Hacker News Reader

Comment by tick_tock_tick | Hacker News Reader

Yes, they absolutely are. Hell just getting a few random bots scraping stuck in a loop or being overly aggressive on your site is enough to double your bill. So yeah it's 100% required.

View on HN

Did we collectively forget rate limiting exists or something?

One bot that's just stuck on a loop or being overly aggressive is going to have one IP.

That is fair but instead of bothering to set that up I can just sign up for a free service in a hour once and just never worry about it.

any sophisticated bots are rotating IPs or pulling from a large pool of IPs. In many cases of fraud/abuse, rate limiting based on IP doesn't work well enough.

> to double your bill

Do you pay a variable amount for your hosting? How and why? All VDS and dedicated server offerings I've ever seen are fixed amount per month. And more often than not the network is limited by speed, not by data transfer.

In that case then the service will just hang as it won't handle the requests caused by even a simple malfunction (not even an actual attack) like the one mentioned by GP.

Mind you, I see your point and I generally don't like the captchas either, but it is definitely a trade-off and I won't blame webmasters that use the DDoS protection.

When you get DoSd you either pay to absorb the traffic or go down. Usually paying a DDoS service is the cheapest option but if you're not, you're paying for more infrastructure (or going down)

Reply on news.ycombinator.com