- Mar 7, 2019
- 1,318
- 1,121
This is precisely how it was until last month. This program singlehandedly caused multiple downtimes for f95zone. It's basically a DDOS. Now it isn't anymore.I suppose it may be counter intuitive in the sense of reducing load on the forums but is this something that would we ever be able to run locally rather than relying on another party for?
If you mean self hosting your own cache api, technically nothing is stopping you, it's open source and even in the same repository. Only dependency is redis and the xf_user cookie in the env file. But of course this defeats the whole purpose, as we go back to multiple people fetching data from f95zone with the same objective and in the same way for no reason. Also, Sam helped me out by disabling some rate limits on latest updates and the version check api, so you wouldn't be able to run the indexer api as it is (mostly just changing the version check api limit from 1000 to 100), and would encounter some rate limits when getting precise data from latest updates if more than a certain amount of requests in an hour.
The idea is that Sam has some more lenient rate limits for my cache api and that it's the only one, so on its own it's more stressful on the server than 1 single f95checker user in the past, but means that it's only this one thing, not thousands of users all doing it at the same time.
Secondly, if we're receieving cached data from your cache server and comparing it with ours, why does the program require signing in? This seems redundant, I personally don't care about the notifications from this program, telling me someone replied to a thread, etc. That could be done away with, it has no impact on the purpose of this software for me which is keeping track of games and that's it.
As stated in the changelog and readme, this is no longer the case. It can be used fully without an account, and it is so by default as notification checking is disabled for new users from now on.So I guess my question is if we're receiving cached data from your server, is there any plans to be able to remove our account from this program and keep it focused on it's main task which from what I can see, requires no account at all.
The limitation is mostly download links. To prevent links being taken down, I obviously cannot include naked download links in the cache api. It only includes an indication of where to find the download link in the thread, which then the checker on your machine will retrieve from the f95zone thread, which of course requires an account. This is true for regular, masked, and donor ddl links. Rpdl torrents require their own account, but not an f95zone account.
You can see in modules/api.py that both fast_check() and full_check(), which are the only methods connecting to my api, use cookies=False.Worst case scenario would be we're passing our account info onto your cached servers and you have a copy of it... obviously this could be checked by going through the source code. It wouldn't be the first time someone has done something malicious despite it being available in open source code, after all someone has to go looking for it in order to find it. I'm not saying you're doing that, I'm just highlighting an example for others.
Last edited: