Hacker News Reader

Comment by embedding-shape | Hacker News Reader

Your webserver most likely have "rate limiting" built in already, which you can configure to act based on lots of variables typically. Set a limit of 1 req/s or whatever, and you've stopped 99% of all DDoS you'll encounter on the public web. If your visitors get cranky, up it to 10 req/s and you still are preventing most of the "abusive traffic", granted your backend/website isn't completely upside down when it comes to performance and resource usage.

CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.

View on HN

This is not how things work and no company providing online services for money would rate limit like that. This would do nothing for real world DDoS. You're in "not even wrong" territory.

And for large services implementing a CDN properly takes days/weeks of preparation. Once you're down it's way too late.

Yeah, of course if you're a large service, stuff that works for SMEs isn't gonna work for you...

If your problem is AI crawlers, then simple rate limits help, I've helped countless of businesses with this already. For the ones that it isn't enough, you continue adding more roadblocks. There is no "one size fits all here" and that you seemingly is under that belief, leads less credence to what you're saying, not more.

Brother if you have the solution, start a company.

There are people willing to throw money at you.

But Free is hard to beat with a global presence.

And please listen to what others are saying here, there's a lot of experienced people here. It is no longer 1998, 2008, or even 2018. The traffic a basic website experiences now is a massive increase, especially for those well SEO'd and using TLS.

Also you said this:

> CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.

Origin obfuscation.

Also greatly helps to protect it directly from various attacks and scans, especially in our new LLM driven security world where new 0days are being found constantly. How much at risk are you willing to put the SMB?

Rate limit never work like that in large volume.

Keeping connection alive take memory.

Rate limit by bytes/sec would hold the connection longer, taking more resources.

Rate limit by ip don't work with sudden surge demand, ddos, etc

Rate limit by user basically means you need to process the request and CPU bound

In very large scale DDoS, incoming SYN alone can cog your down pipe. You need to upgrade the connection just for that (Or something on your upstream to block by ip)

You can do lots of these without using cdn, yes. But it is easier with cdn and it is cheaper than paying for extra capacity "just in case"

Reply on news.ycombinator.com