I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would be a relief to hear that you thought of this possibility and took adequate countermeasures.
What is meta?
- Any Stack Exchange user can ask a question
- The community provides support, votes on ideas, and reports bugs
- Your voice helps shape the way Stack Exchange operates
The rate limiting that has been implemented should fend off a good deal of basic crap. The team is obviously on top of their infrastructure as is evidenced by this post on the new Serverfault Blog. Also others on the Stackoverflow blog. The measures in place already should go a fair distance in preventing a DDoS, and with constant monitoring I would expect that an attack would be quickly noticed and addressed. I would wager that their relationship with the Peer1 would be such that they would get some priority assistance in the case that an attack ensues.
I find it hard to believe that someone that has access to more zombies than SO has concurrent users would have any reason to attack SO, and if they have less, I don't think that it would more than tickle the servers.
Of course, they have their resident sysadmin that can jump in at any time.
The discipline of Risk Management addresses preparedness.
There are two main constraints of Risk Management: impact and probability.
In order to answer your question, we would gauge the impact of a successful attack and the probability of such an attack occurring.
There are several possible responses to risk; each has its strengths and drawbacks, and the best fit depends upon a variety of factors. In order to "be prepare," (the definition of being prepared) one or more responses would be planned based upon the risk(s).
Wikipedia lists "5 types of DDOS", but for purposes of this exercise, we'll address only one (syn flood). Obviously a comprehensive analysis would take all risks in to account, as each would have different impact/probability numbers and responses.
In light of this, is SO prepared?
According to @squillman's answer, the team has taken steps to mitigate (and possibly transfer) the impact of A DDOS. What about the probability? Possible responses:
Given the above, there are things the SO team could do to reduce the probability of a DDOS attack (besides my contrived examples). They are prepared. They could be more prepared.