Comment on Is anyone else getting failures to generate reports when reporting the constant spam from "Nicole, the Fediverse Girl" which originates from a different, new instance every time?

TheFogan@programming.dev ⁨1⁩ ⁨week⁩ ago

• AbnormalHumanBeing@lemmy.abnormalbeings.space ⁨1⁩ ⁨week⁩ ago

  Some admins have been developing and sharing solutions, from regex filters to going down into the databases itself.

  For my small instance and personally, I haven’t seen any new messages in a while now, after adding this regex to the slur filter mechanism:

  (.*(\n)*Hi.*[nN]icole.*[fF]ediverse [cC]hick(.|\n)*)

  Sadly my brain is blanking which instance admins I should credit for that, but it was shared around somewhere.

  source

  • SnotFlickerman@lemmy.blahaj.zone ⁨1⁩ ⁨week⁩ ago

    I love how useful Regex is. I hate writing Regex. Special shout out to anyone who can do it well.

    source

    • pivot_root@lemmy.world ⁨1⁩ ⁨week⁩ ago

      Regex is great, but PCRE deserves a special place in hell. You don’t know unreadable until you’ve encountered regex that uses recursive matching, backrefererences, and subroutine calls.

      source

      • Flagstaff@programming.dev ⁨1⁩ ⁨week⁩ ago

        💀

        source
  • SnotFlickerman@lemmy.blahaj.zone ⁨1⁩ ⁨week⁩ ago

    Ha, I literally just got a new message with spaces between every letter to try to get around filters like this.

    source

    • AbnormalHumanBeing@lemmy.abnormalbeings.space ⁨1⁩ ⁨week⁩ ago

      Makes sense, it’s most likely an ongoing arms race - I’m probably coasting under the radar a bit from running an instance with effectively only 3 people to target at the moment.

      source
• Lost_My_Mind@lemmy.world ⁨1⁩ ⁨week⁩ ago

  So you rewrite the script, and if the message gets banned it replaces the banned words with similar words from a thesaurus.

  I assume the messages would get jumbled after a while.

  “Hi, me name be Nicole. The fediverse baby chicken.”

  source

  • TheFogan@programming.dev ⁨1⁩ ⁨week⁩ ago

    Well yeah it’s still at best a cat and mouse game. Really I suppose the biggest red flag a system could detect is most likely sending out multiple DMs on an account with little other activity.

    can’t really ballpark but I’m guessing the bot must hit several hundred if not thousands of us in rapid succession on creation (otherwise it would be a lot slower and only a few of us would have seen it).

    That being said, auto detecting the links, contact information etc… would be pretty direct as well, as that would require every banned iteration to also remake whatever methods it tries to phish etc… as well.

    source
• SnotFlickerman@lemmy.blahaj.zone ⁨1⁩ ⁨week⁩ ago

  Thanks for the response and good suggestions.

  When I looked at the profile, it didn’t say it was already banned, and I looked moments after I got it, but maybe it’s banned in the seconds between that check and when I submitted the report.

  source