Sounds like they don't have rate limiting implemented? That seems odd, and it's also surprising it isn't talked about in the post.
Obviously judges aren’t going to have to worry about reasonable rate limits but if these DDoSes are rare, I’d much rather they dealt with them on a case by case basis. Without some complex dynamic rate limit that scales based on available compute and demand, rate limiting would be a blunt solution that will necessarily generate false positives.
[1] https://www.theregister.com/2018/09/04/wayback_machine_legit...
Virtually every major website has per-host inbound request limits. This is completely standard practice and Archive.org is the odd one here.
And DDoS isn't the only concern. Legitimate users that run poorly written Python scripts that make insane numbers of requests can hog server resources, and rate limits with appropriate error messages linking to resources documenting efficient access patterns can improve the experience for everyone, and drastically cut costs for the service operators.
What an old fashioned concern! Don't you know that the US justice system uses ChatGPT as an archive retrieval system nowadays? /s