[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, link at end of body, pattern-matching website in body: This wrinkle reducer arrangement contains the accompanying by Aved1978 on workplace.stackexchange.com

tpu- by Kyll

Sorry FDSC people, I'm going to break it for you again soon. Attempting to deploy a light version of OAuth on metasmoke so that you don't have to be logged in to use the write API, and so that you're not passing cookies cross-domain.

@ArtOfCode Will you break it and fix it later or break it permanently?

Yeah, it'll be fixed. But there'll be a period between metasmoke updating and the script updating where one or the other will be using the old auth method, incompatible with the new one.

Ahh okay

@FrankerZ kinda?

@ArtOfCode Btw, as far as I can see, most of our feedback is now coming from FDSC

Why did this get invalidated?

@Magisch yeah, we're going on 2000 feedbacks in the past 16/17 days... which is pretty impressive

we generate over 100 spam flags a day

is that a good thing?

@ArtOfCode I haven't kept track (not sure there is a way to network-wide track your flags) but I'm pretty sure I cast above 30 today in spam alone

@Magisch there isn't, unless it's spam, in which case you go through the API feedback list to see how many you've cast

@FrankerZ Follow the link, it just is a shortened link to another SO question. (as a side note, I think that code is plagarized from a blog post but I forgot to flag it)

Shortened link to a post that has nothing to do with the current post, and plagiarized answer from another post. Seems like spam to me

@ArtOfCode the vast vast vast majority of my tpu- since the new feedback grouping by id has been from FDSC

In general, if there's already valid feedback on a post, I don't bother, and if there isn't, I can use fdsc.

@hichris123 The account got destroyed for it

That is something that I believe metasmoke should catch, and I don't believe it should have been invalidated

@FrankerZ Spam? Misguided user, sure... but spam? No way for the poster to profit that I can see.

@hichris123 It goes through 2 particularly nasty link shortening services (1 lets you track visitor's ips and one lets you change the destination anytime)

A SO moderator deemed it fit to destroy the user based on this post due to this

why?

sigh, link shorteners, does it really? I researched the link shortener and it looked legitimate...

@hichris123 tiny.cc allows link editing at any time. I could link a useful website now and change it into malware a week later

@Magisch yeah - we always watch them - the risk is high

deleting a user because of a bitly link seems excessive

And bit.do prints you a list of all IP adresses that visited, complete with where from and other meta data

^ That's quite scary

The data is public, too

Nah. IP addresses aren't PII.

Are you sure it goes through tiny.cc? I can't see that.

The best you can get with an IP address is a city.

most people don't change their IP addresses every day

@ArtOfCode You can get the mac address from an ipv6 address if someone isn't using privacy extensions

@hichris123 The link goes bit.do -> tiny.cc -> actual post

If it goes though a spam link shortener, that's probably spam. But if it's just this one, misguided and poor practice, but not spam.

OK, yes, this is bad.

@Ferrybig MACs aren't PII either

they are unique at best

IIRC in germany MAC adresses are classified as PII

No, they're not. Personally Identifying Information. This is my MAC address: 00:E1:B0:39:55:17. Now tell me who I am.

OK: So #1 we have multiple redirects. While this may redirect to stackoverflow now, it may not in a day. This was investigated before I made the decision of spam. #2: Even if it didn't redirect through multiple redirects, there is 0 reason for a url shortener (It was an href, and no where did the link show in the post). Also: The url service captured user information. Users could sell that information, it could be wingding looking for ip addresses to ddos...

You can't link a MAC address to a real-life person, so they by definition can't be PII.

For me: That's something I would want metasmoke to catch, and I see that as a tp

Hmm, I guess it does go to tiny.cc. That's fairly suspicious, but enough for a spam flag? Not sure on that one.

I say smack it

See my point #2

@hichris123 Fully plagiarised with only the link changed out for something that could extremely easily be edited into obnoxiously hard to catch spam by a user with no other contributions member since today

@FrankerZ As a note, tp feedback (besides on vandalism) is for spam/offensive flags, not "Should the bot catch this?"

@ArtOfCode Members of the FTC disagree with you

Idk, I'd nuke that. And Martijn Pieters saw it fit to destroy the account.

is tiny.cc blacklisted as a link shortener?

I thought the idea behind tp flags was to try and train metasmoke to determine what should be caught with it?

