4 ms·
We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.
by FredEE 13y ago
We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.
- korzun 13y agoSo why are you blowing this off and now all of a sudden writing rate limiting? The only reason he got 1000+ emails is because you guys messed up. Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'. Mistakes like this are signs of amateur hour.
- MichaelGG 13y agoSuppose they limit it to 100 emails before blocking your account. The guy can just sign up with 10 accounts. Or 5. This "attacker" would still post it and make a big fuss. Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.
- korzun 13y agoIn regards to rate limiting, it would be a much smaller number prior to block. If it's IP based at let's say 10 over X attacker would have to lease 100 IP's. In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.