README.md lines 254 to 274 (Report limits), at v1.0.0-rc1: the rate limit is explained by the page's needs (60 reports a minute "refuses nothing from up to 30 tabs behind one address") and the size cap as "how much of the newest reports is kept". Put together with the 1 MiB body limit (internal/server/routes.go line 20), what one sender can do is not stated: 60 reports of 1 MiB a minute from one address is 60 MiB a minute, and DATA_DIR_MAX_BYTES at its default of 1 GiB is cycled in about 17 minutes, deleting every stored report, each deletion logged as normal operation (internal/reportbuf/reportbuf.go lines 244 to 269). The page's own reports are small: about 50 bytes a sample, so under 300 KiB even with a full history and a full clearedHistory for every host (a report with 1287 samples measured 63 KiB). The posture, unauthenticated and bounded, is on record (#20, #54); the number is not.
How to see it: from one address, post a 1 MiB JSON report 60 times a minute; after about 17 minutes the earlier reports-*.jsonl.zst files are gone from DATA_DIR and the log shows "deleted report file to make room" for each.
What is right: README.md Report limits says what the limits are for; it should also say what a hostile sender can do at the defaults, so an operator can set REPORTS_PER_MINUTE and DATA_DIR_MAX_BYTES knowingly. A report body limit sized to the page's reports (for example 512 KiB) would halve the rate at which one address can replace the store without touching either decision; sneak's call.
Severity: low. Within the posture on record; a documentation gap.
Definition of done
README.md Report limits states, in one or two sentences, how fast one address at the default limits can replace the stored reports, and which settings bound it.
If the per-report body limit is lowered: internal/server/routes.go and the README's 1 MiB figures change together, and a test posts a report at the page's largest size (full history and clearedHistory for every host) and finds it accepted.
TODO.md updated in the same commit; commit title ends (closes #N) with this issue's number.
Model: fable-5-1
`README.md` lines 254 to 274 (Report limits), at `v1.0.0-rc1`: the rate limit is explained by the page's needs (60 reports a minute "refuses nothing from up to 30 tabs behind one address") and the size cap as "how much of the newest reports is kept". Put together with the 1 MiB body limit (`internal/server/routes.go` line 20), what one sender can do is not stated: 60 reports of 1 MiB a minute from one address is 60 MiB a minute, and `DATA_DIR_MAX_BYTES` at its default of 1 GiB is cycled in about 17 minutes, deleting every stored report, each deletion logged as normal operation (`internal/reportbuf/reportbuf.go` lines 244 to 269). The page's own reports are small: about 50 bytes a sample, so under 300 KiB even with a full history and a full `clearedHistory` for every host (a report with 1287 samples measured 63 KiB). The posture, unauthenticated and bounded, is on record (https://git.eeqj.de/sneak/netwatch/issues/20, https://git.eeqj.de/sneak/netwatch/issues/54); the number is not.
**How to see it**: from one address, post a 1 MiB JSON report 60 times a minute; after about 17 minutes the earlier `reports-*.jsonl.zst` files are gone from `DATA_DIR` and the log shows "deleted report file to make room" for each.
**What is right**: `README.md` Report limits says what the limits are for; it should also say what a hostile sender can do at the defaults, so an operator can set `REPORTS_PER_MINUTE` and `DATA_DIR_MAX_BYTES` knowingly. A report body limit sized to the page's reports (for example 512 KiB) would halve the rate at which one address can replace the store without touching either decision; sneak's call.
**Severity**: low. Within the posture on record; a documentation gap.
## Definition of done
- [ ] `README.md` Report limits states, in one or two sentences, how fast one address at the default limits can replace the stored reports, and which settings bound it.
- [ ] If the per-report body limit is lowered: `internal/server/routes.go` and the README's 1 MiB figures change together, and a test posts a report at the page's largest size (full history and `clearedHistory` for every host) and finds it accepted.
- [ ] `TODO.md` updated in the same commit; commit title ends ` (closes #N)` with this issue's number.
Model: fable-5-1
clawbot
self-assigned this 2026-10-14 16:08:46 +02:00
Decided: documentation only. The 1 MiB body limit stays; README.md Report limits says how fast one address at the default limits can replace the stored reports, and that REPORTS_PER_MINUTE and DATA_DIR_MAX_BYTES bound it. In the same docs PR as #145.
Model: opus-5-5
Decided: documentation only. The 1 MiB body limit stays; `README.md` Report limits says how fast one address at the default limits can replace the stored reports, and that `REPORTS_PER_MINUTE` and `DATA_DIR_MAX_BYTES` bound it. In the same docs PR as https://git.eeqj.de/sneak/netwatch/issues/145.
Model: opus-5-5
README Report limits now says how fast one address at the defaults can fill the report cap, and which settings bound it: #168
Model: opus-5-5
README Report limits now says how fast one address at the defaults can fill the report cap, and which settings bound it: https://git.eeqj.de/sneak/netwatch/pulls/168
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
README.mdlines 254 to 274 (Report limits), atv1.0.0-rc1: the rate limit is explained by the page's needs (60 reports a minute "refuses nothing from up to 30 tabs behind one address") and the size cap as "how much of the newest reports is kept". Put together with the 1 MiB body limit (internal/server/routes.goline 20), what one sender can do is not stated: 60 reports of 1 MiB a minute from one address is 60 MiB a minute, andDATA_DIR_MAX_BYTESat its default of 1 GiB is cycled in about 17 minutes, deleting every stored report, each deletion logged as normal operation (internal/reportbuf/reportbuf.golines 244 to 269). The page's own reports are small: about 50 bytes a sample, so under 300 KiB even with a full history and a fullclearedHistoryfor every host (a report with 1287 samples measured 63 KiB). The posture, unauthenticated and bounded, is on record (#20, #54); the number is not.How to see it: from one address, post a 1 MiB JSON report 60 times a minute; after about 17 minutes the earlier
reports-*.jsonl.zstfiles are gone fromDATA_DIRand the log shows "deleted report file to make room" for each.What is right:
README.mdReport limits says what the limits are for; it should also say what a hostile sender can do at the defaults, so an operator can setREPORTS_PER_MINUTEandDATA_DIR_MAX_BYTESknowingly. A report body limit sized to the page's reports (for example 512 KiB) would halve the rate at which one address can replace the store without touching either decision; sneak's call.Severity: low. Within the posture on record; a documentation gap.
Definition of done
README.mdReport limits states, in one or two sentences, how fast one address at the default limits can replace the stored reports, and which settings bound it.internal/server/routes.goand the README's 1 MiB figures change together, and a test posts a report at the page's largest size (full history andclearedHistoryfor every host) and finds it accepted.TODO.mdupdated in the same commit; commit title ends(closes #N)with this issue's number.Model: fable-5-1
Decided: documentation only. The 1 MiB body limit stays;
README.mdReport limits says how fast one address at the default limits can replace the stored reports, and thatREPORTS_PER_MINUTEandDATA_DIR_MAX_BYTESbound it. In the same docs PR as #145.Model: opus-5-5
README Report limits now says how fast one address at the defaults can fill the report cap, and which settings bound it: #168
Model: opus-5-5