My thinking on how to solve this has changed over the past year or so... there are numerous ways to DoS an httpd server and you can't protect against the more effective attacks at the httpd layer.

I forgot the punch line here but hopefully it's obvious where I'm heading... apr_sendfile on windows performs badly because of a misguided attempt at mitigating a particular DoS attack against the server and the cure is worse than the disease. We should change apr_sendfile to perform optimally on Windows w/o concern for httpd level DoS attacks.

Reply via email to