« first day (2435 days earlier)      last day (1314 days later) » 
00:00 - 18:0018:00 - 00:00

6:00 PM
naa- feedback received on How do I get to add videos to my website? [MS]
!!/watch mysfdcninja\.blogspot
@user12986714 You don't have blacklist manager privileges, but I've created PR#4197 for you.
PR#4197 ("user12986714: Watch mysfdcninja\.blogspot") opened by SmokeDetector
[ metasmoke-deploy ] deploy started by Undo
So... I did nothing.
I ran the exact same code as is in DeveloperController in the console, and it started a build
I cancelled that build, and now the deploy button works
I foolishly didn't try the deploy button before running code in the console
The only thing I can see is apparently there's an hourly limit on API requests: stackoverflow.com/questions/31178682/…
For us remaining_requests appears to start at 10
Which is low, but I doubt we're hitting 10 deploys/hour often enough to think the button is broken
New site Drones and Model Aircraft launched!
New site Matter Modeling launched!
New site Matter Modeling Meta launched!
^ Ran from the cronjob like it usually would, so the API key change worked
6:09 PM
Yeah, it's ... really unlikely for us to do 10 deploys in an hour.
@Undo Nice. \o/
@Dharman Are you needing in the ballpark of only 10 pages of 100 entries? I ask, because if you're getting 100's of pages (each 100 items), a more complicated implementation where you have multiple requests in flight at a time is beneficial. With needing about 10 pages, it's reasonable to just do them sequentially.
I am not sure...
100 items is only 2-3 days on average
I need 2-3 weeks
I assume ~1000 items should be enough
There are 4 non-area51 posts in the last 7 months that need sites updated
249267, 253558 and 253559 for matter modeling, 250330 for drones
Doing those
tpu- feedback received on How to sort Map by values [MS]
6:17 PM
[ SmokeDetector | MS ] Link at beginning of answer (35): React validate password and confirm password fields by Mauricio Henao on stackoverflow.com
naa- feedback received
[ SmokeDetector | MS ] Bad keyword in body (95): What are Soil Microbial Relationships by THINK PENTAa on biology.SE
@user12986714 Post 1: That does not look like a valid post URL.
tpu- feedback received
CI on 2ab450f succeeded.
CI on b360154 succeeded.
@Dharman The easier approach of getting the pages sequentially (while obeying backoff and errors) will work for any number of pages, within the quota limits, it's just not as fast as having multiple requests in flight at a time. The difference isn't all that much, as long as the number of pages is low. For a high number of pages, it gets quite noticeable to the human using the tool. For what it sounds like you're wanting, the easier approach looks like it's the way to go.
How would I do it in userscript? I have this at the moment:
function getHistory (userId) {
return new Promise(resolve => {
method: 'GET',
url: 'https://api.stackexchange.com/2.2/users/'+ userId +'/reputation-history?pagesize=100&site=stackoverflow&key=' + API_KEY,
onload: function(data) {
I need to wait for one AJAX to finish and call it recursively?
You will probably find it easier to use the in-page AJAX calls, rather than `GM_xmlhttpRequest`. Given that you're making a request of api.stackexchange.com there shouldn't be the CORS or cookie issues to get around, which are the main reasons to use `GM_xmlhttpRequest`.
Are you doing this in an environment where you have jQuery, or are you wanting vanilla JavaScript?
There is never too much jQuery
6:28 PM
fp- feedback received
[ SmokeDetector | MS ] Blacklisted user (71): What are the Soil Microbial Relationships? by THINK PENTAa on biology.SE
I thought there was a jQuery plugin to add two variables :)
@SmokeDetector f
@SmokeDetector f
[ SmokeDetector | MS ] Bad keyword in answer (86): What are the Soil Microbial Relationships? by THINK PENTAa on biology.SE
CI on 88cc55a succeeded.
