@TetsuyaYamamoto That pattern looks like it's already caught by Bad keyword in answer and Bad keyword in body; append -force if you really want to do that.
@TetsuyaYamamoto Think we should change our FB to NAA? At the end of that answer is "my ds has not updated for five years because my mum left!", and perhaps he isn't trolling?
@SmokeDetector User was just over-excited that the answer solved his problem. This does not appear to be intentional trolling only due to the final line of my ds has not updated for five years because my mum left!. Perhaps could still be a tpu, but I think we should give him benefit of the doubt on this one.
@K.Dᴀᴠɪs You probably edited the message after the SD report was posted. SD then assumed it should be a comment on the most recent post. IMO, SD is a bit aggressive, by design, in assuming that chat messages posted after an SD report are to be comments.
FYI: as we were talking about yesterday, Smokey will now automatically cast an "other" flag on FPs that were deleted and had manual spam flags cast on them.
I could have sworn it did in an instance where a comment was left 2-3 minutes after the post was made, and OP immediately updated post and it showed the 'update' link for the revision history
on posts like the above that look like spam but isn't 100% classified, we can post a comment and delete it so it would go back through the real time watch
I'm not sure the community would be very on board with this.... SD comment on every post it catches "placeholder comment to catch edits" for a very small number of posts... (do we have any data on when/how often this happens?)
I do. OP may see 1 New Comment and by the time they click it it's already gone. Posters don't have their mouse ready to click that link and probably won't even notice it for a few seconds.
@K.Dᴀᴠɪs If you're really saying: On those posts that are FP, I think that 99% of the users won't see it, then that's something other than what I read your message to be. I read it as implying that 99% of the comments would be on FP posts.
I wonder how much spam was really missed do to this 'limitation'. Spammers are getting wise, and they may have been doing this for a while. We are just fortunate enough to have seen a post caught by luck.
@K.Dᴀᴠɪs That's something which would be difficult for us to determine, due to a reasonable quantity being not being known to us at all.
@K.Dᴀᴠɪs Are you actually suggesting that such a comment be placed on every post by users with rep < X? Or only placed on those posts which we detect for some other reason (and rep < X)?
I noticed the other day that spammers have even waited almost 24 hours before editing spam into their post - which means that the question/answer itself didn't even look delete worthy
In both cases I noticed this - the spammer plagiarized another post, making it look like a valid answer. Then the next day edited in a spam link
@K.Dᴀᴠɪs That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
Body - Position 636-665: Read More: <a href="http://, Position 804-866: gmail-login.php" rel="nofollow noreferrer">Gmail login</a> |< Body - Suspicious nameservers: all IP addresses for www.email-loginhelp.com are in set {'116.206.104.141'}
fp- by Tetsuya Yamamoto
@Makyen That pattern looks like it's already caught by Potentially problematic ns configuration in body and Potentially problematic ns configuration in answer; append -force if you really want to do that.
[ SmokeDetector | MS ] Url-only title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, link at end of body, +5 more (794): evaherbalist.com/total-thyroid/ by Ovemfrcv on askubuntu.com
@Shree That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Pattern-matching website in answer and Pattern-matching website in body; append -force if you really want to do that.
@Makyen That pattern looks like it's already caught by Potentially problematic ns configuration in body and Potentially problematic ns configuration in answer; append -force if you really want to do that.
@TetsuyaYamamoto That pattern looks like it's already caught by Potentially problematic ns configuration in body and Potentially problematic ns configuration in answer; append -force if you really want to do that.
People keep fudging the criteria. If we want that to be the criteria we use, then change the official criteria. It's gone from being every once in a while to almost all the time.
Sounds like the user in question doesn't intended to spamming the link inside his profile everywhere, unless caught otherwise. Just keep an eye to watch.
@TetsuyaYamamoto That pattern looks like it's already caught by Potentially problematic ns configuration in body, Potentially bad keyword in body, Potentially bad keyword in answer, and Potentially problematic ns configuration in answer; append -force if you really want to do that.
[ SmokeDetector | MS ] Bad keyword in body, bad pattern in url body, blacklisted website in body, pattern-matching product name in body (390): usually maintain phrases by KTYDRIVET on drupal.SE
@tripleee If we're going to continuously "bend" the criteria, then we should get buy-in from everyone and actually change the criteria.
Note that we should be particularly careful for short entries, particularly if they are being placed on the blacklist-website list, due to that list not using anything to terminate the regex, on ether side.
[ SmokeDetector | MS ] Url in title, blacklisted website in body, blacklisted website in title, body starts with title and ends in url, link at end of body, +5 more (791): evaherbalist.com/total-thyroid/ by Jjfxpuuq on drupal.SE
I'm not unwilling. I do have some concerns. I wasn't around when the 5/5 TP with 0 FP criteria was established, but it appears to have a few different reasons for being there: A) It starts to give us a feel that the pattern will have a TP percentage that maintains the high levels which the blacklist is intended to have; B) It indicates that this is actually something we might see on an ongoing basis, as opposed to just see a couple/few times.
If we do reduce the criteria, we should be more proactive in removing things from the blacklist, if they get FP, particularly if they get FP early on.
About to go to sleep, but the gist of it: Run it based on lambdas & DynamoDB, only one table mapping users to (encrypted?) API tokens. Expose a few methods - add token for user, flag thing as user, remove token for user.
@TetsuyaYamamoto That pattern looks like it's already caught by Pattern-matching website in body and Pattern-matching website in answer; append -force if you really want to do that.
:47623659 That pattern looks like it's already caught by Pattern-matching website in body and Pattern-matching website in answer; append -force if you really want to do that.
@Shree That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
@K.Dᴀᴠɪs That pattern looks like it's already caught by Blacklisted website in answer and Blacklisted website in body; append -force if you really want to do that.
00110011 00110011 00110000 00110001
