My chat app became overwhelmed with profanity and spam, but all this could have been avoided with better security practices. Let's take a look at essential app security libraries and techniques. 

#programming #hacking #tech 

💬 Chat with Me on Discord

https://discord.gg/fireship

🔗 Resources

- Original Chat App Pocketbase Project https://youtu.be/gUYBFDPZ5qk
- 7 Web Security Risks https://youtu.be/4YOpILi9Oxs
- Cryptography Concepts https://youtu.be/NuyzuNBFWxQ
- Cloudflare Turnstile https://www.cloudflare.com/products/turnstile/

🔥 Get More Content - Upgrade to PRO

Upgrade at https://fireship.io/pro
Use code YT25 for 25% off PRO access 

🎨 My Editor Settings

- Atom One Dark 
- vscode-icons
- Fira Code Font

🔖 Topics Covered

- How to prevent profanity in app
- How to deal with spam bots
- How to prevent website hacking
- Web app security best practices 
- Cloudflare Turnstile vs reCaptcha
- Preventing DDoS attacks
2024-02-04T05:15:21.969Z
nova-2
2-general-nova
2024-01-09.29447
30089e05-99d1-4376-b32e-c263170674af
a01955d1-667c-41a1-b7de-9ad0eff0ad11
469dcc5d2d2ec6218cdcf157204a4449d6d214f712349cc0134c24ca0638c879
67875a7f-c9c4-48a0-aa55-5bdb8a91c34a
deprecated
A few days ago, I built a next gen Discord killer with pocket base and Svelte.
It was an amazing experience for about 3 minutes, but then you guys completely destroyed it by spamming it with the most deranged comments I've ever seen on the Internet.
I initially started with a $5 Linux server.
Its usage quickly shot up to 100 consent, so I resized it to 4 cores.
That wasn't nearly enough juice either, and all 4 cores quickly became overwhelmed.
And this is why we can't have nice things on this channel.
The primary person to blame for all this is me, the developer.
I built it with bad security practices by design just to see what would happen.
Funny do bad things.
Luckily, I live in America, so I can't go to jail for the horrible things you guys said, unlike other countries, but nobody wants to use an app that can be spammed by an unlimited amount of hate speech profanity.
This is a major problem when building any kind of app with user generated data.
In today's video, we'll break down all the problems my app had had and talk about tools and techniques you can use to mitigate these issues in your own projects.
The first problem is that people were using profanity even though I told them not to.
They didn't listen.
Your language is convinced them.
I thought this might happen, so I implemented a pooping system where if a comment gets pooped on 5 times, it gets removed from the UI.
I've seen this feature on other platforms like can odyssey where you can slime a comment to death.
And I think it's a good idea, but it doesn't really work for a chat where the messages are moving at a 100 miles an It can also be hijacked by the bad guys to poop down all the comments that are actually good.
So the next thing I did, which is really easy to implement, is just a bad word filter directly in the front end code.
That means the app can't display words like, f f f balls, and so on.
You can also do filtering like this on the back end can before that data ever goes to your database, but it's impossible to catch everything with regular expressions.
The trolls will find ways to say bad words with alternative characters characters that bypass your filters.
In modern times though, artificial intelligence is starting to take over this job.
Google developed perspective which can detect if something is an insult or some variation of profanity, and they use tools like this at scale to keep the worst of the worst comments off of YouTube.
Bad words are one problem, but an even bigger problem is when one person creates a script that automatically signs up new users and they all start spamming the same horrible messages cuss 100 of times per second.
In my chat app, all you need is a username and password to sign up, but that's not nearly enough friction for any real world application.
At the very least, you should require an email and have that user verify the email before they start posting messages.
Pocketbase has a built in email system that can handle this step for you.
Then you can check the verified status and security rules for messages.
That's a step in the right direction, but it's still not perfect.
It's not hard to verify a burner email.
That's why nowadays, you see almost all large scale applications requiring multi factor where a user also needs to verify a phone number with a text message or via an authenticator app to do anything important.
This can also be faked, but it's way more difficult.
Still though, someone could register with a burner phone, and once again spam the chat with horrible messages.
Another step you can take is to verify that the person on the front end is an actual human.
Can By implementing a CAPTCHA, that in theory can only be solved by a real human.
Google's reCAPTCHA is the most popular option, but Cloud Flutter also now has a free alternative called turnstyle, and either option can help validate that requests are actually coming from a human inside your app.
If you're a Firebase user, this is actually built into the platform with a tool called App Check, which has saved my ass multiple times.
That can help with bots, but it's not going to stop some deranged lunatic or someone from the FBI social media team from posting awful messages as a legitimate human being.
Another step you'll wanna take is to implement rate limiting on the back end.
This prevents one single could use her from submitting too many requests within a given time period.
A human can only do so much, and if you see an account breaking past that threshold, then you just shut cut off for a while.
Now the final thing I wanna talk about is problems scaling the infrastructure.
Normally on this channel, we use serverless tools that can scale infinitely in the cloud without any regard for your wallet.
This video was unique because we hosted the entirety of the back end that includes the rest API, the admin dashboard, and the database can sell on a $5 Linux server.
In just one day, over 300,000 messages were created, and Pocketbase also recorded millions of logging records to go along with all the requests to the API.
The pocket based creator left a really nice comment on that video explaining some improvements we could make, like creasing the open file limit to get the real time connections to scale better.
Also, keep in mind that pocket base is a very early stage project that hasn't even hit 1 point o yet.
Overall, I'm extremely impressed at how it scaled with its limited resources and thousands of real time connections.
The front end app got really laggy can just do to the fire hose of messages, and the admin app also froze up a couple of times when I tried to delete some of the worst users and messages.
But the the dashboard never crashed completely and I could always access the data there.
Most importantly, I could always update the rules to globally disable new message creation.
Can I did that for about an hour, so I could go have a nice healthy and relaxing lunch at Arby's?
I left a message from the official FireShip account explaining that the chat had been disabled due to extreme toxicity.
As as I sat down and began to enjoy my roast beef sandwich and curly fries, I went in to double check the chat and found that Toshimichi 17 before found an exploit to overwrite my message in addition to any other user in the chat.
This is my fault for not defining robust security rules, but all I could do was sit there and cry came while eating my strawberries and cream fried pie, now available for a limited time at participating restaurants.
Now even though you guys were able to overwhelm and totally wreck I don't feel ashamed or humiliated for this great dishonor I've brought upon the art of programming.
Ultimately, moderating and controlling spam on a massive chat app is a nearly impossible task.
Even in Discord struggles with it to this day.
We've had to jump through all kinds of hoops to prevent raids and spam on our Discord server.
If you're crazy enough to build your own massive public chat room.
All I can say is good luck and may God be with you.
Thanks for watching, and I will see you in the next one.

