@Dragonrage We also have other lists. Some detections are applied, even things nominally on our watchlists and blacklists, on a per per site basis. The ideal would be that each individual regex would lend the weight only has only contributed on a historical basis, but we've really got too many to dynamically track each one. The next best thing would be to have several different lists which were bins, each with entries which were seeing similar rates of accuracy.
However, the code for that has never been written. What we have, for things that are just straight list entries, are a couple of watchlists and the blacklists. The blacklists try to maintain >= ~96% true positive, depending on circumstances. The entries on the watchlists can be anything under that, but are mostly things we don't have much data on (i.e. very few detections).
2
The watchlist detections are "potentially bad *". The blacklist entries are things like "Bad keyword in".
@Dragonrage Personally, almost all of the usernames are blue for me, as I have blue indicate a visited link. The users who are moderators have a ♦ in front of their name. Why showing a ♦ wasn't used in chat for moderators, I have no idea. It's what's used everywhere else on SE to indicate a moderator. Using something different in chat is just bad UX.
@Dragonrage there USED to be a way to disable detections for sites, but I don't think it's been coded to have multiple different weights based on the site it's on
@Makyen and putting something on the watchlist is usually less of a problem because if you see it once and it never comes again things don't explode or too majorly affect other detection patterns :P
when i get some time, ill have to dig through the code a bit to understand it better. iirc it was a lot of python? which im not super familiar with, but its similar enough to languages ive worked in that i should be able to read it ok
@ThomasWard We can, and do, have things which only run on some sites, or which exclude some sites. However, each of those has to be added as a separate detection entry in findspam.py.
@SmokeDetector k Because the URL didn't exist prior and now exists - which means it was added just for 'reasons' without any actual need to have the link.
@Makyen I am glad though we have all the fully-restorable DB backups every 4 hours now
@Makyen yep, and that's only thanks to the ancillary system - if we have that we store the 'secret' data there while storing public sanitized dumps still in a reachable spot on MS
so we can always just straight restore if we had to
AND it keeps all the FK relations for data too which is a plus
@ThomasWard [:55031115] Potentially bad ns for domain in body - outdoorherbivore.com NS suspicious ns1.bigcommerce.com.,ns2.bigcommerce.com.,ns3.bigcommerce.com.
@Makyen i have nightmares from when its happened to me. if only i could convince my company to have end-to-end testing with smoke tests, load tests, and regression tests with a preprod environment to run them in
@Dragonrage which is ODDLY ENOUGH why I do a ton of dev testing for new APIs, data interaction points, etc. in local copies of the DB and in a development LXD environment on my own laptop.
I don't keep any of their proprietary data I just keep the schema and the code during dev
@ThomasWard one of recent projects involved integrating with a 3rd party vendor for looking up some data by calling an api endpoint. we told them they should push the data to us whenever it was available instead of having us query it so we dont over load their system.
they didnt want to make the effort to do that, then the project went live and they realized they didnt want 20+ million requests per week, so they decided to switch to pushing the data to us
@NobodyNada In fact, we can potentially develop some sort of "auto investigation machine" that will follow links and extract blog/video creation date/views and how well known the potential spam site/company is :-P
@NobodyNada While we should remove this as written, you've identified a very clear pattern of what should be on the list, so it would have been better to either update this one, or remove it and ad a new one which covered just the patterns which were TP. For example:
!!/watch dafont(?<=appsync\.biz/dafont)
Is 100% TP, but doesn't have recent detections, so doesn't really qualify for the blacklist.
@user12986714 I've raised a custom mod-flag suggesting that it might be a hijacked account. In the meantime I think nuking as R/A is acceptable, considering the post's claim that the Holocaust "was just jews killing each other."
@SmokeDetector The Times of Israel (if that's a sufficiently unbiased source) has a tag for "Nazi Collaborators" and articles on the subject. It's not clear that the question is "hate", is there a history of R/A posts?
[ SmokeDetector | MS ] Few unique characters in body, no whitespace in body, potentially bad keyword in body (192): Refactor Assistance ✏️ by Ryan on stackoverflow.com
@Mast You are not a privileged user. Please see the privileges wiki page for information on what privileges are and what is expected of privileged users.
@Mast If you're interested in participating (we'd be happy to have you do so), it would probably be a good idea to start with reading an Introduction to Participating in Charcoal.
[ SmokeDetector | MS ] Blacklisted website in answer, link at end of answer, potentially bad ip for hostname in answer, potentially bad ns for domain in answer (155): Ways to configure a router by TMIS on security.SE
tpu- feedback received
CI on cba4724 succeeded. Message contains 'autopull', pulling...
You've said you've already read it, but I'll link it here, so everything is in one place: there's an Introduction to Participating in Charcoal.
You may also want to look at the userscripts we have available (GitHub), as they can be quite helpful, depending on how you want to participate. For viewing, feedback & flagging in chat, I find FIRE and AIM to be the ones I use the most.
For flagging through the userscripts, your metasmoke account needs to be write authenticated with SE, which, if you haven't already done so, can be done from the authentication page and doesn't require you to also sign up for autoflagging, although authenticating is also a required step for signing up for autoflagging.
In addition, to enable manual flagging, the checkbox that says "Allow metasmoke to raise flags for my account" on this page also needs to be checked. If you have no entries in the "ID Site Count Flags Used Today" list at the bottom of that page, then autoflagging will still not be enabled, but manual flagging through the userscripts will be enabled.
Just so you know, we normally tell people when they are getting privileges that we practice the "ton of bricks" discipline method here: If you mess-up sufficiently, or consistently, we come down like a ton of bricks :-).
To quote ArtOfCode: "TL;DR: ton-of-bricks is mostly to say that we almost never need to enforce things because things enforce themselves through having a good community here. If it gets to the point that someone's enforcing something, something's gone badly wrong."
!!/report stackoverflow.com/a/63049325/208273stackoverflow.com/a/62495977/208273 "Undisclosed affiliation. Posted multiple links to the site, similar names: 'Programmer Dancuk' vs 'Programmer Djancoeg', also uses the name 'Programmer Dancuk' in content linked from the blog author account."
[ SmokeDetector | MS ] Bad keyword in link text in body, link at beginning of body, potentially bad ip for hostname in body, potentially bad keyword in body (112): How to Buy Cryptocurrency In India? by Rohan on superuser.com
