Massive DDOS happening to revolt servers

[JamesTDG]

In the official main server, someone, or more likely a group of people are running a script that is constantly pinging users, and it is lagging the main server so damn much, need this resolved so bad cause the pinging noise is agitating and is also causing my client to struggle bad, REAL BAD.

[Hikariin]

To add to this, the way reloading is handled and the "reconnecting" box massively needs fixed so that the client is at least usable in a basic manner when stupid shit like this is happening. (hell, this could likely even just apply for poor connections with loss/dropouts)

Reconnecting box needs to either be sized consistently between all messages, or it needs to be moved to another location as to not make the channel list unclickable when in a "reconnecting" loop.

Chat and user lists need to store a local cache in order to not constantly go to the reloading circle and back when in a reloading loop.

[amycatgirl]

This is not a client issue, as the websocket was overloaded (As @ToastXC#0429 pointed out in the #Looking for Group channel) so clients could not connect reliably without dropping the connection.

And I am not sure about what you mean with "Reconnecting box needs to either be sized consistently between all messages, or it needs to be moved to another location as to not make the channel list unclickable when in a "reconnecting" loop.", you can still click channels while you are being reconnected to the websocket.

Chat and user lists need to store a local cache in order to not constantly go to the reloading circle and back when in a reloading loop.

Revolt.js (Which is what the client uses internally) already caches messages, users, members, servers and channels in memory, so I am also not sure how this would help avoid this issue.

[Hikariin]

And I am not sure about what you mean with "Reconnecting box needs to either be sized consistently between all messages, or it needs to be moved to another location as to not make the channel list unclickable when in a "reconnecting" loop.", you can still click channels while you are being reconnected to the websocket.

When it does this, it will constantly flash back and forth between "disconnected" (with the reconnect box), and "reconnecting", which constantly moves the channel list an makes things a royal pain to click

Revolt.js (Which is what the client uses internally) already caches messages, users, members, servers and channels in memory, so I am also not sure how this would help avoid this issue.

To fix this one, you need to not hide all cached content on disconnect then (or whatever exactly is happening here) | it also comes with the side-effect of never properly reloading the user list

Gif for example of both: https://i.imgur.com/u9qWr1M.gif

[amycatgirl]

Oh, I see.

So you mean that the connection status box (The one on the channel list) should have a consistent size? Also, the members list and the message view are both flashing in and out because, when the socket connects (receives a Ready event), messages and members get re-fetched to not display outdated (in-cache) information.

One solution would be refetching the messages in the background then only appending the new messages to the view, but that could have the side effect of having duplicate messages. Another would be only notifying the user (via a modal) that they've been disconnected from the socket, but that would be disruptive and really annoying in cases like this...

I think that there needs to be an issue to track this, preferably on revoltchat/frontend, because that's something that hinders UX.

[mitachibana]

Owner of the server ReVoYo here. We have set our server to read only. We were attacked directly yesterday but managed to close everything up and kick out the bad actor. Can confirm that the bad actor enters servers and harvests channelids and userids. We then counted about 200 bots sending mass pings on short intervals which makes the client unstable.

We found that by leaving afflicted servers, one can make their client stable again. For the time being our admin crew has left all major servers. This has prevented the pings from affecting us and the client is stable enough to communicate and manage our server.

Went scouting around other servers and it seems that some less active, smaller servers are also being attacked. Until something is done, all of this will put significant load on Revolt's backend.

I am no expert programmer, so I do not know how the vulnerability can be patched but maybe allowing automod to ban and kick would be good. We wanted to set automod to auto ban any user that posts 5 or more messages within 1 second, but it seems that automod cannot issue a ban in this way.

In any case, it might be a good idea to shut things down and post a maintenance message to give the dev team some time and space to figure this out. Godspeed. If any other info is required or any assistance needed, reach out to me at mitachibana#1667

[Rexogamer]

We are aware of the recent attacks and are taking steps to improve our platform-level anti-spam capabilities - thank you for your patience, and our sincere apologies for this.

[toastxc]

As mentioned here by Insert solutions are underway, this issue will hopefully go away or at least be more manageable in future.