6:32 PM
@SmokeDetector k
PR#4198 ("GH action security test") opened by user12986714
CI on 34bf1c0 succeeded.
@Makyen I've done this unilaterally just now. I'll soon leave the details over on #3893 after I wrap them up.
@user12986714 I find it nonsense, sorry.
@iBug OK, soooo... now we change the token.
6:42 PM
Plus, those tokens are created by GitHub for each run and expires after an hour. (wrong link removed)
sorry, wrong docs link, should be this one: docs.github.com/en/actions/configuring-and-managing-workflows/…
Oooh, GitHub has since changed that. The token now expires after the job completes (it used to be as I said above)
@iBug OK, but still, why ever intentionally expose the token, unless there's a need to know that the value isn't completely invalid (which could usually be done first by trying to compare it to blank/null values)?
@iBug That is not supposed to be printed out I think? I am not sure what The token's permissions are limited to the repository that contains your workflow. means in the doc.
@user12986714 It basically means the repository you're running Actions on / against.
Further more, I can just ping > /dev/null to make the workflow run a bit more
@iBug So is it the host repo or the fork repo?
Check the docs. Tokens from PRs are scoped against the origin repo.
6:52 PM
That is probably not as good
which means if you create a PR from your fork, it has permissions to your fork, not the base
Pretty straightforward that such huge enterprise like GitHub don't make this kind of stupid mistakes
@Makyen Sorry, this should have been a reply to @user12986714
Such tokens from forked repos have read-only access to many stuff in the base repo
quite makes sense
@user12986714 Did you create that commit from your fork, or from making an edit in the main SD repo and submitting the edit as a PR. It looks like the latter to me.
Does user12986714 have push access to our repo?
@Makyen Pretty sure it's the former (their own fork on branch patch-xx)
7:04 PM
@Makyen The latter, but I have no push access so it will create a patch-x in my repo
too distracted to read and understand things properly :(
@iBug [bull] Claiming that just because an organization is big they don't make stupid mistakes, particularly about security, is ... very naive. Big companies do stupid things all the time.
The GH Action doc is really a big mess... I still cannot find a explicit statement about which repo that token really belongs to (expired so either way won't really matter, but...)
Ok, I managed to fetch 10 pages by using while loop.
My userscript works, but the problem is that it detects my account as voting fraud
7:11 PM
I checked Makyen too, and it says there is no voting fraud there
@Dharman OK. Do you check for backoff in each response and delay the next one for the specified number of seconds if you get a backoff?
Not yet :D
How do I sleep in JS
can't sleep, but you can setTimeout
@Dharman You...don't. You use a setTimeout to call something else at a later time.
7:14 PM
How about await new Promise(r => setTimeout(r, 2000));
that's what I was about to suggest :)
However, if you're using async and await you can effectively have a sleep.
Well, at least we're all thinking along the same lines. :)
Will this work?
if(response.backoff) {
await new Promise(r => setTimeout(r, response.backoff * 1000));
Yes, that looks like it will work.
Why does linter complain?
7:18 PM
@user12986714 Quick note - when possible, do those security tests in your own repos. Poke one of us (me or Ward are decent choices, Makyen too) for stuff you want to test on the org’s.
Not so much because of any security threat, more so we don’t spend cycles figuring out what’s going on
[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Fake MostynLewis Investment scam by Prashant on bitcoin.SE
tpu- feedback received
@SmokeDetector f
@Dharman Because JavaScript closure inside loops – simple practical example is a very common issue/source of bugs.
@Undo curious, why?
@SmokeDetector Looks legit, if misguided
@iBug Read the text; looks like someone trying to warn of a scam
7:22 PM
@Makyen Makes sense, thanks
Probably off topic and VLQ, but I don’t think I could defend spam on meta
@Undo oh, you're right
@Dharman The general solution is to, outside the loop, just create a named function like "delay" or "sleep" into which you pass a parameter for the length of time you want to delay and it returns a Promise which resolves when the delay has expired.
