4 ms·
It'd need the help of browsers or OS's (depending on where in the stack you put the logic), but one idea might be to require requests/packets to be signed by so
by zacharypinter 15y ago
It'd need the help of browsers or OS's (depending on where in the stack you put the logic), but one idea might be to require requests/packets to be signed by something that proves a sufficient amount of CPU work has been done (ala bitcoin). If the site comes under attack, they could turn this on (presumably with a middle-man service that can take high bandwidth) and up the amount of work required to reach the destination. This would no doubt slow things for the legitimate users, but it could make things much more difficult for the attackers.
- r00fus 15y agoOf course, botnets or LOIC would completely bypass this defense...
- cube13 15y agoThis really doesn't solve the DDOS problem though. It's throwing more CPU time and bandwidth at a scenario that already requires both of those. It can slow a small group of script kiddies making a thousand requests to your server per second, but it doesn't stop an actual distributed attack using a botnet or large numbers of machines. If you're adding the signatures, you presumably need to spend CPU time to authenticate it, and bandwidth to send the data, plus the actual content. Why not just have the middle-man soak up the extra requests, cache the data, and fan it out that way?