Talking about this like there's an "attack" feels very melodramatic. It seems to me like the non-constructive messages are either shitposts or just curious probes (testing whether certain codepoints make it through, testing whether bad no-no words make it through, testing how various things will render, testing whether the input is sanitized...). There's links to God knows what and some walls of inflammatory language, but I'm not noticing anything that could even remotely cause any harm.

The chat is still there in the corner of this post, with people typing nasty shit into it.

Well have fun delving into programmatic censorship I guess. Or just take it out. If you take the former path and post about trying to fix it here then I'm sure you'll get a lot more free testing of your attempts to enforce civility through regex or whatever. Enjoy learning about the Scunthorpe problem.

From the earliest days of websites allowing text input from users, this has been a thing. The same with any website that allows you to draw things, it will quickly show people drawing crude (in content not skill) objects. This is just human nature. Once people realized you could use these forms as attack vectors, we were off to the races. Now that bots can do it for you, I'd only imagine the time before first bot using the form is in minutes. I have seen all sorts of things suggested as workarounds to mitigate bot form submissions, but eventually, you will be spammed at the least with the feature. Adding something like a bot chat, of course people are going to be abusive to it much more than a simple form field.

For someone to be surprised by this today suggests to me that the person is really really new to managing a website.

I'm mostly curious why anyone would bother with doing attacks like this to some random individuals personal blog, was it one person or multiple people? What was the motivation? Is it just bots crawling the internet to spread hate?

A sad state of affairs, but certainly seems like having a strictly moderated comment section is a better option for a site like this.

Look. It works. I just spent 5 minutes reading the messages posted on your glorious chat app. If I'd be you, i'd plant an ad just above it. Why are you complaining.

I’d suggest one additional heuristic: once your bad word detector has triggered, shut down the chat for 10 minutes. That way waves of assholes don’t monopolize the chat, and when they move on to the next target the functionality returns to your site automatically.

>> The countermeasures

>> The first and most obvious one was a filter of inappropriate words and expressions.

Wouldn't the first and most obvious one be "drop real-time chat" from a blog?

"What I learned" seems to missing what used to be shared to every starting web developer; "If you allow user input on public internet pages, people will put vulgar, racist, hacking attempts and worse there, sometimes constantly over long periods of time"

Almost anyone who had a "guest book" had pre-moderation some way or another, or was a tiny-tiny website with barely any visitors. The second the larger cyberspace ecosystem got a whiff of your user-input-enabled website, the spamming would appear.

``` The first and most obvious one was a filter of inappropriate words and expressions. I won't explain which ones or how it works inside, for obvious reasons, but it is quite effective. The machinery is in the heuristics.

The second, and most natural, was to cut the maximum number of characters way down. Less room is less ammunition to cover content and less space to hide a link. ```

- you forgot the third fix, disable copy paste inside chat boxes, remove all swear words by replacing them with **

Reminds me of Maria Abramovic Rythym 0 performance art.

1: https://www.thecrimson.com/article/2023/3/30/maria-abramovic...

There seems to be one category of technological "attack", which failed - the script injections.

Otherwise:

OK: A guy insults the Tailwinds devs at length

Not OK: Anyone insults that guy briefly

Of course it is his own platform (blog) but that is on another platform (hosting) which could maybe decide they don't want their platform used to attack open source projects.

(I personally have no opinion on Tailwinds except a default negative valence regarding front-end)

The obvious solution is shutting it down it does offer nothing.

Short of that shadow ban everyone everyone sees their own messages, and add a few fake ones every now and then.

You just got yourself a product right there if it works and can market it as Roast me Blog with just trigger filters in your chat to make it healthy roast in place of abuse and highlight top roasters where people could upvote right there in your chat. Negativity turned into positive healthy banter ..

Content moderation and social anonymous behaviour aside, your real-time chat is really poorly implemented UX wise.

I saw the same message appearing more than once, I never saw my own message appear, it has a weird lag/delay feel to it. I didn't really enjoy that experience at all.

Obviously insults and attacks are unreasonable, but I think the tag injection etc should be an expected one if you’re posting on HN right? Like somebody is going to try it for kicks and I wouldn’t say it’s even necessarily malicious

If the chat is saved as an example of how lot to talk. Can that be used for training an LLM on how to talk or what to remove from a chat?

Well, you've just painted a big target on your blog. This is the internet, after all.

Wait. Is it not against the HN guidelines to regularly submit links to your own sites? Isn't that considered self-promotion and, thus, against the rules? I've got nothing against the author, personally, as I'd do the same, but seeing his submission page, I'd like to know how normal getting in trouble is for this practice or if the guidelines are enforced at all in this sense.

This should come as a surprise to absolutely nobody.

But hey traffic is traffic I guess.

"Every input is hostile until proven otherwise": you said it yourself. One of those sad things that somebody new learns on the Internet every day.

This sounds like the kind of feature that ends up being quick to initially implement but takes up way more engineering time to maintain than everything else combined. The author concedes at the end that most genuine uses of the feature are people just saying hello. So maybe the solution here is to disallow unrestricted input and just have a few buttons with fixed things to say.

There is a well-reviewed study on this from 2004 -

Greater Internet Fuckwad Theory[1]

[1] https://www.penny-arcade.com/comic/2004/03/19/green-blackboa...

Next we're going to hear a complaint from Mark Zuckerberg about how people are using Facebook and LLaMa to attack Meta.

The social web has become the adversarial web, unfortunately. You have to have a huge squelch knob if you want any meaningful signal now.