From 43e227e3f36bc8ecefce83cc7b9e65cda8f23f5f Mon Sep 17 00:00:00 2001 From: David Young Date: Sun, 8 Nov 2026 12:14:03 -0700 Subject: [PATCH] Report receiver: don't log senders' addresses The rate limit keeps addresses in memory, for at most a day; the log lines don't need them, so the privacy policy can say they aren't stored. Co-Authored-By: Claude Opus 5.5 --- server/report-receiver/README.md | 5 +++-- server/report-receiver/receiver.py | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/server/report-receiver/README.md b/server/report-receiver/README.md index c0bfc67..750d62d 100644 --- a/server/report-receiver/README.md +++ b/server/report-receiver/README.md @@ -10,8 +10,9 @@ files each as an issue in the private Gitea repository so a report isn't lost if Gitea is down, and tries again every 10 minutes. Saved reports are deleted after 90 days; the Gitea issues stay. - It turns away more than 5 reports an hour or 20 a day from one address, and - more than 500 a day in all, and logs bigger than 10 MB compressed or 64 MB - uncompressed. + more than 500 a day in all. It keeps addresses for that in memory only, for + at most a day, and doesn't write them to its log. It also turns away logs + bigger than 10 MB compressed or 64 MB uncompressed. - `make test` in the repository runs `test_receiver.py`, which sends reports with the real `report` client to the receiver and a fake Gitea. diff --git a/server/report-receiver/receiver.py b/server/report-receiver/receiver.py index 967bf10..30a917d 100644 --- a/server/report-receiver/receiver.py +++ b/server/report-receiver/receiver.py @@ -332,7 +332,8 @@ def make_handler(store, limiter): threading.Thread(target=store.deliver, args=(report_id,), daemon=True).start() def log_message(self, format, *args): - print(f"{self.client_address_seen()} {format % args}", file=sys.stderr, flush=True) + # Without the client's address: it's only kept, in memory, for the rate limit + print(format % args, file=sys.stderr, flush=True) return Handler