Speaker 0: A few days ago, I built a next gen Discord killer with pocket base and Svelte. It was an amazing experience for about 3 minutes, but then you guys completely destroyed it by spamming it with the most deranged comments I've ever seen on the Internet. I initially started with a $5 Linux server. Its usage quickly shot up to 100 consent, so I resized it to 4 cores. That wasn't nearly enough juice either, and all 4 cores quickly became overwhelmed.

And this is why we can't have nice things on this channel. The primary person to blame for all this is me, the developer. I built it with bad security practices by design just to see what would happen. Funny do bad things. Luckily, I live in America, so I can't go to jail for the horrible things you guys said, unlike other countries, but nobody wants to use an app that can be spammed by an unlimited amount of hate speech profanity.

This is a major problem when building any kind of app with user generated data. In today's video, we'll break down all the problems my app had had and talk about tools and techniques you can use to mitigate these issues in your own projects. The first problem is that people were using profanity even though I told them not to. They didn't listen. Your language is convinced them.

I thought this might happen, so I implemented a pooping system where if a comment gets pooped on 5 times, it gets removed from the UI. I've seen this feature on other platforms like can odyssey where you can slime a comment to death. And I think it's a good idea, but it doesn't really work for a chat where the messages are moving at a 100 miles an It can also be hijacked by the bad guys to poop down all the comments that are actually good. So the next thing I did, which is really easy to implement, is just a bad word filter directly in the front end code. That means the app can't display words like, f f f balls, and so on.

You can also do filtering like this on the back end can before that data ever goes to your database, but it's impossible to catch everything with regular expressions. The trolls will find ways to say bad words with alternative characters characters that bypass your filters. In modern times though, artificial intelligence is starting to take over this job. Google developed perspective which can detect if something is an insult or some variation of profanity, and they use tools like this at scale to keep the worst of the worst comments off of YouTube. Bad words are one problem, but an even bigger problem is when one person creates a script that automatically signs up new users and they all start spamming the same horrible messages cuss 100 of times per second.

In my chat app, all you need is a username and password to sign up, but that's not nearly enough friction for any real world application. At the very least, you should require an email and have that user verify the email before they start posting messages. Pocketbase has a built in email system that can handle this step for you. Then you can check the verified status and security rules for messages. That's a step in the right direction, but it's still not perfect.

It's not hard to verify a burner email. That's why nowadays, you see almost all large scale applications requiring multi factor where a user also needs to verify a phone number with a text message or via an authenticator app to do anything important. This can also be faked, but it's way more difficult. Still though, someone could register with a burner phone, and once again spam the chat with horrible messages. Another step you can take is to verify that the person on the front end is an actual human.

Can By implementing a CAPTCHA, that in theory can only be solved by a real human. Google's reCAPTCHA is the most popular option, but Cloud Flutter also now has a free alternative called turnstyle, and either option can help validate that requests are actually coming from a human inside your app. If you're a Firebase user, this is actually built into the platform with a tool called App Check, which has saved my ass multiple times. That can help with bots, but it's not going to stop some deranged lunatic or someone from the FBI social media team from posting awful messages as a legitimate human being. Another step you'll wanna take is to implement rate limiting on the back end.

This prevents one single could use her from submitting too many requests within a given time period. A human can only do so much, and if you see an account breaking past that threshold, then you just shut cut off for a while. Now the final thing I wanna talk about is problems scaling the infrastructure. Normally on this channel, we use serverless tools that can scale infinitely in the cloud without any regard for your wallet. This video was unique because we hosted the entirety of the back end that includes the rest API, the admin dashboard, and the database can sell on a $5 Linux server.

In just one day, over 300,000 messages were created, and Pocketbase also recorded millions of logging records to go along with all the requests to the API. The pocket based creator left a really nice comment on that video explaining some improvements we could make, like creasing the open file limit to get the real time connections to scale better. Also, keep in mind that pocket base is a very early stage project that hasn't even hit 1 point o yet. Overall, I'm extremely impressed at how it scaled with its limited resources and thousands of real time connections. The front end app got really laggy can just do to the fire hose of messages, and the admin app also froze up a couple of times when I tried to delete some of the worst users and messages.

