10

I just saw this suggestion that confused me for a couple of reasons https://stackoverflow.com/review/suggested-edits/13144329

  • why are non-changes highlighted
  • isn't this pattern of output-neutral encoding changes suspicious

How to deal with edits like this? From some wiki experiences, I know that this kind of edit means nothing good.

9
  • 1
    The non-changes are conversions of the apostrophes to their HTML entities (you can see them in the Markdown view). Strange indeed, but harmless. I'd just dismiss.
    – Pekka
    Jul 27, 2016 at 21:21
  • 1
    That email address in the edit comment seems to be a spammer according to a quick google search..
    – Floern
    Jul 27, 2016 at 21:26
  • 1
    @Pekka웃 I know, these are harmless, but I know cases where alternative encodings were used to imitate user names as authors for edits to do harm to communities, as I said in a wiki... The given edit may be for checking the reactions of this network. (seems a bit paranoid, right?)
    – Wolf
    Jul 27, 2016 at 21:26
  • "Anonymous had 0 edit suggestions approved, and 3 edit suggestions rejected": stats are kept for the same anonymous editors, or is this for all anonymous editors combined? (I'd regard that unlikely, though.)
    – Jongware
    Jul 27, 2016 at 21:26
  • 2
    Related on Bitcoin.SE: meta.bitcoin.stackexchange.com/questions/621/…
    – Floern
    Jul 27, 2016 at 21:27
  • 1
    @yellowantphil Yes.
    – Servy
    Jul 27, 2016 at 21:29
  • 1
    @yellowantphil: [user] has approved 1039 edit suggestions and rejected 41 edit suggestions and improved 2 edit suggestions That's... quite a approve/reject ratio... Jul 27, 2016 at 21:56
  • @yellowantphil - This has been addressed.
    – Brad Larson Mod
    Jul 28, 2016 at 15:23
  • Yeah, at the time I approved that change because it seemed benign - just encoding the quotes. But based on the linked threads, it does seem to be a bit suspicious. Like I mentioned to @Pekka, I made a mental note of it when looking at it and probably should have rejected or skipped it instead of approving it.
    – jeremyh
    Aug 1, 2016 at 22:45

2 Answers 2

15

It is very strange, like nothing I've ever seen before. It does not appear to be spam, since the email address is not real. And it's a lot of effort to HTML encode things like that...

So I decided to dig deeper. Here's what I found.

An identical (HTML escaped characters, same email as the summary) BitCoin.SE incident happened over a year ago (which was linked in the comments). While there appears to be an earlier incident on Security.SE, the time difference is very strange, since in that year most people would move onto other activities.

I then went to Google, and the plot thickened: there are many results on random forums. With that random email filled in, for no discernible reason.

And finally, I think I know what happened. Actually, the answer (or question, really) comes from Security.SE:

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "[email protected]".

It seems like someone was playing around with , and did something wrong. That email is used as the default for an unmatched field, and I guess the HTML escaping is just a consequence of the process:

set unmatched fields to 555-555-0199@example.com

It's just a spider: reject these edits always. If it becomes a bigger problem, we should support the feature request to block suggested edits using an email summary.

4

why are non-changes highlighted

Look at the markdown view. (As is virtually always the answer when it looks like nothing has actually changed.)

As you can also see from the code section, the editor HTML encoded a bunch of characters.

It's clearly a wrong change, and is pretty easy to reject. Unless you see it a ton I'm not sure it's a sign of a spammer; I wouldn't really consider it worth your time worrying about it, beyond rejecting it. There are lots of bad edits for lots of reasons, some malicious, some benign.

1
  • Yes, I saw this, but wasn't sure if I shouldn't better report this observation anywhere..
    – Wolf
    Jul 27, 2016 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .