Refresh Users much more aggressively when processing Move activities #714

Merged
floatingghost merged 1 commit from erincandescent/akkoma:move-bust-cache into develop 2024-04-03 10:03:15 +00:00
Contributor

The default refresh interval of 1 day is woefully inadequate here;
users expect to be able to add the alias to their new account and
press the move button on their old account and have it work.

This allows callers to specify a maximum age before a refetch is
triggered. We set that to 5s for the move code, as a nice compromise
between Making Things Work and ensuring that this can't be used
to hammer a remote server

The default refresh interval of 1 day is woefully inadequate here; users expect to be able to add the alias to their new account and press the move button on their old account and have it work. This allows callers to specify a maximum age before a refetch is triggered. We set that to 5s for the move code, as a nice compromise between Making Things Work and ensuring that this can't be used to hammer a remote server
erincandescent added 1 commit 2024-02-29 20:41:56 +00:00
Refresh Users much more aggressively when processing Move activities
Some checks failed
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline failed
ci/woodpecker/pr/build-arm64 unknown status
ci/woodpecker/pr/build-amd64 unknown status
ci/woodpecker/pr/docs unknown status
f18e2ba42c
The default refresh interval of 1 day is woefully inadequate here;
users expect to be able to add the alias to their new account and
press the move button on their old account and have it work.

This allows callers to specify a maximum age before a refetch is
triggered. We set that to 5s for the move code, as a nice compromise
between Making Things Work and ensuring that this can't be used
to hammer a remote server
Author
Contributor

This one is currently marinating on akko.erincandescent.net to see if we have any issues, but its a minor change so I don't expect any

This one is currently marinating on `akko.erincandescent.net` to see if we have any issues, but its a minor change so I don't expect any
Author
Contributor

(I debated a bit whether we should just bypass cache entirely here, what do you think?)

(I debated a bit whether we should just bypass cache entirely here, what do you think?)

it's probably good to use the cache in some capacity here since otherwise it would just become a dos vector which isn't amazing

5s should be fine i guess? i hope

it's probably good to use the cache in some capacity here since otherwise it would just become a dos vector which isn't amazing 5s should be fine i guess? i hope
Author
Contributor

Yeah, theoretically someone could make us refresh a profile 720 times an hour by spamming Moves at us, but in the grand scheme of things they could also make any AP impl try and fetch random objects by spamming Announces at it so this feels moderately academic

But doing some caching at least keeps things from becoming stupid

Yeah, theoretically someone could make us refresh a profile 720 times an hour by spamming Moves at us, but in the grand scheme of things they could also make any AP impl try and fetch random objects by spamming Announces at it so this feels moderately academic But doing some caching at least keeps things from becoming stupid
First-time contributor

FWIW this bug currently causes users to lose their followers from akkoma instances fairly often, since posting about it, i've seen at least 3 mutuals lose some of their followers because of this.

A DoS would only get 0.2 req/s on the target instance, I concur with erin that the concern is purely academical.

FWIW this bug currently causes users to lose their followers from akkoma instances fairly often, since [posting about it](https://tech.lgbt/@ShadowJonathan/111999825642948194), i've seen at least 3 mutuals lose some of their followers because of this. A DoS would only get 0.2 req/s on the target instance, I concur with erin that the concern is purely academical.
Author
Contributor

I haven't noticed any issues arising out of this one over the past month 👍

I haven't noticed any issues arising out of this one over the past month 👍

all good, thank you very much!

all good, thank you very much!
floatingghost merged commit 554f19a9ed into develop 2024-04-03 10:03:15 +00:00
floatingghost deleted branch move-bust-cache 2024-04-03 10:03:15 +00:00
Sign in to join this conversation.
No description provided.