Happy new year, Charcoal family! I hope your night tonight is relaxing and that we can all look forward to an awesome year. There's no-one else I'd rather be fighting endless streams of spam with.
@Makyen Thanks for the clarification! (B) is what I was able to arrive at as the probable explanation, but I didn't think it was very common, which you also appear to agree with.
(A) is much more interesting; I don't think I knew that about text being consumed by prior entries. This seems like it would pose a much deeper set of problems. For example, wouldn't it have a deleterious effect with respect to the combination of watches that we sometimes do on a company name that is also used in their domain name (e.g., "example\.com") and a company name ("example(?!\.com)")?
Would that problem be worked around by making the URL shortener's domain non-consuming?
[ SmokeDetector | MS ] Bad keyword with email in answer, bad pattern in url answer, blacklisted website in answer, potentially bad ip for hostname in answer, potentially bad ns for domain in answer, +2 more (308): What is star Trustpilot Reviews? by BUY TRUSTPILOT REVIEWS on stackoverflow.com
@AdrianMole The regex contains an unescaped ".", which should be "\." in most cases. Append -force to the command word(s) if you really want to add the pattern you provided.
Just for info, that URL domain has been raised in a couple of issues in SOCVR by a user who is a long-time curator (even a mod on one of the smaller sites).
You'd definitely be someone I'd want to grant privileges to, but you need to get some experience actually suggesting watches first, before being granted full privileges to make changes to the black/watchlists without review.
So just... participating like you just did is really what you should do.
@AdrianMole The advice most commonly given is "When your watch/blacklist PRs start becoming annoying to handle because all we're doing is approving them, you're likely a good candidate for blacklist manager permissions". So... That. :)
@Ethan They were already flagged-out by another mod, and the user accounts who posted them had already been destroyed. The pattern was only noticed in retrospect. (One was caught, but the other 3 weren't.) I had to undelete them, report them to SD, and then re-delete. It's an annoying dance, but we have to do it sometimes.
Only thing I have to assist is the script that adds the "smokey" quicklink to the array of quicklinks normally found under posts. Clicking on this checks to see if the post has already been reported to SD. A recent update added the ability to report it to SD directly from there, too. That's what I use all the time now; it's awesome.
I believe I thanked Makyen for it in here some time ago.
I don't think it happens often enough to justify any more development work on a script to automate it.
Of course, it's possible that Ryan has something more sophisticated, because I know he periodically goes through spam-nuked posts on SO and, if they've not been reported, he reports them.
@metasmoke I'm not in a position to review this right now, but the MS search in the PR description is misleading as the keyword is most frequently caught in titles and the search only looks in bodies.
@Ethan We do have a watch item on Super Visa Insurance which we may want to elevate to the blacklist instead. Here's that regex:
@Ethan Yeah I was just referring to the search link that's auto-generated by the PR generation code. Makyen has a pretty awesome bookmarklet that takes highlighted text and opens up a rather fast-loading MS search for it. I'll track it down real quick.
Spam waves are something Charcoal (well, metasmoke) admins can deploy against certain waves of spam to invoke more autoflags against given criteria, separate from normal weight-based autoflagging. It's used somewhat sparingly.
They can be configured per-site or across the network, and they are configurable to cast up to 6 flags, but that's reserved for when mods of a given site say that they'd allow it.
[ SmokeDetector | MS ] Bad keyword in link text in body, bad pattern in url body, blacklisted website in body, potentially bad ip for hostname in body, potentially bad keyword in body (254): What is the GOOGLE REVIEWS? by Naimul Islam on stackoverflow.com
@Ethan SO mods like to send a year-long suspension to spammers before deleting them. However, now that I think about it, I recall the "Delete user as 'no longer welcome to participate'" functionality being changed to auto-apply a year long suspension, so maybe that's not needed anymore
But yeah. Previously, accounts destroyed for spamming/trolling were only blocked by the system for 14 days (this is actually handled internally by SpamRam, going back to your earlier question). After reviewing some stats (but mostly anecdotal evidence), we SO mods decided that was insufficient. Too many spammers came back after more than 2 weeks, re-created their destroyed acccounts, and started spamming some more.
So we decided to issue a 1-year suspension (maximum possible) before destroying the account. That way, the account would be prevented from posting anything for 1 year, even if it was reincarnated.
Well, similar to what some of our spam-fighting tools do. Not what the suspension does. That applies only to the account/profile. So it's a different tactic. Defense in depth.
A forum I mod for has "sticky" bans that spiderweb out to all known-IPs and computer ids and applies bans that way. It connects all similarly-known accounts to the ban, though it doesn't immediately surface those connected accounts. What sucks is that for privacy reasons the site doesn't surface IP traffic to forum mods, only the actual staff of the site, so we have to call in the big guns more often than I'd like to.
@Spevacus On "my" forum there is no off topic section. But the discord server for the company does so we just direct the like 3 people that have made off topic posts to the discord
Matched by the following: gmail[\W_]*+(?:dot[\W_]*+)?com(?<!gmail\.com) on line 18387 of watched_keywords.txt brandonlinton268(?:@gmail\.com)? on line 45263 of watched_keywords.txt
@CodyGray I'm unsure if you're describing a time prior to my being aware of it. When a user is destroyed for spamming, the IP address which they were using is blocked by SpamRam for 7 or 14 days (time is dependant on any other indicators, such as a post being spam/R/A nuked, IIRC?). The SpamRam block on the IP applies across all SE. In addition, an actual suspension is automatically applied to the account on the site where the profile was destroyed. The length of that auto-suspension used to be 14 days, but was changed to 365-days.
