search

OpenWIS / openwis

http://openwis.github.io/openwis
GNU General Public License v3.0
11 stars 15 forks source link

Email Storm possible - limit email output with links to Staging Post during dissemination failures #162

Open woollattd opened 8 years ago

woollattd commented 8 years ago

Should a Primary dissemination for a subscription fail, emails with links to the staging post are sent to the users registered email address. This could lead to hundreds and thousands of emails being sent out.

This will cause huge issues for the receipients as their mail boxes fill up Should this mass of emails be treated as spam by recipient email gateways, the domain sender base score of the originating GISC may suffer and could lead to other non-gisc emails from the originating domain being blocked by other recipients

I suggest that should there be a failure in Primary or Secondary dissemination, the account holder is sent only a couple of emails with a single link to a data store on the staging post that is linked to their account, this will hold the data that cannot be delivered, and they can pick it up manually should they so wish.

additional note - secondary dissemination doesn't seem to work

6a6d74 commented 8 years ago

+1, this sounds like good enhancement

woollattd commented 8 years ago

here's a couple more potential solutions to think about: • Allow blacklisting to disable a set of subscriptions • Enable a method for disabling subscriptions tied to specific destination addresses

woollattd commented 8 years ago

Ah ... Also it's possible for a user to set up a subscription using the staging post as primary dissemination this will also lead to the same problem should they subscribe to large datasets.

this is also an issue for email dissemination too. We need to find a way to restrict this dissemination method, and promote ftp as the primary for multiple subscriptions.

woollattd commented 8 years ago

Blacklisting a user when failure to deliver data occurs can block further file delivery and therefore no more emails are sent. But is a manual process. The only problem now - is to catch it occuring early enough as hundreds or thousands of files can be attempted to be sent in just 30 minutes. Maybe we need some mechanism to automatically Blacklist a user when this occurs as we have for threshholds already?

lmika-bom commented 7 years ago

A potential attack vector in v3 that should probably be fixed. Also something to think about for v4.

rogers492 commented 7 years ago

This issue was moved to OpenWIS/openwis4#73

woollattd commented 6 years ago

reopened since OpenWIS v3.x is in maintenance mode for next 6 years so this still applies