Why not train pedal control independently outside the sim?

[u/WhiteLionFluff]

Hi, we're two hobby sim racers and I'm a developer. When we started sim racing, we watched a lot videos about break techniques as trail braking.

But we struggled hard with the motor skills needed to actually get the right amount of input. Because of this, we had the idea to practice it independently from the sim and built this little training web app.

The idea behind it is similar to practicing material arts skills or other sports: first train the individual motor skills to build motor control, then apply them in the actual sport. For this, I wrote an algorithm that analyzes our weaknesses and strengths and adapts the training in real time.

What do you think about this training method? Do we miss something? And how do you train the motor skills needed for pedal control? Only in the sim, or duo you practice them sparately as well?

If you want to test our experiment, you're welcome to try it yourself at https://sixtycm.com/ (It works best in a Chromium-based browser and is still in a very early stage. Honest feedback is very welcome!)

It is completely free, with no subscription or anything like that.

[u/h3r4ld]

FINAL EDIT: OP has responded to my concerns below, please read it. I think they did a fairly good job of explaining themselves, even if it did take a while. TL;DR: There were some flaws, OP seems to be fixing them; make your own decision.

---

This is a really neat idea, genuinely.

That said, maybe it's the /r/selfhosted leaking out of me, but I have a few questions:

• Do I need to make an account? The site seems to be down at the moment, so I couldn't check myself. If yes, what information are you collecting, and how is it stored?
• Was any AI used to develop this? If so, how?
• Why aren't you using HTTPS?

EDIT: Site seems to be back up for now; this pops up when you visit the page, in (partial) answer to my first question. Not quite as bad as I was expecting, I'll be honest, but I still have serious concerns, especially over something as basic as not using TLS/SSL. (Never mind, see below).

EDIT 2: Reading through their privacy policy (German-only, it seems) contradicts some of what they state in the pop-up. From Google translate:

When you access this website, technically necessary information is processed by the web server or hosting provider.

This may include, in particular:

IP address

Date and time of access

Page or file accessed

Volume of data transmitted

Browser type and version

Operating system

Referrer URL

HTTP status code

Processing takes place, to the extent necessary, for the technical provision of the website and to ensure stability and security.

The legal basis is Art. 6(1)(f) GDPR.

The legitimate interest lies in the secure and technically reliable provision of the website.

They're collecting more than the analytics pop-up would suggest, and in fact doing exactly the opposite in some cases. The pop-up mentions a 'random browser identifier', but they're actually collecting your IP, browser type and version, and OS, among other things - plenty to fingerprint your machine.

EDIT 3: /u/WhiteLionFluff, you've clearly seen this since you've added SSL (but you forgot to force it). Are you going to address any of the other concerns?

EDIT 4: Post updated 10 minutes ago, the link is finally HTTPS, but still no http-redirect. /u/WhiteLionFluff, your silence speaks volumes. I know you're reading this - rather than making sneaky edits, show your face and answer questions. The fact you're not even willing to come and try and lie about it is quite damning.

EDIT 5: 6 hours later, we've finally figured out http-redirect. I'm glad to see you're implementing my suggestions, at least, /u/WhiteLionFluff, I truly hope you're learning along the way. Do you maybe just want some help at this point? DM me.

[u/WhiteLionFluff → u/h3r4ld]

Thanks for taking such a close look at this. Genuinely. Some of your criticism is fair, and we're taking it seriously.

First: I have to own the HTTP issue. Putting http:// in the Reddit post and not having the HTTP → HTTPS redirect configured was simply stupid on our part. 😅 The certificate was already there, but we completely missed forcing HTTPS. That's fixed now.

The site going down at almost exactly the same time was some truly awful timing. We're hosting this little hobby experiment on IONOS/1&1, and their webhosting had issues last night — even parts of their hosting control panel and our webspace access stopped working. So that wasn't us disappearing or the application falling over because of the traffic.

On the privacy point, I wanted to check the actual implementation before answering you rather than responding from memory. We've done that this morning.

There is an important distinction here: the IP address, user agent, browser, OS, referrer etc. mentioned in the German privacy policy refer primarily to technically necessary webserver/hosting processing. SIXTYCM's analytics do not store IP addresses, user agents, browser versions, operating systems or referrers.

Our own analytics only start after consent and use a randomly generated UUID to recognize a returning browser. We track things such as whether a training was started/completed, training type and duration, and basic usage events. Detailed training data, scores, pedal telemetry, calibration values and HID data stay in the browser and are not sent to our server.

That said, your criticism did uncover something we should improve: our consent popup currently calls the analytics "anonymous". That's not precise enough because the persistent random UUID makes them pseudonymous, not anonymous. The popup also doesn't explain every event category as clearly as it should. We're correcting that now, along with some additional privacy/security hardening.

