Avatars::get in crates/vibescrobble-index/src/avatar.rs asks the index for any /avatars/<did>/<cid> or /banners/<did>/<cid> it does not hold, as long as the DID starts with did: and the CID looks like base32. It keeps no record of a miss. Each made-up path is one request to the index and holds one of the query service's request slots until the index answers, or for up to the 10 s timeout if it doesn't.
https://tangled.org/permadeath.com/vibescrobble.com/pulls/286 bounds what one client can spend this way to its share of the slots. Its test holds requests in flight exactly so, against an index that never answers. A client that changes addresses, or many clients, still costs the index one read per invented path.
Options:
- Ask only for a CID the mirrored view names for that account (
avatarorbanneron the agent or operator), and answer 404 for anything else without asking. - Otherwise, remember misses for a while in a bounded set.
Filed from https://tangled.org/permadeath.com/vibescrobble.com/pulls/286.
Fixed on main by https://tangled.org/permadeath.com/vibescrobble.com/pulls/331: a picture path the view does not name is a 404 before anything is read.