4 ms·

This content was very useful to me, as I am running a small service for a few clients that I worry might be taken down by a DDoS. The main takeaway seems to be

This content was very useful to me, as I am running a small service for a few clients that I worry might be taken down by a DDoS. The main takeaway seems to be "use a CDN", but if you are running a more complex service, why can't the attackers hit endpoints that aren't CDN-cached? Is the strategy in this case simply to refuse the request very early in the process, to ensure the service doesn't waste much time processing it?

nojvek 3y ago
The other point here was that billions of requests per month is only 2 requests per second. That can easily be done on a one core server if you use an efficient web language like go/rust/nodejs. Tableplus is a simple marketing site that serves the binary via cdn. Most of the time when a site goes down is because it is doing something very CPU intensive either at the app layer or the Database layer. E.g an expensive query. If queries are hitting indexes and app is doing simple auth, routing and sending queries to DB, it’s hard to DDOS it easily. With things like Cloudflare pages and functions, someone could hit it with billions of requests/month and you’d still be in standard $5/month tier. They could download terabytes off CDN and you’d have $0 cost. It’s pretty radical how much you can build on Cloudflare on their free tier.