A full group could send ~5 messages an hour (relay#54) #124

2026-09-05T11:34:25Z

paulhitt commented

2026-09-05 11:34:25 +00:00

(Migrated from gitlab.com)

The authenticated send charged input.messages.count — one unit per
ENVELOPE. Groups are pairwise fan-out, one envelope per recipient DEVICE, so
a full 32-member group at two to five devices each cost 62–155 units for a
single message against a 600/hour default. Somebody in the group size this
product advertises hit "Too many messages sent recently" after four to nine
lines of ordinary conversation.

Fan-out is a property of the recipients, not of how much the sender is
talking. Charging per envelope made the price of speaking depend on how
many phones your friends own — and the user sees a rate-limit banner whose
real cause nobody would guess, us included, the next time it is reported.

The 1:1 case was fine, which is exactly why it survived. Every manual
test of the send path passes.

Now one unit per message. The abuse case the limit exists for is bounded
separately and per-recipient on the sealed path, which is where an attacker
actually lives.

Two tests, and the second is what stops this being "remove the rate limit":

a wide fan-out costs one unit, not one per recipient device
talking past the budget is still refused

The arithmetic is encoded rather than described — 40 devices against a budget
of 10, nine messages deep — so a change to either number fails loudly instead
of quietly restoring the bug. The budget is set to 10 rather than the real
600 on purpose: at 600 this test would pass under the OLD accounting for the
first few sends and prove nothing until it got slow.

Proven by breaking it: restoring amount: input.messages.count fails the
fan-out test with a 429 on the FIRST message, while "talking past the budget
is still refused" stays green.

641 tests in 57 suites pass.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

The authenticated send charged `input.messages.count` — one unit per ENVELOPE. Groups are pairwise fan-out, one envelope per recipient DEVICE, so a full 32-member group at two to five devices each cost 62–155 units for a single message against a 600/hour default. Somebody in the group size this product advertises hit "Too many messages sent recently" after four to nine lines of ordinary conversation. **Fan-out is a property of the recipients, not of how much the sender is talking.** Charging per envelope made the price of speaking depend on how many phones your friends own — and the user sees a rate-limit banner whose real cause nobody would guess, us included, the next time it is reported. **The 1:1 case was fine, which is exactly why it survived.** Every manual test of the send path passes. Now one unit per message. The abuse case the limit exists for is bounded separately and per-recipient on the sealed path, which is where an attacker actually lives. Two tests, and the second is what stops this being "remove the rate limit": a wide fan-out costs one unit, not one per recipient device talking past the budget is still refused The arithmetic is encoded rather than described — 40 devices against a budget of 10, nine messages deep — so a change to either number fails loudly instead of quietly restoring the bug. The budget is set to 10 rather than the real 600 on purpose: at 600 this test would pass under the OLD accounting for the first few sends and prove nothing until it got slow. Proven by breaking it: restoring `amount: input.messages.count` fails the fan-out test with a 429 on the FIRST message, while "talking past the budget is still refused" stays green. 641 tests in 57 suites pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-05 11:34:25 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-09-05 11:34:46 +00:00

paulhitt commented

2026-09-05 12:35:15 +00:00

(Migrated from gitlab.com)

mentioned in commit f15b467376

mentioned in commit f15b467376864cd6fa43913cfb53d187970b3b08

paulhitt (Migrated from gitlab.com) merged commit f15b467376 into main

2026-09-05 12:35:15 +00:00

paulhitt commented

2026-09-09 18:58:54 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#124