Charcoal HQ

Thomas Ward

18:00

no worries

it just gave me a chuckle

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Como recuperar pastas no repositorio do Github by Alessandra Burckhalter on pt.stackoverflow.com

fp- feedback received

Suraj Rao

stackoverflow.com/a/63510565/4826457 looks weird.. is the answer related to the question?

!!/scan stackoverflow.com/a/63510565/4826457

SmokeDetector

@SurajRao Post 1: This does not look like spam

tripleee

@SurajRao looks to me like they are (very incompetently) promoting their Youtube channel

!!/watch (?-i:UCvm2Gp6ci-RYOdUxGBKzdvA)(?# youtube)

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 8abc6c6 (SmokeDetector: Auto watch of (?-i:UCvm2Gp6ci-RYOdUxGBKzdvA)(?# youtube) by tripleee) (running on teward/Osiris)

tripleee

18:14

@makyen I know it's been a long time and your situation has changed since you left a comment on that PR but would you still be able to guide me a bit in setting up a proper test?

[18:12:19.588] Command received: !!/watch-ip 162.241.148.226
[18:12:20.506] Returning cached links for post
[18:12:20.550] Returning cached links for post
[18:12:20.636] 'NoneType' object has no attribute 'json'
  File "/Users/tripleee/charcoal/ip-asn-test/metasmoke.py", line 465, in update_code_privileged_users_list
    data=json.dumps(payload), headers=headers).json()['items']

do I need to add myself somewhere as privileged? I already set up myself in rooms_custom.yml but maybe there's somewhere else I'm missing?

Makyen

@tripleee Sure.

SmokeDetector

[ SmokeDetector | MS ] Blacklisted website in body, potentially bad keyword in body, potentially problematic ns configuration in body (101): Where can i get the best programmingassignment help online? by stuart williams on stackoverflow.com

tpu- feedback received

Makyen

@tripleee You should already be in users.yml, so all that's needed is for you to be in rooms_custom.yml and be in a list of Blacklist manager users. The list of code privileged users is taken from MS, but required an MS key for SD to obtain it. If it's easier, I can generate a pickle with the current list from MS and send it to you via Keybase (not actually secret, just easy).

SmokeDetector

[ SmokeDetector | MS ] Potentially problematic ns configuration in body (1): How can I override a tooltip title defined in a theme class fucntion? by user1071552 on stackoverflow.com

tripleee

@Makyen nah, I was lazy and hoping I would not need to create an MS key for this

do I need to worry that my instance will send stuff to MS when it shouldn't though?

Makyen

18:20

@tripleee It's easy for me to give you a pickle file, which you can just drop in.

tripleee

@Makyen oh sure, thanks

Makyen

OK. Give me a moment.

double-beep

hey @ThomasWard, are you hosting Redunda?

Thomas Ward

I think so?

cc @ArtOfCode is Redunda still on my infra?

tripleee

IP address 50.211.70.70 would suggest so

double-beep

18:27

if yes, it's been down for several weeks now

SmokeDetector

[ SmokeDetector | MS ] Link at beginning of answer (32): Странное поведение уникального идентификатора во внешнем источнике данных (1С, SQL Server) by user403818 on ru.stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ip for hostname in answer (1): history=model.fit_generator() Why is keras history empty?{} by TinDan_ on stackoverflow.com

fp- feedback received on How can I override a tooltip title defined in a theme class fucntion? [MS]

Makyen

@tripleee OK. There's a current codePrivileges.p on Keybase in the SD runner file section.

It just needs to be put in the pickles directory.

tripleee

@Makyen I don't think I have access to that section ...?

Makyen

@tripleee It looks like you do to me.

tripleee

oh wait sorry yes nvm

thanks!

Makyen

18:31

np.

We really should add something to the config file to let people define blacklist approved users there, as it's commonly needed for testing.

