4 ms·
And it would be easy enough to defend against if it really became a problem -- just time out. Most web sites don't need have a need to receive gigantic POST dat
by sabat 16y ago
And it would be easy enough to defend against if it really became a problem -- just time out. Most web sites don't need have a need to receive gigantic POST data.
- JoachimSchipper 16y agoIt's difficult to distinguish between a persistent user trying to upload a large image over a spotty satellite link and a hacker.
- sabat 16y agoYou're right, but I still don't believe this creates an impossible situation: * most webapps don't allow giant user uploads of any kind * if you have a persistent user with a net connection that's that slow then you have no choice but to time him out
- JoachimSchipper 16y agoA sufficiently-slow connection will make even a reasonable amount of data take a long time. I'm sure Flickr has users that upload large photos over satellite links... There's also no reason why you need to time this person out. If you configure kernel and application for small (or auto-sizing) buffers and use an event-based structure for the application, you should be just fine.
- sabat 16y agoIt's really a matter of one's approach and level of paranoia. Me? If I wasn't running Flickr (say I was running getfreckle.com), I'd probably opt for more conservative settings. I may not need to time that guy out, but I'd probably do it so I wouldn't have to worry later. * If you configure kernel and application for small (or auto-sizing) buffers and use an event-based structure for the application* This would be all the better.
- andrewmccall 16y agoTrue. Though it's a safe assumption that if you suddenly have a large number of spotty satellite users and they're DOSing your site it's probably something malicious.