KasperiP / kiderat-desktop

🐀 Kiderat is a fully open-source bot for automating ticket reservations on Kide.app. With Kiderat, you can save time and effort by letting the bot handle the reservation process for you. Since Kiderat is open-source, you can customize the bot to suit your specific needs or contribute to the project's development.
https://www.kiderat.app
GNU General Public License v3.0
10 stars 2 forks source link

Bot is not actually open source #11

Closed AleksiVirkkala closed 1 year ago

AleksiVirkkala commented 1 year ago

I'm a bit annoyed that you advertise your bot as "fully open-source" while you use private api for x-requested-id.

And no I'm not jealous of the hidden code. It's here:

export function calculateXRequestedId(inventoryId: string): string {
    // Remove dashes from the inventory ID
    const strippedId = inventoryId.replace(/-/g, '');
    // An extra ID that will be XOR'd with the inventory ID
    const EXTRA_ID = '2ad64e4b26c84fbabba58181de76f7b0';

    // Initialize an empty string to store the final result
    let encodedString = '';

    // Loop through each character of the stripped inventory ID
    for (let i = 0; i < strippedId.length; i++) {
        // XOR the ASCII codes of the characters from strippedId and EXTRA_ID
        const xorResult = strippedId.charCodeAt(i) ^ EXTRA_ID.charCodeAt(i);

        // Append the character corresponding to the XOR result to the encoded string
        encodedString += String.fromCharCode(xorResult);
    }

    // Convert the encoded string to Base64 and return the first 10 characters
    return btoa(encodedString).substring(0, 10);
}
KasperiP commented 1 year ago

Indeed, that's true, and I was aware that the decision to do so was rather daring. I've now published the code. I had been anticipating someone to open an issue like this. Since this was the first time Kide took some steps to prevent botting, I believed it presented a valuable challenge for other developers to tackle the issue themselves, rather than resorting to mere copy-pasting solutions from other repositories, as it may not be truly beneficial for anyone.