There will be MAJOR network changes done between May 1 and May 8th which will result in intermittent availability of the Thoth instance of SmokeDetector and Metasmoke at different intervals during that time. There is no clear planned downtime schedules.
@ThomasWard There's been issues as a result of the switch months ago to Sophos for the firewall, and I'm tired of the headaches caused by it. SO, we're going to a newly rebuilt/reinstated pfSense instance with new rules and certificate functions. THIS will power the infra at my area and solve a lot of issues that we've seen with MS and connectivity and such previously, so we're going back to what we know worked. But cleanly configured and with some upstream patches from pfSense applied for SSL.
[ SmokeDetector | MS ] Bad keyword in body, bad keyword with email in body, bad phone number in body, blacklisted website in body, potentially bad keyword in body, +1 more (349): Laborumzug in Berlin by Spammer McSpamface on stackoverflow.com
[ SmokeDetector | MS ] Bad keyword in body, bad keyword with email in body, bad phone number in body, blacklisted website in body, potentially bad keyword in body, +2 more (420): Laborumzug in Berlin by Spammer McSpamface on ukrainian.SE
[ SmokeDetector | MS ] Bad keyword in body, bad keyword with email in body, bad phone number in body, blacklisted website in body, potentially bad keyword in body, +1 more (349): Laborumzug in Berlin by Spammer McSpamface on stackoverflow.com
@HenryEcker I didn't realize that (I assumed wrongly that some spammer was just being weird). If all the users with that username are spammers, feel free to just undo the blacklist, but if there's a few that post spam after having their name changed to that, it may be worth keeping.
@cocomac I wasn't making any statement for or against the blacklist (I'll leave that to you and the other charcoal folks) I was just letting you know that that specific username is almost always the direct result of a moderator renaming the account after being detected as a spammer/spam account.
I would assume that would lead to a relatively high tp rate as well given that it is typically an indication of prior history of spamming.
My comment was really more of a "just for your information" than a comment on your action of adding it to the blacklist (which is why I replied to the "Love the username" message)
@HenryEcker Thanks for letting me know - I wasn’t aware of that. While a high TP rate, that would mean that to some extent that the blacklist is a duplicate of the user blacklist, so given that it is typically done manually to users, I’m not convinced it is needed.
!!/reject 7750 "Watches are case insensitive by default, no need to explicitly do that. Also, why \s vs the more standard [\W_]*+ I'm not opposed to the watch if the regex is updated, though"
[ SmokeDetector | MS ] Potentially bad asn for hostname in answer, potentially bad ip for hostname in answer, potentially bad ns for domain in answer, potentially bad keyword in answer, potentially bad keyword in username (5): Unit of measurement for services by Lorcum Security on english.SE
[ SmokeDetector | MS ] Bad ns for domain in body, blacklisted website in body, phone number detected in body, potentially bad ip for hostname in body, potentially bad keyword in username, +1 more (368): American airlines español by Nicholas David on gamedev.SE
[ SmokeDetector | MS ] Pattern-matching website in body, potentially bad ip for hostname in body, potentially bad ns for domain in body, potentially bad keyword in body, potentially problematic ns configuration in body (99): Who is The Best Diabetologist in South Delhi? by Doctor Delhi on superuser.com
teward/Thoth: In getting MS post information, recovered from requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='metasmoke.erwaysoftware.com', port=443): Read timed out. (read timeout=10.0)
@tripleee That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@Nick That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answerThe pattern starts with whitespace. Append -force to the command word(s) if you really want to add the pattern you provided.
@Nick That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@cocomac It's as expected, but not as desired. Currently, when the message is too long (i.e. > 500 characters) for a "normal" chat message, SD and MS default to making the message a multi-line message by adding a newline character. In chat, multi-line messages don't support markdown formatting. At this point, we've found another possibility for how to handle that, but the code hasn't been changed.
@NisseEngström It appears to have self-resolved. The one which I checked was a watched NS not resolving in DNS.
@NisseEngström In such cases where the domain and the company or product are the same, we usually use a more complex regex for the company/product in order to prevent it from matching the domain. In this case, that more complex regex would be something like digital[\W_]*+retina(?!\.in(?<=digitalretina\.in)) for the company name. That way, when/if the one or both of the entries are moved to the blacklists they won't be detecting exactly the same text for two different detection reasons.
@Makyen That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body Append -force to the command word(s) if you really want to add the pattern you provided.
@Makyen That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer Append -force to the command word(s) if you really want to add the pattern you provided.
@Makyen That pattern looks like it's already caught by Blacklisted username Append -force to the command word(s) if you really want to add the pattern you provided.