But the the dashboard never crashed completely and I could always access the data there. Most importantly, I could always update the rules to globally disable new message creation. Can I did that for about an hour, so I could go have a nice healthy and relaxing lunch at Arby's? I left a message from the official FireShip account explaining that the chat had been disabled due to extreme toxicity. As as I sat down and began to enjoy my roast beef sandwich and curly fries, I went in to double check the chat and found that Toshimichi 17 before found an exploit to overwrite my message in addition to any other user in the chat.

This is my fault for not defining robust security rules, but all I could do was sit there and cry came while eating my strawberries and cream fried pie, now available for a limited time at participating restaurants. Now even though you guys were able to overwhelm and totally wreck I don't feel ashamed or humiliated for this great dishonor I've brought upon the art of programming. Ultimately, moderating and controlling spam on a massive chat app is a nearly impossible task. Even in Discord struggles with it to this day. We've had to jump through all kinds of hoops to prevent raids and spam on our Discord server.

If you're crazy enough to build your own massive public chat room. All I can say is good luck and may God be with you. Thanks for watching, and I will see you in the next one.
A few days ago, I built a next gen Discord killer with pocket base and Svelte. It was an amazing experience for about 3 minutes, but then you guys completely destroyed it by spamming it with the most deranged comments I've ever seen on the Internet. I initially started with a $5 Linux server. Its usage quickly shot up to 100 consent, so I resized it to 4 cores. That wasn't nearly enough juice either, and all 4 cores quickly became overwhelmed.
And this is why we can't have nice things on this channel. The primary person to blame for all this is me, the developer. I built it with bad security practices by design just to see what would happen. Funny do bad things. Luckily, I live in America, so I can't go to jail for the horrible things you guys said, unlike other countries, but nobody wants to use an app that can be spammed by an unlimited amount of hate speech profanity.
security
This is a major problem when building any kind of app with user generated data. In today's video, we'll break down all the problems my app had had and talk about tools and techniques you can use to mitigate these issues in your own projects. The first problem is that people were using profanity even though I told them not to. They didn't listen. Your language is convinced them. I thought this might happen, so I implemented a pooping system where if a comment gets pooped on 5 times, it gets removed from the UI. I've seen this feature on other platforms like can odyssey where you can slime a comment to death. And I think it's a good idea, but it doesn't really work for a chat where the messages are moving at a 100 miles an It can also be hijacked by the bad guys to poop down all the comments that are actually good. So the next thing I did, which is really easy to implement, is just a bad word filter directly in the front end code. That means the app can't display words like, f f f balls, and so on. You can also do filtering like this on the back end can before that data ever goes to your database, but it's impossible to catch everything with regular expressions.
The trolls will find ways to say bad words with alternative characters characters that bypass your filters. In modern times though, artificial intelligence is starting to take over this job. Google developed perspective which can detect if something is an insult or some variation of profanity, and they use tools like this at scale to keep the worst of the worst comments off of YouTube. Bad words are one problem, but an even bigger problem is when one person creates a script that automatically signs up new users and they all start spamming the same horrible messages cuss 100 of times per second.
youtube
artificial intelligence
google
In my chat app, all you need is a username and password to sign up, but that's not nearly enough friction for any real world application. At the very least, you should require an email and have that user verify the email before they start posting messages. Pocketbase has a built in email system that can handle this step for you. Then you can check the verified status and security rules for messages. That's a step in the right direction, but it's still not perfect.
email
It's not hard to verify a burner email.
That's why nowadays, you see almost all large scale applications requiring multi factor where a user also needs to verify a phone number with a text message or via an authenticator app to do anything important. This can also be faked, but it's way more difficult. Still though, someone could register with a burner phone, and once again spam the chat with horrible messages.
phones
Another step you can take is to verify that the person on the front end is an actual human. Can By implementing a CAPTCHA, that in theory can only be solved by a real human. Google's reCAPTCHA is the most popular option, but Cloud Flutter also now has a free alternative called turnstyle, and either option can help validate that requests are actually coming from a human inside your app. If you're a Firebase user, this is actually built into the platform with a tool called App Check, which has saved my ass multiple times. That can help with bots, but it's not going to stop some deranged lunatic or someone from the FBI social media team from posting awful messages as a legitimate human being. Another step you'll wanna take is to implement rate limiting on the back end. This prevents one single could use her from submitting too many requests within a given time period.
A human can only do so much, and if you see an account breaking past that threshold, then you just shut cut off for a while. Now the final thing I wanna talk about is problems scaling the infrastructure. Normally on this channel, we use serverless tools that can scale infinitely in the cloud without any regard for your wallet. This video was unique because we hosted the entirety of the back end that includes the rest API, the admin dashboard, and the database can sell on a $5 Linux server. In just one day, over 300,000 messages were created, and Pocketbase also recorded millions of logging records to go along with all the requests to the API.
