Rate limit can be avoided using JS

[DeadPackets]

Anyone can pet with a ridiculous speed using the following JS:

window.setInterval(function(){ pet() }, 80)

[ineffyble]

Hey, yeah, it's not perfect, although there's some server-side limitations (in terms of max quantity of pets per POST (rejected if too large), and in terms of maximum number of requests per 5 minute window (throttled by rack-attack).

Definitely more to be done though.

[DeadPackets]

Hmm, you could fix part of the issue by uglifying the client side JS or at least making it a bit hard to read.

[ineffyble]

Plan when I find time to improve things is switch to WebSockets and probably a ReactJS front-end. Which would definitely have an obfuscation advantage.

[Qwertie-]

How will you obfuscate the code when its open source anyway. Even if you couldn't work out which function to call you could just watch the network tab to see whats going on.