DID PLC Rate Limits and Validation

[bnewbold]

This is a short announcement that we intend to impose some rate limits and constraints on the did:plc service. The starting limits (which we can change if these are too restrictive) are all per-DID (not per-IP) and include:

• DID updates (operations): 10 updates/hour, 30 updates/day, 100 updates/week
• strings have length limits
• maximum overall operation size (CBOR) dropped to 4 Kbytes from 7.5 KBytes
• alsoKnownAs array can't contain duplicates (this is a DID Core specification rule)
• no additional or un-specified fields allowed in operations

Details in this PR: did-method-plc/did-method-plc#47

All existing PLC DIDs will stick around, and old invalid operations won't be invalidated, at least for now. These limits only apply when submitting new operations to the directory.

We believe that these limits should cause no problems to end users, or to most developers running any automated services. In particular they should not limit any party running a large PDS: the Bluesky PDS has no special bypass for these rate-limits.

The motivation for these limits are to prevent automated churn which can fill up the database and result in very long operation logs, which are resource-expensive both for the PLC directory itself, and for any other party keeping a mirror or working with the full operation log.

If you are a developer who thinks this could cause a problem for you, please let us know!

[bnewbold]

This was deployed to the production PLC directory (https://plc.directory) yesterday (2023-09-27).

An unrelated recent change was that the bluesky-social/did-method-plc github repository was moved to a new PLC-specific github org, and is now at did-method-plc/did-method-plc. github should redirect most things as needed.