I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would be a relief to hear that you thought of this possibility and took adequate countermeasures.

  • 22
    Sounds suspect to me. Are you preparing one?
    – Gnoupi
    Commented May 27, 2010 at 15:03
  • 5
    Scoping out the joint, eh?
    – Andy E
    Commented May 27, 2010 at 15:04
  • 1
    @Gnoupi Psssht! They must not notice my evil intent yet!
    – mafu
    Commented May 27, 2010 at 15:06
  • 18
    Is anyone truly prepared for a DDoS attack?
    – squillman
    Commented May 27, 2010 at 15:07
  • @squillman: slashdot?
    – perbert
    Commented May 27, 2010 at 15:08
  • @squillman sure, but I'd still assume that a site this big should take basic means to deal with such a thing.
    – mafu
    Commented May 27, 2010 at 15:09
  • 3
    Please go into detail what countermeasures SO has prepared, and where the vulnerabilities are. pulls out notepad Commented May 27, 2010 at 15:26
  • 4
    In the event of (say) a full-scale alien invasion, how prepared do you think this planet's defenses would be? Tell me!
    – Blorgbeard
    Commented May 27, 2010 at 16:05
  • 1
    Are they prepared for the Spanish Inquisition? Commented May 27, 2010 at 16:38
  • 3
    @Lance: No one expects the Spanish Inquisition! Commented May 27, 2010 at 16:41
  • 7
    Regular SO usage can be likened to a DDoS attack :P Commented May 27, 2010 at 20:02
  • @Blorgbeard: That depends, what kind of Aliens? Tommy Lee Jones, Jeff Goldblum and Will Smith are still alive and kicking, so basically nothing can happen to us. Commented Apr 17, 2012 at 14:59
  • 6
    That's a nice Q&A network you got there. It'd be a shame if something were to happen to it.
    – RivieraKid
    Commented Apr 17, 2012 at 15:14
  • 5
    @MichaelMrozek "pulls out notepad"? Psh. A real programmer would use [vi/emacs/notepad++/a magnetized needle and a steady hand].
    – Pops
    Commented Apr 17, 2012 at 15:15
  • @perbert I think squillman was talking about being prepared to withstand a DDoS attack, not create one. :) Commented Jun 6, 2012 at 23:21

3 Answers 3


The rate limiting that has been implemented should fend off a good deal of basic crap. The team is obviously on top of their infrastructure as is evidenced by this post on the new Serverfault Blog. Also others on the Stackoverflow blog. The measures in place already should go a fair distance in preventing a DDoS, and with constant monitoring I would expect that an attack would be quickly noticed and addressed. I would wager that their relationship with the Peer1 would be such that they would get some priority assistance in the case that an attack ensues.


I find it hard to believe that someone that has access to more zombies than SO has concurrent users would have any reason to attack SO, and if they have less, I don't think that it would more than tickle the servers.

Of course, they have their resident sysadmin that can jump in at any time.


Is SO prepared to meet a DDoS attack?

The discipline of Risk Management addresses preparedness.

There are two main constraints of Risk Management: impact and probability.

In order to answer your question, we would gauge the impact of a successful attack and the probability of such an attack occurring.

There are several possible responses to risk; each has its strengths and drawbacks, and the best fit depends upon a variety of factors. In order to "be prepare," (the definition of being prepared) one or more responses would be planned based upon the risk(s).


  • Acceptance

    In this case, the response is to do nothing to prevent the risk from occurring. A plan for dealing with the aftermath might be appropriate. This response is appropriate for low-impact risks or low-impact, low- or medium-probability risks. For example, the risk of an airplane falling on one's house has a low probability. If it does occur, it would be high impact. One would accept the risk because the cost of doing anything else (moving into a cave, erecting an anti-aircraft defense shield) is overkill.

  • Transfer

    The risk is transfered to another party. A common form of this response is insurance. The probability of getting into an automobile accident is high enough and the impact is significant enough to merit transferring the risk to the insurance company. Another example would be to outsource a portion of a project to a third party and make them contractually obligated to deliver.

  • Avoidance

    This response is to eliminate the risk by removing the condition(s) that could lead to the risk being realized. If I have a risk of my backyard grill's propane tank exploding, I simply throw away the tank and the risk is eliminated.

  • Mitigation

    This response is a middle ground between avoidance and acceptance. It reduces the risk's probability and/or impact but does not eliminate the risk. An example of this would be to replace one's 1965 junker with a modern vehicle that had seatbelts, a rollcage, crush zones and airbags in order to mitigate the risk of dying in a car crash.

SO Preparedness

Wikipedia lists "5 types of DDOS", but for purposes of this exercise, we'll address only one (syn flood). Obviously a comprehensive analysis would take all risks in to account, as each would have different impact/probability numbers and responses.

In light of this, is SO prepared?

According to @squillman's answer, the team has taken steps to mitigate (and possibly transfer) the impact of A DDOS. What about the probability? Possible responses:

  • Avoidance - is there a way to avoid a DDOS completely? Short of cutting the cord, no. As long as users can get in, a botnet can attempt to connect.

  • Transfer - is there a way to transfer the risk, so as to avoid the probability? Unlikely. Setting up a honeypot or having the hosting provider take other countermeasures to hide/mask the location of SO would not be feasible.

  • Mitigation - making the site less attractive to griefers/flooders/script kiddies would be a form of this response, but undesirable from a usability standpoint. Employing resources to locate and prosecute perpetrators would not be financially/legally feasible.

  • Acceptance - accept that one is going to get attacked, but taking steps to reduce the impact is probably the easiest response in SO's case.

Given the above, there are things the SO team could do to reduce the probability of a DDOS attack (besides my contrived examples). They are prepared. They could be more prepared.

  • -1 Not sure what information this answer contributes.
    – user164291
    Commented Jun 6, 2012 at 21:36
  • So basically you're saying that squillman has answered the question? What does the unsubstantiated content on the likelihood of an attack add?
    – Bart
    Commented Jun 6, 2012 at 21:41
  • @Bart quillman answered the impact aspect. He did not answer the probability aspect.
    – BryanH
    Commented Jun 6, 2012 at 22:08
  • Fair enough, but you don't back up the probability aspect with anything though. I don't yet see the added value in this answer.
    – Bart
    Commented Jun 6, 2012 at 22:12
  • Done and done...
    – BryanH
    Commented Jun 6, 2012 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .