« first day (1431 days earlier)      last day (2395 days later) » 

J F
12:08 AM
@SmokeDetector Think that’s real?
 
tpu- by DraconicPenguin
tp- by DraconicPenguin
 
@bwDraco User removed from blacklist (13969 on law.stackexchange.com).
 
(misread the post)
 
fp- by DraconicPenguin
 
12:12 AM
Sorry, went through it too quickly.
It's an FP.
Nothing obviously spammy about it.
 
[ SmokeDetector | MS ] Few unique characters in answer, no whitespace in answer: What is the syntax meaning of RAISERROR() by hfgh345 on stackoverflow.com
 
tfw you autoflagged
 
tpu- by DraconicPenguin
 
12:32 AM
Server load:
(all times UTC-4)
 
@ArtOfCode Out of curiosity, did you recently change how MS API filters work? I generated a new one and it looks different
like base64 encoded
 
that... is not recent
 
recent = within the past year I guess
 
then yes
 
do the old ones still work?
because I've been using this one without realizing
 
12:43 AM
[ SmokeDetector | MS ] Blacklisted website in body: L293d Motor Driver to heat a wire by maxphat on arduino.SE
 
@ArtOfCode ok I'm getting an error when trying to use the new filter
Mysql2::Error: Unknown column 'deleted.deleted' in 'field list'
{"from_date"=>"0", "to_date"=>"1508287704", "key"=>"<key>", "filter"=>"AAAAAAAAAIADAAAAAAAAAA==", "page"=>"1"} on /api/posts/between
line 80 of APIController
 
@quartata filters are broken
 
:(
 
issue me, I'll look when I have time, but I can't do anything right now
debugging a slightly more pressing issue where Chrome has decided that HTTP/2+SPDY is no longer a valid protocol
 
wuh
didn't they like invent SPDY
 
12:57 AM
yeah, that's about the sum of it
 
Looks like it was Undo
I thought he didn't like vim
oh OK I see the problem
 
1:16 AM
[ SmokeDetector | MS ] Blacklisted username: Angular - Error Unknown error has occurred by wingding on stackoverflow.com
tpu- by Tetsuya Yamamoto
[ SmokeDetector | MS ] Username similar to website in answer: Which is the plural of "forum": "fora" or "forums"? by abahadil on ell.SE
tpu- by DraconicPenguin
 
1:36 AM
Experimenting with some broader (and far more complex) regexes to try to catch p----/d--- size spam...
 
This seems like definite spam to me. Am I missing something?
 
rsyslog is pretty popular if that's what it's "advertising"
granted I'm not clicking on that link
 
I wish MetaSmoke was faster with very complex regex searches...
 
also syslog-ng is better
fite me
 
It's not advertising rsyslog. It's advertising a specific commercial product, which happens to have a community edition that is (or says it is) open source.
However, there is some information on the page on that site that is linked to.
 
1:42 AM
ok yeah then that's spam
 
it's NAA for sure tho
look at the question
 
Hold on, I did visit the site; I'll make and link to screenshots of the linked page and main page.
Yeah, if it weren't NAA I would've been less sure it's spam, but I don't think it's really trying to answer the question, I think it's trying to advertise.
Screenshots: This is the page it directly links to, which has information that might help answer some question... but which is also even explicitly framed as advertising (it's the "Why?" page on the site for commercial software, and it's really an article about why people should--supposedly--use their product). This is the site's main page.
 
@bwDraco tell that to MySQL :P
 
1:49 AM
> ((p(eni|nie|nei|enni|eeni|ein|ine)s)|(d(ick|ikc|kic|kci|cik|cki))) (is )?([0-9]+)?\.?([0-9]+)? inch(es)?
Trying to write a comprehensive regex for catching this sort of spam. We have something similar from last night; can we revert this?
 