SmokeDetector

iBug/Sandy: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 58848be (SmokeDetector: Merge pull request #4194 from Charcoal-SE/auto-blacklist-1594973069) (running on iBug/Sandy)

tripleee

getting weird regex errors ... ugh, I guess my master branch needs to be updated to upstream master

but then how can I test code which is in another branch? do I need to merge to master locally first?

thanks so far anyway, gotta go ... I guess I found a bug or two already

SmokeDetector

[ SmokeDetector | MS ] Bad keyword with email in body (57): Coding At C++ / C# by Reza Nasiri on stackoverflow.com

tripleee

!!/watch rnasiri033@gmail\.com

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 0308a78 (SmokeDetector: Auto watch of rnasiri033@gmail\.com by tripleee) (running on teward/Osiris)

Thomas Ward

18:44

@double-beep might need kicked

i'll look

double-beep

thank you :)

SmokeDetector

tpu- feedback received

ArtOfCode

@ThomasWard shooould be

Thomas Ward

rebooting that box @ArtOfCode

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): ogr2ogr PDF unable to open datasource but PDF is recognized fine in GDALInfo ✏️ by Joe Nunn on gis.SE

[ SmokeDetector ] SmokeDetector started in standby mode at rev 9240024 (SmokeDetector: Auto watch of lasercut24\.net by Eliah Kagan) (running on iBug/Coral)

teward/Osiris: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started at rev 0308a78 (SmokeDetector: Auto watch of rnasiri033@gmail\.com by tripleee) (running on teward/Osiris, Python 3.6.9)

Restart: API quota is 9378.

[ SmokeDetector | MS ] Offensive answer detected (78): what does "Save the hammer for the man" mean in this context? ✏️ by Emilio on english.SE

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Looking for input as to next steps for my lawn issue by SDM72 on gardening.SE

[ SmokeDetector | MS ] Link at beginning of answer (32): Spring boot : bean creation profile specific by Vlad Ulshin on stackoverflow.com

fp- feedback received on what does "Save the hammer for the man" mean in this context? [MS]

fp- feedback received

[ SmokeDetector | MS ] Potentially problematic ns configuration in body (1): daemontools svscan cannot start supervise due to permission denied error on CentOS 8 by comc on serverfault.com

[ SmokeDetector | MS ] Link at end of answer, pattern-matching website in answer (139): Is there any tax difference between a US citizen and a US lawful permanent resident? by shaik on money.SE

tpu- feedback received

fp- feedback received on daemontools svscan cannot start supervise due to permission denied error on CentOS 8 [MS]

Thomas Ward

19:22

@ArtOfCode you'll need to look @ redunda

box reboot still didn't fix it

@double-beep Art is best to fix redunda :P

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, pattern-matching product name in body, potentially bad keyword in body (292): How Does The Canzana CBD Oil Work On Your Body? by canzanarate on patents.SE (@Catija)

tpu- feedback received

[ SmokeDetector | MS ] Link at end of answer, pattern-matching website in answer (139): Would you approve use of these PCBs??? Delamination issue by baba on electronics.SE

tpu- feedback received on Would you approve use of these PCBs??? Delamination issue [MS]

[ SmokeDetector | MS ] Mostly punctuation marks in body, repeating characters in body (98): Ansible: Check disk size and create volume group according its size ✏️ by turgun on stackoverflow.com

fp- feedback received

[ SmokeDetector | MS ] Potentially bad ip for hostname in body (1): Cómo mostar en un div una imagen seleccionada desde un carrousel con bootstrap 4 by Jimmy Grijalva on es.stackoverflow.com

[ SmokeDetector | MS ] Body starts with title and ends in url (98): i create a navigation bar in seperate file, but after include its not work by kamal maurya on stackoverflow.com

fp- feedback received

[ SmokeDetector | MS ] Potentially bad keyword in body (1): What led to Japan committing war crimes in WWII that were worse than those of Nazi Germany? ✏️ by Alexandros Kourtis on history.SE

fp- feedback received

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer, pattern-matching email in answer, potentially bad keyword in answer (271): Python get rid of bytes b' ' by Mrs Crystal Joseph on stackoverflow.com

tpu- feedback received

[ SmokeDetector | MS ] Potentially bad keyword in body (1): How to make a hero image responsive by Jhon1213 on stackoverflow.com

fp- feedback received

user12986714

20:07

@ArtOfCode really?