No, not really. There's no training done with the data (as of yet) for the bot.

@Andy I disagree with them :P a static public IP plus a static internal IP would enable you to identify a device, so that combination would be PII. A MAC address can be spoofed easily, so I wouldn't say that you can reasonably link it to a device. They're not intended to be unique, and if you have one you can't say "it was this person" or "it was this computer", so I don't see how they're PII.

@ArtOfCode If I get your phone's mac address (say, from following you with a wireless sniffer and watching your phone send out probes for wireless networks in the area) I can easily determine which mac is yours (you were the only one to travel from A to B to C to D). Now I know who you are, where you are, how long you were there...and I'd like to see you know that I'm doing it and you change your phone's MAC.

You don't need an IP for the mac to give you away. Your mac is sent with EVERY transmission your phone makes - "Hello?! Any network out there?" or "Hi new network! I'd like an IP please"

@Andy slight problem with that idea: if you're following me, you already know who I am.

Whelp: I'm standing behind my decision for that, and I guess I'll have to eat an invalidated feedback on that, but for the record, I disagree with that decision. While it's something that may take a bit of digging into: It was ultimately determined as such, and the user was destroyed over it.

Your chat history is PII, and SO makes that public. You find some pitchforks, I'll grab a stack of torches.

@ArtOfCode But now I know exactly where you are too. That's the difference.

@ArtOfCode how... what?

@Andy you were following me, you already knew that

@undo take a look at GH. Implementing sort-of light OAuth for the write API

@ArtOfCode Once I have that mac though, I don't need to follow you

I have technology to assist in that case

Don't MAC addresses usually not leave your LAN?

oh, WiFi scans. Right.

@Andy you don't? Why not?

But no good for tracking someone across the internet, right?

From the FTC argument I linked above:

> Instead, businesses generally use “cookies” to track consumers’ activities and associate those activities with a particular computer or device. . . . [H]owever, it may be possible to link or merge the collected information with personally identifiable information – for example, name, address, and other information provided by a consumer when the consumer registers at a website.

Mac, in combination with other stuff, makes it very easy to identify a person

Just like IP with other stuff does

@ArtOfCode I still don't understand how this can work without cookies.

In combination, sure, yeah. I'm saying I don't think a MAC, on its own or with an IP address, is identifiable

@ArtOfCode And the FTC is saying that the combination of stuff does make it identifiable.

@undo I'll document the flow when I've got the code down. I think it should work as-is now, actually, but I haven't tested or written tests

We need IPv6

@Andy sure, I agree with them there. If you have a combination of stuff, various information, you can identify someone. If you've just got a MAC, or a MAC plus a public IP, you can't.

@undo No. MAC doesn't go across the internet. It stays local to the network you are on (or you broadcast to)

@undo of course, I may have completely overlooked some glaring security hole, in which case we have a problem. Yeah. Second set of eyes on this before you deploy it would be good

@ArtOfCode "stuff" is easily gotten though by visiting a link. Drop a cookie in the user's browser and now you can track their activities. Or, if you are less friendly, malware.

There are DEFCON talks about the insane amount of information leaked by mobile devices, but IIRC it was mostly local-proximity stuff

I keep trying to get the company to pay for my trip to Blackhat/DEFCON. They haven't yet, but I'm hopeful

@Andy gonna disagree again, I'm afraid... sure, you can drop a cookie on them. It'll only get sent to you, though. So, if you're a link shortener, you'll be able to match up my IP and potentially MAC address with the websites I'm visiting, and you'll have a city-level rough location. I still don't think that's PI.

Also...if you go, don't take any device you care about.

@ArtOfCode But then you go sign into Facebook...

@Andy yeah, and... what happens? That cookie that the link shortener dropped on you doesn't get sent to Facebook.

And Facebook doesn't share the fact that you've logged in with the link shortener.

well, unless it's fb.me.

Comes down to one simple thing

@ArtOfCode Do you think that your phone number is private information?

tomanthony.co.uk/blog/detect-visitor-social-networks - Not sure if that's still possible, but that JS code is to check if a user is logged into Google, Facebook or Twitter. Drop that on your url shortner and you have information about a user as they pass through

@FrankerZ private, yes, not identifiable

That comes down to the definition of identifiable. Does it have to be 100% accurate to be identifiable?

