4 ms·

You passed the first test: I asked myself "wait, how is this not a one-stop-shopping service for aspiring, technically incompetent DOS attackers"? And I found y

You passed the first test: I asked myself "wait, how is this not a one-stop-shopping service for aspiring, technically incompetent DOS attackers"? And I found your FAQ and answered that question inside of 45 seconds: http://loadimpact.com/forum/viewtopic.php?id=7 http://loadimpact.com/forum/viewtopic.php?id=7

jakewolf 18y ago
Still the basic test uses up some good bandwidth. What about the impact on shared hosts who sometimes severely limit the number of connections?
davidw 18y ago
Ok, but what if a number of people all try the free test with some site?
- teej 18y ago
  Fake it and show the results from the last test to that site.
rlonn 18y ago
We have a ton of security features to limit abuse of the system. A site that cannot handle the impact of a single basic (free) test can be DOS:ed once, yes. But we have a limit on how often we will generate load to (or from, really) individual IP addresses, so the second or third time in a day someone tries to "load test" the same site, they will be denied their test. This means you can at most DOS-attack a small site a few minutes per day. We hope it will be enough to make would-be abusers go somewhere else - i.e. not worth their time.
- patio11 18y ago
  You may want to put a per-domain-per-day limit in there somewhere, otherwise you are going to have a very stressful day the first time someone on SomethingAwful hears of this wonderful new toy. (Its a DDOS in a can if you have a few dozen people capable of reading directions.)
  - wesley 18y ago
    Or simply add a way to claim a server by uploading a specific file to verify ownership. You probably don't want to do this because it would make the process much harder, but you can allow it in reverse; claim to deny load tests for a domain.
    - rlonn 18y ago
      We actually have that feature also :-) Although it doesn't kick in until you try and run a test with higher load levels. Then you need to have a "loadimpact.txt" file in the root of your server, or the test won't start.
      - imp 18y ago
        Like others have suggested, please require that before any testing. I like the concept of your site, but I really don't want people DOS'ing my site for any amount of time, even a few minutes. I know they can do it manually, but if you give a nice easy interface to help even noobs then that makes me a little scared of your site. I'm guessing that you want to give a "live demo" to people, but I'm sure you could just show a demo report of a couple sites that have already been tested.
        rlonn 18y ago
        We need to be more open about what security measures we have built into the service, I think. I can tell you right now that the free tests most people are running have a built-in cutoff feature that aborts the test if it detects that the server on the other end is starting to respond significantly slower than it did at the start of the test. Example: the test starts by simulating 10 clients. The average page load time measured is 500 ms. The test then moves on to test using 20 clients. If the average page load time goes above 1 second (twice what it was originally), the test will be aborted. We have a general security philosophy that is based on different levels of trust. An anonymous user is trusted the least, a registered but non-paying user is trusted a little bit more, and a paying user is trusted even more. The level of trust determines how often you can run tests, how much data your tests are allowed to transfer, how often you can place load on individual destination servers (IPs), what settings you can make for your tests, etc.
andrewljohnson 18y ago
You failed my first test. I tried to load test my start-up - www.trailbehind.com - using your free service. However, it said I had already tried to load test my site and it failed. I went through your registration process, and got nothing. Very disappointing - the type of thing that will make me never look at your website again and scoff about it to my friends should they bring it up. And a couple other nits: 1) Your registration page where I choose my plan type is not intuitive. Maybe it's because green is not a good color to call attention to stuff. 2) Your Register and Cancel buttons should be different colors. I clicked the wrong one and had to redo my registration. 3) Don't ask for number of employees and industry. They're not required and they will hurt your conversion rate slightly. And it indicates to me you might sell my data.
- rlonn 18y ago
  Sorry to hear you were disappointed. We will try and improve the registration procedure, and also the feedback to users as regarding why load tests are denied (often, it is because some resource used on your site have been used by a lot of other sites aswell, and our system doesn't want to strain that particular resource/object - but we have to be clearer about this). Employees and industry is there for us to learn who our customers/users are. This is a new type of service, and we need information on who are target audience are, because we frankly don't know that yet. These values are optional to fill in, though. Should we be more informative, maybe, and tell people that we will absolutely not under any circumstances give out information about them to a third party - would that reassure you? Finally, your confirmation email might have been delayed as there was a DNS issue yesterday that caused outgoing email to be queued for a while. Apologies about that too and thank you for the feedback. It's very nice of you to give it even though you weren't happy with the service. Negative (but constructive) feedback is the most valuable of all for us.
- lacker 18y ago
  Sorry AJ - I had already tried to load test trailbehind earlier ;-)

jakewolf 18y ago

Still the basic test uses up some good bandwidth. What about the impact on shared hosts who sometimes severely limit the number of connections?

