Oh! I hadn't seen this. I was more inspired by the St Louis aquarium (where you color a fish and it swims) and Google's Quickdraw (a memory from like 2016)
That's actually intentional desgin - I think you can like a fish a little or like a fish a lot, and therefore should be able to upvote/downvote to your hearts content :)
The only potential risk I see with anonymous voting is some 4chaner is apt to create a bunch of fish with horrific names and use distributed IPs to upvote them to the top. I guess regular moderation could filter that out.
The first case would be an issue yes, although this app doesn't exactly strike me as something that an insane amount of people would be connecting to from corporate networks
It can work okay for apps that don't go to massive scale and where users aren't concentrated in the same place. The chance of another simultaneous user on your block/building/CGNAT isn't extremely likely.
Unfortunately got posted to some heinous websites... and I made the mistake of using a very simple username and password that's been leaked 100 times for my admin account. I was going to "change it later"...
Anyway, working on the rollback now. A nice guy from here reached out and reported some small vulns I involuntarily committed.
This is an issue that many are seeing, it has to do with how the model is loaded / how the submission logic works without it. I think I know the fix, but am currently getting slammed at my big boy job and so I can't fix it until I'm free in the evening ...
There is mobile support... but it currently loads a 40mb model which doesn't work so great in a lot of places where you will use a phone. I meant to allow you to submit anyway, but I didn't test enough. Sorry...
Actually most people aren't trying to submit bad fish! I was surprised to, it's really like 95/5 good to bad submissions. People seem to follow the rules on average :)
I don't let the client decide whether the submission needs moderation :)
There's a very slightly different model in the backend that sends things to the mod queue. Strings are also sanitized there. But copilot really wanted to add all that logic to the frontend too and I thought it was funny
Absolutely! I've removed all references of HTML and JS using string interpolation.
(jk)
This is definitely a drawback with with vibe-coding. I never really write like HTML5 style code - at work I always use typescript with heavy ESLint, so never have to worry about this.
I figured the string sanitization in the backend would take care of any XSS vulns, which was my main concern. But I will have to read into the dangers of string interpolation which I admit I do not remember too much about (outside of the XSS stuff I tried to mitigate).
