and yes, i am working on other resource exhaustion attack mitigations, i have just found one relating to queries that just query on kind and time limits, as used by spiders
these cost so much iops and processing time and memory that i'm having to put my foot down about this
i dunno if i can even cap this properly
i'm making a new rule that queries that have no criteria at all but time limits are ignored
these assclowns running spiders constantly trying to pull the whole damn event store from the relay are not getting service, what the fuck...
oh well, this is relay policy, i'm just making this public readable because we need that for publication purposes and generally seems like a reasonable thing, but queries that overburden the relay's resources are not ok
i think if the user is authed, and whitelisted then ok, otherwise no, but even then, i may have to make further mitigations, but for now simply blocking these vague queries is fixing the problem
