@Undo routerlogin.net is valid. It's registered to Netgear. However, the actual domain that they link to, netgearkb.net, is registered anonymously, and appears to be a spoof site. Or, at least, that's what it looks like to me.
Does SmokeDetector also check for text in HTML comments?
Like if I write a perfectly good answer (or question), but with an HTML comment like <!-- viagra penis enlargement free bitcoins [email protected] -->, will it flag it?
@forest Actually, it's not the raw HTML that SE renders. It's been processed by SD. While I haven't looked at the SD code which does the processing, at a minimum it has has all <, > and & changed to <, >, and &. This means it's A) unsafe to use directly, B) renders inaccurately when used directly, and C) you are not guaranteed to be able to recover the HTML which SE actually provided through the SE API. It is, however, easier to run regexes against.
@iBug Thanks. Yeah, I had more-or-less assumed it was translating the other HTML entities too, but the ones I listed are the main issues when attempting to render the resulting text (e.g. in <code> you now have actual HTML tags instead of something that renders as text, which means that you have both security and rendering issues when using it). SD needs to unescape() it so that the processing of the text is closer to what we humans are expecting (i.e. what we write regexes for).
I just question if we should be storing the SD html.unescape()'ed version, the version that is provided by the SE API, or both. Probably best would be to store both. We need the unescaped version against which to run database searches, but it would be nice to have the SE original for rendering (since it can't be 100% accurately recovered).
Hey guys, just saw some new spam around the url csharpstar.com. I mod flagged the answers (for >10k) 123. Can we add csharpstar.com to the Smokey blacklist?
@tripleee That we have only 2 reports containing csharpstar.com is a bit disturbing. There are 5 occurrences in URLs plus 3 occurrences not in URLS on SE (all on SO). All were posted after the blacklist was added. So, we only detected and recorded 2 of 8 occurrences in that time.
[ SmokeDetector | MS ] Bad ns for domain in body, bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, +1 more: Thermo Burn weight burn by user401677 on meta.SE
@SmokeDetector Still alive [ MS]. Link is misleading. Link text shows and question states a valid domain, which is owned by Netgear. The actual URL for the link is a spoof site, which is registered anonymously.
@SmokeDetector All 5 of the user's answers on SO have undisclosed affiliation. All the answers are from 2014, but I've left comments. The user was last seen on SO on 2018-09-04 and Magento yesterday, so there's a chance they might update the posts to have disclosure. Their 5 answers on Magento don't have undisclosed affiliation.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, body starts with title and ends in url, link at end of body, +2 more: Revitalize Serum by fakojaf on askubuntu.com
> Pattern-matching website in body, pattern-matching website in title, potentially bad ns for domain in body, potentially bad ns for domain in title ---------- Title - Position 1-17: supplementcost.co Title - supplementcost.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphosting.com. Body - Position 1-17: supplementcost.co Body - supplementcost.com NS suspicious dns1.namecheaphosting.com.,dns2.namecheaphosting.com.
@tripleee That pattern looks like it's already caught by Pattern-matching website in body, Blacklisted website in answer, Blacklisted website in body, and Pattern-matching website in answer; append -force if you really want to do that.
@tripleee Since Smokey is always one of the users to cast a flag on every autoflagged post, if autoflagging goes haywire on a specific site, it makes sense to temporarily stop humans' autoflagging if Smokey's unable to cast a flag on a site (as a result of a flag ban)
@Shree That pattern looks like it's already caught by Pattern-matching website in answer, Pattern-matching website in body, Blacklisted website in answer, Blacklisted website in body, Bad ns for domain in body, and Bad ns for domain in answer; append -force if you really want to do that.
@tripleee This way, moderators can simply stop Smokey's autoflags by declining them, rather than having to reach an admin, and we have times here when none of the admins are active.
[ SmokeDetector | MS ] Bad keyword in body, blacklisted website in body, body starts with title and ends in url, link at end of body, pattern-matching website in body, +2 more: trouble shoot the potential problems by hoiert201 on askubuntu.com
@TheDarkSide You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.
[ SmokeDetector | MS ] Url in title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +3 more: x4up.org/body-slim-down/ by user48362 on rpg.SE
[ SmokeDetector | MS ] Bad ns for domain in body, bad keyword in body, blacklisted website in body, body starts with title and ends in url, link at end of body, +2 more: There are both essential things by brosa8113 on superuser.com
@gparyani I think the "no-restart" facility actually bypasses this error and so it only manifests when the Smoke Detector instance tries to interact with Github directly ... but I haven't reviewed the recent code changes in this area
iBug should be able to tell but probably left for bed already
[ SmokeDetector | MS ] Bad keyword in body, pattern-matching product name in body, pattern-matching product name in title, pattern-matching website in body, potentially bad keyword in body, +1 more: Slim Max Keto Trial Review by simonkilani on stackoverflow.com
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, body starts with title and ends in url, pattern-matching website in body, potentially bad ns for domain in body: Praltrix Australia Notwithstanding, by caropinmax on graphicdesign.SE
@tripleee That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
[ SmokeDetector | MS ] Url-only title, blacklisted website in body, blacklisted website in title, link at end of body, pattern-matching website in body, +4 more: healthyskylane.com/paltrox-rx/ by pcuztps on askubuntu.com
