A friend on his own tuwunel homeserver with 100MiB upload maximum can put a 90 MiB file on a room of my own tuwunel instance and the the 90 MiB file is present in my media folder after any of my clients download it while i set a 24 MiB max upload.
It seems weird as this could allow for Denial of Service of the disk space of the server by uploading massive file to any homeserver (assuming you have access to any room in that server).
Best would be having have multiple options:
- for max foreign file downloaded in DB, size above this we could force streaming to the uploader homeserver or block access (either https redirect or by proxying the stream).
- for time to keep a foreign file before automatic suppression, so we do not keep foreign file forever.
If we want a fast implementation to prevent DoS before a better implementation, we could apply the local max file upload to federated uploads and block everything above.
A friend on his own tuwunel homeserver with 100MiB upload maximum can put a 90 MiB file on a room of my own tuwunel instance and the the 90 MiB file is present in my media folder after any of my clients download it while i set a 24 MiB max upload.
It seems weird as this could allow for Denial of Service of the disk space of the server by uploading massive file to any homeserver (assuming you have access to any room in that server).
Best would be having have multiple options:
If we want a fast implementation to prevent DoS before a better implementation, we could apply the local max file upload to federated uploads and block everything above.