I investigated this problem and figured out that spams disappeared if Snort's "Automatically show latest notes" feature is turned off. Looking further, the filter relay seems to return spam posts when it received a REQ message with multiple filters.
Maybe it's a bug in the filter relay? I hope it helps you.
It’s not a bug, it’s a feature. We intentionally do not filter requests that come with additional filters.
Our goal is only to provide you a clean global feed when you request events unfiltered. If the client/user wants to apply their own filtering to the request, we generally return ALL available events (including applicable spam).
I will look in to exactly what snort is requesting and see if a simple adjustment can be made in this case. Thank you for figuring that out, thats very helpful.
Found it! Thank you for your report, extremely helpful.
This is the request they are making when you check the “automatically show latest notes”
["REQ","timeline:global:all-e1d014bddc2d",{"kinds":[1,6],"since":1678802443,"until":1678806043},{"kinds":[1,6],"since":1678809650,"limit":1}]
I’m not sure this is good practice but basically they are adding a 2nd filter instead of changing the params of the first one. The first filter asks for all kind 1,6 events from 2 hours ago till an hour ago (why not more recent?). The second filter asks for only events newer than 5 minutes.
At this time if we see 2 filters, we just pass the request without any filtering/changes as we did not want to break any existing functionality. I can fix this specifically for snort later today.
