The latest articles on DEV Community by Eva (@ewasion). https://dev.to/ewasion https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F33122%2F0e22a084-af42-4399-a88f-a74090052db8.png https://dev.to/ewasion en Eva Wed, 13 Sep 2017 08:11:54 +0000 https://dev.to/ewasion/the-day-i-broke-gabai https://dev.to/ewasion/the-day-i-broke-gabai <h2> Intro </h2> <p>As a social network, <a href="https://gab.ai">Gab</a> is trash... but a great way to learn from other people's mistakes, and that's what this post is all about!<br> They have a JSON API (only used internally, they don't talk about it anywhere) for basically everything, and most things are not rate limited.<br> Obviously, I wanted to see what I can do.</p> <h2> The beginning </h2> <p>Once I wrote PHP functions for everything the API had to offer, I made a simple bot that would take the messages people sent, passed them through Cleverbot and posted the answer...<br> Until it wasn't working anymore, my IP was blocked from viewing my notifications. Forever.<br> I thought about all the bot accounts that followed me as soon as I created my account. They probably don't limit when you follow people!<br> And turns out they don't. And looking at your timeline isn't limited. My plan: Follow every single user and look at my timeline to see if anyone mentioned the bot.</p> <h2> The mess </h2> <p>I set it up so my bot follows about 100 users every 5 minutes, I looked at my follow count from time to time then went to bed.<br> 2 March 2017, Gab is having trouble loading, other people are starting to report the problems, I just think they are getting ddossed by some skid.<br> The next day, everyone was getting 502 or 504 errors, meaning we could not message <a href="https://gab.ai/support">@support</a> to ask what was going on.</p> <h2> The aftermath </h2> <p>After a week or so, everything was back to normal.<br> I went to tweak some things on my bot, but the account disappeared, that's when I realised I was probably the cause of this.<br> It followed 145k accounts at a slow pace, and all it was doing was check its timeline like a normal user would.</p> <p><strong>Lessons learned: check if your whole website can be killed by simply following a lot of people, limit your API even if you think you will be the only one using it.</strong></p> <p><em>Note: This can still be done, it doesn't look like they fixed anything.</em></p> gab social media network