networking
streaming
internet
multimedia
youtube
The pocket based creator left a really nice comment on that video explaining some improvements we could make, like creasing the open file limit to get the real time connections to scale better. Also, keep in mind that pocket base is a very early stage project that hasn't even hit 1 point o yet. Overall, I'm extremely impressed at how it scaled with its limited resources and thousands of real time connections. The front end app got really laggy can just do to the fire hose of messages, and the admin app also froze up a couple of times when I tried to delete some of the worst users and messages. But the the dashboard never crashed completely and I could always access the data there. Most importantly, I could always update the rules to globally disable new message creation. Can I did that for about an hour, so I could go have a nice healthy and relaxing lunch at Arby's? I left a message from the official FireShip account explaining that the chat had been disabled due to extreme toxicity.
As as I sat down and began to enjoy my roast beef sandwich and curly fries, I went in to double check the chat and found that Toshimichi 17 before found an exploit to overwrite my message in addition to any other user in the chat. This is my fault for not defining robust security rules, but all I could do was sit there and cry came while eating my strawberries and cream fried pie, now available for a limited time at participating restaurants. Now even though you guys were able to overwhelm and totally wreck I don't feel ashamed or humiliated for this great dishonor I've brought upon the art of programming.
security
Ultimately, moderating and controlling spam on a massive chat app is a nearly impossible task. Even in Discord struggles with it to this day. We've had to jump through all kinds of hoops to prevent raids and spam on our Discord server. If you're crazy enough to build your own massive public chat room.
networking
All I can say is good luck and may God be with you. Thanks for watching, and I will see you in the next one.
A few days ago, I built a next gen Discord killer with pocket base and Svelte. It was an amazing experience for about 3 minutes, but then you guys completely destroyed it by spamming it with the most deranged comments I've ever seen on the Internet. I initially started with a $5 Linux server. Its usage quickly shot up to 100 consent, so I resized it to 4 cores. That wasn't nearly enough juice either, and all 4 cores quickly became overwhelmed. And this is why we can't have nice things on this channel. The primary person to blame for all this is me, the developer. I built it with bad security practices by design just to see what would happen. Funny do bad things. Luckily, I live in America, so I can't go to jail for the horrible things you guys said, unlike other countries, but nobody wants to use an app that can be spammed by an unlimited amount of hate speech profanity. This is a major problem when building any kind of app with user generated data. In today's video, we'll break down all the problems my app had had and talk about tools and techniques you can use to mitigate these issues in your own projects. The first problem is that people were using profanity even though I told them not to. They didn't listen. Your language is convinced them. I thought this might happen, so I implemented a pooping system where if a comment gets pooped on 5 times, it gets removed from the UI. I've seen this feature on other platforms like can odyssey where you can slime a comment to death. And I think it's a good idea, but it doesn't really work for a chat where the messages are moving at a 100 miles an It can also be hijacked by the bad guys to poop down all the comments that are actually good. So the next thing I did, which is really easy to implement, is just a bad word filter directly in the front end code. That means the app can't display words like, f f f balls, and so on. You can also do filtering like this on the back end can before that data ever goes to your database, but it's impossible to catch everything with regular expressions. The trolls will find ways to say bad words with alternative characters characters that bypass your filters. In modern times though, artificial intelligence is starting to take over this job. Google developed perspective which can detect if something is an insult or some variation of profanity, and they use tools like this at scale to keep the worst of the worst comments off of YouTube. Bad words are one problem, but an even bigger problem is when one person creates a script that automatically signs up new users and they all start spamming the same horrible messages cuss 100 of times per second. In my chat app, all you need is a username and password to sign up, but that's not nearly enough friction for any real world application. At the very least, you should require an email and have that user verify the email before they start posting messages. Pocketbase has a built in email system that can handle this step for you. Then you can check the verified status and security rules for messages. That's a step in the right direction, but it's still not perfect. It's not hard to verify a burner email. That's why nowadays, you see almost all large scale applications requiring multi factor where a user also needs to verify a phone number with a text message or via an authenticator app to do anything important. This can also be faked, but it's way more difficult. Still though, someone could register with a burner phone, and once again spam the chat with horrible messages. Another step you can take is to verify that the person on the front end is an actual human. Can By implementing a CAPTCHA, that in theory can only be solved by a real human. Google's reCAPTCHA is the most popular option, but Cloud Flutter also now has a free alternative called turnstyle, and either option can help validate that requests are actually coming from a human inside your app. If