davidw 18y ago

Ok, but what if a number of people all try the free test with some site?

teej 18y ago
Fake it and show the results from the last test to that site.

rlonn 18y ago

We have a ton of security features to limit abuse of the system. A site that cannot handle the impact of a single basic (free) test can be DOS:ed once, yes. But we have a limit on how often we will generate load to (or from, really) individual IP addresses, so the second or third time in a day someone tries to "load test" the same site, they will be denied their test. This means you can at most DOS-attack a small site a few minutes per day. We hope it will be enough to make would-be abusers go somewhere else - i.e. not worth their time.

patio11 18y ago
You may want to put a per-domain-per-day limit in there somewhere, otherwise you are going to have a very stressful day the first time someone on SomethingAwful hears of this wonderful new toy. (Its a DDOS in a can if you have a few dozen people capable of reading directions.)
- wesley 18y ago
  Or simply add a way to claim a server by uploading a specific file to verify ownership. You probably don't want to do this because it would make the process much harder, but you can allow it in reverse; claim to deny load tests for a domain.
  - rlonn 18y ago
    We actually have that feature also :-) Although it doesn't kick in until you try and run a test with higher load levels. Then you need to have a "loadimpact.txt" file in the root of your server, or the test won't start.
    - imp 18y ago
      Like others have suggested, please require that before any testing. I like the concept of your site, but I really don't want people DOS'ing my site for any amount of time, even a few minutes. I know they can do it manually, but if you give a nice easy interface to help even noobs then that makes me a little scared of your site. I'm guessing that you want to give a "live demo" to people, but I'm sure you could just show a demo report of a couple sites that have already been tested.
      - rlonn 18y ago
        We need to be more open about what security measures we have built into the service, I think. I can tell you right now that the free tests most people are running have a built-in cutoff feature that aborts the test if it detects that the server on the other end is starting to respond significantly slower than it did at the start of the test. Example: the test starts by simulating 10 clients. The average page load time measured is 500 ms. The test then moves on to test using 20 clients. If the average page load time goes above 1 second (twice what it was originally), the test will be aborted. We have a general security philosophy that is based on different levels of trust. An anonymous user is trusted the least, a registered but non-paying user is trusted a little bit more, and a paying user is trusted even more. The level of trust determines how often you can run tests, how much data your tests are allowed to transfer, how often you can place load on individual destination servers (IPs), what settings you can make for your tests, etc.

andrewljohnson 18y ago

You failed my first test. I tried to load test my start-up - www.trailbehind.com - using your free service. However, it said I had already tried to load test my site and it failed. I went through your registration process, and got nothing. Very disappointing - the type of thing that will make me never look at your website again and scoff about it to my friends should they bring it up. And a couple other nits: 1) Your registration page where I choose my plan type is not intuitive. Maybe it's because green is not a good color to call attention to stuff. 2) Your Register and Cancel buttons should be different colors. I clicked the wrong one and had to redo my registration. 3) Don't ask for number of employees and industry. They're not required and they will hurt your conversion rate slightly. And it indicates to me you might sell my data.

rlonn 18y ago
Sorry to hear you were disappointed. We will try and improve the registration procedure, and also the feedback to users as regarding why load tests are denied (often, it is because some resource used on your site have been used by a lot of other sites aswell, and our system doesn't want to strain that particular resource/object - but we have to be clearer about this). Employees and industry is there for us to learn who our customers/users are. This is a new type of service, and we need information on who are target audience are, because we frankly don't know that yet. These values are optional to fill in, though. Should we be more informative, maybe, and tell people that we will absolutely not under any circumstances give out information about them to a third party - would that reassure you? Finally, your confirmation email might have been delayed as there was a DNS issue yesterday that caused outgoing email to be queued for a while. Apologies about that too and thank you for the feedback. It's very nice of you to give it even though you weren't happy with the service. Negative (but constructive) feedback is the most valuable of all for us.
lacker 18y ago
Sorry AJ - I had already tried to load test trailbehind earlier ;-)