Comment by nickff

Does everything you say apply equally to DDoS attackers? If not, you need to come up with some way to differentiate ‘malicious users’ from benign ones. Amazon’s ‘bright line’ seems reasonable, though I’d personally love to see an even better one.