Hacker News Reader

Comment by ama729 | Hacker News Reader

> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality.

Why not just limit the number of request per site and per user? Ie. John Smith can only make X request (let say 1000) to www.google.com.

Doesn't seem too hard.

View on HN

They state that 400-800 mbit/s == consumer grade sites? really?

When you're as totally awesome and uncaring about your customers as Facebook, you can toss out words like "consumer grade" to describe people affected by your fuck-ups.

Download fast and break (other people's) things.

Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.

I don't know what your setup is like but a connection != the requests my webserver can handle.

I know, it was two separate comments. A: It's "just" IO, performing probably the most heavily optimized IO pattern in the world (serving static files) and B: buying a 1Gbps uplink is trivial.

>"buying 1Gbps uplink is trivial"

1 Gbps dedicated uplink is not trivial everywhere in the world. You also need more quota. Facebook easily crawled more than 1 TB of data during an hour. The more the better may not be best solution here. The higher the uplink, faster Facebook may crawl. So instead of transfering 1 TB in an hour for a 1 Gbps uplink, the transfer will be 10 TB if you have 10 Gbps. This will also depend how much bandwidth they allow their crawler, there must be an upper limit though.

Serving 1Gbps of traffic from Amazon S3 would cost $250,000 a year.

Maybe that's not a big deal to you, but it would be to me!

Reply on news.ycombinator.com