[salawat]

A staged DOS is exactly how you perform a back end stress test actually. This is industry standard. It's what testers do every time we want to know when our systems give up and fall over. The key is doing it on a prod like environment before going live.

Your "legitimate traffic" for a finite population of intended users should by definition not be capable of compromising the capacity of your system to operate if you have allocated your resources correctly unless your fundamental implementation is unsound.

Any excess traffic beyond a modest multiple of your expected turnout (I.e. worst case scenario where every citizen of Iowa decides to attend the primary) would by definition be either potential tampering via fuzzing by unintended actors trying to inundate servers to drown out or frustrate your expected userbase,or the most accident/mistake prone gaggle of users ever.

Not saying that happened or that I've seen anything that says it did, I just find your assertion odd that you'd think that a staged DOS in the testing phase against your infrastructure isn't how performance testing works.

[duxup]

>a staged DOS in the testing phase against your infrastructure isn't how performance testing works.

That's exactly what I'm saying... that's not a good test for performance.

It's a good test to see how your DOS mitigation plans work, but it's not a good test for production traffic performance.

[dsfyu404ed]

It doesn't matter if it's a "good" test in the general case. It's a standard test and would have caught this.

[duxup]

> It's a standard test and would have caught this.

There's nothing to indicate that. You could have the service behind any given DOS mitigation system and it would never even touch the back end...