Artisan Spammer Cannery and Loanshark Hunting Grounds

security_paranoid

01:53

user2650845

1 1

Weijun Zhou

03:31

ASACCA

1 1

dsfasdasdfasdf

1

windows-8

Weijun Zhou

03:50

adsfdgfg

1

hard-drive mac networking windows-7 wireless-networking

Journeyman Geek

04:16

caught up to here

Cow

06:20

MS is back online

been up 10 mins

Bill Tür stands with Ukraine

07:44

1

1

1

1

1

1

1

1

DavidPostill

08:04

already chewed

Journeyman Geek

yeah, I was getting off the front page

The spammers seem extra busy again

A-Tech

https://superuser.com/users/2651800/dsfdasfsad
https://superuser.com/users/2651805/user2651805

Journeyman Geek

got both

A-Tech

10:41

https://superuser.com/users/2652296/system-logic-solution
https://superuser.com/users/2652301/vbvbvbvbvb
https://superuser.com/users/2652290/andwis
https://superuser.com/users/2652239/user2652239
https://superuser.com/users/2652286/anika-almeida
https://superuser.com/users/2652282/delta
https://superuser.com/users/2652248/user2652248
https://superuser.com/users/2652226/user2652226
https://superuser.com/users/2652205/user2652205
https://superuser.com/users/2652249/user2652249

https://superuser.com/users/2652257/sdgrhe
https://superuser.com/users/2652313/user2652313

https://superuser.com/users/2652338/user2652338
https://superuser.com/users/2652334/user2652334

Journeyman Geek

got em all

A-Tech

12:43

https://superuser.com/users/2652638/kotabalii
https://superuser.com/users/2652689/user2652689
https://superuser.com/users/2652720/ghan-shyam

Giacomo1968

Ghan Shyam

1

dsfsadfdsa

1

A-Tech

https://superuser.com/users/2652646/user2652646
https://superuser.com/users/2652725/ewrwerwreewr
https://superuser.com/users/2652717/erenyaeger

Giacomo1968

user2652748

1

windows-7

Journeyman Geek

13:00

all good to here

@Giacomo1968 now they're trying self deletions... interesting

Lundin

13:18

Howdy. Is this the right place to discuss spam? What chat room does SmokeDetector post in (if any)?

Journeyman Geek

@Lundin I tend to keep an eye on charcoal HQ and the tavern on the meta (in addition to the SD RSS feeds for super user)

this place is more for dealing with spammers than spam (so no direct charcoal/SD feeds), but discussions are fine

Lundin

Oki. Well you guys are probably already aware but I noticed a new spammer pattern today. They will copy/paste a new legit question and post a spam seed which is 100% identical and on-topic. Then later flip it to spam through an edit. Makes flagging harder since we can't really use spam flag when the post is just a duplicate and/or plagiarized.

Journeyman Geek

yup

look for the windows 7 tag :D

they like those

Lundin

13:40

I noticed :)

Journeyman Geek

They also seem to be trying to nuke their accounts before I do

presumably so they can reuse the credentials later

Lundin

The spammers are so sophisticated that they even delete the spam themselves :) Mission accomplished.

And tbh I'm only using this site because I'm very interested in airline ticket booking and refunding. It's my core interest, so that's why I visit SU and not the Travel site where such questions are on-topic.

Journeyman Geek

lol

At this point I think they're just trying to DDOS the spam filters

Lundin

13:55

I'm just trying to imagine what the spammer's life must be like. There's sad ways to make a living and then there's really sad ways...

