4 ms·
They mention a single user downloading a 20GB file thousands of times on a single day, why not just rate limit the endpoint?
by zwnow 1y ago
They mention a single user downloading a 20GB file thousands of times on a single day, why not just rate limit the endpoint?
- alluro2 1y agoTheir download service does not require authentication, and they are kind enough to be hesitant about blocking IPs (one IP could be half of a university campus, for example). So that leaves chasing around to find an individual culprit and hoping they'll be nice and fix it.
- account42 1y agoThey could however rate-limit per IP with possibly a whitelist or higher limits for cooperative universities that are willing to prevent abuse from their own network. Unless they are facing a DDOS but then this appeal is even less likely to help.