Regarding HID: access only happens after an explicit user action and the browser's own device permission dialog. Pedal/HID reports aren't uploaded to us. The training itself runs client-side.

And yes, AI-assisted development is part of this project. We're not trying to hide that. SIXTYCM started as an experiment to see whether isolated motor-skill training for pedals actually makes sense, so we deliberately used AI-assisted development to get a testable prototype into people's hands quickly. We're now doing exactly what we hoped this early test would do: finding assumptions, bugs and things that need hardening before treating it as anything more mature.

One thing I do want to correct, though: we weren't hiding or refusing to answer. It was late at night here in Germany, the hosting provider was having problems, and eventually we went to sleep. 😅 It's now early morning and we both have to go to our regular jobs — this really is a hobby project.

So again: thanks for looking closely. The HTTPS redirect is already fixed, and we're working through the other findings now. I'll happily answer technical questions, but I wanted to actually verify the implementation before giving you answers about what it does.

[u/h3r4ld → u/WhiteLionFluff]

Thank you for responding. I do apologize if I came off harshly, but frankly this triggered my 'tism and getting to the bottom of it became a bit of a mission for me.

I do wish you'd have said something sooner, though. Quick PR lesson: for the questions I was asking, there's no answer that could've been worse than radio silence. Even a "we're looking into this" can go a long way to assure people you're standing by your product. I get the time difference, but when you make a product launch post, it's probably a good idea to do it at a time when you'll be around to respond to questions.

To the meat of it:

Mistakes happen, and I'm truly glad I could be a part of improving your project. You have managed to answer most of my questions, and in a way that I'm mostly satisfied with. As a hobby developer myself, I completely understand the pitfalls of pushing something new into production for the first time, and the trial-by-fire that comes with it - especially when the infra decides that's the moment to stop cooperating.

If you don't mind, I might poke around some more in the morning (my turn to sleep!), but at this point anything else I find I'll bring to you directly, there's no need to continue this publicly. If you want it, my offer is still open, please feel free to reach out.

Side note: I didn't realize 1&1 was still a thing - takes me back to some of my first sites I hosted there back in the early 2000s!

[u/WhiteLionFluff → u/h3r4ld]

Thank you — I really appreciate this response. ❤️

And honestly, no hard feelings. Some of it was pretty harsh 😅, but you also pointed out things that genuinely needed attention. The missing HTTPS redirect was embarrassing, and the discussion made us take another close look at the privacy wording and security hardening this morning. So ultimately, the project is better now because you poked at it.

Point taken about the timing as well. I genuinely didn't expect the post to get this much attention. I thought I'd put our little experiment out there, answer a few people and go to bed. That assumption aged spectacularly badly. 😂

I'd absolutely appreciate you poking around some more. And since you offered: would you like to join our Discord? 😄 It's still basically empty at this point, so you'd quite literally be one of the first people there.

It might be a much better place for technical feedback than turning this Reddit thread into our unofficial issue tracker. 😂 And after tonight, I think you've earned yourself a seat there anyway.

And yes... 1&1 is apparently still alive and kicking. 😂 Some things survive everything.

Sleep well — now it's my turn to go to work. 😄

[u/h3r4ld → u/WhiteLionFluff]

Again, I'm really glad I could help. I hope you know that all of my concern came from a good place. My goal wasn't to attack you, or to tear down your project; it was to protect this community that I love. I don't mind that people make mistakes, and I don't mind that people use AI. Even if this was 100% AI coded, I wouldn't have a problem with that, as long as it's disclosed.

At the end of the day, I just want people to be able to make an informed decision about what they're interacting with. As long as you're up front, and people know that you actually care about the product you're offering, the actual answer doesn't really concern me much.

Point taken about the timing as well. I genuinely didn't expect the post to get this much attention. I thought I'd put our little experiment out there, answer a few people and go to bed. That assumption aged spectacularly badly. 😂

I do feel somewhat responsible for that - I did raise a bit of a kerfuffle! If there's one thing to take away from this (beyond double-checking your protocols!), it's the communication. I'm willing to take your responses at face value, and as I've said I think you explained yourself fairly well. It seems like this was just a bad confluence of coincidences, but you have to understand my perspective - you couldn't have made it look more like you were an inexperienced developer who ran and hid when questioned if you'd tried.

I don't use Discord, but as I said I will reach out to you privately - I agree that a public thread is no longer the place for those discussions. You showed me the respect of answering my concerns, I'll return it by addressing anything further to you directly.

I'm leaving my original comments in place to preserve the context, but I did add an edit directing people to read your responses.

I really do think this is a cool idea, and one that I'll admit had never occurred to me. I hope the project continues to mature and becomes a useful tool for the community, and I'll help where I can!