@TetsuyaYamamoto [:40609726] Body - Position 433-446: 2348150806939, Position 457-470: 2348180975664
fp- by Tetsuya Yamamoto
 
@bwDraco this can be made much shorter
d[ick]{3} for the second part
although {2,3} would probably be better
 
Never mind.
I'll probably just push using the SmokeDetector account.
 
please don't
make a PR
 
1:52 AM
@bwDraco Don't
 
Well, last time it happened, it broke stuff.
 
Then let's fix stuff.
 
??
what do you mean @bwDraco
 
I pushed to deploy by mistake.
 
then push to master :P
 
1:55 AM
exactly which is why you should make a PR
also it should be reviewed
 
I really wish it was easier to remove stuff from the blacklist.
This will complement the existing regex, so no need to revert.
 
[ SmokeDetector | MS ] Link at end of answer, potentially bad keyword in answer: HTML Video not working on mobile by user8645656 on stackoverflow.com
tpu- by DraconicPenguin
 
!!/blacklist-website browseplay\.com
 
@quartata Blacklisted browseplay\.com
 
4/4 over 6 months but all below auto
 
2:07 AM
CI on 76044ff succeeded. Message contains 'autopull', pulling...
Restart: API quota is 14729.
 
In related stuff...
!!/blacklist-keyword pusys
 
@bwDraco Blacklisted pusys
 
Commonly found in wingding posts.
 
CI on 48a6650 succeeded. Message contains 'autopull', pulling...
[ SmokeDetector ] SmokeDetector started at rev 48a6650 (SmokeDetector: Auto blacklist of pusys by bwDraco --autopull) (running on bwDraco/Linode)
Restart: API quota is 14688.
 
hasn't been seen in 10 months according to MS tho
!!/alive?
wtf?
uh
what just happened
!!/rev?
um
 
2:16 AM
[ SmokeDetector ] SmokeDetector started at rev 48a6650 (SmokeDetector: Auto blacklist of pusys by bwDraco --autopull) (running on bwDraco/Linode)
 
The bot is running. It just took a moment to restart.
 
!!/alive?
 
@quartata Kinda sorta
 
I just logged in.
 
Restart: API quota is 14679.
 
2:17 AM
@bwDraco No, it restarted and then left the room
I have no idea why
it was still running, MS had gotten a status ping
I think maybe WS died or something weird
 
2:27 AM
> ((p[eni]{3,4}s{1,2})|(d[ick]{2,4})|pussy) (is )?\.?[0-9]+\.?([0-9]+)? inch(es)?
Two optional decimal points and a mandatory digit, instead of making both digits optional.
 
fp- by DraconicPenguin
 
> Would not be caught as an answer.
 
(wondering if it would trigger the bad NS check because my website is registered with Namecheap)
 
@bwDraco looks good, maybe make the whitespace \W
 
2:34 AM
Tried that, didn't work.
 
hm?
 
It returned no results.
 
Oh, in MS?
 
Yup.
 
MySQL regex might not support it
I guess leave it be for now
 
2:36 AM
headdesk
 
Hmm?
 
On the MySQL limitation.
> ((p[eni]{3,4}s{1,2})|(d[ick]{2,4})|pussy)\W(is\W)?\.?[0-9]+\.?([0-9]+)?\Winch(es‌​)?
!!/blacklist-keyword ((p[eni]{3,4}s{1,2})|(d[ick]{2,4})|pussy)\W(is\W)?\.?[0-9]+\.?([0-9]+)?\Winch(es‌​)?
 
@bwDraco Blacklisted ((p[eni]{3 4}s{1 2})|(d[ick]{2 4})|pussy)\W(is\W)?\.?[0-9]+\.?([0-9]+)?\Winch(es)?
CI on 78a2c49 succeeded. Message contains 'autopull', pulling...
[ SmokeDetector ] SmokeDetector started at [rev 78a2c49 (SmokeDetector: Auto blacklist of ((p[eni]{3 4}s{1 2})|(d[ick]{2 4})|pussy)\W(is\W)?\.?[0-9]+\.?([0-9]+)?\Winch(es)? by bwDraco --autopull)](//github.com/Charcoal-SE/SmokeDetector/commit/78a2c49) (running on bwDraco/Linode)
Restart: API quota is 14555.
 
