News for hackers. Stuff that matters.

A comment on Slowloris - the low bandwidth, yet greedy and poisonous HTTP client. Parent comment

Re:Slowloris - the low bandwidth, yet greedy and poisonous H... by cynicalkane on Tuesday December 07, 2010 @03:26PM (#1980447)
Say many Slowloris clients attack at once. There reaches a point where threads are much less free than events. Newer concurrency systems will handle thousands or millions of lightweight processes without firing up large numbers of native threads, and there's a reason for that design decision.
[ Parent | on HN ]
Re:Slowloris - the low bandwidth, yet greedy and poisonous H... by jamesaguilar on Tuesday December 07, 2010 @04:36PM (#1980726)
> There reaches a point where threads are much less free than events.

Why?

> Newer concurrency systems will handle thousands or millions of lightweight processes without firing up large numbers of native threads, and there's a reason for that design decision.

I would say that is based on the historically accurate but currently false notion that OS threads are expensive to start up or keep idle.

[ Parent | on HN ]
Re:Slowloris - the low bandwidth, yet greedy and poisonous H... by wladimir on Wednesday December 08, 2010 @03:56AM (#1982325)
It's still true -- I recommend looking at some comparisons. Worker-thread based http servers consistently have worse performance at handling a large number of connections, and the error rate for those (simply) using threads is also higher at large number of connections,

For example, see this benchmark of Python web servers: http://nichol.as/benchmark-of-python-web-servers

[ Parent | on HN ]