Help!
Today a user discovered that you can do @all in discourse chat. At first it was like a joke, but a lot of users were actually getting pinged, including me I saw pings coming from the channel even though nobody pinged me
Is there a quick mitigation of this possible a lot of users are spamming help.
Plus I can’t mute people in the chat because of the other bug I discovered 
We’ll take a look. In the meantime you may want to disable chat on your site for now.
Thank you I am disabling chat right now until this gets fixed
I also recommend you set SiteSetting.chat_auto_silence_from_flags_duration to 1 day and flag offenders.
Yes: suspend them for a period of time for abuse
I have already done that, and disabled chat.
Yes, I wanted to do this setting, but currently there is a bug with silencing as well:
It’s available to everyone as a per-user setting, so it’d be good to let folks know about it.
Still, in your case, silencing and/or suspending the user is the right thing to do.
I think the way forward here is to for us to next get the silencing but fixed (we have it pretty high on our list already)
I think those mitigations should go along way, so that’s what we’d like to focus on first.
Beyond that, I think it’s worth considering having an option to disable @all or @here globally, or per-channel. But we haven’t made a decision on that quite yet.
There is also something on our list to ensure the existing max users notified per group mention applies in chat (it doesn’t currently). And maybe @all and @here should be subjected to the same limits.
Oh ok cool rn I made it so TL1 and above can talk in chat and it’s working pretty well since the higher trust level offenders were already temp suspended
Any update on this I think it would be good if they just had an option to disable it globally
We are planning to make this a per-channel option in the not too distant future, but we haven’t started that yet.
We now have a per-channel setting to disable @all and @here via his PR from @j.jaffeux
You’ve got this totally backwards. Enabling @all should be opt-in. Having it be enabled by default is madness.
And disable it on this site ASAP! I’ve never even used chat on this site and I got an email notifying me of someone using @all. I’m astounded you thought this was acceptable to enable by default.
I am genuinely sorry about that. There should be a couple of safety guards in place to make sure that didn’t happen, and I’m afraid something has gone awry somewhere. I apologise most profusely. 
We’re looking into it now, and hopefully will have more information shortly.
The good news is that this has been fixed. 
There had been a regression where the channel-wide onsite notifications had been correctly suppressed but the email versions were still sent out. That has been resolved now, and there should be no more issues. 
I apologise again to anyone who received that email.
