f95cb2b143
The goal of a login ratelimit system is to prevent brute force attacks on passwords. The current login ratelimit system is based on VDelay which uses exponential backoff based on IP address after failed login attempts. This is not ideal because of corporate proxies and LSN causing the number of false positives to be very high resulting in users getting the dreaded "you've been doing that too much". This new system uses a factored out version of the core ratelimiting system which uses fixed ratelimits per period (allowing some burstiness) and is per-account. To help mitigate the effects of a denial of service attack on a specific user, different ratelimit buckets are used depending on whether or not the user has used the IP the login request is coming from before. As an escape hatch, successfully resetting an account's password adds the current IP to that account's recent IPs allowing it into the safer ratelimit bucket. The ratelimit never applies if you are currently logged in as the user, allowing account deletion to happen regardless of ongoing brute force / denial of service attacks.
Greetings!
This is the primary codebase that powers reddit.com.
For notices about major changes and general discussion of reddit development, subscribe to the /r/redditdev and /r/changelog subreddits.
You can also chat with us via IRC in #reddit-dev on FreeNode.
Quickstart
To set up your own instance of reddit to develop with, we have a handy install script for Ubuntu that will automatically install and configure most of the stack.
Alternatively, refer to our Install Guide for instructions on setting up reddit from scratch. Many frequently asked questions regarding local reddit installs are covered in our FAQ.
APIs
To learn more about reddit's API, check out our automated API documentation and the API wiki page. Please use a unique User-Agent string and take care to abide by our API rules.
Happy hacking!
Issues and Contribution Guidelines
Thanks for wanting to help make reddit better! First things first, though: github issues is only for confirmed, active bugs. Please submit ideas to /r/ideasfortheadmins.
Please read more on contributions in CONTRIBUTING.md.