Couldn't agree more. Anything that deviates from usual usage patterns can be relatively easily detected and negative impact mitigated. But nowerdays botnets a

Couldn't agree more. Anything that deviates from usual usage patterns can be relatively easily detected and negative impact mitigated. But nowerdays botnets are the real threat with every 13 year old kid being able to get hundreds of machines infected with ease which is enough to pose a real threat to most websites when they launch absolutely valid HTTP requests. Botnet sizes of tens of thousands of zombies are not uncommon. It is a tough problem and the reason why DDoS attacks are so effective and therefor popular. They work. When your site gets beyond a certain size, chances are you don't even have accesslogs for performance reasons because you get dozens of thousands of requests per second. So finding the malicious requests and singling them out from the rest to be able to filter them is hard to say the least. Plus every false positive could really hurt. Imagine you accidently filter some check-out requests in some online shop - that's a lost sale. Attacks like the one outlined in the "paper" (it's really more a bunch of slides) can be easily defended against. They are not new just because someone alters the request method from GET to POST and wants to sell it as dangerous just to grab some fame. The fact that they suggest a change in the protocol would be needed just reinforces my suspicion. Announcing a flaw in a hugely popular protocol like HTTP gets you a sh*tload of attantion and in the end jobs. I know a few people working for companies in the web-security field, some also member of OWASP. Exagerations are very very common. The more fear a customer has the more protections you can sell them.