in quotes

@quartata Returning in a few ms is better than letting the attacker run /reasons, but point taken. Nginx would scale better

Yeah, it's more effort to saturate the workers that way but it's still possible

I'd recommend hard hats to anyone who walks into foreign objects on a regular basis. Or anyone who has extra stickers and wants to show them off.

Whereas if Nginx is taking care of it then it probably won't flinch; it can reject them while waiting on real requests

On mobile, but can start the conversation: What's a sane max for req/s? Some legit userscripts hit light routes pretty hard

I'd say 10 is decent.

@thesecretmaster ugh, AV equipment. I hit my head on one of those anodized metal racks, left a divit for months.

@Undo 5 seems to be the most that anything actually does

No one makes anything soft in that space

Yeah, I walked into a vertical pipe today. Luckily no harm done.

afk, but nginx throttling seems reasonable

@ArtOfCode Yeah, should be doable with a bit of work. I'll see if I can rework it today

@thesecretmaster While the userscripts can adjust to this, 10 is way below what's currently done by the userscripts. However, that is primarily because many of the routes the userscripts use don't permit specifying multiple posts.

In theory, you can apply the rate limit only to expensive routes.

@ArtOfCode github.com/Charcoal-SE/SmokeDetector/pull/2148

@Undo Heh. If you're doing that kind of thing, get a headlamp and ear protection that attaches to your hard hat. You can even get a sharpie that attaches.

Merged SmokeDetector #2148.

@WELZ just doesn't like you

Discrimination

CI on 3b0e551 succeeded. Message contains 'autopull', pulling...

towards welz(y|ie)s

[ SmokeDetector ] SmokeDetector started at rev 3b0e551 (metasmoke: Merge pull request #2148 from Charcoal-SE/auto-blacklist-1525911965.7307863 --autopull) (running on ArtOfCode/EC2)

Restart: API quota is 12395.

[ SmokeDetector | MS ] Bad keyword in answer, offensive answer detected, potentially bad keyword in answer, toxic answer detected: 'Whatever happens, happens for good, is this verse found In any scriptures? by Muhammad on hinduism.SE (@NogShine @Pandya @Zoe)

Quite literally, the change from API v1 to v2.0 resulted in a change from 1 call to the /api/posts/url route to up to hundreds of calls to multiple other routes in order to get the same information to populate the information actively displayed to the user in a chat room. The userscripts can spread that out over time, and just delay showing information to the user, but it's still routes that are going to be hit.

tpu- by Makyen

@Makyen That sounds like a different problem. If you need an API route written, I can try to write it.

What we could really do with is GraphQL... but my attempts so far have been pretty fruitless

[ SmokeDetector | MS ] Potentially bad keyword in body: GS-JJ / custom patches by custom patches on superuser.com (@Zoe)

tpu- by ByteCommander

@ArtOfCode Should the queue timings for something that triggers a scan be included?

That is, the time spent in queue is 0

(do you get what I mean?)

(nope)

@thesecretmaster If you want to know the specific routes, they were mentioned here and a few messages below that.

@ArtOfCode So if you have an item in the queue and the threshold for scanning is 2, when that second post comes in it'll get a queue time saved of ~0 seconds

since it goes into the queue and immediately leaves it, because we've reached the threshold

@thesecretmaster Basically, getting data for a MS post requires 4 API calls (potentially more, but the userscripts don't really use other data). Three of those routes don't permit specifying multiple IDs (of any type). Thus, to get data for a complete chat, transcript, or search page, which could have > 100 SD posts, it requires 1 + 100 *3 = 301 API calls when the user loads a page.

@quartata yup

@ArtOfCode Like, not working? Or working, but not useful?

@thesecretmaster not working. I haven't had enough time to learn about it and apply it

I just got it up and running. Want a PR once I get it to a useful state?

@thesecretmaster absolutely

K, give me another hour/half hour.

stick it under /api/graphql or /api/gql if that's not difficult, just for continuity

@thesecretmaster That short? Undo's going to have a giant deploy coming up, I've got a huge feature approaching completion too :P

I might be exaggerating a bit, but it seems super simple to me thus far.

