> A competent attacker without a botnet can try to find weak points in your application They can, but it this case it sounds unlikely. It's not feasible for a

> A competent attacker without a botnet can try to find weak points in your application They can, but it this case it sounds unlikely. It's not feasible for a potential attacker to bother with this kind of analysis and then just send a few dozen requests per second. Instead they can just pay $5 to a Russian bot net operator who will inundate the site with hundreds of thousands of requests. Even from a single mid-range DSL line alone one could launch thousands of HTTP requests without breaking a sweat.