Spam

[greggman]

People suck! You try to do something nice and someone always and without fail shits all over you 😢

[jfontan]

Thank you for the heads up. I'm trying to clean up.

[jfontan]

I believe I've cleaned up most of it. The service is up again.

[jfontan]

I'll close it tomorrow if I can't find any more entries like that.

[jfontan]

It happened again. I took down the page while I find time to clean up and add a check to somehow alleviate it. Today I believe I won't have time to do it.

[Skoopyy]

It happened again. I took down the page while I find time to clean up and add a check to somehow alleviate it. Today I believe I won't have time to do it.

What is this exploit exactly and how are you going to patch it?

Is there going to be an ETA on when the site is going to be back up?

[Memexurer]

so the exploit works by just spamming shader upload form (POST https://glslsandbox.com/e). and i think the best way to fix this would be to add a captcha (cloudflare turnstile for example) to the shader upload form...

[Skoopyy]

so the exploit works by just spamming shader upload form (POST https://glslsandbox.com/e). and i think the best way to fix this would be to add a captcha (cloudflare turnstile for example) to the shader upload form...

good idea but is there any downsides to this?

[Memexurer]

good idea but is there any downsides to this?

i dont think so? you can read more about turnstile here: https://www.cloudflare.com/products/turnstile/

[jfontan]

@Skoopyy

It's strange that your user appears in the payload in some of the spammy effects:

VERY GOOD SHADER t.me/telegrosik - skoopyy on discord

[jfontan]

@Memexurer I would use captcha just as last resort. This adds friction to users and I prefer to find other ways before resorting to that.

Immediate things I plan to do:

• Clean up the actual spam
• Add a read only mode so people can access it but not upload new effects
• Bring up the page with a notice saying that effects cannot be added or modified

The big problem is letting the clients create new effects without rate limit. This let the spammer generate 250k effects very fast.

I'm planning as first step adding a rate limit per client and give error if it is sending too many effects in a short time. I also plan to do the same when the payload is equal or similar but this will be done afterwards.

@mrdoob what do you think?

[Skoopyy]

@Skoopyy

It's strange that your user appears in the payload in some of the spammy effects:

VERY GOOD SHADER t.me/telegrosik - skoopyy on discord

Very strange indeed...

[mrdoob]

@jfontan considering the nature of the site, maybe we could add Github Oauth?

[jfontan]

@jfontan considering the nature of the site, maybe we could add Github Oauth?

I'll take a look at how this can be implemented.

[mrdoob]

The underlying idea being that if we save the user for each effect, we could potentially report the spammy users to Github so they get banned 🤔