Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:   |  Actual Points:  1.5
Parent ID:   | Points:  2
 Reviewer:  hiro |Sponsor:
-+
Changes (by cohosh):

 * actualpoints:   => 1.5


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:  hiro |Sponsor:
-+
Changes (by cohosh):

 * status:  merge_ready => closed
 * resolution:   => fixed


Comment:

 Merged in
 
https://gitweb.torproject.org/gettor.git/commit/?id=c2930fe339d0be0deceb4120e771bc4f24f28770

 and deployed as of `2020-02-13T20:10:15+`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+-
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  merge_ready
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:  hiro |Sponsor:
-+-
Changes (by hiro):

 * status:  needs_review => merge_ready


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+--
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:  hiro |Sponsor:
-+--

Comment (by hiro):

 LGTM!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+--
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:  hiro |Sponsor:
-+--
Changes (by cohosh):

 * reviewer:   => hiro


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+--
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:   |Sponsor:
-+--
Changes (by cohosh):

 * status:  assigned => needs_review


Comment:

 I'd like to review this quick fix as is and then work on #33191 before
 writing unit tests.

 Basically, the deferred objects returned by adbapi calls to the database
 are difficult to deal with pytest.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+--
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  assigned
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:   |Sponsor:
-+--

Comment (by cohosh):

 Here's a commit that does what I described above:
 
https://dip.torproject.org/cohosh/gettor/commit/e36587122d5cd813e1693ab2640baf1c25298d56

 I noticed we don't have any database-related tests. I'm going to try to
 put some together as a part of this ticket.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+--
 Reporter:  cohosh   |  Owner:  cohosh
 Type:  defect   | Status:  assigned
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:  2
 Reviewer:   |Sponsor:
-+--
Changes (by cohosh):

 * owner:  (none) => cohosh
 * status:  new => assigned


Comment:

 Okay, it seems like this was originally intended to be an actual rate
 limit, where the function `get_num_requests` was supposed to pull from the
 database requests that were in progress from the same email address. The
 way it's implemented now, requests are not removed from the table when
 they are completed. Instead, the status is updated from `ONHOLD` to
 `SENT`.

 There's no reason to keep these entries around, especially since we have a
 separate table for statistics. I also don't feel good about keeping
 records of individual requests, even if the email addresses are hashed.
 Emails draw from a low entropy tool and subsequent requests from the same
 account are linkable.

 I '''think''' just deleting requests once they are handled will fix this.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #33123 [Applications/GetTor]: Update GetTor's rate limiting

[Tor Bug Tracker & Wiki]

#33123: Update GetTor's rate limiting
-+
 Reporter:  cohosh   |  Owner:  (none)
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/GetTor  |Version:
 Severity:  Normal   |   Keywords:
Actual Points:   |  Parent ID:
   Points:  2|   Reviewer:
  Sponsor:   |
-+
 Right now GetTor has a limit for the number of total requests a user can
 make from a single email address. This was likely put in place to prevent
 abuse or resource consumption, but functions as a total limit rather than
 a rate limit.

 This does not seem desirable, the limit right now is pretty low (30
 requests), and is essentially a lifetime limit since we don't clear the
 database when we update links.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs