5

https://superuser.com/questions/1504987/where-is-ubuntu-certificate-of-authenticity-located/ and Strange labels on our servers are today's examplars of that old wheeze the "Linux Certificate of Authority" which is back again (see Purchasing a license for enterprise GNU/Linux)

I understand there's an automated process which looks for spam posts in Stack Exchange sites (Aha! SmokeDetector!). I'd like to suggest the folks who maintain that (the Charcoal team), consider adding 'Certificate of Authority" on all posts from folks with low points who don't mention Windows or tag Windows in their posts.

The first post cited above has been deleted as spam, so, yes, it's spam.

deleted by Community‚ô¶ 11 mins ago
This question was deleted as spam or offensive

Certainly, not all SE sections would need it (e.g., Mi Yodeya), but Ask Ubuntu, Server Fault, Super User, unix.stackexchange.com, and elementaryos.stackexchange.com are certainly candidates, IMHO.

What's the best way to contact the Charcoal spam-fighting team on Stack Exchange?

14
  • 2
    Re: "I understand there's an automated process which looks for spam posts in Stack Exchange sites". I believe you're referring to the SmokeDetector. Commented Nov 25, 2019 at 19:02
  • 1
    Are those posts considered spam?
    – rene
    Commented Nov 25, 2019 at 19:09
  • Yes: See above.
    – K7AAY
    Commented Nov 25, 2019 at 19:11
  • 5
    Two cases is not a strong signal. I might add "Certificate of Authority" to the watch list but I need some more evidence / confirmation before doing so. At the moment the link on that SF post is not considered spam nor is the phrase "certificate" and its variants.
    – rene
    Commented Nov 25, 2019 at 19:15
  • 4
    I've pinged some of the project admins, but if you ever have a question related to Charcoal there's a whole chat room for that
    – Machavity
    Commented Nov 25, 2019 at 19:16
  • @rene I truly do appreciate your caution. This scam has recurred twice previously; on 11/11 askubuntu.com/questions/1187999/… and 9/30 serverfault.com/questions/986224/… and I recall many more instances I can't find a URL for.
    – K7AAY
    Commented Nov 25, 2019 at 19:20
  • 2
    For the record, SmokeDetector does watch the keyword GLAT. But there are plenty of false positives for it.
    – Das_Geek
    Commented Nov 25, 2019 at 19:22
  • 1
    @Das_Geek that link leads to a 403
    – Luuklag
    Commented Nov 25, 2019 at 19:37
  • 2
    @Luuklag Probably because you do not have an account with SmokeDetector, or were unauthenticated with it. To produce the results I linked to, I used a regex search of \bglat\b, which is what Smokey actually uses for that keyword. Unauthenticated users are not allowed to perform a regex search.
    – Das_Geek
    Commented Nov 25, 2019 at 19:40
  • @Das_Geek, yup thats the error I got, perhaps you can share the percentage of false positives for us mere mortals ;)
    – Luuklag
    Commented Nov 25, 2019 at 19:45
  • Too darned many faise positives. The search "Certificate of Authority" does not parse for that exact string, and is returning many legit posts.
    – K7AAY
    Commented Nov 25, 2019 at 19:59
  • 2
    @Luuklag There are 8 true positives and 9 false positives. So about 47%.
    – Das_Geek
    Commented Nov 25, 2019 at 20:01
  • 1
    SU has some issues with this. One of our mods is active in the charcoal team, and is kinda aware of this. I'll pass it on Commented Nov 26, 2019 at 3:51
  • 1
    I think this is very dangerous to add directly to the filter.
    – Mast
    Commented Nov 26, 2019 at 8:20

1 Answer 1

16

Thanks for your report!

The simplest way to contact Charcoal is probably by turning up in the chat room, though attendance varies depending on the time of day. At peak European and US business hours, you can expect someone from the admin team to be there, or at the very least some active users who hang around and can respond to you or relay a message to the broader team.

Authorized users are strongly encouraged to use the chat bot's !!/report command to submit any spam we have missed to SmokeDetector and the metasmoke back end for analysis.

The most effective way to get something done is to create a Pull Request in the GitHub repo for SmokeDetector but of course, that requires familiarity with the project and with Python. A good way to request a change is to submit a GitHub Issue with your feature request or suggestions.

For the time being, I have created a "watch" for "certificate of authority" though it is somewhat likely that we will have to remove or amend it, or create a more complex rule.

The code in findspam.py has many custom rules which restrict a particular regex to particular sites in the Stack Exchange network or to users below a particular reputation threshold, for example. What you are asking could be done, though I vaguely expect that we will want to make some tweaks or try different approaches if this is going to be an extended campaign.

In the end, many spammers give up after we start noticing them, and investing in creating a custom rule is then not really worth the effort. However, there are a few high-profile spam organizations which keep on posting multiple messages per day month after month, typically as part of a broader campaign targeting many other web sites in addition to the Stack Exchange network.

For more information, we have a public web site at https://charcoal-se.org/ and if you want to participate in our efforts, the site has a few suggestions for ways in which you can help.

3
  • 3
    The non-deleted samples you point to do not look like spam, though of course if we can help identify posts which should be flagged, we will be happy to do that too; but please understand that other types of abuse and nuisance posts are not our focus.
    – tripleee
    Commented Nov 26, 2019 at 6:02
  • Since the same nuisance post has appeared three times in two months, and when it appeared appeared in multiple SE sites, this particular spammer seems disinclined to give up. I do not disagree with tripleee's comment above, only noting this particular nuisance is persistence, unlike others who give up when a Clue is administered as noted in the next to last paragraph of triplee's answer.
    – K7AAY
    Commented Nov 26, 2019 at 17:04
  • 1
    For what it's worth, two years later, the watch I created has had three hits, all false positives. I will be unwatching it now.
    – tripleee
    Commented Sep 2, 2022 at 10:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .