« first day (1238 days earlier)      last day (1537 days later) » 
00:00 - 13:0013:00 - 00:00

1:09 PM
[ SmokeDetector | MS ] Bad keyword with email in body: App in development that can greatly assist the company/partnership by Jahmal Spring on stackoverflow.com
[ SmokeDetector | MS ] Link following arrow in body, pattern-matching website in body, repeated URL at end of long post: Rhino Black Plus: The Best Review? by ghastihars on stackoverflow.com
tpu- by Glorfindel
[ SmokeDetector | MS ] URL in title, bad keyword in body, bad keyword in title, blacklisted website in body, blacklisted website in title, +3 more: healthyclubpro.com/lumivol/ by sotecoge24 on graphicdesign.SE
tpu- by Glorfindel
1:27 PM
[ SmokeDetector | MS ] Username similar to website in answer: ESP8266 WiFiClient simple HTTP GET by techtutorialsx on stackoverflow.com
tpu- by DavidPostill
That would've been declined on Drupal (┛◉Д◉)┛彡┻━┻
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, pattern-matching website in body, repeated URL at end of long post: Skin Novela Where to buy? by mohamedel3mros on apple.SE
tpu- by Glorfindel
[ SmokeDetector | MS ] Offensive body detected, offensive title detected: "Every Nigger is a Star" (acoustic version) guitar chords by user38327 on musicfans.SE
@M.A.R. Well it worked. He has added a disclaimer. Time to retract the flags. @Glorfindel @M.A.R.
thanks David.
fp- by Glorfindel
1:33 PM
David thanks
@DavidPostill Registered answer as false positive.
@SmokeDetector fp
@DavidPostill I don't think you should change the feedback
What it caught was indeed fish at the time
You mean you mis-replied?
@M.A.R. Never mind.
1:35 PM
Never minds
Guys, I don't get this comment
@M.A.R., I care about feedback, but if my views make me indifferent b/c of my rep, why should that matter? — KyloRen 1 min ago
B/C is 'because', right?
@M.A.R. Yes
@M.A.R. on that thread there is much more I don't get
@rene It's OK. The OP doesn't get much if it either. That is clear from his comments :)
Yeah, I was not feeling left out or so ;)
I'm wondering if language barrier is again to blame here
@rene You want something more confusing?
Meh, I'd just stick to a regular rant
Q: Is downvoting answers really a way of trying to correcting answers?

xavier_fakeratForgive my ignorance, but Iam really shocked to see a developing trend where answers are just downvoted without justification. I thought it was more important that utilise the "edit" option that is included below each and every post if there is need for any modication and furthermore hovering ar...

1:51 PM
@M.A.R. that could be at play, yes.
tpu- by Glorfindel
@KyloRen "Where is the forum to post your frustrations" - somewhere other than SE. Reddit, maybe? I wouldn't know. Like I mentioned in another comment, I've learned that posting frustrations gets you nowhere on SE, but posting your concerns in a reasonable and constructive way might actually stand a chance of getting you what you want. — rand al'thor 2 mins ago
"Where is the forum to post your frustrations?" Duh -- YouTube comments
OK, fun's over.
Where you be, spammers?
Oh nice
> flagging & you

