@Yatin That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
I'm trying to figure out if it's safe to blacklist the username Alexavier Miller, which has 6 TP, across 2 profiles on stackoverflow.se and android.se, both deleted. There's one network account with profiles on apple.se and sound.se.
I suspect it's the same person, but I can't figure out a way to make sure. I assume a moderator on the sites with the deleted profiles could figure out if they are linked to the same account, but is there a way I can figure that out?
@tripleee That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body; append -force if you really want to do that.
[ SmokeDetector | MS ] Blacklisted username, pattern-matching website in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body, +2 more (261): Will Cash app customer service make my SSN? by Ella Mark on rpg.SE
@cigien Not that I've found, though I'd be interested to know if so, as I've had the same question a number of times. It's possible that one could do an SEDE query depending on when the account was created, but I'm also not sure how to write that query.
@RyanM Yeah. This particular case I don't really see that it could be a different person, but I'd rather err on the side of caution with blacklisting real names. I was actually rather hoping that there would be a way to figure it out from their network account. If it requires a SEDE query, that's something that's well beyond my current abilities.
@SmokeDetector google translation (farsi): "We have n points in two-dimensional space, each point being blue or red. We want to know if there is a straight line that separates these two sets of points. That is, the red dots on one side of the line and the blue dots on the other side of the line. There may not be such a line. The program reads the list of dots with their colors from a file"
@Makyen If, as you say, that's by design, then in that case, the GitHub issue reporting that should be labeled as a feature request, not as a bug as it is now, right?
@gparyani meh. If it's a bug or a misfeature/feature request is really dependent on what the intent was when the code was written. I think that it being labeled as either makes it clear that people would like it to change. In this case, I don't really see all that much benefit to taking the time to try to figure out which one it was at the time that code was written. If the person that wrote the code wants to say what their intent was, or just change to an FR, then that's fine.
[ SmokeDetector | MS ] Bad ip for hostname in body, bad keyword in title, blacklisted website in body, link at beginning of body, link following arrow in body, +4 more (538): CBSlim Weight loss Supplement by Mellyluise on astronomy.SE
@Makyen Shouldn't that be deutschland|de instead of de|deutschland? The way you've written it, the full deutschland will never match, right? I guess de|utschland would work as well, though that would be less obvious as to the intent.
@cigien It's probably a bit more efficient to have it the as deutschland|de, but given the full regex, it should have the same matches. The bookending \b requires it to match to a word boundary, so isn't permitted to stop at just "de" when "deutschland" is there.
@Makyen Oh, that's right. When testing on regex101 I don't always put the word boundaries. I just did and you're right, it keeps going even after it matches de. Thanks for the reminder.
Another question, if you don't mind. I certainly like the idea of adding germany in there, but it's not part of the text. I take it you're adding that based on your experience of expecting that to show up in future spam?
@cigien Yes, I put it in there as speculative. It's not that much of a reach for them to switch to using the English name for the country. It's also not all that unusual for spammers to use a few different countries or different indicators for the country (at least switching between abbreviated and not, and alternate abbreviations). So, overall, it was just a "why not", given that the real thing we're looking for is "cbslim".
While we don't want to go too overboard with adding things like that, it's not critical to add just the things we've seen. What we don't want to do is get past the point where we start seeing FP, or where we're just picking up random words, which might either be confusing to humans looking at the why data, or shadow another watch/blacklist entry which would have started with the next word.
@Makyen Ok, the intent of doing that is quite clear, and I think I can see what kinds of things we could add to watches that aren't necessarily in the text of the spam. I'm probably going to be quite conservative for a while with what I add, partly because of the potential for generating FP, and creating confusing why messages. I'll be careful, mostly because it's not entirely clear to me when those additional things might shadow other entries, and how to watch out for that.
I'll just go with my strategy of asking out loud before adding an entry, or just explaining when I make an entry like that, and hope that someone points out if I've done something inadvisible. It's been working out quite well so far :) Thanks for the explanation, that was useful.
[ SmokeDetector | MS ] Bad ip for hostname in body, bad ns for domain in body, blacklisted website in body, link following arrow in body, blacklisted user (463): Top 5 Amazon EC2 Instance Types by Harris2020 on stackoverflow.com
@Yatin That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
Seems ok. Making the negative lookbehind come after is still not obvious to me. I'll do some tests and see if it's ok. Thanks for spotting the need to update the watch, I missed that.
Ok, yeah, because we don't want watches to be duplicated. The fixed watch seems correct then. I'm like 95% sure about it at least :p I'll take another look at it later, and ask if I need more clarification.
