I added a real-time chat to my blog, people used it to attack me

Sometimes the most irrelevant piece of a project becomes its absolute protagonist.

My blog has a small social widget floating on one side. You can see it on the right on desktop, on the left on mobile. It tells you how many people are reading the site in real time, and it lets you drop a short message for everyone else who is present to see. It is very basic. There is no history, and you do not need to create an account or a profile. A message appears and a few seconds later it is gone. It is an ornament, a wink, the kind of detail you add on a Friday afternoon and expect nothing from. To my surprise, it was used against me to discredit me and to censor an article.

Let me put you in context. I wrote an article on why I don't recommend Tailwind CSS and shared it on Hacker News. Within minutes, the text box filled with offensive and provocative messages, some even trying to impersonate me.

How it works

I barely had to do anything, and the dirty work was done by the site's architecture.

My site is an SPA that renders the HTML on the server and sends it to the browser over WebSockets (I use Django LiveView, my own framework). When you work this way, knowing how many people are connected in real time comes for free. Each visitor keeps an open connection, so I just have a table with the live connections. When someone joins or leaves, I broadcast the new number to everyone present and the counter updates on its own.

From there, adding an input and relaying what someone writes to everyone else is a small step. The same channel I already use for the counter serves me for the message.

I gave it the classic limits, nothing overly sophisticated:

• A maximum number of characters per message.
• The text disappears from the screen after a few seconds.
• You cannot send messages back to back: there is a minimum interval between one and the next.

In principle it seems pretty solid. What harm could a box that only broadcasts plain, ephemeral text do to me? You're thinking the same thing I was, I'm not crazy, right?

The attacks

It turns out that a public text box connected to every reader at once is an irresistible toy that sparks creativity:

• Insults and hate speech. Racism and assorted provocations. The goal, I suppose, was twofold: to make whoever was reading uncomfortable and to make the article look bad in front of the aggregators and networks where it was being shared.
• Targeted provocations. A certain president was mentioned quite a bit, with death threats. I suppose it was aimed at a specific social network or community.
• Covering the content. Very long messages with repeated characters, # and @ in a row, to push the text down and clutter the screen. On mobile it was surprisingly effective.
• Impersonating me. They started writing messages pretending to be me, inviting people to visit certain links or dropping spam. There is always someone who wants to profit from the noise.
• Injecting code. Many tried to sneak in JavaScript so it would run in everyone else's browser. They never managed it, but the attempt is interesting. Since the server renders and escapes the HTML before broadcasting it, a <script> travels as inert text and reaches your neighbor's screen as what it is, a few letters, not as code. The same architecture that makes the chat trivial is what makes it immune to this.
• Discrediting me head-on. And the simplest one: messages of contempt toward me or the blog, just to see if it stuck.

I must have annoyed a lot of people at once, because the wave lasted a whole day. Continuous attacks. Perhaps carried out by AIs or bots, I don't know.

Such was the scale that I started getting warnings in private. Something unheard of!

The countermeasures

The first and most obvious one was a filter of inappropriate words and expressions. I won't explain which ones or how it works inside, for obvious reasons, but it is quite effective. The machinery is in the heuristics.

The second, and most natural, was to cut the maximum number of characters way down. Less room is less ammunition to cover content and less space to hide a link.

The rest is the hardest countermeasure of all: patience and not taking the bait. A troll is after a reaction. If the system absorbs the blow in silence and you don't respond, the game stops being fun for the attacker. Don't feed the trolls.

What I learned

The easy conclusion would be "there are a lot of people with too much free time." And it's true. But there are a couple of less obvious things I take away.

Every input is hostile until proven otherwise. It's a mantra we developers repeat, and one you internalize all at once the day you live through something like this.

Real-time moderation is a different problem. Moderating comments is comfortable: they arrive, they wait, you review them, you decide. An ephemeral message that is broadcast instantly gives you no such margin. Either you trust an automatic filter that acts in milliseconds, or you are too late. The asymmetry is brutal, since an attacker improvises in seconds, but the countermeasure takes hours or days.

Ephemerality plays in your favor. The fact that the message disappears on its own, that there is no history, that no profiles or karma are left to farm, takes away almost all the incentive for a troll.

To wrap up the story, I just want to say that I don't regret having it. The vast majority use it to say hi, and seeing ten strangers coincide on the same page at once still has something magical about it.

Do you have company? Take the chance to say hello, or even start a friendship. You never know who is on the other side of the screen.