19 flags used today
11 is the max I see on my autoflagging timeline
@Ferrybig thank you :)
2:31 PM
@Undo @ArtOfCode You have mail related to Metasmoke in your mailbox
@Ferrybig I do? Which address did you send it to?
@ArtOfCode The email you last used to commit to metasmoke, it was the first email I could find that was not a large mailing list
Ah, I'd've been looking in the wrong inbox then :)
@Ferrybig I can see how that looks, but those steps wouldn't get you into an account - this line makes sure you've authenticated with the username/password first.
Thanks for bringing it up, though :)
heh, shoulda checked chat first
But still, good catch @Ferrybig
2:47 PM
I didn't expect that that toke would survive a large number of page changes
@Undo you should only be getting the error you quoted if 2FA isn't enabled on your account
@ArtOfCode target_user is nil there
Although that should throw, right? Weird
or that
Yeah, I guess it should
should really have SNO'd that, but eh
weird edge case, good for confusing the haxx0rs
I also thought that it was a real exploit because it gave "That's not the right code." for some of the accounts i tried, and then it still worked on my account
[ SmokeDetector | MS ] Manually reported answer: New to Rich Snippets (html), how do I put them in my code? by vijay on stackoverflow.com
@Ferrybig Sure you're logged out? Sounds like some rouge cookies on your browser.
NAA + irrelevant
Can you repro in incognito?
2:50 PM
Plus emboldens the site link
Restart: API quota is 15860.
Woah-kay. Interesting. Exploit worked the first time I tried it in incognito, but failed the second.
and norepro in a new incognito window
@Undo Trying it with art's account (7) and code 123456 I get "That's not the right code." in an incognito window
@ArtOfCode is SE authentication supposed to bypass 2fa?
@Ferrybig well to be fair that isn't the right code :)
At least we are confusing the attackers, :)
And we are leaking what codes are correct at what moment, helping them in reducing the possible keys that would generate codes
2:58 PM
@ArtOfCode got some kind of super-sticky cookie?
Try on mine. Ping for a code.
(I'm reasonably confident that there's no way this could possibly work)
@ArtOfCode That doesn't change the issue. You can trivially generate the sha hash of somebody else's ID and use it to get the other access token (and you can see the input for the hash just by looking at the code in tampermoney). Same problem as network id.
Need a secret that doesn't change across tabs or domains. IP address maybe.
IPs aren't very secret
What's my IP address?
Oh you're a mod
But it's secret enough
It'd be pretty easy to either (a) go look at it, or (b) entice you to visit some domain I control
Ip address change frequently with ipv6 you swap between ranges every hour or so, and you get the problem of proxies
3:03 PM
@Undo this one, for example.
It's still good enough for my thing
But not in general
@Undo don't think so
I could have the user manually enter a secret in the tampermonkey script
What's the application for this @Jason?
@Undo got a code?
3:05 PM
@ArtOfCode 606624
yeah, same error you quoted
@Undo Using artofcode's dss authentication thing without letting other users who know you're using the app grab your access tokens.
@JasonC yeah, ask the user to enter a secret and use the SHA256 hash of it
I could onebox a self-hosted image here and look at the logs to collect a bunch of IPs
3:06 PM
just using the raw secret is a bad idea
@JanDvorak Fun fact: Onebox a self-hosted image with basic password protection and everyone's browsers asks for a password.
O_o That's ... not ideal
Lol that's awesome
Don't bug report that let's have some fun with it first
Can we see it live?
yeah, just a sec. Not set up to make that kind of exploit quickly
3:12 PM
@Undo here
Wait lemme make a new room
I suspect the bug report would be answered with "there's no good way around it. Instead, let's just kick everyone who does it"
Ban, actually. This has been reported before
@ArtOfCode Even that can be bypassed by using window.prompt = function()
In that case
3:13 PM
a totally secure system in userscripts is hard
This will probably work ...
@TimStone Does it work on the main site?
@Glorfindel Huh, didn't work for me
@Glorfindel GET https://www.project3851.com/dailyonions/Gerwin.jpg 401 (Unauthorized)
3:15 PM
Why did that focus TNB rather than this room?
Uh, just got a prompt for a password. That was noisy.
@Undo it asks me for username/password, but Firefox warns me explicitly that the username/password are not for the current site (i.e. chat.SE.com).
That probably prompted 30~ish people for it.
@Glorfindel Behavior has improved, then
@Glorfindel Could you edit it so it no longer is in the transcript?
3:16 PM
I didn't get prompted at all - Chrome Canary.
Yeah, Chrome doesn't show the box
Q: What is this pop-up?

please delete meWhen I looked at the chat FAQ and clicked the link to take me to Sandbox I got this pop-up, which seems a little bit odd: Now, when I Googled plzz.de, I found a website about Stefano Palazzo, who happens to be a Stack Exchanger. When I added :9993 to the web address, I got the same pop-up. So...

