<html>
<head>
<base href="https://bugzilla.icculus.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:tim@ngus.net" title="Tim Angus <tim@ngus.net>"> <span class="fn">Tim Angus</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW --- - DDOS with getchallenge"
href="https://bugzilla.icculus.org/show_bug.cgi?id=5954">bug 5954</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>tim@ngus.net
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - DDOS with getchallenge"
href="https://bugzilla.icculus.org/show_bug.cgi?id=5954#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - DDOS with getchallenge"
href="https://bugzilla.icculus.org/show_bug.cgi?id=5954">bug 5954</a>
from <span class="vcard"><a class="email" href="mailto:tim@ngus.net" title="Tim Angus <tim@ngus.net>"> <span class="fn">Tim Angus</span></a>
</span></b>
<pre>I've added rate limiting to getchallenge in 7b15415. As far as the DDoSing
goes, the numbers used are deliberately not that aggressive. The reason for
this is that it is impossible to tell the difference between legitimate inbound
requests from genuine clients and those from a DDoS cluster. If you prevent the
DDoS, you also prevent legitimate use of your server. By all means try playing
with the numbers if you think you have a set which is acceptably more
aggressive without disrupting normal access. The existing limits were all
picked with a finger in the air.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>