@cigien My intent, not having seen the one you added, was to detect the domain, inclusive of the poorly obfuscated version which they used in addition to the properly formatted URL.
@SmokeDetector tpu- Plagiarism: copied entirely from the link in the answer, as are seemingly (almost?) all of this user's answers network-wide. Custom flagging in progress.
@Makyen In this case, it's quite extreme: 20 of the user's 22 posts network-wide are plagiarized. Per the feedback guidelines, I didn't explicitly report any of it to SD (it's all custom flagged now), but it does seem reasonable to assume that they will continue to do so. Should I remove the user blacklist, though, if we don't want to try to catch such things?
The feedback guidance notes that "plagiarism should be marked as k", which implies that blacklisting the user is appropriate. If we don't want to use user blacklisting for that, that wording should probably be changed.
@RyanM You do have a point. That should be changed; done. Blacklisting the user, either manually or with tpu/k is effectively our having SD go out and look for plagiarism by the user. While I agree that the plagiarism should be appropriately handled by moderators when custom flagged and the plagiarism explained, it's not what SD is really intended for.
It also sets our users up for unexpected situations. They are likely to mark future contributions by the user as FP, rather than realizing that they need to do a more detailed look for plagiarism. When looking at SD reports, most users are expecting to be looking for spam/R/A. That will tend to result in confusion, and/or poor classification.
I personally always check why a user was blacklisted when I see something that looks like FP, on the assumption that there might be a clue there (as I would do for an otherwise innocuous-looking post with a watched domain in it). That was why I left the comment in chat, so that they'd find it when checking why the user was blacklisted.
@SmokeDetector @Makyen the FIRE display did not reveal the link at all here, could it somehow be made more prominent? I clicked FP at first because it seemed innocuous
yeah it might help to show the reason in the dialog - if i see "suspicious link" and see no link i'll know it's hidden (or at least i'll know to go look for it)
or another sol is just if the link contains too few non-whitespace characters just insert "[hidden link]" into the link or smth like that ¯\_(ツ)_/¯
@RyanM There's code, or at least intent, for such a detection, but it's waiting on other code for me, which I'm extremely delayed in providing, but have worked on it in the last couple of days.
teward/Osiris: In getting MS post information, recovered from requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='metasmoke.erwaysoftware.com', port=443): Read timed out. (read timeout=10.0)
@CodyGray That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command if you really want to add this pattern.
@hyper-neutrino That pattern looks like it's already caught by Potentially bad keyword in answer and Potentially bad keyword in body Append -force to the command if you really want to add this pattern.
I'll add a link to the metasmoke record for this domain
oh it was linked already
this is a pesky spammer who has a large number of (mostly industrial metal etc) sites on a single IP address, and posts rather innocent-looking questions about problems with the sites
[ SmokeDetector | MS ] Bad keyword in answer, blacklisted website in answer, potentially bad ip for hostname in answer, potentially bad ns for domain in answer, potentially bad keyword in answer (184): HP Wireless Printer not working by jamessmith09 on serverfault.com
@tripleee The pattern starts with whitespace. In order for a "number" to make an exact match, the pattern must begin with a digit or up to two of +,(,[, or { immediately followed by a digit. Append -force to the command if you really want to add this pattern.
The setup here is seriously impressive. Committing from a chat comment and then reloading that quickly. I know that's spam in an anti-spam chatroom, but still. I'll shut up now :)
@CodyGray I was looking at that and still thinking it was a bit lowish but maybe I'm getting too jaded (50k+ users still exhibiting antisocial and noobish behaviors left and right)
@ChristianGollhardt I have activated your account. Please review the project documentation at charcoal-se.org and ask here if you need details or clarifications