On a side note...the person that wrote that post above could use some anti-spam measures for their comment section

@Andy information, yeah, but you still can't identify who they are. You don't get a username with that JS.

@FrankerZ FTC says reasonable, which is fair. You'd probably want a 90% certainty that this is your person.

Unless someone is spoofing your phone number as part of a test, I can be assured that if I see your number pop up on my caller ID, that it would be your device (Within 90% certainty).

You can't tie that to a device though. Phone numbers can move devices.

Phone numbers can also move SIM cards.

Yes, but with 90% certainty, it would still be your device

I guess: It would be identifiable for a certain time period

Still disagree. How do you get from having my phone number to identifying precisely which one of the world's 14 billion devices I'm using, with 90% certainty?

90% of people don't move devices very often

Sure, but if you've got my phone number, you can't identify which device I'm using, even if I haven't changed it in the last century.

I certainly don't know how. Social engineering with your carrier might work, though.

For a simple example, take this: if I gave you my phone number, could you identify what make of phone I've got?

You need to be able to uniquely identify the device, with reasonable certainty, to qualify it as PII.

The only way I know how would be to call up your carrier, make up some sob story about having a stroke and forgetting all my passwords, but I want to confirm (for fire-insurance purposes) that I had an iPhone and correct me if I'm wrong.

And I have two SIM cards here, remind me which one is for my phone and what the IMEI should be?

sd f

sd f

You certainly wouldn't that kind of information over the phone in the UK, though. Data protection makes it illegal to provide PII without first identifying that you're speaking to the owner of it or their authorized agent.

No idea about the US.

There are horror stories about Amazon revealing stuff over the phone or some such insanity

Remember that guy who got his life wiped away, then wrote a story about it on Wired or something?

nope :)

Mat Honan

wired.com/2012/08/apple-amazon-mat-honan-hacking

Oh - @undo have you got an MS backup you can give me?

@ArtOfCode Whatcha looking for specifically?

@undo everything I need to stop my testing copy chucking errors at me :)

kk

I'm just going to nuke the users table in it, then

It's currently complaining about the lack of SmokeDetector records, but I guess there are other things it needs too.

and what's the betting I run into that tzinfo error again

that's an easy one to fix

yeah, I'll search it up now because you just know I'm going to hit it

ta

Only 13 MB compressed for all the spam?

spam compresses well

It's 50MB+ otherwise

[ SmokeDetector | MS ] Blacklisted user: Print a spreadsheet with IMAGE formula by C2Call on stackoverflow.com

@Undo You may want to remove the table "ignored_users" from the dump, as this table contains data currently not exposed to the public

@Ferrybig Not terribly concerned about it

Potential damage is low

And I assume you can say the same about the api keys, as most of those keys are already public in some scripts

Backoff received of 10 seconds on request to questions/17886;741?site=space

yes

[ SmokeDetector | MS ] URL in title, bad keyword in body, link at end of body, pattern-matching website in title: testboosthelp.com/jack-hammer-xl/ by janetreeser on security.stackexchange.com

tpu- by Ferrybig

you didn't redact the Smokey keys, though...

whoops :)

!!/test jackhammerxl955.wordpress.com

> Would not be caught for title, body, and username.

Oh, hmrph

yeah, those are about to change

And that's how security breaches happen :)

I've redacted the message, though, so the link is gone

It was gone before anyway

it was?

Permissions

ah

useful things, those

[ SmokeDetector ] SmokeDetector started at rev 459dd59 (ArtOfCode: Merge pull request #200 from angussidney/patch-2) (running on Raspberry Pi)

Restart: API quota is 4653.

okay, ya'll have new keys.

Ideally they'd be tied to metasmoke accounts and it wouldn't be handled through email, but whatever

[ SmokeDetector | MS ] Link at end of answer: How to create custom form in blogger sending to admin email by Jillian Robinson on stackoverflow.com

tpu- by Magisch

sd n

@undo [:31882665] That message is not a report.

@SmokeDetector These messages could probably be exempt from the list of Smokey messages, but meh.

!!/report scifi.stackexchange.com/questions/138726/…

@Randal'Thor Post 1: Could not find data for this post in the API. It may already have been deleted.

@SmokeDetector Aww, it seemed like a fun post

And if I undelete it, I won't be able to spam-flag it again. Ah well.

