3 ms·
Open connections take system resources. One way to DOS a website is to open a ton of connections and just sit on them. If the server allows extra long timeouts
by oconnor663 10y ago
Open connections take system resources. One way to DOS a website is to open a ton of connections and just sit on them. If the server allows extra long timeouts as long as some bits come in occasionally, then the attacker can send bits occasionally. It's a tricky problem. It might work to allow long turnouts as long as you don't have an ongoing DOS attack, but that sort of thing is hard to configure and test.
- viraptor 10y agoAfter Slowloris and other attacks, this is pretty much a solved problem. Minimise per connection memory, limit connections per IP, drop connections which don't finish the request in X seconds, and separate your app server from your front proxy. And for the front proxy, don't block on reads - do minimal event loop until you can dispatch the full request.
- callalex 10y agoOne person's "Solved Problem" is another person's "I just built an app in rails that accomplishes what I want it to, why did it stop working?"