That should catch all cases of p---/d--- length posts from wingding.
!!/test penis 4 inches
 
> Bad keyword in body, bad keyword in title, blacklisted username
----------
Title - Position 1-6: penis
Title - Position 1-6: penis
Body - Position 1-6: penis
Username - Position 1-6: penis
 
2:39 AM
How many MS hits?
 
The comma is reserved.
 
Maybe test it locally with Python
 
I'll have to revert it. Hold on...
@quartata No, it's that the comma is reserved as a delimiter for the blacklist string.
 
import re; re.match("<regex>", "...")
@ArtOfCode If I have a post ID, how do I get a list of reasons from MS?
 
look at the API docs
 
2:43 AM
That's the blacklist command using commas as delimiters.
...and PullApprove appears to be broken.
 
@ArtOfCode derr sorry
 
> 'ByteCommander' is not a collaborator of this repo
@ArtOfCode ^
 
pullapprove seriously sucks
Like what does that even mean
You don't have to have collaborator to approve
 
!!/whois code_admin
 
@bwDraco I am aware of 22 code_admin. Currently in this room: bwDraco, quartata, ArtOfCode, Undo, John Dvorak, Henders, Magisch, Ashish Ahuja. Not currently in this room: Ferrybig, doppelgreener, Thomas Ward, angussidney, Suraj Rao, tripleee, Mithrandir, Byte Commander, Yvette Colomb, ProgramFOX, Paul Stenne, Andy, Glorfindel, NobodyNada.
 
2:48 AM
So someone was added.
It was 20 when I was added.
@ArtOfCode or @Undo, can you manually merge this?
 
ByteCommander also is in the organization so it can't be that
 
CI on 7d9a8a2 succeeded. Message contains 'autopull', pulling...
Restart: API quota is 14473.
 
PA fixed
 
Okay.
 
What was the problem
 
2:52 AM
!!/test-a penis 4 inch
 
> Bad keyword in answer
----------
Body - Position 1-13: penis 4 inch
Body - Position 1-6: penis
 
!!/test-a pennis is 123.456 inches
 
> Bad keyword in answer
----------
Body - Position 1-25: pennis is 123.456 inches
 
!!/test-a dikc . inch
 
> Would not be caught as an answer.
 
2:54 AM
!!/test-a peins .2 inch
 
> Bad keyword in answer
----------
Body - Position 1-14: peins .2 inch
 
Fantastic!
@quartata New code admins added, but the PullApprove collaborators list wasn't updated.
This regex should let us catch more wingding content. A lot of wingding's posts aren't conducive to this sort of processing but this will help us better respond to this sort of spam.
 
tpu- by DraconicPenguin
[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer, email in answer, pattern-matching email in answer: Arrival: Why Did Louise's Husband Leave Her? by shelly on scifi.SE (@Mithrandir)
 
sd k
 
3:14 AM
[ SmokeDetector | MS ] Offensive answer detected, blacklisted user: Can you legally defend yourself against an attacking police officer? by JOE Blow on law.SE
[ SmokeDetector | MS ] Bad keyword with email in answer: HE3D-XI3 3D printer Repetier software config help! by jason on 3dprinting.SE
 
@SmokeDetector why
 
@bwDraco Post - Keyword money with email jasonkeithmurray@gmail.com
naa- by DraconicPenguin
[ SmokeDetector | MS ] Bad keyword in body, bad keyword in title, blacklisted website in body, link at end of body, pattern-matching website in body: Our chest muscle is one of the Androforce X10 by crystalsrogers on askubuntu.com
tpu- by Tetsuya Yamamoto
 
What's it written in?
Oh OK
sure send me a link when you're finished
I was worried it was something Windows only
is all
Just an FYI I am very bad at Go
 
Yet another wingding pattern:
!!/blacklist-keyword fukc(ing)?
 
