3 ms·
Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment). The bucket is the same name as the domai
by cjk2 2y ago
Ok I'm actually going to delete my web site and cloudfront distribution over this. It gets no traffic (at the moment).
The bucket is the same name as the domain so I can imagine this could be exploited quietly very easily as PUTs are so expensive.
Literally a $5 VPS could cost someone $1k.
- kzrdude 2y agoA $5 VPS should have a $10 spend limit or something, at which point it should shut down. In a reasonable world.
- notnmeyer 2y agoi doubt it. i would imagine any single ip address would get rate-limited/throttle before doing much. the situation the article is describing is much more like a botnet — there were hundreds or thousands (or more?) of unique instances making requests.
- cjk2 2y agoI very run big buckets in production that have single addresses hammering them hard all day every day. I've never seen any restrictions or throttling.
- dvfjsdhgfv 2y ago> i would imagine any single ip address would get rate-limited/throttle before doing much Yes, you would imagine, because without relevant WAF rules in place there would be no throttling.
- yjftsjthsd-h 2y ago> i would imagine any single ip address would get rate-limited/throttle before doing much. Does AWS have default per-IP rate limits?