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Verify gumroad license using jquery by Jinson Johny on stackoverflow.com

user12986714

When trying to submit a feedback on m.erwaysoftware.com/posts/uid/stackoverflow/63512247

SmokeDetector

fp- feedback received

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Помогите, пожалуйста, понять что я не учел при решении задачи ✏️ by Ярославцев Андрей on ru.stackoverflow.com

fp feedback received

user12986714

@user12986714 I also just got signed out for no reason too

SmokeDetector

tp feedback received on Social media management tool [MS]

tp feedback received on What tool exists to identify the RGB value of a pixel? [MS]

user435118

20:20

@user12986714 What page?

user12986714

12 mins ago, by user12986714

When trying to submit a feedback on https://m.erwaysoftware.com/posts/uid/stackoverflow/63512247

!!/blacklist-website digitalserviceusa\.com

SmokeDetector

@user12986714 That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.

Thomas Ward

!!/bisect digitalserviceusa.com

SmokeDetector

@ThomasWard Matched by digitalserviceusa\.com on line 3701 of blacklisted_websites.txt

Thomas Ward

@user12986714 already blacklisted :)

user12986714

20:22

:-P

Thomas Ward

@user12986714 also your 'login' session only lasts for so long so it might've recycled your login somehow

not 100% sure on that

(nginx+passenger is weird)

user12986714

Emm why am I having so many random MS issues recently

Maybe it is not happy about my security tests

user435118

How easy would it be to do a DoS on the signup page on MS? i.e. make loads of accounts?

user12986714

Then admin can just turn login off in site settings

Makyen

@Daniil Been there, done that. It's not that big of a deal. A bit more of a pain with account deletion not yet verified fixed, but still easily handle-able (e.g. as mentioned, just turn off account creation).

user435118

20:33

@Makyen You executed a DoS?

Makyen

@Daniil We've had people do so against MS.

user435118

@user12986714 Probably :P

user435118

@Makyen That could be dangerous though as there could be massive backlog of chat reports if an admin is not online

user435118

And they could not even be logged on MS if all resources are used and it's a big DoS (i think, not an expert)

Makyen

@Daniil The longest backlog of SD chat messages/reports we've seen is about 1.5 hours of backlog.

We've improved things significantly since then, so at the level we saw, it wouldn't be as bad. It wouldn't be good, just not as bad. There's a Github issue describing the SD chat rate-limiting situation and what's been done to improve it.

user12986714

20:38

@ThomasWard You may be interested in this ^; also @thesecretmaster

SmokeDetector

[ SmokeDetector | MS ] Mostly punctuation marks in body, repeating characters in body (98): public_html NOT RESPONDING AS ROOT DIRECTORY OF MY WEBSITE by Wisdom Omote on stackoverflow.com

Thomas Ward

@user12986714 thanks

we're looking into it

user12986714

@ThomasWard Well, if you want an even better example, I do have one now... (if it is possible, kill the request from 99.232.251.159)

Thomas Ward

@user12986714 cc @Undo @ArtOfCode

@user12986714 i could just block your IP... :P

Metasmoke being rebooted due to migration to a different compute core, 5min outage.

!!/ms-down-force

SmokeDetector

Metasmoke status autoswitch is now disabled.

teward/Osiris: Metasmoke status: set to down.

@ThomasWard Metasmoke status is now: down; Auto status switch: disabled.

Thomas Ward

20:56

!!/ms-up

SmokeDetector

teward/Osiris: Metasmoke status: set to up.