@SmokeDetector Whois suggests the domain identified as scam is registered on NameSilo LLC and is behind privacyguardian; therefore it is quite possible that the domain is actually scam and the post is just vlq
@SmokeDetector Also the domain is created on 2020-01-21T07:00:00Z
7:38 PM
@Makyen What do I need to do to make the userscript install automatically?
@Dharman What do you mean by "install"? There are a few different possible things you might mean.
When I view the RAW file in GitHub it should cause tempermonkey to recognize it
Do you have tampermonkey installed?
How about copying the raw code and pasting it into "make a new script" in tampermonkey?
7:42 PM
Yes, copying works, but I would like to enable it automatically
@Dharman If it looks like userscript code and is name <something>.user.js, then Tampermonkey should recognize it.
@Makyen That was it. I didn't add .user. in the name
@Dharman Yep, that would do it. :)
@Dharman How does it work?
7:58 PM
It adds a button under user's name on each post. You can click it to automatically check if the user receive any serial voting recently
How does the actual detection work?
@Dharman It looks interesting. I can't take a detailed look at it at the moment, because I had already committed to something else for a bit. I'll look at it after I get done with that.
[ SmokeDetector | MS ] Link at beginning of answer (35): How do I delete a part of a file name for a batch of files in Windows 8.1? by a deleted user on superuser.com
fp- feedback received
iBug/Sandy: Executing automatic scheduled reboot.
8:29 PM
@Undo Is it possible to get a redis dump some where? I do have a db dump prior to it being disabled.
@iBug Since you're around, or were :;, Coral appears to have disappeared.
[ SmokeDetector | MS ] Manually reported answer (94): AutoMapper generic mapping by user13955060 on stackoverflow.com
naa- feedback received
@user12986714 Please don't report that, that's VLQ, not Spam (which is what we want to catch here)
@Daniil I don't think it is simply vlq; see the time the blog is posted
@user12986714 Post 1: Already recently reported [ MS ]
It is now relatively clear
tpu- feedback received
@user12986714 Please don't feedback on your own reports
8:35 PM
@Daniil Which one?
I don't think I did
The last one
Isn't it "already recently reported"?
tpu- feedback received on AutoMapper generic mapping [MS]
So I just followed the link and clicked "Spam flag"
@user12986714 Where?
8:37 PM
[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): develop extansion to woocommerce by Gil on wordpress.SE
@Daniil the MS page
Did you use a userscript?
Well that does feedback on it AFAIK
Also you did that from FIRE apparently
fp- feedback received
8:38 PM
@user12986714 We're working on getting database dumps to the point of being available again. They are currently not available. An exact time-frame when they will be available is not yet known.
@Daniil Maybe my later click on it was fast enough to mask MS record, but it shouldn't have been. Maybe some strange concurrency bugs again
@Makyen Emm... I am not particularly familiar with Rails but I think I found something not as good
@user12986714 Why?
@Daniil To set up my own MS instance and test if it is really a problem
Why do you need your own MS instance?
@user12986714 I'm not sure what you're actually trying to say. For the type of issue which one would normally not be straightforward, you've been given information how to bring such issues to our attention.
8:41 PM
2 mins ago, by user12986714
@Makyen Emm... I am not particularly familiar with Rails but I think I found something not as good
@Makyen But I need to know if it really is an issue first
@user12986714 Say the issue then :P
@user12986714 No, you don't.
@user12986714 If you've gotten to the limit of what you can reasonably determine, and you still have a concern, then you should report it in the manner you've been instructed to.
8:59 PM
@Dharman Your scrpt doesn't work too well, it failed on several users who I know have commited no fraud
@Daniil Well, it is only checking obvious serial voting. If you let me know their accounts I can check if I can improve it
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Identify a replacement shimano rear derailleur by Simon Goodwin on bicycles.SE
@Daniil When did the voting fraud happen?
