Charcoal HQ

6:01 PM

[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): Intersection observer not working on mobil with 2 sections by Cyril on stackoverflow.com

Mast

@tripleee If you're thinking (?:mother)?f(?:\W*[au])+[ck]+(?<!fa(?:[ck][ac]))(?:er|ed|ing?)?s?, that doesn't seem to work. It catches a lot more than it should and a lot more than the original. Actually makes it worse.

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, potentially bad keyword in body (96): Moving characters for fitness app by Lamis on stackapps.com

[ SmokeDetector | MS ] Potentially bad keyword in body (1): I tried upgrading to Ubuntu 20.04 from 18.04 using do-release-upgrade, but it got an error while upgrading two packages by Diego L. on askubuntu.com

fp- feedback received on Moving characters for fitness app [MS]

fp- feedback received

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer, potentially bad keyword in answer (172): Apple Transport Security by sarah maria on stackoverflow.com

tpu- feedback received

Mast

6:21 PM

sdc blacklist-number +2348143581382

SmokeDetector

@Mast That pattern looks like it's already caught by Bad keyword in body and Bad keyword in answer; append -force if you really want to do that.

Mast

@SmokeDetector why

SmokeDetector

Bad keyword in answer - Position 127-223: love him so much. i was really going too depressed and a friend directed me to this spell caster, Position 790-803: 2348143581382
Bad keyword in answer - Position 905-911: HERPES
Bad keyword in answer - Position 905-911: HERPES
Bad keyword with email in answer - Obfuscated email babatundesolutioncentre1@gmail. com
Potentially bad keyword in answer - Position 224-233: Dr. Tunde, Position 687-711: babatundesolutioncentre1, Position 712-722: gmail. com

Spevacus

Ah, it's hidden at the end of the first line.

I missed that, too.

Mast

I know it's there, but I'm wondering why it shouldn't be on the dedicated list for numbers.

That's what that list is for, right?

blacklisted_numbers

Makyen

6:31 PM

@Mast Because it's in a large swath of numbers were blacklisted years prior to the existence of the numbers list. There's hundreds of numbers that need to be reorganized. That particular detection should be moved into a new blacklisted patterns detection and the individual numbers placed on the blacklisted numbers list.

user435118

@Makyen In line with that, we should probably check the watchlist for domains that haven’t been used for a long time to improve scan speed

SmokeDetector

teward/Osiris: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev bc83caa (SmokeDetector: Auto watch of topspying\.com by tripleee) (running on teward/Osiris, Python 3.6.9)

Restart: API quota is 9657.

[ SmokeDetector | MS ] Offensive body detected, offensive title detected, potentially bad keyword in username (96): Is replika.ai FASCIST? by Anthony Dwayne Chapelle on ai.SE

tpu- feedback received

Mast

There goes the troll again.

Makyen

@Daniil We could, but if scan speed is the issue we're addressing, then we should focus on the regexes which actually take significant time first. The ones which just a small incremental amount of time, while there are certainly a lot of them, and removing some would be a good idea, don't get us much, except by removing them in bulk. However, removing them in bulk means we're not really evaluating them.

We have had times when a keywords has returned to being active years after the last time it was observed. It's really hard to guess what those might be prior to them happning.

Mast

But for starters it would help if we split them up?

Or is it better to leave them be?

tripleee

6:43 PM

@Mast you want [ck]|ac not [ck][ac] in the negative assertion

Makyen

@Mast I'm not sure what you're asking wrt. "split them up"

Mast

> That particular detection should be moved into a new blacklisted patterns detection and the individual numbers placed on the blacklisted numbers list.

SmokeDetector

fp- feedback received on How to store Terraform provisioner "local-exec" output in local variable and use variable value in "remote-exec" [MS]

Mast

That's what I'm referring to.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): What's the deal with X25519 Support in Chrome/Firefox? ✏️ by Jim Landy on security.SE

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Calypso with quantum espresso for nanoparticles by Shafayet Rahat on mattermodeling.SE

Makyen

6:48 PM

@Mast Basically, there are some organizational issues that were created along with the creation of the watch/blacklisted numbers lists. Those have never been fully resolved, because things basically work the way they are and everyone has had other things they consider a higher priority.