Journeyman Geek

14:10

Its a living

Lundin

Looks great in your CV too

A-Tech

Regarding the development of the spammers methods: SE should make an event with a test site where we are supposed to try and post made up spam that gets past the filters. The results could be used to make more sophisticated filters.

https://superuser.com/users/2653004/user2653004
https://superuser.com/users/2652996/pompom

Journeyman Geek

got both

@A-Tech I mean, we could do 100% of what we get now first :D

music2myear

user2652943

1

Pummy

1

A-Tech

14:26

Yes SE/SD will eventually catch on and block the current forms of filter circumventions. But assuming the event creates more sophisticated spam and thus better filters we wont have to play catch up (for a while)

Journeyman Geek

the problem isn't sophisitication though

its volume

music2myear

@JourneymanGeek This

Prestige Roshanara

1

Tutu

1

A-Tech

Yesnt? If we had 100 exact same spam posts one regex/filter rule would be enough to prevent everything. Our problem (from my view) is the variation meaning we have to have more complex filters-> which SE/ the comminity tools lack atm meaning we users have to deal with this. This is where volume comes into play.

but I'm just throwing thoughts/ideas out until something stickts so maybe im all wrong

Journeyman Geek

well SD is catching most of them

our problem is not enough flags

A-Tech

user2653037

1

absolutly

Journeyman Geek

14:34

The Smiths - Vicar In A Tutu (Official Audio)

►

all good to here

music2myear

14:53

@JourneymanGeek Even with more flags, we need people on the front page around the clock to provide that last human flag. I suppose it's a good thing SD is designed conservatively, to require that last human check. I haven't looked into its algorithms to see whether a 100% confidence level is even possible, or how possible it is.

Journeyman Geek

@music2myear people run out of flags

Cow

man, I hope you will write to someone @JourneymanGeek everyone seems to be out of flags today

Journeyman Geek

We've better tooling than most sites (including this room)

Cow

SD used 60 flags of mine lol

Journeyman Geek

I already have a SR for more flags

Cow

14:55

nice

Journeyman Geek

Still waiting on a response

Cow

:-)

roger that sir

music2myear

@Cow Every time I check, SD tells me it has used zero of my flags.

Cow

you need to setup your conditions correctly

Here: metasmoke.erwaysoftware.com/flagging you can set preferences, how many flags SD is allowed to use and the conditions

conditions are key to getting autoflags

music2myear

I did that a looooong time ago. Years. But I haven't been back to check it. The Conditions page seems to be having problems, but the Preferences page loads OK. I believe I went through the Wizard last time, maybe the settings that applied back then were have all been deprecated.

Cow

15:07

you need loads of patience with the conditions

the database is over 100GB

or 200? I dont remember

click it and wait at least 5-10 mins for it to load

Journeyman Geek

.....

Cow

do something else while waiting

I clicked my biggest one 15:49 my time and it loaded 10:04

music2myear

Got them to load. 7 flags allowed for "all sites" (looks like the two different times I went through the wizard there were different numbers of sites in existence).

I added 60 flags allows for SU just now.

Journeyman Geek

Cow

@JourneymanGeek holy f_ck

Journeyman Geek

15:09

via metasmoke.erwaysoftware.com/graphs

music2myear

I'd guess SU also gets the most traffic, by far.

Spammers follow the eyeballs.

Journeyman Geek

@music2myear technically that's SO

We were slightly less than SO (and about quarter the total spam) last time I checked

Weijun Zhou

Are we really just lacking the last human flag? Are all spams today on SU (which follow a clear pattern) caught by SD?

Cow

@music2myear add that one and you should see a change

Journeyman Geek

@WeijunZhou I think some of them were caught by me possibly before SD

and its just general volume

Cow

15:13

@music2myear remember to set your preferences high so it can utilize your available flags, it wont conflict as it will test before using it

music2myear

Yea, I'm going to adjust the weight. I appreciate the screenshot of your settings. I'm waiting for the page to load now.

Journeyman Geek

metasmoke.erwaysoftware.com/sites/…

Looks like we're still mostly good on time to delete but they do seem to have escalated the number of posts getting through lately

Weijun Zhou

OK. I'm just making sure that the spams following this clear pattern are either removed quickly enough before they are caught by SD, or are caught by SD and just lack the last flag from human. If that is true, maybe that's already the best we can do for now.