[ metasmoke ] ci/circleci failure on 1879e9b: Your tests failed on CircleCI

@SmokeDetector will this also retroactively work on existing comments?

Restart: API quota is 12176.

Apparently, nobody seems to have interest in running on GD.SE. If anybody wants to quickly get 300 rep - I'd be happy to vote for you as my 2nd choice 😂

@ArtOfCode probably

@WELZ an election won't fire if there are less than the number of seats

oh, only 1 seat

There needs to be at least 1 more than the amount of seats

yeah sorry thought there were 2

@thesecretmaster it might well be, I just didn't have the time to dedicate to figure it out

[ metasmoke ] ci/circleci failure on ae5fb14: Your tests failed on CircleCI

...huh, almost 1k LOC changed in that abuse report feature

59 files touched

I honestly hope I never, ever, have to modify bodyfetcher again after this

I don't want to even think about it

It's nothing wrong with the code itself

It's just how the smallest thing can lead me down a 15 minute design rabbit hole

I don't know what it is about how this is structured

[ metasmoke ] ci/circleci success on 9a45493: Your tests passed on CircleCI!

Hey @quartata can you change bodyfetcher so that it…

:P

@SmokeDetector This is one of things that really annoys me about Rails, it makes all these empty files

...grows wings and flies

@quartata yup. You can clean 'em up, I just... don't care enough.

430 files that are actively getting linted

Restart: API quota is 12065.

[ metasmoke ] continuous-integration/travis-ci/push failure on 3c7f0e1: The Travis CI build failed

@quartata @WELZ post tags fixed

[ metasmoke ] ci/circleci success on 3c7f0e1: Your tests passed on CircleCI!

[ metasmoke ] continuous-integration/travis-ci/push error on 642e25f: The Travis CI build could not complete due to an error

[ metasmoke ] ci/circleci success on 642e25f: Your tests passed on CircleCI!

Whut eez post_comments table?

Comments on posts

there's some on this one

and... you're gonna want to merge master, there's 4 new models in there

Hiss

@ArtOfCode Thanks

@ArtOfCode That abuse report stuff doesn't need to be in the graphql api does it?

@thesecretmaster Might as well, if it's not abnormally difficult to add

@ArtOfCode Okay. Batching is now implemented for AF. I've pinned a message in SOBotics asking people to update, but I'm not entirely sure who's using the script

It's actually super simple. I might try to get fancier later, but for tonight I'm sticking to the easy stuff.

@Rob sweet, cheers

What does an edit on a spam or R/A flag does? Does it cancel the red flags on the post?

no, only rollbacks cancel flags

@NogShine An edit doesn't but a rollback to a version prior to the edit drops the flags placed on the edited version.

Then what are the negatives if spam posts are edited?

@NogShine Should spam posts be edited?

fp by Nisse Engström on Which are the quietest seats on these aircraft? [MS]

fp by Nisse Engström on Ubuntu 18.04 3D acceleration on VirtualBox [MS]

fp by Nisse Engström on How do I deal with my over expecting boss who scolds me everytime? [MS]

tpu by Nisse Engström on Is Mahamaham connected with kumbh mela? [MS]

@Makyen This applies to R/A posts too. Right?

Something interesting to note: our overall TP rate is down to 80%

Obviously this is reflective of our newfound trigger-happy watch philosophy

@NogShine Yes. With the exception that posts which are actual questions or answers that only incidentally use offensive language should be edited to remove the offensive language and rescue the post.

Not a bad thing as long as lots of humans are involved

A new dril tweet that perfectly sums us up:

@quartata Frankly, that's something that I've wondered about. While we obviously don't want to gratuitously watch things, obtaining the goal of detecting all spam more or less requires looking at a higher % of FP, as many things require being able to look at more than what's available to SD (at this time) and to be able to differentiate between spam and not-spam that just isn't available automatically. Are we really wanting to sacrifice detecting more edge-case spam in order to have a low FP?

