Why my chat app broke… a cautionary tale

My chat app became overwhelmed with profanity and spam, but all this could have been avoided with better security practices. Let's take a look at essential app security libraries and techniques.

#programming #hacking #tech

💬 Chat with Me on Discord

🔗 Resources

🔥 Get More Content - Upgrade to PRO

Use code YT25 for 25% off PRO access

🎨 My Editor Settings

- Atom One Dark
- vscode-icons
- Fira Code Font

🔖 Topics Covered

- How to prevent profanity in app
- How to deal with spam bots
- How to prevent website hacking
- Web app security best practices
- Cloudflare Turnstile vs reCaptcha
- Preventing DDoS attacks

[Fireship]

For those asking, the Toshimichi exploit was simple. My Pocketbase update rule failed to match the auth request userID to the existing message userID, thus allowing any to user modify the content of any message, whoops

[Evansgr]

Obviously you should have implemented a blue check for only valid users who pay $8 for it, which would eliminate any possibility of misuse!

[SpaceChicken]

Fireship, I understand your painful moderation of the chat app, but I have to say, I had a few of the most fulfilling and satisfying conversations with like-minded individuals there. I haven’t read such intelligent poetry as and “FARTFARTFARTFARTFARTFART” in my entire life.

[EnricoRos]

Reddit meets 4chan for a day? So instructional!! 🙏 Thanks! A crash course in security, psychology, best practices. Twitter in a nutshell.

[ryanpmcguire]

I feel like a good way to stop the profanity would be to explicitly state that is it allowed.

[citi]

I gotta say, I love this channel. Enough tech and humor to get me through work

[Murmeltier]

It's funny to see how programming evolved, but the problems basically stayed the same. I remember the time 20 years ago, when everyone was programming IRC bots to mitigate the same behavior. Maybe on a much smaller scale, tho.

[randxalthor]

These are the most helpful videos for me coming from another specialty. All the pitfalls of practical engineering that you usually have to learn the hard way because nobody vlogs about their failures.

[mcrazick]

If censorship continues in such trends, especially with the use of sophisticated AI, people on social media will become more sarcastic and passive-aggressive :)

[andymc]

Was amazing how much traffic the demo app got. And it was fun to watch all the exploit attempts in real-time. Would love to see this turned into a series where we continue to strengthen, and stress test the app.

[PixelSheep]

the last sentences really summed up any approach towards trying to create any program ever made

[PPMBlast]

There's currently large scale login attacks on number of industries. These are all good practices to follow but I'd love to hear suggestions on limiting the maniacs with scripts/headless browsers validating the captcha synthetically

[Achilles]

You left out the most important piece! How did that guy overwrite your comment? What was the exploit used?

[conororeilly]

Man, this actually seems like an incredible way of showing people considerations that need to be made when making anything. Streaming it and watching how "trolls", or poltergeists more like, start trying to wreak havock. I love it

[jasonc]

Dude I love how you bring current events into your videos.

[jesseparrish]

You can't beat spam on chat apps because chatroom messages are intrinsically spam.

[UselessDuckCompany]

I got banned from twitch once for bad user content so I feel your pain. It's just impossible to automate well.

[SethBrasile]

@Fireship I can't describe how incredibly useful content like this is. This is so so so useful and would make a great format to keep exploring.

[william]

That was more educational than a tutorial. Getting to see what happens when you deploy your app to a large audience is something we rarely see or experience

[DuckyyFuzzz]

Part 1: here’s how to build a public chat app
Part 2: ten reason why you shouldn’t build a public chat app