#84 residual: per-homeserver-domain fair-pending sub-cap

robocub commented

2026-07-11 16:51:02 +00:00

Collaborator

Follow-up to the #84 core (shipped alpha.18: global cross-MXID rate limiter + swept stamp maps). Residual: the global 16-slot PENDING_LINK_CAP can still be filled by a federated-MXID Sybil set sharing one homeserver, freezing honest onboarding. Fix: a per-source-homeserver-domain sub-cap under PENDING_LINK_CAP (extract domain from requester MXID), reserving headroom so no single origin domain occupies the whole table; expire idle-unapproved entries faster when near-full.

robocub referenced this issue

2026-07-11 16:51:31 +00:00

#79 findings 2+3 (HIGH): global cross-MXID rate limiting + fair pending-table admission #84

robocub referenced this issue from a commit

2026-07-11 17:22:14 +00:00

fix(mgmt,config): #87/#88/#89 open-registration hardening residuals

robocub commented

2026-07-11 17:50:13 +00:00

Author

Collaborator

Fixed + shipped in v0.3.0-alpha.19 (deployed 2026-07-11). A per-foreign-domain cap (PER_DOMAIN_PENDING_CAP=3) bounds how much of the shared 16-slot pending table one homeserver's users can hold. The home server is exempt — it is invite-gated (not a Sybil vector), and capping it would throttle legitimate concurrent onboarding. Hardcoded for now; promote to a [limits] knob later if a deployment needs tuning.

Fixed + shipped in **v0.3.0-alpha.19** (deployed 2026-07-11). A per-foreign-domain cap (`PER_DOMAIN_PENDING_CAP=3`) bounds how much of the shared 16-slot pending table one homeserver's users can hold. The home server is **exempt** — it is invite-gated (not a Sybil vector), and capping it would throttle legitimate concurrent onboarding. Hardcoded for now; promote to a `[limits]` knob later if a deployment needs tuning.

robocub closed this issue

2026-07-11 17:50:13 +00:00

Rows
Columns

#84 residual: per-homeserver-domain fair-pending sub-cap #88