[ metasmoke ] ci/circleci failure on bcd4b2d: Your tests failed on CircleCI

[ metasmoke ] ci/circleci failure on bcd4b2d: Your tests failed on CircleCI

I'm under the impression that we have two goals, A) catch all the spam and B) automatically flag all the things we are highly confident are spam. That means that we're really looking at multiple classifications, which get confused because we only talk about TP and FP.

We really have a class of things which are TP, but which includes a subset of Believed to be Known Spam (i.e. things that are autoflagged and are classified as TP by users), along with Possible Spam marked TP (ie. reported posts which are marked TP). Then we have FP, which includes everything else, but which has subsets of Believed to be Known Spam which is classified as FP (those FP where we autoflagged), Possible Spam marked FP (non-autoflagged posts marked FP) and all unreported posts.

This is the debate where we come back to the project definitions

Smokey aims for zero false negatives (i.e. no missed spam posts)

Autoflagging aims for zero false positives (i.e. no flagged legit posts)

@Undo My changes are good to go, but @thesecretmaster has some incoming soonish which you might wanna wait for

(got a rough ETA on those?)

CI pending now

[ metasmoke ] ci/circleci success on 076dfca: Your tests passed on CircleCI!

[ metasmoke ] ci/circleci success on 076dfca: Your tests passed on CircleCI!

Just need approval on the PR

It's not done, but it's done enough that we can play with it a bit.

Reading code

It's pretty simple

Just a list of attributes that get exposed

Thanks

@thesecretmaster What's the /graphiql thing do?

So, now I'm good to deploy

Good to go @Undo

@ArtOfCode Was in the template for one of the tutorials. I assume it's a thing to make dev faster? Debug-er? Something-er?

Wait it doesn't check for an API key

@ArtOfCode Which is what I understood to be the case. It's just that zero false negatives effectively means we will see a moderate FP rate, but we shouldn't feel that's inherently bad. Obviously, we don't want to have FPs grow without purpose. We should do what we can to reduce FP, as long as that doesn't result in missing significant TP.

@Makyen Yep, that

@quartata Well, it's just fur fun right now. Once it's done, I think we'll require keys.

[ metasmoke ] ci/circleci success on 5341eba: Your tests passed on CircleCI!

@ArtOfCode Speaking of, we should talk about that again. Since the meta post back in march, we've steadily crept up on the auto flag false positives. metasmoke.erwaysoftware.com/…✓&why=

@quartata going with that, I just spot checked 5 SO ones...you had auto flags on all of them. What are your conditions at? Or...I just got lucky and only picked ones you'd been selected for when auto flagging

@Andy quartata runs minimums

Tends to be the same folks on autoflagging fps, because they tend to be at the minimums.

[ SmokeDetector | MS ] Potentially bad keyword in body, potentially bad keyword in title: download Spotify music converter? by Audrey Clarke on askubuntu.com (@Zoe)

[ SmokeDetector | MS ] Potentially bad keyword in answer: download Spotify music converter? by Joe Gromny on askubuntu.com (@Zoe)

@Andy 1/21/3

@Andy Any 3 reasons, same as Art

I've recently changed them. The posts you saw were probably from that one time I got super unlucky and got a flag ban

@quartata I'd suggest knocking your min weight up a touch so that you don't get hit with three "potentially" reasons

My current reason is very accurate

I'm at 50/1/3

@ArtOfCode yeah perhaps, but it hasn't happened yet

I got it a couple times

@Andy Well, there were two today because we have both "Offensive answer detected" and "Potentially bad keyword in answer" trigger on just the f-word, and perspective gives that word a high score (probably in combination with many words). For these, we probably shouldn't be triggering both "Offensive answer detected" and "Potentially bad keyword in answer" from just a single word.

That one was actually a TP

They tried to do it again and Undo decided not to give the benefit of the doubt

Assuming this is the one you mean:

Yes, but should we count the first, or either, occurrence as TP or FP. The only reason that the second would be counted as TP is because it was second. Both were repairable.

m.erwaysoftware.com/posts/uid/stackoverflow/50256683

True positive or not, those two reasons still fall into the double dipping that we've been doing for months now

Then get rid of the watches

That is an actual legitimate double dip -- pretty sure it's literally just "fuck" which is already in the offensive regex

!!/test fuck

see?

