5 ms·

Are you expecting people not to try and crack the site if you just tell them not to? lol

jbesomi 6y ago
Good observation; should I remove it? I'm also learning that's hard to detect click bots, one approach might be to identify all clicks with the same frequency, but that's can be easily bypassed by using writing a bot that click the button with random intervals.
- grzracz 6y ago
  A smart way of going about it would be to just implement ratelimits based on human ability of clicking a mouse button - I'm sure no human is able to click a button 100 times a second. And of course ban people that are consistently at the gates of the ratelimit.
  - jbesomi 6y ago
    Thank you. That's what I will do (and write a blog post about it)
    - jbesomi 6y ago
      I got to think a bit more on that ... and: what about doing the complete opposite? i.e to encourage automatic clicks with the final goal of making stonks go even more up?
gus_massa 6y ago
It's very Cookie Clicker like https://orteil.dashnet.org/cookieclicker/ https://orteil.dashnet.org/cookieclicker/ so I was expecting to see an upgrade to buy an autoclicker. Reading that bots are not allowed, made it clear that it was a very different game.
- jbesomi 6y ago
  didn't know about Cookie Clicker; that's a nice one too. Yeah, idea would be to have only real clicks ...
  - grzracz 6y ago
    well unless you'll make people record themselves clicking it's impossible to do - even if you are completely able to detect the software, people can still exploit the system by building additional hardware. if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible
    - jbesomi 6y ago
      > if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible Sounds like a good proposal! Will think about that. How hard do you think would be for users to change the IP address and bypass this idea?
      - gus_massa 6y ago
        In spite of perfect detections of fake clicks is impossible, at lest trying to detect and filter them is a nice problem. I don't expect advanced solutions against your site. It's not a bank, nobody would get a huge profit with fake clicks. You need to fight against script kiddies, not specialized hardware. So I guess some easy heuristic to detect people that clicks too fast or do not sleep for a week will be enough.
        jbesomi 6y ago
        Indeed. Thanks for advice. I will implement it. I will first work on a throtting system will and a way to detect programmed clicks. This should already drastically reduce spam.
        6y ago

Good observation; should I remove it? I'm also learning that's hard to detect click bots, one approach might be to identify all clicks with the same frequency, but that's can be easily bypassed by using writing a bot that click the button with random intervals.

grzracz 6y ago
A smart way of going about it would be to just implement ratelimits based on human ability of clicking a mouse button - I'm sure no human is able to click a button 100 times a second. And of course ban people that are consistently at the gates of the ratelimit.
- jbesomi 6y ago
  Thank you. That's what I will do (and write a blog post about it)
  - jbesomi 6y ago
    I got to think a bit more on that ... and: what about doing the complete opposite? i.e to encourage automatic clicks with the final goal of making stonks go even more up?

gus_massa 6y ago

It's very Cookie Clicker like https://orteil.dashnet.org/cookieclicker/ https://orteil.dashnet.org/cookieclicker/ so I was expecting to see an upgrade to buy an autoclicker. Reading that bots are not allowed, made it clear that it was a very different game.

jbesomi 6y ago
didn't know about Cookie Clicker; that's a nice one too. Yeah, idea would be to have only real clicks ...
- grzracz 6y ago
  well unless you'll make people record themselves clicking it's impossible to do - even if you are completely able to detect the software, people can still exploit the system by building additional hardware. if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible
  - jbesomi 6y ago
    > if you want only real clicks, you could just limit the clicks to 1/ip address and then have only country ranking visible Sounds like a good proposal! Will think about that. How hard do you think would be for users to change the IP address and bypass this idea?
    - gus_massa 6y ago
      In spite of perfect detections of fake clicks is impossible, at lest trying to detect and filter them is a nice problem. I don't expect advanced solutions against your site. It's not a bank, nobody would get a huge profit with fake clicks. You need to fight against script kiddies, not specialized hardware. So I guess some easy heuristic to detect people that clicks too fast or do not sleep for a week will be enough.
      - jbesomi 6y ago
        Indeed. Thanks for advice. I will implement it. I will first work on a throtting system will and a way to detect programmed clicks. This should already drastically reduce spam.
        6y ago