And it would be easy enough to defend against if it really became a problem -- just time out. Most web sites don't need have a need to receive gigantic POST data.
* most webapps don't allow giant user uploads of any kind
* if you have a persistent user with a net connection that's that slow then you have no choice but to time him out
There's also no reason why you need to time this person out. If you configure kernel and application for small (or auto-sizing) buffers and use an event-based structure for the application, you should be just fine.
* If you configure kernel and application for small (or auto-sizing) buffers and use an event-based structure for the application*
This would be all the better.