SmokeDetector

iBug/Coral: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 9240024 (SmokeDetector: Auto watch of lasercut24\.net by Eliah Kagan) (running on iBug/Coral)

Mast

@Makyen I understand, it's not particularly a matter of a couple quick fixes to get it sorted.

Every time I'm trying to help out with the small stuff I get stumped.

Makyen

7:11 PM

@Mast You're doing well. We appreciate the help. Sometimes, what looks like a little problem is the tip of an iceberg, which may, or may not, be something you want to deal with.

Mast

@Makyen I'm willing, but I'm not a developer (anymore). I do have limited regex experience, but it still looks like black-magic at times and I'm very familiar with how out-of-hand legacy projects can get.

So there will be problems that I'm more than happy to do some legwork for, yet I tend to bite off more than I can chew :-)

I have some leave coming up, got some experiments with flowcharts on my to-do list. Might have some time to actually understand Smokey :-)

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): A single pci-e connector on my gpu is bent by Snoop Doop on superuser.com

fp- feedback received

Makyen

@Mast If you want to work on SD, I'm sure your help will be appreciated.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Is there a way to send me a notification to my phone if {hostname} arrives home? by codingiscool420 on stackoverflow.com

Mast

@Makyen I'll give it a shot at least, but I'm tired of overpromising and underachieving. We'll see what comes out.

SmokeDetector

7:20 PM

fp- feedback received

user435118

@Makyen How about we have 2 versions of SD running? One as-is, one with cleared lists, when new stuff gets caught on the current one, add it to the new one accordingly. Then shut the current lists down after 6 months?

user435118

This could help us organise the number lists and improve any regexes we have

Mast

@SmokeDetector f"acked is the start of an f-string, not offensive.

user435118

We could keep some of the rude regexes as-is to not rewrite them

SmokeDetector

tpu- feedback received on Cannot connect MySQL Workbench to MySQL server [MS]

[ SmokeDetector | MS ] Post is mostly images (13): Download Pic Form HTML by Tamir Eliyahu on stackoverflow.com

Makyen/EC2-linux: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 4fc58ea (SmokeDetector: Auto watch of impressorahpdrivers\.com by NobodyNada) (running on Makyen/EC2-linux)

Makyen

7:31 PM

@Daniil Why? What actual problem are you trying to solve?

user435118

@Makyen Inefficient regexes, obsolete [watch/black](list) items

Makyen

@Daniil What actual problem are they causing?

user435118

@Makyen Messy regex items, slower scan time

Makyen

@Daniil How are those causing a problem? Are the SD instances unable to keep up with scanning?

user435118

@Makyen There’s probably a backlog most of the time

Mast

7:37 PM

I'd guess increasing total amount of hits while increasing the TP/FP ratio is of higher concern.

user435118

@SmokeDetector Not a lot of images at all, this is happening too much now

SmokeDetector

[ SmokeDetector | MS ] Blacklisted username (90): center automorphisms are all inner automorphisms? by Shiv Gupta on math.SE

user435118

sdc bisect Shiv Gupta

SmokeDetector

@Daniil Matched by (?-i:^Shiv Gupta$) on line 346 of blacklisted_usernames.txt

user435118

@SmokeDetector fpu-

Mast

7:41 PM

sdc alive

SmokeDetector

@Mast Of course

Mast

sdc bisect Shiv Gupta

SmokeDetector

@Mast Matched by (?-i:^Shiv Gupta$) on line 346 of blacklisted_usernames.txt

Mast

@Daniil It's going to take more than that.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in answer, blacklisted user (72): Cannot connect MySQL Workbench to MySQL server by Angel Torre on askubuntu.com

tpu- feedback received

user435118

7:48 PM

@Mast ?

Mast

@Daniil To get that user from the blacklist.

