To push back against the hoards of commenters taking issue with the last line: An entity the size of CF shouldn't need to perform mass blocking to deter DDos at

To push back against the hoards of commenters taking issue with the last line: An entity the size of CF shouldn't need to perform mass blocking to deter DDos attacks, both from the perspective of their customers or their resources. Would it be difficult to delay requests from "low-reputation" sources? Tor users are used to delays when browsing and the automated "ddos-protection" JS challenges appear to do that (even if not by design). What ever happened to read-only websites? Using one's browser to render static content? An underrated concept in 2023, when almost every website wants to run some sort of code on your computer. Your pain is felt, OP!