One question, doesn't GRASP open up the server to potential DoS via resource exhaustion if an attacker publishes fake commits which the server will then have to verify before being able to reject it? I'm not sure if rate limiting or temporary ban etc for IP addresses will be enough to prevent this
Login to reply
Replies (1)
All servers that expose public services are vulnerable to DoS. Standard mitigations include IP banning and rate limiting. For maintainer pushes and repository creation, GRASP servers can temporarily (or permanently, if they wish) use features such as npub whitelists and Web of Trust (WoT). For PR submissions (pushing to ref/nostr/), GRASP servers can suspend acceptance of pushes when there isn't an existing event (where WoT can be applied) during an attack. Other GRASP servers not under attack can accept this data and ours can pick up this data later.