@ThomasWard Metasmoke status is now: up; Auto status switch: enabled.

user12986714

@ThomasWard Looks like I cannot connect to MS... (hopefully this is because I am blocked)

Thomas Ward

@user12986714 yeah you gave me your IP I have a full block in effect on your IP right now

and I mean full block :p

also perfect way to kill requests: reboot the server :P

user12986714

@ThomasWard Didn't the thing get seized up when reboot? (or it is a hard reboot)

Thomas Ward

nope didn't seize up

i just moved its compute to the new node in my cluster so poweroff, migrate, poweron

same storage array so :p

fast migration

user12986714

21:06

@ThomasWard Ouch. Let's hope other MS users in the same subnet won't find me

Thomas Ward

you gave me a single IP not a subnet :P

if we're doing subnet blocking I may as well block the entire /16 :p

user12986714

@ThomasWard Well, in a sense that it is a router with NAT

Thomas Ward

well then it's your fault :p

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Controlling a Brushed Motor with DC Voltage to Avoid EMI (no speed control needed) by NuclearDude on electronics.SE

user12986714

@SmokeDetector fp-

@ThomasWard locks front door

SmokeDetector

21:13

[ SmokeDetector | MS ] Bad keyword in title, bad keyword with email in body, phone number detected in title, potentially bad keyword in title (221): +234708548119%%I want to join occult for money ritual by Young Billionaires on 3dprinting.SE

tpu- feedback received

user12986714

@SmokeDetector k

user12986714

21:24

@ThomasWard Well... I don't think the issue is fixed beside blocking my ip addr(:-P), as I can still access the affected routes using Tor.

Thomas Ward

@user12986714 oh so you're bypassing things

user12986714

@ThomasWard Oh no... you really think spammers have the same terminal NAT router as me?

(Note: I didn't log in when using Tor)

SmokeDetector

[ SmokeDetector | MS ] Potentially problematic ns configuration in answer (1): Media player placed in iframe doesn't playing with Angular by Roy on stackoverflow.com

user12986714

@SmokeDetector fp-

Thomas Ward

@user12986714 oh i have a solution takes a bit to install things

user12986714

21:30

@ThomasWard Hopefully not by blocking Tor (ouch)... Why don't we just remove things from routes.rb?

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): How can I create new fields in return results and set values in them on the basis of conditions using Mongoose? by Ian Mawanda on stackoverflow.com

user12986714

@SmokeDetector fp-

!!/report stackoverflow.com/questions/48440854/…

SmokeDetector

[ SmokeDetector | MS ] Potentially bad ns for domain in answer (1): RabbitMQ AWS autoscaling by Amrit Pal Singh on stackoverflow.com

[ SmokeDetector | MS ] Pattern-matching website in answer (78): how display content in each listview iteams by Viktor Fallenheart on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad ns for domain in answer, blacklisted user (72): what is the proper configuration for rabbitmq aws autodiscovery plugin by Amrit Pal Singh on stackoverflow.com

tpu- feedback received on how display content in each listview iteams [MS]

user12986714

!!/watch legendshub\.com

thesecretmaster

@user12986714 Just so you know, we're going to patch the issue, but it's something that we knew was possible when we created the graphql API so it's not hugely urgent, and in the future I think it'd be better for us if you could submit theoretical vulnerabilities (or testing locally, if possible) rather than testing on production.

SmokeDetector

21:37

@user12986714 You don't have blacklist manager privileges, but I've created PR#4413 for you.

PR#4413 ("user12986714: Watch legendshub\.com") opened by SmokeDetector

Thomas Ward

@user12986714 also if you're actively testing your exploit testings, let someone know because if you seize up MS I'mma get annoyed

and if you seize up my server farm i'm going to destroy you

:p

user12986714

@thesecretmaster Yeah, I would certainly be happy to test locally once redis dump is available

thesecretmaster

Oh is it not yet available? Is that stalled on me or something else (cc @ThomasWard)?