Yeah chrome doesn't show it I just tested in another room
:36589684 That's why I said "wait lemme make another room", like a polite person, lol :P
It was fixed in Firefox and then the change was reverted for some reason?
Yes that'd be a password dialog
3:18 PM
@JasonC this is Charcoal HQ, we test in production. If we test at all.
http basic authentication has its advantages and disadvantages
Wrong kind of test :P
@Ferrybig Kinda sorta
@ArtOfCode Another approach could be to have DSS key by IP as well as key id on its end, or otherwise verify that you're requesting from the same ip you created the key with.
You'd lose your token when your ip address changed but
It could probably be made an option in the authorization request if you wanted to enable it or not. Maybe I'll make a pr for that too. Some day. "Next week."
Oh but
It doesn't know the ip you created the key with because it only gets the request forwarded from oauth
3:24 PM
[ SmokeDetector | MS ] Link at end of answer: apache - DirectoryIndex - php page with arguments by Andrey on stackoverflow.com
I don't think it's ok for a system to reset its settings every hour, or with every request if you are using the company's load balancing proxy
Yeah but in my crappy little userscripts I also don't care. Plus SE API token expirations.
But you're right in general that's not ideal either.
@SmokeDetector F
If everyone went to ipv6 much earlier then the trouble would be far smaller, just thrust the range of /64 addresses for everyone and you are set
3:28 PM
This would suck less if SE put a blank proxy page on every site, just for API usage.
Could you pull something from stackauth?
The only safe thing be writing a browser extension (instead of a userscript), because they have their own private storage
@Undo The proxy page has to be on the same domain as the request came from
I mean they've got one at api.stackexchange.com/docs/proxy for demos
they could just add one to every site.
ah, right
@TimStone Is there a secret blank page that currently exists on every se site?
3:38 PM
@JasonC You could try to use one of the following: meta.stackexchange.com/a/76569/215067
3:57 PM
@JasonC mm, I don't think so, no. The closest you'd get to a full HTML page with no content is the revisions route which returns a full page with nothing in the header but the title and just a <pre> in the body, and then obviously it's not a shared URL across all sites due to the GUID/possibility of any given post being deleted
Hm. /reputation kind of fits that description, I wonder if that would work.
I'll test later. For now, breakfast. Later all.
noms double chocolate chip cookies
^ that's MY breakfast lol
@Undo if I put type hints into Smokey code can I add a module to the requirements.txt? (the typing module from Py3 backported and available in pip heh...)
If it benefits us
PEP 484 compliance, and Python 3 reverse compat compliance (PEP 484 as well)
we don't test it in flake, but 484 strongly suggests having type hints for py2
and, i already have them in the Post object code, but with invalid syntax :P
4:27 PM
@Ferrybig Thanks, will do
I'm starting an internship on 2017-04-10. Unsure yet, but it probably means I won't be lurking here as much. So if there's someone else who can help, it'd probably be faster to ping them than me, at least for the next week or so while I figure out what I'm doing.
Q: What to do about these set theory questions

Noah SchweberThere have recently been a number of set theory questions of very low quality - many of these (most?) appear likely to have been asked by the same person under different accounts (the username is always [oneletter].[lastname], and the question almost always ends with "Please help me.." (including...

