PDS abuse mitigations

[erlend-sh]

Roomy is hosting its own PDS instance to enable new users to sign up without needing a Bluesky account (or an account on any other atproto platform).

This however also means that we bear some responsibility for the content our Roomy/PDS users spread on all sorts of platforms other than the one (roomy.space) we fully understand and moderate directly.

Mitigations

Rate limits

To what extent could we actually rate-limit our PDS users on other platforms than Roomy? Like, if we could apply our most basic Trust Level allowances like 'post pictures' on the PDS level, that would save us a lot of grief, and would also protect Bluesky from Roomy as a potential spam vector.

Seems this would require upstreaming some basic trust level features to our PDS dependency.

Block cross-site signup

And what about blocking the use of Bluesky altogether for brand new Roomy accounts, could we do that? E.g. could we intentionally make Roomy-native accounts unable to sign into Bluesky with their handle?

[zicklag]

We're going to have something of a hard time managing if someone wants to cause trouble probably.

I might be able to create a volume with a size limit so that they can't use up all the space on the server.

If they start bombarding with spam we can probably just delete the account.

If we get tons of sign-ups we can disable sign-ups.

Having some telemetry and alerting would be very helpful. I've still got a little bit of work to nail that down for us, but I have a solid direction on it.