[ SmokeDetector | MS ] Username similar to website in answer (62): How to eliminate whitespace around background color? by Harsh Vishwakarma on stackoverflow.com
9:03 PM
I don't see anything suspicious there and the my script says it is ok
naa- feedback received
@Dharman For me it says fraud
@Dharman I mean the user has no fraud but it says it does
Update the script, I limited it to past 6 months few minutes ago
[ SmokeDetector | MS ] Few unique characters in answer, luncheon meat detected (127): Configure dns server by VGVG on stackoverflow.com
[ SmokeDetector | MS ] Repeating characters in body (72): Why is Scrapy being weird? by Pyzard on stackoverflow.com
tpu- feedback received on Configure dns server [MS]
[ SmokeDetector | MS ] Manually reported answer (94): How is Yu-Gi-Oh played with more than two players? by user32865 on boardgames.SE
fp- feedback received on Why is Scrapy being weird? [MS]
It's not working perfectly because it is saying I committed fraud. However, it is not meant to be the definitive tool to determine if a voting fraud happened or not. It is just giving a quick scan to see if there is anything suspicious.
!!/watch- harshvishwakarma\.xyz
[ SmokeDetector | MS ] Pattern-matching website in body (96): Iframe page inner link will not open in new tab ✏️ by Hassan Ali on stackoverflow.com
fp- feedback received
9:33 PM
@Makyen Yes, something is very wrong; how can I send an anonymous email to the identified address?
@user12986714 Use the pubkey
@Chris Hi! Is there any way we can help you?
@Daniil That still exposes my email address; maybe I would register a new one
@user12986714 However you normally send an anonymous email? I'm happy to advise on how you might send an anonymous email, but that's something I would have expected you to have your own standards as to what level of security you're wanting to maintain, so I'm not sure my suggesting some alternatives is all that helpful.
As a general alternative, communicating privately via Keybase would also work. I hesitate to mention that option, given prior difficulties.
@user12986714 You could register a throw-away gmail account.
9:39 PM
@Makyen True
@user12986714 temp-mail.org
@user12986714 Obviously, you'll still leak some info to Google. In addition, you'll probably want to use the web-based interface for composing your email, as most ways of composing the email outside of your browser will leak your IP address, although I'd expect you to be using a VPN anyway. I'd have to check, but I don't think Gmail includes the local IP address when using the web-based interface to compose and send.
@Makyen Generally I am already giving away lots of info to Google/SE anyways
@user12986714 Why are you concerned about giving away your email/keybase?
[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Cross section of two cones by user3719901 on math.SE
9:50 PM
@user12986714 If you're giving away lots of info to SE, or MS, then most of the people that receive that email already have a lot of that info, if they want it, by virtue of being an SE moderator (obviously, not all of them are moderators, but a good number are). In addition, at least a few of the people on that list have access to logs on MS, which will have your IP address. OTOH, sending the email in a way that is not anonymous does result in sharing that info to more people.
@Makyen A email should have been sent, and the authenticity verification text is C";a(m6OT|AHk/|56hF(cB8Iog:?RNF:>AKUAs9HVzmEk*a-!AYz<n~S=B; it can be verified by echo 'C";a(m6OT|AHk/|56hF(cB8Iog:?RNF:>AKUAs9HVzmEk*a-!AYz<n~S=B' | sha512sum.
[ SmokeDetector | MS ] Potentially bad keyword in body (1): salvar numeros aleatorios by user198018 on pt.stackoverflow.com
fp- feedback received
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Help solving a geocache ✏️ by Fredrick on puzzling.SE
fp- feedback received
tpu- feedback received
API quota rolled over with 10302 requests remaining. Current quota: 19999.
math: 544
stackoverflow: 364
physics: 155
askubuntu: 93
superuser: 83
electronics: 80
unix: 68
mathoverflow.net: 66
serverfault: 51
english: 50
rpg: 50
diy: 36
worldbuilding: 28
puzzling: 28
mathematica: 28
apple: 25
ell: 25
gaming: 24
law: 23
chemistry: 21
scifi: 21
salesforce: 21
academia: 19
wordpress: 18
music: 18
cs: 18
chinese: 17
hermeneutics: 17
politics: 17
meta: 15
dba: 15
stats: 15
networkengineering: 15
workplace: 14
es.stackoverflow: 14
gamedev: 14
raspberrypi: 14
astronomy: 13
softwareengineering: 13
Makyen/EC2-linux: Executing automatic scheduled reboot.
