Hacker News Reader

I’ve done some basic filtering against some slowloris etc type attacks, I’ve got lots of open proxy and relays blocked from the web. I’ve also got rate limiting in place now, and I’m offloading assets to a proper CDN. In the end my server should only serve a few hundred KB at absolute max, the rest handled by a CDN. My thought is with that it probably would hold up to the attacks. Thoughts?

View on HN

Imagine something like a pingback attack [1], it can hit you from at least tens of thousands of IPs you don't yet filter, because they are not proxies or relays and will likely exhaust various resources: file descriptor, socket limits, CPU. And this is one of the most primitive layer 7 attacks not even attempting to look like a real user agent.

[1] https://en.wikipedia.org/wiki/Pingback#Exploits

Reply on news.ycombinator.com