Why Some Denial-of-Service and Rate-Limiting Issues Have No Universal Fix

Summary

LiveOverflow argues that many denial-of-service and rate-limiting findings have no universal fix: controls can trade brute-force risk for availability problems, while impact depends on deployment and threat model. It favors operational readiness over bounty-driven whack

Key points

• The creator’s password-hashing test did not substantiate the claimed exhaustion: timings stayed near 0.3 seconds for most tested lengths, and the run eventually failed while generating a 51-million-character input.
• In the Nextcloud example, brute-force throttling made requests sleep; enough sleeping backend processes could affect availability. Changing the behavior to return HTTP 429 altered the trade-off, but did not create a universal fix.
• IP rate limits can be bypassed with multiple addresses, proxies, VPNs, Tor or botnets. Account lockouts can instead block legitimate users and, according to the cited OWASP guidance, create denial-of-service risks.
• The impact of costly requests depends on deployment choices such as timeouts, autoscaling, available resources and the cost of handling the requests.
• Uploads, image processing, data imports and zip bombs are cited as other ways to consume server resources; the video argues their impact and appropriate controls vary by system.
• The creator advocates threat-model-based decisions and operational readiness—such as monitoring and failover—rather than expecting bug bounty reports to produce a single fix for every availability issue.