Did I read Firebase? I assume you stayed on the free side? Or your attackers were mean enough to have you wake up to a five figure bill?
DrawAFish.com Postmortem
101–110 of 113 posts
Re: DrawAFish.com Postmortem
#102There's a swastika fish on there right now. Folks get through the filter by putting it inside a fish shape: https://drawafish.com/rank.html?userId=1754341779700_log2xle... Edit: it's been deleted.
There's also a fish with the word "Balls" written on it: https://drawafish.com/profile.html?userId=1754400041983_0hqg...
Pretty mild, all things considered.
Re: DrawAFish.com Postmortem
#103So long and thanks for all the fish.
So long and thanks for all the slurs? ;-)
Re: DrawAFish.com Postmortem
#104Earlier quoted context omitted.
I actually did see one, while the site was #1 and well before the overnight excitement. (Good grief, even at this late age I have something to do with my Friday evenings...) I don't really know what you want me to tell you about it. The swastika per se as I recall had to be drawn backwards, because there is no meaningful overlap between its outline and that of a fish, so unlike the penis case this is very easy for th…
Yes but what was the incident like, in general? Was it just swastikas, or words too, or what? When I saw it, it was just normal fish.
I got you.
So think of 4 Chan but fish. Like the entire screen.
50 of the fish are just regular fish with slurs written in them.
There’s like 10 swastika fish moseying around.
And then you have the odd fish with like an Isreali flag with…let’s say stereotypical features for the face.
Re: DrawAFish.com Postmortem
#105From my (limited) experience poking at vibecoded apps, "broken/missing authentication" is the most common issue by far.
That said, the 2021 OWASP Top 10 had "broken access control" in the top spot already, prior to the real takeoff of vibecoding: https://owasp.org/www-project-top-ten/ - curious to see the 2025 update.
Re: DrawAFish.com Postmortem
#106Earlier quoted context omitted.
Yes but what was the incident like, in general? Was it just swastikas, or words too, or what? When I saw it, it was just normal fish.
I got you. So think of 4 Chan but fish. Like the entire screen. 50 of the fish are just regular fish with slurs written in them. There’s like 10 swastika fish moseying around. And then you have the odd fish with like an Isreali flag with…let’s say stereotypical features for the face.
Hahaha that is an excellent description, well done. It's as if I was there.
Re: DrawAFish.com Postmortem
#107Re: DrawAFish.com Postmortem
#108Earlier quoted context omitted.
I think "Who, specifically, claims that [...]?" comes off as less condescending than "Who claims that [...]? Be specific." just by virtue of the latter using imperative language, which triggers a reflexive "you're not the boss of me" reaction.
The message is clear in both cases. It's easier to put aside these irrational reflexive reactions and think about whatever worth can be derived from the message than it is to carefully manage the emotions of varied readers whom you don't know. This is different from bring overtly inflammatory, although the lines for this are subjective.
In the two cases, the meaning of the message may be the same, but the tone of the message is different. One tone invites further engagement, the other invites disengagement.
Re: DrawAFish.com Postmortem
#109> I vibe coded... Well, there ya go. To be fair, it says the attention was unexpected, and this was just a coding exercise... And the port-mortem shows what I'd hope to see: digging in and figuring out root causes. So I'm not judging OP poorly over this. But still. Launching a vibe-coded app that accepts input from anonymous users is just asking for trouble. I'm frankly surprised it ran as long as it did without such…
Ultimately an app like this caused more joy than harm. I'm all for people vibe coding fun little things like this when the stakes are low. Would prefer to see more non coders with diverse ideas feeling empowered to start a project rather than them seeing a huge wall to climb and never starting. The web needs more silly apps from silly people.
I agree with you to a point. But that point comes when the silly app turns into a channel for hate speech. At that point, I'm not sure we can justify the claim that it caused more joy than harm.
Re: DrawAFish.com Postmortem
#110I read the HN thread first, and the first comment I saw from the author was about AI nazi symbol detector they put in... I wonder how many orders of magnitude that comment increased interest in making offensive fish? Later I saw images of the attacked site posted elsewhere and thought they were both predictable and hilarious.
A better group psychological approach might have been to only name the penis filter, ye. Then the transgressions are on the vandal who can't rationalize it is sticking it to the man, but that he is just that guy drawing swastikas.
Or don't even mention it at all-- it's just got a fish detection filter.
At least people trying to see if they can get around a fish detector are going to preferentially submit toilets and tires (and dicks, sure). :)