That was the goal with fpu-, right?

Machavity

@Mast That's what fpu does, yes

Mast

So that's what I said, it's going to take more than that.

user435118

@Mast What do you mean?

Mast

blacklisted_usernames.txt, line 346. That's what you need to modify to get what you want, right?

user435118

7:52 PM

I made that specific user exempt, I don’t want to remove the username from detection

Mast

The fpu- list (whatever it's called) overrules the blacklisted_usernames file?

Like a negative look-behind, effectively, excluding it from the found results?

Machavity

8:04 PM

@Mast Blacklists don't apply to whitelisted users

Mast

That's the word I was looking for, thank you.

Although there's no whitelist_usernames file, so I'm not sure where they're stored.

SmokeDetector

iBug/Sandy: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 58848be (SmokeDetector: Merge pull request #4194 from Charcoal-SE/auto-blacklist-1594973069) (running on iBug/Sandy)

ArtOfCode

@Daniil have a look at the scan rates reported on metasmoke, that'll tell you

SmokeDetector

8:21 PM

[ SmokeDetector | MS ] Phone number detected in title (65): Cannot initiate the connection to archive.ubuntu.com:80 (2001:67c:1360:8001::24) ,Network is unreachable) [IP: 91.189.88.142 80 by Saurav Raj Joshi on unix.SE

fp- feedback received

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): NodeJS Invalid_grant gaxios.js:85:23 by Rodrigo Martinez on stackoverflow.com

[ SmokeDetector | MS ] Link at beginning of body (42): My iOS app keeps crashing on iPad, doesn't crash on any other device (LOGS ATTACHED) by Noroup Studios on stackoverflow.com

user435118

@ArtOfCode How will they tell me?

ArtOfCode

@Daniil if posts per day < scan capacity per day, we're good

if not, we got problems

SmokeDetector

8:37 PM

fp- feedback received

fp- feedback received on NodeJS Invalid_grant gaxios.js:85:23 [MS]

[ SmokeDetector | MS ] Potentially bad asn for hostname in body (1): Problema nas fontes do site hospedado by Renillson Santos on pt.stackoverflow.com

user435118

@ArtOfCode Where’s scan capacity per day?

SmokeDetector

fp- feedback received

ArtOfCode

8:54 PM

@Daniil metasmoke.erwaysoftware.com/smoke_detector/6/statistics

that's per second

so multiply by 86400

NobodyNada

@Mast The user whitelist (along with the user blacklist, information about recent reports and chat messages, !!/notify preferences, and more) is stored in a local pickle (so it's not uploaded to GH or MS, and it isn't synced to other SD instances).

Mast

@ArtOfCode So, we stay under 50% at all times, even just before the reset?

NobodyNada

@Mast I think that's API quota you're looking at, which is the number of requests SD is allowed to make to the Stack Exchange API. In this case, however, we're instead talking about the percentage of available CPU power our regexes are consuming.

ArtOfCode

not available CPU power either

just the number of posts we can scan per second

NobodyNada

@ArtOfCode isn't that CPU-bound?

ArtOfCode

8:58 PM

yes and no

couldn't tell you precisely what the bottleneck is, but it doesn't tend to run at 100% CPU

Mast

@NobodyNada Only that? It's never synced to (semi-)permanent storage?

def add_whitelisted_user(user):
    if user in GlobalVars.whitelisted_users or user is None:
        return
    GlobalVars.whitelisted_users.add(user)
    _dump_pickle("whitelistedUsers.p", GlobalVars.whitelisted_users)

That indeed only puts it 'in memory'.

NobodyNada

@Mast It saves it to the file whitelistedUsers.p

Mast

Yes, but is that read by the next instance on boot or whiped on shutdown?

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Is there an "art" term for this kind of palette? by Richard Klassen on graphicdesign.SE

NobodyNada

@Mast It's loaded on startup, but it doesn't sync across instances of SmokeDetector running on different machines

it survives reboots, but not failovers

Mast

9:02 PM

Ah, ok.

