@ArtOfCode I assume the "Spam Checks Maintainers" section correlates to "code admin" permissions aka blacklisters? In that case my name should probably be moved up there from the "regular" member section...
Is there a Stack Overflow site for discussion on email scams and phishing?
Here's my question:
I have dealt with a lot of spam over the years, as I am sure everyone else has. Gmail has gotten pretty good with their spam filters. But this is a recent occurrence, I can't quite figure out the p...
Proposal for Helios - a centrally managed SmokeDetector database - is available
10
TL;DR: Move the lists that SmokeDetector currently maintains (blacklists, watchlists, notifications, permissions eventually) to a location that better facilitates management of these. The idea is that any instance would be able to quickly and without messing with git get up and running with the latest version of all lists.
Moving from Git to something like this eliminates one of our most fragile processes - git.
Currently adding to a blacklist involves submitting a command, editing a file, submitting a pull request, going through CI, pulling the change, restarting.
Any of those steps can (and do) fail.
This new process would still edit a file locally (for caching) and then send a single HTTP call to update the remote system. That's it. No messing with git.
Other instances of Smokey would receive these updates either on start up or promotion from standby by issuing a single HTTP call and updating the local cache. Very similar to a git pull, but faster.
The proposal is long, but it includes a test script, sample output, and details about each of the end points for this proof of concept.
Please read it.
If you have questions or feedback, either here or comments on the gist work well.
@ArtOfCode - Any ideas about this issue. I leave the branch at deploy and make sure it's up to date, then start smokey. Apparently, some time between last night and this morning, it's diverged?!
@NobodyNada I pulled before I went to sleep. The first watch command issued was the one by you when you discovered the problem so I don't think it's that...
(Although I have no idea what it could be of course...)
Title - Position 1-19: Ultra Muscle Testo Title - Position 7-13: Muscle Body - Position 44-62: ultra-muscle-testo, Position 91-109: Ultra Muscle Testo, Position 753-771: ultra-muscle-testo, Position 831-849: ultra-muscle-testo Body - Position 20-43: supplementch3mistry.com, Position 729-752: supplementch3mistry.com, Position 807-830: supplementch3mistry.com Body - Position 20-42: supplementch3mistry.co, Position 729-751: supplementch3mistry.co Post - Link at end: http://supplementch3mistry.com/ultra-muscle-testo/</a>
Body - Position 10-26: Male Enhancement, Position 224-240: Male Enhancement, Position 344-360: male-enhancement, Position 422-438: male-enhancement Body - Position 97-102: penis, Position 259-267: erectile Body - Position 73-84: supplements Body - Position 318-337: allsupplement4u.com, Position 396-415: allsupplement4u.com Body - Position 321-336: supplement4u.co Post - Link at end: http://allsupplement4u.com/alpha-male-enhancement/</a>
@JakeSymons Moderators will notice the spam/abusive flags and act on them.
In some cases, one must contact a moderator directly, for example when a user has spammed some, but not all, sites that they've signed up for, and the user profile is used to display spam.
what we do here is we try to keep track of repeat spammers. So when we "blacklist" something it just means that we put it in Smoke Detector's database, so that it will alert if it ever sees it again. We have no (direct) power over what Stack Exchange moderators do (but of course a few of them hang around here as well) and don't have any powers that we would not otherwise have as users of these sites
moderators and ultimately SE admins have their own systems and e.g. IP blacklists which we don't have any access to
when we flag a post as spam, it gets added to a moderator queue, and when it receives enough flags, the post will be deleted. A moderator can still after this point delete the user's account etc which is a distinct, separate action which again we have no direct influence over
so in summary, we just automate some of the things we would do as regular users anyway
it helps that we are coordinated, so when Smoke Detector reports a spam message here, it often gets deleted within less than a minute
though during off hours it can take significantly longer, especially on low-traffic sites
as a low-rep users you don't see some of the things many of us see, so you have limited access e.g. to flags
as you learn the system and earn rep, you are able to do more, as the site places more trust in you in return for your contributions
@JakeSymons a lot of the regular expressions we use are fairly blunt. As long as the spam reports clearly dominate over the false positives (false alarms, aka FPs) we tolerate that they're not perfect
so clearly among the hits in Metasmoke's database, the TPs dominate, massively
(I guess you need to be a registered Metasmoke user to be able to use the regex search but you can approximate it if you don't; just uncheck the regex box and search for just "muscle")
@JakeSymons Yeah, we call that time period "spam hour." It's at exactly the same time as Indian business hours, and during that time period the pharma spammer posts a crazy amount of spam
I am creating this question to collect any relevant observations you can provide about the dominant spammer in the Stack Exchange network.
More specifically, I am asking about the spammer who currently dominates the Metasmoke spam archive collected by the Charcoal HQ volunteer anti-spam effort.
...
@JakeSymons just body is fine, it's an AND search so it applies all the constraints you put in any of the boxes, just leave the ones empty you want unconstrained
so you can search for title:http:// and body:.co.in or whatever
@NobodyNada it's unlikely that the government cares but they are quite likely violating the Terms of Service of basically all the network service providers they use
one of the purposes of that post is to collect enough evidence to contact Go Daddy, Cloudflare, WhoisGuard, etc and actually have them take action
but my experience is that you have to have massive evidence (and/or a very long time) to see real results
especially for a pesky "snowshoe spammer" who takes care to only leave a small footprint on any one individual service provider
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Title - Position 1-19: sublime-things.com Body - Position 1-19: sublime-things.com Username - Position 1-19: sublime-things.com
@tripleee I've been taking a look at the source for Halflife and I think it would be good if the ActionCable bits were in another file and each individual check was in its own file and registered themselves with the checker
Should I try refactoring it or do you have different plans for it already?
I'm not sure if you've noticed that we actually have a different meaning for "spam" on this site than the the way the term is used outside the network.
Is there a Stack Overflow site for discussion on email scams and phishing?
Here's my question:
I have dealt with a lot of spam over the years, as I am sure everyone else has. Gmail has gotten pretty good with their spam filters. But this is a recent occurrence, I can't quite figure out the p...