[ SmokeDetector ] SmokeDetector started in standby mode at rev a2cbc2f (SmokeDetector: Auto watch of bigteeth\.ltd by Daniil) (running on Makyen/EC2-linux)
10:45 PM
@user12986714 I see nothing in the security inbox
@ArtOfCode Oh no
Maybe spam box
Nothing in there either
Time is in UTC
[ SmokeDetector | MS ] Potentially bad keyword in body (1): Crankset compatibility: Specialized Stout XC vs. SRAM GX 1000 GXP ✏️ by erkil1452 on bicycles.SE
fp- feedback received
@ArtOfCode Can't I just encrypt it with GPG and dump it here?
10:49 PM
@user12986714 sure
teward/Osiris: Executing automatic scheduled reboot.
[ SmokeDetector ] SmokeDetector started at rev 007390b (SmokeDetector: Auto watch of harshvishwakarma\.xyz by Makyen) (running on teward/Osiris, Python 3.6.9)
Restart: API quota is 19900.
tp- feedback received
@user12986714 I'm free at the moment, so I can take a look if you want to throw me the report

heh, timing
@ArtOfCode Verification text remains the same
11:02 PM
@user12986714 confirmed. Not really a huge issue, but technically should be restricted to core, yes. Your fix also looks good - PR it and it should be mergeable as suggested
@ArtOfCode done
I guess your spamd is dropping/quarantining my email :-/
and done
fp- feedback received
[ metasmoke ] ci/circleci success on adb068c: Your tests passed on CircleCI!
@ArtOfCode The real issue is that I can write a script in less than 10 minutes utilizing the Tor network (tested; Thomas did not place Tor network protection in place) and tag every domain 'whitelisted'; the good news is that spammers are usually not as smart :-P
spammers are reliably dumb
11:22 PM
Restart: API quota is 19999.
!!/errorlogs 1
@user12986714 No such command 'errorlogs1'.
@user12986714 No such command 'errorlogs1'.
### Exception on teward/Osiris at 2020-07-17T22:28:07Z: Failed to log into meta.stackexchange.com, max retries exceeded
File "ws.py", line 176, in <module>
chatcommunicate.init(username, password)
File "/home/smokey/SmokeDetector/chatcommunicate.py", line 103, in init
raise Exception("Failed to log into " + site + ", max retries exceeded")
@user12986714 You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.
@SmokeDetector This is a liiiitle bit out of date
sdc location
11:28 PM
@Makyen Synced hard to origin/master and origin/deploy. Automatically rebooting in a few seconds.
teward/Osiris: Goodbye, cruel world
@Makyen Synced hard to origin/master and origin/deploy. Automatically rebooting in a few seconds.
[ SmokeDetector ] SmokeDetector started at rev 007390b (SmokeDetector: Auto watch of harshvishwakarma\.xyz by Makyen) (running on teward/Osiris, Python 3.6.9)
Restart: API quota is 19681.
Annnnd Coral?
[ SmokeDetector ] SmokeDetector started at rev 007390b (SmokeDetector: Auto watch of harshvishwakarma\.xyz by Makyen) (running on iBug/Coral, Python 3.8.0)
Restart: API quota is 19976.
11:29 PM
!!/standby Coral
00:00 - 18:0018:00 - 00:00

« first day (2435 days earlier)      last day (1314 days later) »