NobodyNada

"Instance" in CHQ generally means a single machine running a single checkout of SmokeDetector; even if you reboot it's technically still the same instance

(See metasmoke.erwaysoftware.com/status for the list of all instances)

Mast

And multiple instances (multiple 'servers') can be running at the same time.

Which leads to very interesting effects sometimes.

NobodyNada

That's correct. Normally we keep one instance active and the rest in standby, but if two instances end up active then they will both respond to commands

Mast

It looks like Osiris is doing most of the heavy lifting lately.

Naturally the blacklisting/whitelisting is all explained in the docs, but it only makes sense after you've got your nose smashed into it.

> The user-blacklist and user-whitelist are maintained per SmokeDetector instance. The SmokeDetector instances do not share these lists between themselves. Thus, if the SmokeDetector instance is switched, the new instance will only have a record of the entries on these lists which were added/removed while that instance was active.

NobodyNada

@Mast Yep. It's best to stay on one "primary" instance (because the pickles won't sync), and we usually use Thomas's instances because his infrastructure is very reliable, powerful, and well-maintained

user435118

9:09 PM

@ArtOfCode That’s a massive issue. We need to get that capacity up urgently

ArtOfCode

@Daniil Hm?

NobodyNada

@Daniil unless I'm missing something, it looks like capacity is about ~150k posts/day, while we're currently scanning ~100k posts per day

Which...might be an issue eventually, as we keep adding more regexes, but we seem to be in decent shape for now

Especially since overall activity on the SE network is trending downwards IIRC

ArtOfCode

bear in mind also that IIRC that's per-thread

Mast

Daily graph has a peak on 104479 (July 21), we've been doing fine as far as the graph goes back.

NobodyNada

@ArtOfCode Interesting, didn't realize we were multithreaded, but glancing through the code, that looks right

user435118

9:38 PM

@NobodyNada It is, SE is dying :( is there a graph of overall activity on SE and the trend?

Mast

@Daniil If you don't mind only having yearly accuracy, Shog used to post 'A year in moderation' posts on all metas.

So you could take the 2019 and 2018 versions of the same site and see the difference in stats.

For SO:

2019, 2018, 2016

And no, there's no 2017.

Not that I know of anyway.

Anyway, if you take those stats from a couple of sites, you have some network-wide yearly data that should provide enough datapoints to make an estimated guess about activity.

SU: 2019, 2018

Also, people have been thinking sites were dying for a long time.

This is from '10:

4

Q: Is Super User dying?

There are a number of exchanges that are stepping all over Super User: Web Applications, Electronic Gadgets (although rumor is that one isn't going to survive, but be replaced by more specific exchanges for Android combined with the Apple exchange), TeX, Unix & Linux, Apple are all in beta. There...

discussion

10 years later the site ain't dead yet and the user asking the question is a mod at Programmers.

SmokeDetector

9:53 PM

[ SmokeDetector | MS ] Bad keyword with email in body (57): 20.04 local repository not working for updates/installs by Acme Computer on askubuntu.com

Mast

^ That's an odd one.

SmokeDetector

fp- feedback received

Mast

@SmokeDetector icons-64x64@2.rar is hardly an e-mail address.

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): What are some flexible workout routines that don't require a change in diet to be effective? by Whiskey Bob 98 on fitness.SE

[ SmokeDetector | MS ] Potentially bad keyword in body (1): adb + android: access app-produced clipboard data programmatically in Linux terminal by grobber on stackoverflow.com

[ SmokeDetector | MS ] Link at beginning of answer (32): Где можно узнать "координаты" цвета? by Master_Sniffer on ru.stackoverflow.com

[ SmokeDetector | MS ] Misleading link (22): JS. Updating objects in an array (matching by value) by Kim Lopez on stackoverflow.com

fp- feedback received

NobodyNada

10:23 PM

@Daniil Here's a random SEDE for Stack Overflow only

SmokeDetector

There's been no scan activity for 3 status pings. There may be a problem.