you're a Firebase user, this is actually built into the platform with a tool called App Check, which has saved my ass multiple times. That can help with bots, but it's not going to stop some deranged lunatic or someone from the FBI social media team from posting awful messages as a legitimate human being. Another step you'll wanna take is to implement rate limiting on the back end. This prevents one single could use her from submitting too many requests within a given time period. A human can only do so much, and if you see an account breaking past that threshold, then you just shut cut off for a while. Now the final thing I wanna talk about is problems scaling the infrastructure. Normally on this channel, we use serverless tools that can scale infinitely in the cloud without any regard for your wallet. This video was unique because we hosted the entirety of the back end that includes the rest API, the admin dashboard, and the database can sell on a $5 Linux server. In just one day, over 300,000 messages were created, and Pocketbase also recorded millions of logging records to go along with all the requests to the API. The pocket based creator left a really nice comment on that video explaining some improvements we could make, like creasing the open file limit to get the real time connections to scale better. Also, keep in mind that pocket base is a very early stage project that hasn't even hit 1 point o yet. Overall, I'm extremely impressed at how it scaled with its limited resources and thousands of real time connections. The front end app got really laggy can just do to the fire hose of messages, and the admin app also froze up a couple of times when I tried to delete some of the worst users and messages. But the the dashboard never crashed completely and I could always access the data there. Most importantly, I could always update the rules to globally disable new message creation. Can I did that for about an hour, so I could go have a nice healthy and relaxing lunch at Arby's? I left a message from the official FireShip account explaining that the chat had been disabled due to extreme toxicity. As as I sat down and began to enjoy my roast beef sandwich and curly fries, I went in to double check the chat and found that Toshimichi 17 before found an exploit to overwrite my message in addition to any other user in the chat. This is my fault for not defining robust security rules, but all I could do was sit there and cry came while eating my strawberries and cream fried pie, now available for a limited time at participating restaurants. Now even though you guys were able to overwhelm and totally wreck I don't feel ashamed or humiliated for this great dishonor I've brought upon the art of programming. Ultimately, moderating and controlling spam on a massive chat app is a nearly impossible task. Even in Discord struggles with it to this day. We've had to jump through all kinds of hoops to prevent raids and spam on our Discord server. If you're crazy enough to build your own massive public chat room. All I can say is good luck and may God be with you. Thanks for watching, and I will see you in the next one.
A
a
few
few
days
days
ago,
ago
I
i
built
built
a
a
next
next
gen
gen
Discord
discord
killer
killer
with
with
pocket
pocket
base
base
and
and
Svelte.
svelte
It
it
was
was
an
an
amazing
amazing
experience
experience
for
for
about
about
3
3
minutes,
minutes
but
but
then
then
you
you
guys
guys
completely
completely
destroyed
destroyed
it
it
by
by
spamming
spamming
it
it
with
with
the
the
most
most
deranged
deranged
comments
comments
I've
i've
ever
ever
seen
seen
on
on
the
the
Internet.
internet
I
i
initially
initially
started
started
with
with
a
a
$5
$5
Linux
linux
server.
server
Its
its
usage
usage
quickly
quickly
shot
shot
up
up
to
to
100
100
consent,
consent
so
so
I
i
resized
resized
it
it
to
to
4
4
cores.
cores
That
that
wasn't
wasn't
nearly
nearly
enough
enough
juice
juice
either,
either
and
and
all
all
4
4
cores
cores
quickly
quickly
became
became
overwhelmed.
overwhelmed
And
and
this
this
is
is
why
why
we
we
can't
can't
have
have
nice
nice
things
things
on
on
this
this
channel.
channel
The
the
primary
primary
person
person
to
to
blame
blame
for
for
all
all
this
this
is
is
me,
me
the
the
developer.
developer
I
i
built
built
it
it
with
with
bad
bad
security
security
practices
practices
by
by
design
design
just
just
to
to
see
see
what
what
would
would
happen.
happen
Funny
funny
do
do
bad
bad
things.
things
Luckily,
luckily
I
i
live
live
in
in
America,
america
so
so
I
i
can't
can't
go
go
to
to
jail
jail
for
for
the
the
horrible
horrible
things
things
you
you
guys
guys
said,
said
unlike
unlike
other
other
countries,
countries
but
but
nobody
nobody
wants
wants
to
to
use
use
an
an
app
app
that
that
can
can
be
be
spammed
spammed
by
by
an
an
unlimited
unlimited
amount
amount
of
of
hate
hate
speech
speech
profanity.
profanity
This
this
is
is
a
a
major
major
problem
problem
when
when
building
building
any
any
kind
kind
of
of
app
app
with
with
user
user
generated
generated
data.
data
In
in
today's
today's
video,
video
we'll
we'll
break
break
down
down
all
all
the
the
problems
problems
my
my
app
app
had
had
had
had
and
and
talk
talk
about
about
tools
tools
and
and
techniques
techniques
you
you
can
can
use
use
to
to
mitigate
mitigate
these
these
issues
issues
in
in
your
your
own
own
projects.
projects
The
the
first
first
problem
problem
is
is
that
that
people
people
were
were
using
using
profanity
profanity
even
even
though
though
I
i
told
told
them
them
not
not
to.
to
They
they
didn't
didn't
listen.
listen
Your
your
language
language
is
is
convinced
convinced
them.
them
I
i
thought
thought
this
this
might
might
happen,
happen
so
so
I
i
implemented
implemented
a
a
pooping
pooping
system
system
where
where
if
if
a
a
comment
comment
gets
gets
pooped
pooped
on
on
5
5
times,
times
it
it
gets
gets
removed
removed
from
from
the
the
UI.
ui
I've
i've
seen
seen
this
this
feature
feature
on
on
other
other
platforms
platforms
like
like
can
can
odyssey
odyssey
where
where
you
you
can
can
slime
slime
a
a
comment
comment
to
to
death.
death
And
and
I
i
think
think
it's
it's
a
a
good
good
idea,
idea
but
but
it
it
doesn't
doesn't
really
really
work
work
for
for
a
a
chat
chat
where
where
the
the
messages
