News for hackers. Stuff that matters.

A comment on Rate Limits.

Re:Rate Limits by bcoates on Wednesday August 17, 2016 @01:21PM (#12306424)
I'll bite: sliding windows are a pain, if you hit them by accident they result in a weird self-DoS. Why not token bucket? It's a simpler algorithm to implement and less pain for the client.

If I'm unaware of these limits and use them up all at once, I'm locked out for a week instead of having to wait 1/rate to issue just one more.

[ Parent | on HN ]
Re:Rate Limits by j4cob on Wednesday August 17, 2016 @01:31PM (#12306494)
(Let's Encrypt engineer)

Token bucket is a good idea, and I agree that it would make the user experience of hitting rate limits less onerous. We implemented sliding windows because they were straightforward to implement based on our long-term database state. I'll do some thinking about whether we can emulate a token bucket style on top of that without having to add another source of truth for rate limit information.

[ Parent | on HN ]
Re:Rate Limits by nickpsecurity on Wednesday August 17, 2016 @11:16PM (#12310203)
Has anyone published something about the performance, scaling, and price of your HSM's? I'd like a link to it if it's available.
[ Parent | on HN ]