The access log records message size too, and outlives the envelope #174

2026-09-09T19:50:12Z

paulhitt commented

2026-09-09 19:50:12 +00:00

(Migrated from gitlab.com)

relay#59 flagged that the edge proxy keeps a second copy of the size disclosure. Measured on production rather than assumed:

POST /api/flamenet/v1/e2e/messages carries RequestContentSize. Ten sends in the window, ten distinct sizes: 6483, 6486, 6510, 6518, 6943, 6971, 20189, 25867.

It is worse than the issue put it. The envelope is erased the moment the app confirms receipt; the access-log line recording how large it was lives for up to a week. The log outlives the row it describes.

/metadata said nothing about this. That page is a promise, so it now says it, alongside the note that padding on the sending device is what would hide both and has not been done, and that an operator who wants neither can turn the access log off.

Also worth recording: the issue's definition of done says /metadata "does not mention size at all". That is stale. The envelopes-table row has covered it in full for a while, verified on the live page, so only this half was missing.

Tests: 697, 0 failures.

relay#59 flagged that the edge proxy keeps a second copy of the size disclosure. Measured on production rather than assumed: `POST /api/flamenet/v1/e2e/messages` carries `RequestContentSize`. Ten sends in the window, ten distinct sizes: 6483, 6486, 6510, 6518, 6943, 6971, 20189, 25867. It is worse than the issue put it. The envelope is erased the moment the app confirms receipt; the access-log line recording how large it was lives for up to a week. **The log outlives the row it describes.** `/metadata` said nothing about this. That page is a promise, so it now says it, alongside the note that padding on the sending device is what would hide both and has not been done, and that an operator who wants neither can turn the access log off. Also worth recording: the issue's definition of done says `/metadata` "does not mention size at all". That is stale. The envelopes-table row has covered it in full for a while, verified on the live page, so only this half was missing. Tests: 697, 0 failures.

paulhitt commented

2026-09-09 19:51:19 +00:00

(Migrated from gitlab.com)

mentioned in commit 7932fa99ee

mentioned in commit 7932fa99ee3d512e80c6d0ba64a88a873e9c0754

paulhitt (Migrated from gitlab.com) merged commit 7932fa99ee into main

2026-09-09 19:51:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#174