Subject: [weirds] Issue 5: rate limiting return code

From: "John Levine" <[email-masked]>
Date: 16 Mar 2013 22:55:15 -0000

Proposed new section

5.5.  Rate Limits

   Some servers apply rate limits to deter address scraping and other
   abuses.  When a server declines to answer a query due to rate limits,
   it MAY return a 429 response code as described in [RFC 6585].  A
   client that receives a 429 response SHOULD decrease its query rate,
   and honor the Retry-After header if one is present.

   Note that this is not a defense against denial-of-service attacks,
   since a malicious client could ignore the code and continue to send
   queries at a high rate. 

That's MAY rather than MUST or SHOULD because some servers might not
want to disclose their rate limits to random strangers.

---

From: Simon Perreault <[email-masked]>
Date: Tue, 19 Mar 2013 10:17:23 +0100

>     since a malicious client could ignore the code and continue to send

Excellent text!

> want to disclose their rate limits to random strangers.

In that case, s/MAY/SHOULD unless prohibited by local policy/.

Simon

---

From: Joseph Yee <[email-masked]>
Date: Tue, 19 Mar 2013 08:53:57 -0400

>>     since a malicious client could ignore the code and continue to send
+1

> In that case, s/MAY/SHOULD unless prohibited by local policy/.

I think MAY is good enough, but if this ensure operator has full
control how they intended to deal with rate limiting, I'm for it.

Joseph

> Simon
>
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds

---

From: Michael Young <[email-masked]>
Date: Tue, 19 Mar 2013 09:08:24 -0400

I'm in favour of this addition.

Michael Young

M:647-289-1220