| > scale your service Scaling is done entirely at the expense of the service provider, so, not a sustainable option (and AIUI already done so as to continue serving for other users, but at terrible cost). Scaling issues are good to have when you have customers, not when you personally foot the bill. > adjust your terms At the very least changing terms won't change the already deployed app instances. In each of the three delineated scenarios it won't even register a blip on the abuser radar. So, not an option. > start rate limiting Pretty sure that was attempted. This is DDoS, rate limiting means doing it across the board, impacting every user, including those in good standing. > or shut it down. The only effective option. a.k.a the nuclear option a.k.a We Can't Have Nice Things. > get someone's attention That's the end game of these gray tactics. Not wreaking havoc but triggering awareness in a last resort way so that dialog can be opened/corrective measures can be taken. Note that "shut it down" would presumably have a similar effect, so there's no real harm done in practice. |