Alin Sinpalean

Secure by design `deserialize_from()`

6

We just realized after blissfully having used `deserialize_from()` for quite a while that it is potentially very dangerous when not used in conjunction with `with_limit()`. And unless you carefully read...

`process_cpu_seconds_total` should not be an integer

1

#430 switched `process_cpu_seconds_total` from an (`f64`) `Counter` to an `IntCounter`, for performance reasons. Issue is that processes that don't use a lot of CPU will now have 1 second CPU...

feat: [MR-592] Define and enforce callback limits

1

Define a subnet-wide soft cap on callbacks; and a per-canister guaranteed callback quota; and enforce them when outgoing requests are being enqueued.

At the end of each round, if the total best-effort message memory usage is above the limit, build a priority queue and keep shedding the largest messages from the canisters...

Fill up to half of each stream's slots (and up to ~2.5% of its target byte size) with `Refunds`; before routing canister messages up to 100% capacity. This ensures fairness...