A hundred phones in one pub share one exit IP, so half our rate limiters are not keyed on it

Try this: curl -s https://pub-trivia.app/robots.txt | grep too-many # Disallow: /too-many-requests curl -s https://pub-trivia.app/too-many-requests | grep -o ' ]*>' # A rate limit page that is disallowed in robots.txt and carries a noindex tag. Both, for reasons I will come to, and the second one matters more than the first. We build quiz software for pubs. The rate limiting story in a normal web app is "key on the IP, pick a number, move on". That advice is wrong for us in a way that took a production incident to see properly, because the defining fact about our traffic is that a hundred peop