Hacker News Reader

Someone hacked it. People go to great lengths to vandalize

It seems you are letting any client with a session token update the entire wall. The endpoint simply takes the base64 PNG and sets it as the wall.

I was thinking maybe taking a diff, limiting its maximum area, and rate-limiting might at least discourage that.

Thanks for the heads-up. You’re absolutely right! Rate-limiting could help, but it would make quick strokes difficult, so I decided against it.

I’ve already implemented a few measures, but I’d rather not share the details publicly.

No more Trump