@bwDraco Blacklisted fukc(ing)?
 
3:27 AM
14/14, all below auto.
 
that's weird ... the chatrooms I was in all looked like nothing happened since I last visited
 
CI on 8ae4892 succeeded. Message contains 'autopull', pulling...
 
reloading fixed it but I haven't seen anything like that before
 
Restart: API quota is 14296.
 
3:30 AM
> Would not be caught as an answer.
 
hmmm, really?
oh, your NS is not Namecheap
$ host -t ns fierydragonlord.com
fierydragonlord.com name server dns1.registrar-servers.com.
fierydragonlord.com name server dns2.registrar-servers.com.
 
Hmm...
So, @tripleee, what do you think of these new wingding patterns?
 
@bwDraco I was going to ask about that, looking at search results
 
> ((p[eni]{3,4}s{1,2})|(d[ick]{2,4})|pussy)\W(is\W)?\.?[0-9]+\.?([0-9]+)?\Winch(es‌​)?
fukc(ing)?
pusys
 
3:32 AM
metasmoke.erwaysoftware.com/… gets me 11/11 so I wonder how you got 14/14
maybe you ran it without anchors?
right
 
2 hours ago, by bwDraco
Experimenting with some broader (and far more complex) regexes to try to catch p----/d--- size spam...
 
stackoverflow.com/questions/23550651/… has it in a comment but that's harmless
@QPaysTaxes pretty suspicious
stackexchange.com/… a few FP hits on f*kc
@bwDraco yeah, I was going to ask about that ... what's your thinking? trying to articulate fuzzy matches with regex is slow and error-prone
oh sry, copy/pasting those searches is error-prone, I edited the search box to look for "fukc" but the URL still points to the first search
here's the proper one stackexchange.com/…
 
@tripleee I had designed that regex to require a "# inch" at the end.
lol
Hmm. Catching curse words is never really easy when people have all sorts of ways to obfuscate them.
 
@bwDraco yeah, but how did you arrive at (effectively) p[eins]{2,4}? That matches e.g. pie or pine too, so the search will be slow when it backtracks a lot
 
Not "pi".
 
3:40 AM
I noticed -- edited
 
It's actually {3,4}.
 
so pies then
 
Because one of wingding's posts contains "pines x inches".
 
ohhh wingding
I was looking at Soundex for matching Wingding variations but I didn't actually finish that, still have the tabs open
 
The end goal is to identify and catch as much wingding content as possible.
> pines 1 inch
 
3:43 AM
again, maybe consider alternatives to regex for fuzzy search
 
!!/test-a pines 1 inch
 
> Bad keyword in answer
----------
Body - Position 1-13: pines 1 inch
 
but if it works, great
 
@QPaysTaxes Yes, it is, but until now, we have not had a way to systematically identify at least a nontrivial subset of wingding's posts.
 
@QPaysTaxes there's a tortured regex which identifies some variations but it keeps on leaking when new variants come up
the spelling has been straightforward in the latest campaigns, though
 
3:46 AM
> ang ang
That's another wingding pattern that was blacklisted yesterday.
"inch(es)?\ lol" was also blacklisted, though this is a bit more borderline. I might argue that this is no longer necessary thanks to the new, comprehensive regex.
Just checked, the new regex would catch all of these results.
So, we should remove that from the blacklist.
 
@bwDraco I'll include that in the batch I'm doing
 
@tripleee Metaphone might be a better fit
I use this library: pypi.python.org/pypi/jellyfish
got lots of phonetic algs and some edit distance metrics
 
yeah, been looking at that
also @bwDraco I'm removing the backslashes before space in the user name regexes you submitted yesterday ... it's harmless but also unnecessary
 
Thanks
 
Soundex doesn't store a lot of information is the main problem
Easy false positives
 

« first day (1431 days earlier)      last day (2395 days later) »