Hacker News Reader

"Read-only" pages are still fertile ground for layer 7 DDOS.

It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.

Not only that but you could only display CAPTCHAs on the actual target of the DDoS.

The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.

It remains an issue for the origin server if the DDoS targets uncacheable content.