[ SmokeDetector | MS ] Few unique characters in answer, no whitespace in answer, potentially bad keyword in answer, repeating characters in answer (265): Do I need VMWare vSphere? by sdf on serverfault.com
@Yatin Having separate watches for keywords and domains can be useful when we decide to blacklist either one, since they are separate lists. We can also add more weight by catching a post in multiple ways. There may be more to this; I remember reading a more detailed explanation before, I'll see if I can find it in the transcript.
@Yatin Yeah, I think so. I haven't clicked through to see if the site is legit, but the post itself is spam, and there are no FP for that domain on SE.
As to the icustomersupport\.co\.in, the post it appeared in doesn't seem to be spam. However, I don't see any harm in watching the domain; there are no FP on SE at least.
@Yatin I'm not sure. I see what you're trying to catch, but I don't know the extent of the FP for that. e.g. "thank you for sharing your blog article" would be caught, and that's not really an indicator of spam. Searching for these phrases on SE is going to be very hard. I wouldn't be too comfortable approving the watch myself, but I'm also not saying that we shouldn't try it out. I would say that if we do add the watch, we should monitor it closely to see if it starts generating too many FP.
@Yatin That pattern looks like it's already caught by Mostly punctuation marks in answer and Mostly punctuation marks in body; append -force if you really want to do that.
@cigien It looks like it was an intermittent DNS issue. I'm rerunning the GitHub Action jobs, but given that it didn't continue to fail in subsequent commits and your watch wouldn't have caused the error, I'm expecting it to pass.
@Makyen I don't really like the extra text on feedback messages corresponding to the last report. I often used these to quickly tell with a quick glance whether feedback was issued to the last report, or to a different report from a long time ago, especially if I just manually reported a post.
Can we consider a compromise solution, in which the link to the post at the end is omitted, but the "[MS]" link remains? This will solve that issue, while also solving the FIRE issue and the race condition issue (as in the rare case of a race condition, the MS link will make it clear).
@Yatin That keyword is eligible for blacklisting, given the 6 TP, so we can go ahead and blacklist it. Also, the inner parentheses is redundant. If you do need it for whatever reason, you should make it non-capturing for efficiency, i.e. prefer (?:xxx) instead of (xxx).
You should also generally mention that the pattern is from a youtube video, just so it's clear when looking it up, as well as for searching. It's fine this time, just mentioning it for future reference.
> 1544351547 Makyen ^\s*<p>\s*(?:</?\w+/?>\s*)*<a href="(?:(?:[a-z]+:)?//(?:[^" >/.]*\.)*(?:youtube\.com|youtu\.be)[/"])\W*(?![\W\w]*?</(?:code|blockquote)>)(?#Separate start with youtube watch; lower TP rate, but most TP are not otherwise detected)
Naah that isn't "negative lookup". In fact there isn't something called a lookup AFAIK, it is lookahead/lookbehind... Also it isn't either... it is a non-capturing group
BTW I am getting a pattern error for all flavours of regex for some reason
user435118
@Yatin I think MS uses a different regex package. Change the flavour to Python 2.7 and add backslashes behind all the speech marks. I already did it here.
@Yatin I'm on the fence here with the feedback. In all fairness, it could be a good-faith question. Until we see more from this user or until we link this user to an already known troll I'm going to go with fp.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, pattern-matching product name in body, potentially bad keyword in body (391): Is Magnum XT Real Or Hoax? by hiliumketo on askubuntu.com (@Ollie)
@Yatin Particularly for blacklists, please be more careful about looking for possible FP. Definitely check/search on SE for possible legitimate uses. A domain name like 'apnews.com' is a good hint that the spammers may be using an otherwise legitimate source to host spam articles.