While I agree that we shouldn't double dip, I disagree with some of the definitions used for "double dip". Specifically, some have suggested that the same thing detected in the body and title should not count as two different things. I disagree with that. Those are two separate things. OTOH, detecting the same identical thing just in the body is double dipping.

Offensive answer and toxic answer are the double dip on that post above. Why do we need to hit the same word twice with two different scores? Just a few days ago it hit a legit post. metasmoke.erwaysoftware.com/post/116152

Not all offensive posts are toxic, and not all toxic posts are offensive

But really what you're complaining about is not the reasons, it's autoflagging

We've made a big improvement recently which is to enforce an overall accuracy for conditions. It's cut down on FPs a lot

also that particular post would have autoflagged a year ago anyways

none of this is new

@quartata That's awfully presumptuous of you. That's not what I'm complaining about at all. I'm complaining about the reasons that are hitting the exact same things and effectively doubling a posts score.

I didn't mean it in a negative way. The flaw you're observing is inherent to how we do autoflagging currently

Two reasons that are similar should not double a post's score

That's it

[ SmokeDetector | MS ] Repeating characters in answer: How does Voyager 1 send signals to Earth? by not troll on space.SE

tpu- by Rob

@quartata And yet... metasmoke.erwaysoftware.com/post/118865 Offensive answer / toxic answer. Double score.

What we could really do with is some definition of reason difference such that if |A+B| >= 0.7 * Max[|A|, |B|], the reasons involved get a score penalty

[ SmokeDetector | MS ] URL in title, bad keyword in body, bad keyword in title, potentially bad NS for domain in body, potentially bad NS for domain in title, +2 more: bigconverter.xyz/ninogeshe-nandy-mp3-song-download/ by jacgrill on english.SE

tpu- by Makyen

tpu- by Ashish Ahuja

!!/unwatch f+u+[ck]+

@Makyen Removed f+u+[ck]+ from watchlist

that's one way to do it

!!/watch-force f+u+[ck]+(?<!fuck)

@Makyen That pattern looks like it's already caught by Toxic answer detected, Offensive body detected, Offensive answer detected, Potentially bad keyword in body, Toxic body detected, and Potentially bad keyword in answer; append -force if you really want to do that.

ooh, nice

[ SmokeDetector ] SmokeDetector started at [rev 291de11 (SmokeDetector: Auto unwatch of f+u+[ck]+ by Makyen --autopull)](//github.com/Charcoal-SE/SmokeDetector/commit/291de11) (running on ArtOfCode/EC2)

rather than a negative lookbehind you could also do {2,}

Restart: API quota is 11425.

@quartata But that's not what's desired (i.e. "fuc" and "fuk").

@Makyen yeah, that's true

trying to think

@Andy Mockplus was unusual and probably shouldn't be cited as an example

there were very, very old spam posts with it... I'm still not sure what's up

@quartata That seems unfair. It's being autoflagged. I think it's fair to talk about.

@Andy I strongly disagree that finding the same URL in the title and body is "double dipping". It's not. That's two separate things.

The fact that the URL was repeated is the piece of information that conveys

@Andy try to wring consistency out of this: metasmoke.erwaysoftware.com/…

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body: Vitax Forskolin by kasighat on apple.SE

Sometimes it's super spammy, sometimes it's not

@Makyen It's the same URL. It's doing an NS lookup. If it fails for the title, it fails for the body. There is no chance it can pass one and not the other.

At any rate we lowered it to a watch right after

tpu- by Makyen

Don't conflate bad blacklists with this sort of thing

@Andy Yes, it can. The user can not put it in the title, or not put it in the body.

We've done some bad blacklists in the past few months, partially because we have new code admins on board

@Andy Most of time when bad NS gets FPs, it's because it's someone's project that's shady or maybe they're just hosting on the cheap. But those are rarely going to be repeated in both the title and the body

[ SmokeDetector | MS ] Potentially bad keyword in username: Practice exam probability questions by John on math.SE

fp- by Makyen

!!/addwlu math.stackexchange.com/users/560567

@Makyen User whitelisted (560567 on math.stackexchange.com).