You don't even need JS to perform "DDoS" - simply link to an image or some other resource on the target site from another site with high traffic, and you accomplish essentially the same effect. Forums that allow linking to images/etc. in inline posts and/or signatures are another way to "gather a crowd", and I've accidentally DDoS'd in this way too... not unlike the "slashdot effect". In fact it could be argued that HTTPS makes DDoS even more effective, due to the additional overhead it introduces on each connection.

I think per-IP rate limiting is one of the best ways of preventing DDoS - stop answering clients that issue too many requests in a short time and they will probably choke on their own open-connections limit very soon as the connections start timing out, since the packets are coming from the browser initiating TCP connections and not a dedicated packet-spewing program.