NobodyNada

!!/commands

SmokeDetector

@NobodyNada I'm SmokeDetector, a bot that detects spam and offensive posts on the network and posts alerts to chat. A command list is available here.

Makyen

Hmmm... Just in case:

!!/reboot

SmokeDetector

teward/Osiris: Goodbye, cruel world

NobodyNada

10:24 PM

@Makyen darn, I wanted to check the queue status

SmokeDetector

[ SmokeDetector ] SmokeDetector started at rev bc83caa (SmokeDetector: Auto watch of topspying\.com by tripleee) (running on teward/Osiris, Python 3.6.9)

NobodyNada

Maybe it still has something

SmokeDetector

Restart: API quota is 19983.

NobodyNada

!!/queuestatus

SmokeDetector

codereview.stackexchange.com: 3
pt.stackoverflow.com: 5
tex.stackexchange.com: 3
ru.stackoverflow.com: 9
blender.stackexchange.com: 2
magento.stackexchange.com: 1
stats.stackexchange.com: 1
es.stackoverflow.com: 2

Makyen

10:24 PM

@NobodyNada Ahhh... sorry about that.

NobodyNada

@Makyen well, that's what I get for trying to edit a chat message and look up commands at the same time

I missed the editing deadline and didn't get to run the command :D

SmokeDetector

[ SmokeDetector | MS ] Mostly punctuation marks in answer, repeating characters in answer (116): КАК УДАЛИТЬ ВОПРОС? by pomidor on ru.stackoverflow.com

NobodyNada

@NobodyNada @Daniil The rate of new questions leveled off around 2014 and has been declining since 2017 (the recent spike is not real; it's just the roomba)

@SmokeDetector naa- Google Transalte says it's "HOW TO REMOVE A QUESTION?"

Makyen

Letting it sit and auto-reboot may have been the better choice. Although, it's fairly rare to go 3 minutes at this time of day/day of the week without any activity on SE.

user435118

10:38 PM

@NobodyNada It’s dying much faster than I thought

user435118

Seems like the whole word is dying to be honest

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): New pattern has been found in Prime Numbers? by Crazy Facts on math.SE

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): So what exactly is RESERVE BATTERY LEVEL(IN %) in Dell ALIENWARE Laptop? by Strobe on superuser.com

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): Why am I getting "cannot access authentication server" when I try to mod Minecraft? by crystallinqq on stackoverflow.com

NobodyNada

10:58 PM

@SmokeDetector Well...that person's definitely come up with their own ideas about how computers work

Not to be confused with HORSE - CORN THEORY

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): How do I use Tensorflow for signal processing? by mahyar on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ip for hostname in answer (1): Can't Add Repository "Could not find a distribution template for elementary/hera" ✏️ by federico sanchez on elementaryos.SE

fp- feedback received on So what exactly is RESERVE BATTERY LEVEL(IN %) in Dell ALIENWARE Laptop? [MS]

NobodyNada

@SmokeDetector naa- Borderline R/A, but contains some advice that at least appears to be relevant

SmokeDetector

naa- feedback received on How do I use Tensorflow for signal processing? [MS]

fp- feedback received

SmokeDetector

11:25 PM

[ SmokeDetector | MS ] Potentially bad ns for domain in body (1): Asking for your opinion about a research conducted in regards to patterns in prime numbers by Crazy Facts on math.SE

SmokeDetector

11:45 PM

teward/Horus: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 4fc58ea (SmokeDetector: Auto watch of impressorahpdrivers\.com by NobodyNada) (running on teward/Horus)

[ SmokeDetector | MS ] Potentially bad ip for hostname in body (1): My tensorflow-gpu install is not working on CNN's by brian samoukian on stackoverflow.com

fp- feedback received

[ SmokeDetector | MS ] Bad keyword in link text in body, body starts with title and ends in url, potentially bad keyword in body (168): english bulldog puppies for sale near me by bulldog breeders on stackoverflow.com

tpu- feedback received

Transcript for