Cow

@WeijunZhou remember SD is only as good as we have taught it to be. All search patterns are made by us, the maintainers

Also @JourneymanGeek seems to be a lot faster sometimes that the API itself

and then there's no record

Journeyman Geek

>_>

My Dog Caught a Rat. **Shocked**

►

Its in my blood :D

Cow

15:19

ROFLMAO

Lundin

Seems to be ups and downs - sometimes there's a time window where my flag always seems to be the final one. Sometimes there's a time window when more flags are required. I guess it depends on the nature of the spam coming through right then.

Cow

yes it depends a lot on the weight

I dont really want to discuss it here, but I know exactly when and why things are different

Journeyman Geek

More seriously

@Cow some days I just leave the front page open, and nuke em as they come in

Cow

me2

I just dont have much time, the last two days I had to go to the office and I dont have time then

might have more time tomorrow morning to nuke for a few hours

Journeyman Geek

Its not 'efficient' but it gets spammers fast, and if I'm nuking accounts, I save all y'all flags :D

Cow

15:22

true nuking the account is so important because almost 90% repost instantly after

Journeyman Geek

yup

or come back after a while to post again

Cow

yeah and post comments and answers on their own spam

music2myear

SD being able to nuke accounts would be an interesting development.

Cow

it will never happen

you cannot have a bot with moderator privileges

Journeyman Geek

@music2myear A false deletion would be.... troublesome

Cow

15:24

or a community bot at least

music2myear

Yea, you're right.

Journeyman Geek

I've had one or two incorrect ones and generally, they're an annoyance to fix + embarassing

music2myear

SD feeding high probability/multiple post accounts to a chatroom like this where mods can review and nuke may help?

Cow

mods can already do that

Journeyman Geek

@music2myear in theory yes, but I also follow SD RSS feeds and what I get feels incomplete

Lundin

15:25

"The nuke room"

Journeyman Geek

+ its good to have eyes on the ground

Cow

mods can already configure SD to post in rooms where it has access, but it must have write access

Journeyman Geek

@Cow there's an RSS feed I use

Cow

yeah that is great too

Journeyman Geek

BUT in the context of this room, it feels noisy when everyone's aware of it

Cow

15:26

yeah we dont need it here

Journeyman Geek

so I keep it on my own reader as a 3rd/4th source of truth

Cow

this is for nuking accounts

Lundin

...and now I'm out of flags. TTFN I guess.

Cow

@Lundin well thanks for the help at least :)

Weijun Zhou

@Cow Are the patterns adjusted in real time and in effect right away?

Cow

15:30

@WeijunZhou yes

Journeyman Geek

Should be tapering off around now anyway

Weijun Zhou

I really hope the number of spam flags are shared across the SE network as already proposed on meta SE. I only have so many flags here.

Lundin

Heh I only have 14 flags. Definitely not trusted around here. MinionUser.

Weijun Zhou

@Cow Glad to know.

Bill Tür stands with Ukraine

15:56

GTR SK

1

music2myear

16:45

@Cow Oh, interesting. So if the spammers start working together to upvote each other's posts, they could avoid a lot of our auto flags.

Cow

@music2myear it's complicated, for blacklisted usernames max rep is 1, for blacklisted websites it's 52, for watchlists it's 32 for detection

remember that sock upvoting would probably get detected and reverted anyways

Cow

17:37

@JourneymanGeek tried this about a week ago i.sstatic.net/gwllhHKI.png

still pending

link in post

1

A: Can the max number of daily raised flags be increased?

The Flag base limit has been increased to 100 on Super User to help with the current wave - and we're also trying a couple other things on our end too.

music2myear

18:11

As of 24 minutes ago that post has a reply stating:

"

The Flag base limit has been increased to 100 on Super User to help with the current wave - and we're also trying a couple other things on our end too."

music2myear

19:18