onepub-dev / onepub-dev/reVault
could our key servers be used to dos someone.
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 4
- Forks
- 0
- Avg merge
- 1h 55m
- Merged PRs (30d)
- 1
Description
When you publish a public key you enter an email address.
You can enter anyone's email address which means that you could use are servers to send emails.
The problem is possibly exacerbated when we start running upto 32 servers. Whilst we have rate limiting on the servers it is per server.
This means that if our rate limit is 5 per hour (the default) an abuse could send 5*32 per hour.
How do we stop this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests; start by locating the public-key publication flow and the existing per-server rate-limiting logic. Define how abuse prevention should work across up to 32 servers, then verify that the chosen limit cannot be bypassed by distributing requests between servers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- distributed-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100