@Makyen do you have stats on how often they stick to the same geography? I know I have at least seen variations like great britain - gb - uk - united kingdom so I guess South Africa should also alternate with za; but more broadly, should we have a canned expression which includes all the locales they use, sort of like the Indian cities list?
@tripleee For this specific product, the only one I've seen used is South Africa, so far. I probably should have included at least za as an additional alternative. That aside:
You're right that we should probably develop a default list. There are a relatively limited number of entries which are quite common. It wouldn't take all that many to have a mostly-inclusive list.
Hmmm... The way I've been considering decorations has been something like adding information in PCRE comments (e.g. !!/watch foobar(?#NO CODE) which would then strip the code prior to running the match). The problem with any such concepts is that each one we add, and potentially combinations, is a separate list. Those lists either have to be maintained externally, or is at least is a separate list within SD.
It's not an insurmountable problem, but we should put some thought into how it should be organized.
@tripleee Yeah, the form is basically the same, but the words are always based on what I've seen the spammer use, either in the one post I'm looking at, or over an MS search. The numbers and hex are basically constant. However, The list of commonly used additional words is relatively short. It's mostly locations and a few words like "review", "pill", "cream", "creme", etc.
While there are a few detections where the some extra words are required in order to be more sure it's spam, the vast majority are just optional words. As a result, it's not likely to increase FP rate by having a few extra words be included from a common list, but which that particular spammer hasn't been seen to use.
@RyanM The current version has 4 characters left. I'm willing to adjust it to what's useful to other people, but I'm not sure where to pick up the extra characters. One thing that doesn't work right now is the reboot button. We could take it out, but I'm strongly hoping we have a functional solution for that in the not too distant future.
To get more characters, we could abbreviate a few items (e.g. "Project Links:" -> "Links:", "SmokeDetector" => "SD", "metasmoke" -> "MS", "search" -> "🔍", etc.), but that will make it less understandable to newer people. To use fewer characters in the links, we'd need to use a link shortener on the MS links.
@Mast While it might be nice to have a links page, it seems like putting the commonly used links one link removed makes them less accessible. Personally, rather than going to the links page from here, I'd probably just turn to my bookmarks, most of the time.
We're already at a limit of sorts either way. The moment more items are added, accessibility goes down, whether that's due to shorter descriptions or an extra click.
@Mast How to determine which ones are popular? Personally, I use most of the listed links, other than the Blaze links and "Who to ping" (although I have used all of them sometimes).
@tripleee Yeah, that's the sort of thing which having the extra words is intended to catch. For most of the things I've used that formulation on, there are some set words which are typically the product name. For most matches, the extra words are desirable, if present, but not needed to differentiate against non-spam.
@tripleee Having a page of links sounds like a reasonable idea. I didn't intend to indicate I was against it, merely that it would be an adjunct to the list here, not really replacing it. If we have such a links page, then we get into organizing it and deciding what should be on it. :;
@RyanM A URL shortener for the MS links would save some characters. I'm not a big fan of using them, mostly because I habitually check the displayed URL prior to clicking on a link, but shortening URLs is, after all, the primary reason for their existence.
[ SmokeDetector | MS ] Bad ip for hostname in body, bad keyword in body, bad keyword in title, blacklisted website in body, body starts with title and ends in url, +5 more (636): Keto Burning New Zealand by magretakop on graphicdesign.SE
[ SmokeDetector | MS ] Blacklisted website in answer, pattern-matching website in answer, potentially bad keyword in answer, potentially problematic ns configuration in answer (173): Getting Windows error reporting dialog by JohnBrown on stackoverflow.com
[ SmokeDetector | MS ] Bad ip for hostname in answer, bad ns for domain in answer, bad keyword in answer, bad keyword in link text in answer, blacklisted website in answer, +3 more (508): Changing my career field to QA by 360digtmg on sqa.SE
@VictorVosMottor That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
@VictorVosMottor I just got here, but an article (as in a page being linked to) is not regarded as disclosure. The disclosure is where you say that you are the author of the article (or otherwise affiliated with the site). The phrase "undisclosed affiliation" in SE's description of spam refers to a situation where, say, I post a link to my article (or in general some product that I am affiliated with), without saying that it is my article (or my company's article/product/whatever it is)
@VictorVosMottor That pattern looks like it's already caught by Potentially bad keyword in body, Blacklisted website in answer, Blacklisted website in body, and Potentially bad keyword in answer; append -force if you really want to do that.
@VictorVosMottor In any event, take a look at that user's other posts. They are clearly spamming links to their site rather than trying to participate legitimately.
@JeffSchaller Somewhat, yeah. It's also fully copy-pasted from the linked article. Weird case.
Looks like it also got nuked, whether it was by the author or a moderator I'm not sure. Spam flag was marked helpful, but they're not destroyed, which makes me think it might've been by the author.
It's also possible that I'm mistaken about "Axis.Horizontal" being enough of an actual answer to pass muster. It didn't seem like the usual site-spam to me, but I'm still adjusting my radar!
@JeffSchaller Heh, I feel ya, I'm teetering back and forth myself. I think the copy-pasted answer being cut-off and then a simple "Full tutorial here: (link)" is pretty darn spammy.
@Spevacus I deleted because it's borderline NAA with a link. Compared to the other answer, it's a hint that there might be another castle somewhere with an answer
[ SmokeDetector | MS ] Potentially bad keyword in answer, potentially bad keyword in username, username similar to website in answer, blacklisted user (136): Luke's failure at the cave by filmyduniya on movies.SE
[ SmokeDetector | MS ] Url in title, bad keyword in body, bad keyword in title, body starts with title and ends in url, pattern-matching product name in body, +5 more (588): buy2health.com/max-force-keto/ by Xmqorebbjqjnxn on puzzling.SE
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, potentially bad keyword in body, potentially bad keyword in title, toxic body detected, +1 more (326): Pen stuck in Penis, hurts a lot by Jan Bredow on stackoverflow.com
[:55697678] <skipped> [:55697654] <skipped> [:55697637] Blacklisted user - blacklisted for https://askubuntu.com/a/1245166 (https://metasmoke.erwaysoftware.com/post/248859) by https://chat.stackexchange.com/transcript/11540?m=54716227
@NobodyNada Thanks. It acted basically the same as it had previously: just stopping and then some typical MS connection issues (hours after stopping). It may have been responsive to a !!/reboot. The previous time it didn't appear to respond until I logged in to the instance (and only logged in). I'm not sure what's causing this, but we can put in a detection to automatically reboot when something similar happens.
@Makyen That sounds like a good idea! Another option I've been considering is a MS-side change to fallback to the primary SD instance if the relay goes down.
@NobodyNada Well, the code that puts it on the relay isn't in MS. It's in SD. Having a second instance posting those isn't what we want long term. Eventually, I expect to integrate the separation into the active SD instance (i.e. each SD instance posts those as the metasmoke user when active). I've allowed myself to procrastinate doing that with the ostensible reason that I'm waiting to get an official MS or charcoal-se.org based email address to use for credentials.
