To view parent comment, click here.
To read all comments associated with this story, please click here.
Neolander,
"It's certainly not the same, but if there's a way to take a server down with a small amount of organization/friends, due to the way the software running on this server works, it's another form of security vulnerability."
This speaks to unscalable designs and systems, however a company can find itself in a situation where systems can handle the legitimate load of X customers, but not X + Y attackers. I'm uncomfortable with the conclusion that a company out to design the infrastructure to handle X customers + Y attacks.
Edit: Although, what choice is there?
Edited 2011-06-29 12:53 UTC
Availability != security.
The fact that a site wasn't designed to withstand a DDoS does not mean it suffers from a security problem and neither is inefficient code a security problem.
It's usually not feasible to start out with a site and infrastructure designed to handle the volume of YouTube or Facebook or a DDoS.
Deploy now, get customers and worry about scalability when the need arises. Even a DDoS once or twice is not a cause for concern unless it has a major impact on your bottom line and/or is caused by a security problem.
Some wise guy said something about premature optimization a long time ago and it's still true.





Member since:
2011-01-28
sagum,
"If you look at the LOIC that the anonymous group use, they target a website to request pages that take up vast amounts of resources, be it memory, server side scripting or database load."
"In this instance, just a few people (sometimes even 1 person) can take down a website simply because of bad code."
Believe me when I say that I'm a huge advocate of running efficient code. However you have to admit that depleting the server of resources by running useless (yet valid+legal) queries is not nearly the same thing as taking over the server through a security vulnerability.