Thomas Ward

once @thesecretmaster gives me an idea of what we need from the redis side of things (copying, tarballing, etc.) I can get those working :P

@thesecretmaster redis dumps? ^ that

thesecretmaster

You can just copy the rdb file from wherever it lives I believe

user12986714

21:39

@ThomasWard I really should not have fixed the flag log things so you can't push that button (:-P)

Ryan M

sdc watch- cheapbusinessessay\.com

taps foot

user12986714

!!/report stackoverflow.com/questions/55592996/…

SmokeDetector

@user12986714 Post 1: Already recently reported [ MS ]

PR#4414 ("Ryan M: Watch cheapbusinessessay\.com") opened by SmokeDetector

Ryan M

there we go.

SmokeDetector

[ SmokeDetector | MS ] Link at beginning of answer, potentially bad ns for domain in answer (33): Online homework/testing systems? by Jan Boehner on math.SE

user12986714

21:43

@SmokeDetector tpu-

@SmokeDetector fp-

Ryan M

@SmokeDetector fp- no other reports for the domain, responsive to the question

Does changing feedback from tpu- to fp- also undo the blacklist?

Spevacus

!!/rmblu math.stackexchange.com/users/817913/jan-boehner

SmokeDetector

@Spevacus No such command 'unblu'.

@Spevacus User is not blacklisted.

Ryan M

sdc isblu math.stackexchange.com/users/817913/jan-boehner

SmokeDetector

@RyanM User is not blacklisted (817913 on math.stackexchange.com).

Spevacus

21:45

I guess so.

Ryan M

Neat.

Thomas Ward

@user12986714 what button, the redeploy button or the reboot button :p

it's a VM with an emergency hard-off trigger if it really eats up too many resources :p

user12986714

@ThomasWard The destroy button of course

Thomas Ward

@user12986714 ah that button :p

SmokeDetector

[ SmokeDetector | MS ] Link at end of answer, potentially bad keyword in answer (62): What is the equivalent of Active Directory on Linux by neel punatar on unix.SE

Ryan M

21:47

suspicious, unclear though ^

Spevacus

Also not sure...

Has two other TP's but

user12986714

!!/addblu unix.stackexchange.com/users/429214/neel-punatar

SmokeDetector

@user12986714 User blacklisted (429214 on unix.stackexchange.com).

Ryan M

@user12986714 Why blacklist the user?

Spevacus

I suppose to watch them in case they drop another somewhat-spammy post that isn't caught by any watchlists at the moment.

Ryan M

21:51

Is that necessary? We have the domain watched.

Spevacus

¯\_(ツ)_/¯

Ryan M

Doesn't seem like the user should be blacklisted unless it's a tp

user12986714

@RyanM It is just a watch-user command in fact

We just get notified about the next post

Spevacus

That user's next FP removes them even if they're manually blacklisted, right?

user12986714

If it is also spam, then we are sure; otherwise a fp will remove user from "blacklist"

@Spevacus Yes

Ryan M

21:54

That reason has pretty high weight though

user12986714

In a sense most spammers are serial spammers

Machavity

22:12

!!/watch myrout\.es

SmokeDetector

[ SmokeDetector ] Blacklists reloaded at rev 4b58612 (SmokeDetector: Auto watch of myrout\.es by Machavity) (running on teward/Osiris)

[ SmokeDetector | MS ] Link at beginning of body (44): what does transaction type and transaction sub type mean in paypal payout reconciliation reports by Devansh Baghel on stackoverflow.com

fp- feedback received

[ SmokeDetector | MS ] Potentially bad ip for hostname in body, potentially bad ns for domain in body (2): Cannot open files in wine 5.0.1 by Cameron Scoggins on superuser.com

[ SmokeDetector | MS ] Link at beginning of body (44): What happens if I put this into a search engine and then press enter? by Owen Bonham on stackoverflow.com

user12986714

@SmokeDetector fp-

@SmokeDetector tpu- nonsense

SmokeDetector

tp feedback received on What is the equivalent of Active Directory on Linux [MS]

