> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Title - Position 0-1: 🍆 Body - Position 0-1: 🍆 Username - Position 0-1: 🍆
[ SmokeDetector | MS ] Blacklisted website in body, pattern-matching website in body, potentially bad asn for hostname in body (198): Facing problem in CSS by Andrew on meta.SE
@Zoe @Henders SD not listening here in CHQ happens from time to time. Usually, it will still be listening to other rooms, and/or on other servers. When it happens, going to one of the other rooms where it's still listening and giving the !!/reboot command usually fixes it. I usually try Charcoal Test, SOCVR, then Tavern on the Meta.
@doppelgreener That pattern looks like it's already caught by Blacklisted website in body and Blacklisted website in answer; append -force if you really want to do that.
@CalvT I don't think so. Spam campaigns in the past have begun to vary which contact details they've supplied after one or two started getting caught. I won't begrudge them the offer to have all of them provided to us at once.
@doppelgreener Usually, we begin with watching and wait until there's a few posts with the pattern prior to blacklisting. Are there additional posts with this pattern which have not been reported to SD? [I'm not really objecting, as it has a relatively low chance for FP. Note: a change to our blacklisting guidelines is currently being discussed.]
@Makyen Yeah, I'm familiar with those guidelines. We've also discussed them in here several times with folks like Undo and ArtOfCode acknowledging there's a point where you don't have to wait for an arbitrary number because it's obviously unequivocally going to be spam. I usually wait for several hits, I decided that was not necessary in this case.
They are after all literally a spam group spamming spam
@doppelgreener There are generally two issues wrt. generating FP: A) is what's attempted to be detected actually spam; B) is the pattern that's being added something that will detect other things that are FP which it's not intending to detect. Both of those issues are things we try to mitigate by watching patterns, at least for a time, prior to blacklisting.
For website blacklisting, particularly with entries that are generic words in themselves like spam\.group, or that are quite short, there's a significant issue with potential FP, because the website blacklist does nothing to try to ensure that what's actually being detected is a website, domain, or part of a URL and is not part of larger words.
Unlike the keyword blacklist and watchlist (those bookend detections with \b, so you're only detecting full words), the website blacklist (and username blacklist) just use the exact regex pattern you provide to test against post bodies and titles. So, spam\.group will detect things like "This is not spam.Groups like...", "antispam.group", etc. I'm not saying that it's going to be a big issue in this particular instance, but it's something that needs to be kept in mind.
@doppelgreener Blacklisted websites and blacklisted usernames have no boundary. Blacklisted keywords and watchlist entries are bounded by \b on both sides.
[ SmokeDetector | MS ] Mostly punctuation marks in body, offensive body detected, potentially bad keyword in body, repeating characters in body, toxic body detected, +1 more (276): Do I exist, do I? ✏️ by Mark on stackoverflow.com
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username ---------- Title - Position 0-1: 🍆 Body - Position 0-1: 🍆 Username - Position 0-1: 🍆
> Potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username, title has only one unique char ---------- Title - Positions 0-1, 1-2: 🍆 Title - Position 0-2: 🍆🍆 Body - Positions 0-1, 1-2: 🍆 Username - Positions 0-1, 1-2: 🍆
I just nuked another 10 accounts trying to sneak in innocent devops questions to be answered by other accounts with the target payload, catlight dot io.
@MartijnPieters That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@MartijnPieters That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