4:55 PM
@JF You doubt me?
Several times now, Smokey has replied before the message is posted. Any ideas about why?
Before what message is posted?
5:11 PM
2 hours ago, by SmokeDetector
@Ferrybig Kinda sorta
He's fast
5:25 PM
5:43 PM
OK. The transcript is popping up that login. Can a room owner delete from the transcript?
@Undo Good luck in the new position
Can you share where it is? No biggie if not, I'm just curious
@DavidPostill are you referring to my message? I thought I deleted it?
@Undo good luck!
5:59 PM
@Glorfindel Yes. But it's still visible in the transcript (at least for me)
@Glorfindel Never mind - it's a user script "Show deleted chat messages for Stack Exchange" :)
[ SmokeDetector | MS ] Bad keyword in body, link at end of body, pattern-matching website in body, repeated URL at end of long post: The other elements in the ingredients by Liam Lily on superuser.com
tpu- by Ferrybig
6:33 PM
naa- by Ferrybig
[ SmokeDetector | MS ] Few unique characters in body: result from get method is not displaying in View angular 2 by user3431310 on stackoverflow.com
@SmokeDetector v
@DavidPostill ah, I blamed it on mod powers. Sorry for the inconvenience, it turned to be a little more annoying than I thought.
@DavidPostill can I get a link to the userscript?
Also, FR: add an indication whether the message is deleted
7:04 PM
@JanDvorak Only room owners and moderators can see the deleted transcript
I meant outside of transcript
[ SmokeDetector | MS ] Manually reported answer: Python exit from all function and stop the execution by pdbu on stackoverflow.com
tpu- by Glorfindel
@SmokeDetector K
@JanDvorak The script only work for mods and room owners. You can get it at meta.stackexchange.com/a/246765/267099
7:20 PM
ROs can see deleted messages?
never mind then. I'm neither.
@quartata Yes.
7:53 PM
[ SmokeDetector | MS ] Username similar to website in answer: Granite devices IONI servo drive by Granite Devices on robotics.SE
@SmokeDetector f
8:05 PM
API quota rolled over with 14499 requests remaining. Current quota: 19999.
stackoverflow: 213
askubuntu: 77
superuser: 64
chemistry: 49
math: 46
unix: 45
electronics: 42
english: 37
academia: 36
stats: 30
apple: 26
gaming: 25
drupal: 24
mathoverflow.net: 24
cs: 21
ell: 19
wordpress: 17
webapps: 16
physics: 16
mathematica: 15
ru.stackoverflow: 14
es.stackoverflow: 14
worldbuilding: 14
patents: 14
arduino: 13
raspberrypi: 13
travel: 13
salesforce: 13
gis: 12
scifi: 12
android: 12
diy: 12
dsp: 11
expatriates: 10
money: 10
tex: 10
rpg: 10
gamedev: 9
softwareengineering: 9
Don't really like sharing the actual company because it's pretty much location-identifying combined with my state
8:19 PM
45 minutes if you take the bus ...
Don't be late every day :)
My Dad used to live opposite the school gates. He used to wait until the bell rang for assembly and then run to school. He was late every day...
[ SmokeDetector | MS ] Blacklisted user: Precision to_double by fuzz on stackoverflow.com
fp- by Glorfindel
Conflicting feedback on Precision to_double.
Conflicting feedback on Precision to_double.
@SmokeDetector I made a mistake there
[ SmokeDetector | MS ] Bad keyword with email in answer, email in answer: How can I earn money with torrents? by Olivia Miguel on gaming.SE
tpu- by Glorfindel
[ SmokeDetector | MS ] Bad keyword in answer: What would be the evolutionary pressures of horned simians? by creeon on worldbuilding.SE
fp- by Glorfindel
[ SmokeDetector | MS ] Shortened URL in body: NOOB NEEDs HELP in Choosing the Right Amp! by audiophile420 on sound.SE
fp- by Glorfindel
8:51 PM
Restart: API quota is 19816.
9:04 PM
[ SmokeDetector | MS ] Bad keyword in answer, bad keyword in username: Change "logged in" link in (you must be logged in to post a comment) by Toko Obat Bius on wordpress.SE
[ SmokeDetector | MS ] Bad keyword in answer, bad keyword in username, bad keyword with a link in answer: Change "logged in" link in (you must be logged in to post a comment) by Toko Obat Bius on wordpress.SE
tpu- by Glorfindel
9:31 PM
[ SmokeDetector | MS ] Offensive answer detected: How to preemptively block a non-contact on whatsapp by user216414 on android.SE
tpu- by Glorfindel
[ SmokeDetector | MS ] Username similar to website in answer: You had me at hello by MarkSill on codegolf.SE (@quartata)
fp- by Glorfindel
9:50 PM
@SmokeDetector Any progress on abusing making productive use of the extra quota?
[ SmokeDetector | MS ] Manually reported answer: Longest Calculator Word? by urmum on puzzling.SE
naa- by DavidPostill
tpu- by Wrzlprmft
[ SmokeDetector | MS ] Blacklisted username: How can one "under-average Joe" fight monsters? by Lololololol on worldbuilding.SE
fp- by Wrzlprmft
@JF @ArtOfCode has data IIRC, I've been too busy to look at it.
It's a simple task of adjusting thresholds, really. Just need to figure out which ones are beneficial to lower, then taking the ones we can afford with the quota, minus whatever buffer we want.
It's something anyone here could do, actually.
I thought pulling the comments on the math sites was good, because the Thierno guy was putting the stuff in the comments to avoid detection.
Would be nice, but it'd pretty much need to be a fork of what we have. We're not set up to handle comments.
It'd be easy to just push them through the regexes, but the issue is that there's no good way to get realtime notifications network-wide.
If you're limiting it to a couple of sites, it's possible to just hit /comments every few minutes. Can't do that network-wide, though.
10:20 PM
@Undo Actually, maybe you could. Depends on what your target response time is
@Undo Talking to yourself again? Or are there two of you? ;p
Smokey already hunts spam on Aviation: metasmoke.erwaysoftware.com/… members can always hop into the charcoal chatroom to report possible spam that might have been missed. — rene 2 mins ago
We are definitely only one person.
@rene Looks good, thanks :)
10:44 PM
@Undo yeah, need to do the final stage of figuring how much to change each site by
But I have data on which we should change
/me abuses mod edit powers because ISO8601
@Undo fyi, you've already given out enough information to identify it if I had 10 minutes to spare to look through the list
11:00 PM
@ArtOfCode There are a couple options from that list, but yeah
But just to be safe, why not
Yay for censorship
@Undo Aye, long as you know :) could probably use some context from TL as well to narrow it down
Yeah, you know where to look. A random crazy I tick off on SO probably wouldn't, which is my baseline
So crazies can't find it and I don't really care enough. Good enough :)
00:00 - 13:0013:00 - 00:00

« first day (1238 days earlier)      last day (1537 days later) »