4 ms·
I thought this is the older way of doing DDoS, like replicating user's behaviour and overwhelming the server with repeated requests. And it's very obvious that
by vthallam 9y ago
I thought this is the older way of doing DDoS, like replicating user's behaviour and overwhelming the server with repeated requests. And it's very obvious that any public facing API should be heavily cached and rate limited, in fact, all the major application frameworks provide easy to implement code for these.
But yeah, more developers should be aware of the possibility of this.
- b4lancesh33t 9y agoI am not a ddos mitigation expert, but I am under the impression that the remedies you mention are only going to help with relatively small attacks. It is very inexpensive to buy enough DDOS capacity to saturate a whole server's CPU just decoding requests. Caching and rate limiting aren't going to help you much then. If you're a serious target these days, you basically need to have your services behind one of the big solutions. Rolling your own is far too expensive for any but the largest players. Cloudflare, GCE, and I'm sure many others offer ddos mitigation for grownups.
- bluedino 9y agoDevs need to remember to use performance monitoring tools to see where the slow code is - we had an app that could come to a halt if more than 10 people logged in, in one second - it took forever to dynamically generate the menus. Stupid recursion error, quieted NewRelic alerts down right away.