Aug 3, 2026

I've implemented the DoS protection throttle. This operates in the network proxy (the socket encapsulator and base class for all channels). The real work was done in every piece of network code over the past 5 years. Protection operates on backpressure, a design principle I picked up from the late great Pieter Hintjens. So really there's nothing to do except to set a rate limit, so a timer, a handler, and a config setting. The config setting was already in there, and now the rest is done. I will probably also drop in a per service override config setting. There is no limit whatsoever on how much can be sent to the node/server. The limit is on what we send back. Queries are small, responses are large and costly - and generally the larger the more costly (though not always, so there's some room for tuning this). The interesting part about the handling is that there is no moving window, accumulation or averaging. There's just a rate at which we reply (or notify), in bytes per time. The send is emitted (at network speed of course), and then the handler invocation is delayed (asynchronously) until the time allocated for that number of bytes is reached. So if the configured rate is faster than network speed, there's no limit. Otherwise the channel is reduced to the configured speed. The total cost is just the timer invocation and its handler indirection, which are trivia in terms of network perf.