messages
are
are
moving
moving
at
at
a
a
100
100
miles
miles
an
an
It
it
can
can
also
also
be
be
hijacked
hijacked
by
by
the
the
bad
bad
guys
guys
to
to
poop
poop
down
down
all
all
the
the
comments
comments
that
that
are
are
actually
actually
good.
good
So
so
the
the
next
next
thing
thing
I
i
did,
did
which
which
is
is
really
really
easy
easy
to
to
implement,
implement
is
is
just
just
a
a
bad
bad
word
word
filter
filter
directly
directly
in
in
the
the
front
front
end
end
code.
code
That
that
means
means
the
the
app
app
can't
can't
display
display
words
words
like,
like
f
f
f
f
f
f
balls,
balls
and
and
so
so
on.
on
You
you
can
can
also
also
do
do
filtering
filtering
like
like
this
this
on
on
the
the
back
back
end
end
can
can
before
before
that
that
data
data
ever
ever
goes
goes
to
to
your
your
database,
database
but
but
it's
it's
impossible
impossible
to
to
catch
catch
everything
everything
with
with
regular
regular
expressions.
expressions
The
the
trolls
trolls
will
will
find
find
ways
ways
to
to
say
say
bad
bad
words
words
with
with
alternative
alternative
characters
characters
characters
characters
that
that
bypass
bypass
your
your
filters.
filters
In
in
modern
modern
times
times
though,
though
artificial
artificial
intelligence
intelligence
is
is
starting
starting
to
to
take
take
over
over
this
this
job.
job
Google
google
developed
developed
perspective
perspective
which
which
can
can
detect
detect
if
if
something
something
is
is
an
an
insult
insult
or
or
some
some
variation
variation
of
of
profanity,
profanity
and
and
they
they
use
use
tools
tools
like
like
this
this
at
at
scale
scale
to
to
keep
keep
the
the
worst
worst
of
of
the
the
worst
worst
comments
comments
off
off
of
of
YouTube.
youtube
Bad
bad
words
words
are
are
one
one
problem,
problem
but
but
an
an
even
even
bigger
bigger
problem
problem
is
is
when
when
one
one
person
person
creates
creates
a
a
script
script
that
that
automatically
automatically
signs
signs
up
up
new
new
users
users
and
and
they
they
all
all
start
start
spamming
spamming
the
the
same
same
horrible
horrible
messages
messages
cuss
cuss
100
100
of
of
times
times
per
per
second.
second
In
in
my
my
chat
chat
app,
app
all
all
you
you
need
need
is
is
a
a
username
username
and
and
password
password
to
to
sign
sign
up,
up
but
but
that's
that's
not
not
nearly
nearly
enough
enough
friction
friction
for
for
any
any
real
real
world
world
application.
application
At
at
the
the
very
very
least,
least
you
you
should
should
require
require
an
an
email
email
and
and
have
have
that
that
user
user
verify
verify
the
the
email
email
before
before
they
they
start
start
posting
posting
messages.
messages
Pocketbase
pocketbase
has
has
a
a
built
built
in
in
email
email
system
system
that
that
can
can
handle
handle
this
this
step
step
for
for
you.
you
Then
then
you
you
can
can
check
check
the
the
verified
verified
status
status
and
and
security
security
rules
rules
for
for
messages.
messages
That's
that's
a
a
step
step
in
in
the
the
right
right
direction,
direction
but
but
it's
it's
still
still
not
not
perfect.
perfect
It's
it's
not
not
hard
hard
to
to
verify
verify
a
a
burner
burner
email.
email
That's
that's
why
why
nowadays,
nowadays
you
you
see
see
almost
almost
all
all
large
large
scale
scale
applications
applications
requiring
requiring
multi
multi
factor
factor
where
where
a
a
user
user
also
also
needs
needs
to
to
verify
verify
a
a
phone
phone
number
number
with
with
a
a
text
text
message
message
or
or
via
via
an
an
authenticator
authenticator
app
app
to
to
do
do
anything
anything
important.
important
This
this
can
can
also
also
be
be
faked,
faked
but
but
it's
it's
way
way
more
more
difficult.
difficult
Still
still
though,
though
someone
someone
could
could
register
register
with
with
a
a
burner
burner
phone,
phone
and
and
once
once
again
again
spam
spam
the
the
chat
chat
with
with
horrible
horrible
messages.
messages
Another
another
step
step
you
you
can
can
take
take
is
is
to
to
verify
verify
that
that
the
the
person
person
on
on
the
the
front
front
end
end
is
is
an
an
actual
actual
human.
human
Can
can
By
by
implementing
implementing
a
a
CAPTCHA,
captcha
that
that
in
in
theory
theory
can
can
only
only
be
be
solved
solved
by
by
a
a
real
real
human.
human
Google's
google's
reCAPTCHA
recaptcha
is
is
the
the
most
most
popular
popular
option,
option
but
but
Cloud
cloud
Flutter
flutter
also
also
now
now
has
has
a
a
free
free
alternative
alternative
called
called
turnstyle,
turnstyle
and
and
either
either
option
option
can
can
help
help
validate
validate
that
that
requests
requests
are
are
actually
actually
coming
coming
from
from
a
a
human
human
inside
inside
your
your
app.
app
If
if
you're
you're
a
a
Firebase
firebase
user,
user
this
this
is
is
actually
actually
built
built
into
into
the
the
platform
platform
with
with
a
a
tool
tool
called
called
App
app
Check,
check
which
which
has
has
saved
saved
my
my
ass
ass
multiple
multiple
times.
times
That
that
can
can
help
help
with
with
bots,
bots
but
but
it's
it's
not
not
going
going
to
to
stop
stop
some
some
deranged
deranged
lunatic
lunatic
or
or
someone
someone
from
from
the
the
FBI
fbi
social
social
media
media
team
team
from
from
posting
posting
awful
awful
messages
messages
as
as
a
a
legitimate
legitimate
human
human
being.
being
Another
another
step
step
you'll
you'll
wanna
wanna
take
take
is
is
to
to
implement
implement
rate
rate
limiting
limiting
on
on
the
the
back
back
end.
end
This
this
prevents
prevents
one
one
single
single
could
could
use
use
her
her
from
from
submitting
submitting
too
too
many
many
requests
requests
within
within
a
a
given
given
time
time
period.
period
A
a
human
human
can
can
only
only
do
do
so
so
much,
much
and
and
if
if
you
you
see
see
an
an
account
account
breaking
breaking
past
past
that
that
threshold,
threshold
then
then
you
you
just
just
shut
shut
cut
cut
off
off
for
for
a
a
while.
while
Now
now
the
the
final
final
thing
thing
I
i
wanna
wanna
talk
talk
about
about
is
is
problems
problems
scaling
scaling
the
the
infrastructure.
infrastructure
Normally
normally
on
on
this
this
channel,
channel
we
we
use
use
serverless
serverless
tools
tools
that
that
can
can
scale
scale
infinitely
infinitely
in
in
the
the
cloud
cloud
without
without
any
any
regard
regard
for
for
your
your
wallet.
wallet
