I am unaware of any successful DDOS (other than accidental ones) which food not make some use of unsuspecting people's computers, either by ping reflection, botnets or secret iframes. All of these sound less like a sit-in and more like an attack which should be prosecuted to me.

I am happy to hear of counterexample.