As per comment https://projects.tigase.org/boards/15/topics/4825?r=6160#message-6160:

I just run the following code on my local machine with 8GB RAM onboard:

int maxRosterSize = new Long(Runtime.getRuntime().maxMemory() /250000L).intValue();

System.out.println("maxRosterSize: " + maxRosterSize);

and got 7635.

It's too big for one user and potentially a possible vulnerability for the server.

I see the following problems:

1. It will be hard to serialise/deserialize such a big roster for server

2. load for DB.

3. it's hard for client to load such a big roster - traffic issue

would be great to have a possibility to limit it via config. For example set it to 100 or something like that

Add configuration option to limit roster size