API quota rolled over with 7504 requests remaining. Current quota: 19999.

math: 362
stackoverflow: 229
superuser: 91
physics: 66
askubuntu: 66
unix: 45
electronics: 41
serverfault: 35
salesforce: 34
english: 32
codegolf: 31
mathoverflow.net: 27
scifi: 24
diy: 24
datascience: 21
ell: 20
wordpress: 19
es.stackoverflow: 19
dba: 19
worldbuilding: 17
gaming: 17
law: 17
chemistry: 16
rpg: 15
money: 14
sharepoint: 13
android: 13
apple: 13
graphicdesign: 13
workplace: 12
politics: 12
mathematica: 12
cs: 11
ru.stackoverflow: 11
stats: 11
chinese: 11
security: 11
quant: 11
vi: 11

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Steady growth distribution rate for twin primes. Why is there a max and min value? ✏️ by Ilan Alon on mathoverflow.net

thesecretmaster

22:30

Is there a command to check if something's already been caught?

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Will there be problems trying to run bootcamp with third party ssd macbook upgrade on Catalina 10.15.6? by GGarrett2 on apple.SE

thesecretmaster

!!/scan cseducators.stackexchange.com/a/6483

SmokeDetector

@thesecretmaster Post 1: Looks like spam but not reported: Post is bumped by community ♦️

thesecretmaster

hmm?

Ryan M

that's...odd...

that post has not been bumped by Community

thesecretmaster

22:33

Well, I nuked it so shrug

Ryan M

Probably should report it if it's not caught in general

user435118

@thesecretmaster You can use the Metasmoke URL converter and check for a entry.

5

thesecretmaster

Ah it was caught

Ryan M

Oh neat, TIL

Makyen

@thesecretmaster If you are looking at the SE page with a post and want to see if the post was caught, then SIM - SmokeDetector Info for Moderators (install) provides a "smokey" button on each post which will tell you if it was caught and some additional information (TP/FP feedback, if autoflagged, who manually flagged, etc).

SmokeDetector

22:43

fp- feedback received on Steady growth distribution rate for twin primes. Why is there a max and min value? [MS]

fp- feedback received

SmokeDetector

22:59

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Solder various parts of broken wire in a fan coil by DADi590 on electronics.SE

SmokeDetector

23:20

[ SmokeDetector | MS ] Potentially bad keyword in answer (1): How did Black Widow hold her own in Infinity War? ✏️ by LazyReader on scifi.SE

[ SmokeDetector | MS ] Manually reported question (93): What is the significance of the drainage system? by Laker Builders Merchant on meta.SE

PR#4415 ("Sonic the Masked Werehog: Watch lakerbfs\.co\.uk") opened by SmokeDetector

Makyen/EC2-linux: Executing automatic scheduled reboot.

[ SmokeDetector ] SmokeDetector started in standby mode at rev 0466c1d (tripleee: Merge pull request #4395 from Charcoal-SE/auto-blacklist-1597851396) (running on Makyen/EC2-linux)

[ SmokeDetector | MS ] Repeating characters in body (71): How to center TabBar horizontally on the TabWidget by Ahmed4end on stackoverflow.com

[ SmokeDetector | MS ] Potentially bad keyword in body (1): Have I not understood what "several" means? by Glenny Cerezo on english.SE

[ SmokeDetector | MS ] Potentially bad keyword in body (1): How to do p2p payments in flutter by tye moore on stackoverflow.com

[ SmokeDetector | MS ] Potentially problematic ns configuration in answer (1): How do I specify the RowNode.id in ag-grid by Kiril Matev on stackoverflow.com

fp feedback received on How to center TabBar horizontally on the TabWidget [MS]

fp feedback received on Have I not understood what "several" means? [MS]

Transcript for