3 ms·
stonks.click – You click. Stonks go up.
- gus_massa 6y agoDid you made it? What is the tech stack? Any interesting problem making it? Does usernames with non ascii characters cause problems? Did your server collapse under the load yet?
- jbesomi 6y agoYes, I made it. The primary goal was to learn how to make a real-site that can also scale. Yes, there were a few interesting problems, especially how to make it support a large load; the solution has been to use socket.io and Redis. I'm thinking about writing a blog post about it. I'm validating all usernames, for now I don't have problems caused by ASCII characters. For now the website is supporting well the loads. client and server communicate via websockets (using socket.io), and this drastically reduce requests. Moreover, I'm using NGINX as a load balancer to further improved the load support.
- grzracz 6y agoAre you expecting people not to try and crack the site if you just tell them not to? lol
- jbesomi 6y agoGood observation; should I remove it? I'm also learning that's hard to detect click bots, one approach might be to identify all clicks with the same frequency, but that's can be easily bypassed by using writing a bot that click the button with random intervals.
- grzracz 6y agoA smart way of going about it would be to just implement ratelimits based on human ability of clicking a mouse button - I'm sure no human is able to click a button 100 times a second. And of course ban people that are consistently at the gates of the ratelimit.
- gus_massa 6y agoIt's very Cookie Clicker like https://orteil.dashnet.org/cookieclicker/ https://orteil.dashnet.org/cookieclicker/ so I was expecting to see an upgrade to buy an autoclicker. Reading that bots are not allowed, made it clear that it was a very different game.
- jbesomi 6y agodidn't know about Cookie Clicker; that's a nice one too. Yeah, idea would be to have only real clicks ...
- grzracz 6y agowell unless you'll make people record themselves clicking it's impossible to do - even if you are completely able to detect the software, people can still exploit the system by building additional hardware. if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible
- jbesomi 6y ago> if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible Sounds like a good proposal! Will think about that. How hard do you think would be for users to change the IP address and bypass this idea?
- gus_massa 6y agoIn spite of perfect detections of fake clicks is impossible, at lest trying to detect and filter them is a nice problem. I don't expect advanced solutions against your site. It's not a bank, nobody would get a huge profit with fake clicks. You need to fight against script kiddies, not specialized hardware. So I guess some easy heuristic to detect people that clicks too fast or do not sleep for a week will be enough.
- 6y ago