This
this
video
video
was
was
unique
unique
because
because
we
we
hosted
hosted
the
the
entirety
entirety
of
of
the
the
back
back
end
end
that
that
includes
includes
the
the
rest
rest
API,
api
the
the
admin
admin
dashboard,
dashboard
and
and
the
the
database
database
can
can
sell
sell
on
on
a
a
$5
$5
Linux
linux
server.
server
In
in
just
just
one
one
day,
day
over
over
300,000
300,000
messages
messages
were
were
created,
created
and
and
Pocketbase
pocketbase
also
also
recorded
recorded
millions
millions
of
of
logging
logging
records
records
to
to
go
go
along
along
with
with
all
all
the
the
requests
requests
to
to
the
the
API.
api
The
the
pocket
pocket
based
based
creator
creator
left
left
a
a
really
really
nice
nice
comment
comment
on
on
that
that
video
video
explaining
explaining
some
some
improvements
improvements
we
we
could
could
make,
make
like
like
creasing
creasing
the
the
open
open
file
file
limit
limit
to
to
get
get
the
the
real
real
time
time
connections
connections
to
to
scale
scale
better.
better
Also,
also
keep
keep
in
in
mind
mind
that
that
pocket
pocket
base
base
is
is
a
a
very
very
early
early
stage
stage
project
project
that
that
hasn't
hasn't
even
even
hit
hit
1
1
point
point
o
o
yet.
yet
Overall,
overall
I'm
i'm
extremely
extremely
impressed
impressed
at
at
how
how
it
it
scaled
scaled
with
with
its
its
limited
limited
resources
resources
and
and
thousands
thousands
of
of
real
real
time
time
connections.
connections
The
the
front
front
end
end
app
app
got
got
really
really
laggy
laggy
can
can
just
just
do
do
to
to
the
the
fire
fire
hose
hose
of
of
messages,
messages
and
and
the
the
admin
admin
app
app
also
also
froze
froze
up
up
a
a
couple
couple
of
of
times
times
when
when
I
i
tried
tried
to
to
delete
delete
some
some
of
of
the
the
worst
worst
users
users
and
and
messages.
messages
But
but
the
the
the
the
dashboard
dashboard
never
never
crashed
crashed
completely
completely
and
and
I
i
could
could
always
always
access
access
the
the
data
data
there.
there
Most
most
importantly,
importantly
I
i
could
could
always
always
update
update
the
the
rules
rules
to
to
globally
globally
disable
disable
new
new
message
message
creation.
creation
Can
can
I
i
did
did
that
that
for
for
about
about
an
an
hour,
hour
so
so
I
i
could
could
go
go
have
have
a
a
nice
nice
healthy
healthy
and
and
relaxing
relaxing
lunch
lunch
at
at
Arby's?
arby's
I
i
left
left
a
a
message
message
from
from
the
the
official
official
FireShip
fireship
account
account
explaining
explaining
that
that
the
the
chat
chat
had
had
been
been
disabled
disabled
due
due
to
to
extreme
extreme
toxicity.
toxicity
As
as
as
as
I
i
sat
sat
down
down
and
and
began
began
to
to
enjoy
enjoy
my
my
roast
roast
beef
beef
sandwich
sandwich
and
and
curly
curly
fries,
fries
I
i
went
went
in
in
to
to
double
double
check
check
the
the
chat
chat
and
and
found
found
that
that
Toshimichi
toshimichi
17
17
before
before
found
found
an
an
exploit
exploit
to
to
overwrite
overwrite
my
my
message
message
in
in
addition
addition
to
to
any
any
other
other
user
user
in
in
the
the
chat.
chat
This
this
is
is
my
my
fault
fault
for
for
not
not
defining
defining
robust
robust
security
security
rules,
rules
but
but
all
all
I
i
could
could
do
do
was
was
sit
sit
there
there
and
and
cry
cry
came
came
while
while
eating
eating
my
my
strawberries
strawberries
and
and
cream
cream
fried
fried
pie,
pie
now
now
available
available
for
for
a
a
limited
limited
time
time
at
at
participating
participating
restaurants.
restaurants
Now
now
even
even
though
though
you
you
guys
guys
were
were
able
able
to
to
overwhelm
overwhelm
and
and
totally
totally
wreck
wreck
I
i
don't
don't
feel
feel
ashamed
ashamed
or
or
humiliated
humiliated
for
for
this
this
great
great
dishonor
dishonor
I've
i've
brought
brought
upon
upon
the
the
art
art
of
of
programming.
programming
Ultimately,
ultimately
moderating
moderating
and
and
controlling
controlling
spam
spam
on
on
a
a
massive
massive
chat
chat
app
app
is
is
a
a
nearly
nearly
impossible
impossible
task.
task
Even
even
in
in
Discord
discord
struggles
struggles
with
with
it
it
to
to
this
this
day.
day
We've
we've
had
had
to
to
jump
jump
through
through
all
all
kinds
kinds
of
of
hoops
hoops
to
to
prevent
prevent
raids
raids
and
and
spam
spam
on
on
our
our
Discord
discord
server.
server
If
if
you're
you're
crazy
crazy
enough
enough
to
to
build
build
your
your
own
own
massive
massive
public
public
chat
chat
room.
room
All
all
I
i
can
can
say
say
is
is
good
good
luck
luck
and
and
may
may
God
god
be
be
with
with
you.
you
Thanks
thanks
for
for
watching,
watching
and
and
I
i
will
will
see
see
you
you
in
in
the
the
next
next
one.
one
success
The speaker discusses the problems with their app, including spamming users with negative comments and user generated data. They suggest ways to mitigate these issues, including using a bad word filter and a bad word filter directly in the front end code. The speaker also mentions the challenges of scaling infrastructure and the need for moderating and controlling spam on a large chat app.
Why my chat app broke… a cautionary tale
A few days ago, I built a next gen Discord killer with pocket base and Svelte. It was an amazing experience for about 3 minutes, but then you guys completely destroyed it by spamming it with the most deranged comments I've ever seen on the Internet. I initially started with a $5 Linux server. Its usage quickly shot up to 100 consent, so I resized it to 4 cores. That wasn't nearly enough juice either, and all 4 cores quickly became overwhelmed. And this is why we can't have nice things on this channel. The primary person to blame for all this is me, the developer. I built it with bad security practices by design just to see what would happen. Funny do bad things. Luckily, I live in America, so I can't go to jail for the horrible things you guys said, unlike other countries, but nobody wants to use an app that can be spammed by an unlimited amount of hate speech profanity. This is a major problem when building any kind of app with user generated data. In today's video, we'll break down all the problems my app had had and talk about tools and techniques you can use to mitigate these issues in your own projects. The first problem is that people were using profanity even though I told