Ack. @undo I can't get the test server working right now, but I think the thing should work. Deploy at your own risk :)

With how hard deploys are right now, I'd rather get it right the first time :P

I'll look at the tests, although I still don't understand how this is supposed to work

Fair

... ohh, this is OAuth for metasmoke

@ArtOfCode How is this better than cookies?

Essentially this. App has an API key. App needs an API token to use for write operations. Tokens are tied to the API key and the user, so each user-app combination has a distinct write token. App sends the user to MicroAuth#request, using its API key. Metasmoke asks the user if they want to authorize the app. If user says yes, user gets given a code to enter in the app. App uses this code and its API key to go to MicroAuth#token, where it can get hold of the write token.

What problem does it solve?

@undo cross-domain cookies aren't great

Why?

or so I hear

@undo lemme find that one out

I'm thinking there must be a reason why SE, Google, Facebook, all the big stuff, uses OAuth to authorize apps instead of using the cookies.

well, it's necessary for server-side stuff.

What is? The cookies?

Also, they can't rely on CORS to validate where it's coming from.

@ArtOfCode OAuth, if you're doing it right

aye

Also, using OAuth makes it (easier|possible) for desktop apps to write, instead of just userscripts

This is true

I'll have another go at getting it tested when I can actually get my server working, though.

You want uniqueness instead of unique in the validations

that'll get rid of a lot of red

ah

that'll be my terrible memory at work

SD F

[ SmokeDetector | MS ] Link at end of answer: How to improve SEO while using MVC with AJAX by kanaylal on stackoverflow.com

naa- by MAR

I n'd, because it might not be that k-worthy.

[ SmokeDetector | MS ] Link at end of answer, blacklisted user: Delete old pages by kanaylal on stackoverflow.com

Why does metasmoke not like my reports?

It's owlist.

[ SmokeDetector | MS ] Blacklisted user: How to improve my site alexa rank and increase world seo rank? by kanaylal on stackoverflow.com

@SmokeDetector k

@SmokeDetector f

Backoff received of 10 seconds on request to questions/77388?site=travel

@ArtOfCode Working on those deployment issues, so might move your recent commits to a new branch. I still plan on deploying them, but want to deal with one potential problem at a time ;)

yeah, no problem

or maybe I can just trick Capistrano into not deploying master. That'd be better

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer: Forum Data Analysis by jenny jeniffer on stackoverflow.com

Hmm, I wonder how duplicate feedback is still accepted by metasmoke (ex metasmoke.erwaysoftware.com/post/37987). cc @undo

Maybe the API doesn't check for it, although I thought that was at the model level

I was pretty sure it was too. shrug

probably art's userscript gave an error, so Yvette submitted that feedback using the review page

@Ferrybig It should have rejected it, though

[ SmokeDetector | MS ] Manually reported answer: Adding a column to multiple tables in MS Access using SQL by sdf on stackoverflow.com

Um. @undo metasmoke.erwaysoftware.com/post/37987 "Incomplete response received from application"

oh, that's what that was about

I knew someone would still ping Undo

For whatever reason, running gem pristine --all fixes it. It feels like there's a bad cache somewhere.

Not exactly sure what I did, but pushing ALL THE BUTTONS fixed it.

squashing your changes @ArtOfCode. Might mean rewriting history, aka Git might be irritated for a while

@undo shrug, I rewrite it often enough myself

yeah, usually I don't do this when it's already public but meh

I do, for small stuff like metasmoke, unless we're both working on it at the same time

[ SmokeDetector | MS ] Link at end of answer: how to add solr to run on startup? by OliviaU on serverfault.com

if it's just me committing then I can rewrite history, force push, overwrite, and nobody knows anything about it :)

nevermind, too hard

I'm not very good at this :P

Restart: API quota is 2491.

[ SmokeDetector | MS ] Repeating characters in answer: "On the one/other hand" vs. "on the one/other side" by donald drumpf on english.stackexchange.com

[ SmokeDetector | MS ] Bad keyword with email in answer: What's up with Nami's breast size? by Joan Hardy on anime.stackexchange.com

sd k

[ SmokeDetector | MS ] Bad keyword with email in answer: lua code deobfuscation by Christine Turner on stackoverflow.com

sd n