them not to. They didn't listen. Your language is convinced them. I thought this might happen, so I implemented a pooping system where if a comment gets pooped on 5 times, it gets removed from the UI. I've seen this feature on other platforms like can odyssey where you can slime a comment to death. And I think it's a good idea, but it doesn't really work for a chat where the messages are moving at a 100 miles an It can also be hijacked by the bad guys to poop down all the comments that are actually good. So the next thing I did, which is really easy to implement, is just a bad word filter directly in the front end code. That means the app can't display words like, f f f balls, and so on. You can also do filtering like this on the back end can before that data ever goes to your database, but it's impossible to catch everything with regular expressions. The trolls will find ways to say bad words with alternative characters characters that bypass your filters. In modern times though, artificial intelligence is starting to take over this job. Google developed perspective which can detect if something is an insult or some variation of profanity, and they use tools like this at scale to keep the worst of the worst comments off of YouTube. Bad words are one problem, but an even bigger problem is when one person creates a script that automatically signs up new users and they all start spamming the same horrible messages cuss 100 of times per second. In my chat app, all you need is a username and password to sign up, but that's not nearly enough friction for any real world application. At the very least, you should require an email and have that user verify the email before they start posting messages. Pocketbase has a built in email system that can handle this step for you. Then you can check the verified status and security rules for messages. That's a step in the right direction, but it's still not perfect. It's not hard to verify a burner email. That's why nowadays, you see almost all large scale applications requiring multi factor where a user also needs to verify a phone number with a text message or via an authenticator app to do anything important. This can also be faked, but it's way more difficult. Still though, someone could register with a burner phone, and once again spam the chat with horrible messages. Another step you can take is to verify that the person on the front end is an actual human. Can By implementing a CAPTCHA, that in theory can only be solved by a real human. Google's reCAPTCHA is the most popular option, but Cloud Flutter also now has a free alternative called turnstyle, and either option can help validate that requests are actually coming from a human inside your app. If you're a Firebase user, this is actually built into the platform with a tool called App Check, which has saved my ass multiple times. That can help with bots, but it's not going to stop some deranged lunatic or someone from the FBI social media team from posting awful messages as a legitimate human being. Another step you'll wanna take is to implement rate limiting on the back end. This prevents one single could use her from submitting too many requests within a given time period. A human can only do so much, and if you see an account breaking past that threshold, then you just shut cut off for a while. Now the final thing I wanna talk about is problems scaling the infrastructure. Normally on this channel, we use serverless tools that can scale infinitely in the cloud without any regard for your wallet. This video was unique because we hosted the entirety of the back end that includes the rest API, the admin dashboard, and the database can sell on a $5 Linux server. In just one day, over 300,000 messages were created, and Pocketbase also recorded millions of logging records to go along with all the requests to the API. The pocket based creator left a really nice comment on that video explaining some improvements we could make, like creasing the open file limit to get the real time connections to scale better. Also, keep in mind that pocket base is a very early stage project that hasn't even hit 1 point o yet. Overall, I'm extremely impressed at how it scaled with its limited resources and thousands of real time connections. The front end app got really laggy can just do to the fire hose of messages, and the admin app also froze up a couple of times when I tried to delete some of the worst users and messages. But the the dashboard never crashed completely and I could always access the data there. Most importantly, I could always update the rules to globally disable new message creation. Can I did that for about an hour, so I could go have a nice healthy and relaxing lunch at Arby's? I left a message from the official FireShip account explaining that the chat had been disabled due to extreme toxicity. As as I sat down and began to enjoy my roast beef sandwich and curly fries, I went in to double check the chat and found that Toshimichi 17 before found an exploit to overwrite my message in addition to any other user in the chat. This is my fault for not defining robust security rules, but all I could do was sit there and cry came while eating my strawberries and cream fried pie, now available for a limited time at participating restaurants. Now even though you guys were able to overwhelm and totally wreck I don't feel ashamed or humiliated for this great dishonor I've brought upon the art of programming. Ultimately, moderating and controlling spam on a massive chat app is a nearly impossible task. Even in Discord struggles with it to this day. We've had to jump through all kinds of hoops to prevent raids and spam on our Discord server. If you're crazy enough to build your own massive public chat room. All I can say is good luck and may God be with you. Thanks for watching, and I will see you in the next one.
The speaker discusses the problems with their app, including spamming users with negative comments and user generated data. They suggest ways to mitigate these issues, including using a bad word filter and a bad word filter directly in the front end code. The speaker also mentions the challenges of scaling infrastructure and the need for moderating and controlling spam on a large chat app.