I attended Outskill's Generative AI Mastermind this weekend, & my mind is now buzzing with ideas that I can work on with AI! They gave me a chance to gift this to a friend, & I think you should attend this.
@flipkartsupport Same thing here, no response from the escalation team also @flipkartsupport . There is no transparency or prompt communication from them
@Flipkart Ordered a phone from you, but you cancelled and deducted โน150 as "offer handling fee" & refused full refund! This non-refundable scam hits thousandsโwhere's transparency in policy? Refund my full amount NOW! #FlipkartRefundScam#ConsumerRights@CCI_India
Bought an MSI monitor and later found out they donโt repair physically damaged displays โ not even for a fee.
This policy wasnโt disclosed at purchase. Zero transparency, poor support.
Wonโt buy MSI again. #MSI#CustomerExperience#TechFail
Implemented API rate limiting by IP address. 1000 requests per hour per IP. Perfect protection against abuse.
Next week: Legitimate customer hit rate limit. Complained their service was broken.
They were behind corporate NAT. 500 employees sharing one IP address. Hit limit in 20 minutes.
Changed to rate limit by API key instead. Problem solved.
Week after: Bot attack. 50,000 requests per hour. Different API keys. Free tier abuse.
Changed to rate limit by both IP and API key. Problem solved.
Week after: DDoS from 10,000 different IPs using 10,000 different free tier API keys.
Rate limiting was useless against distributed attacks.
Real solution:
- IP-based rate limiting for unauthenticated endpoints
- API key rate limiting for authenticated endpoints
- Behavioral analysis for suspicious patterns
- CAPTCHA challenge for suspicious traffic
- CloudFlare in front for DDoS protection
- Cost limits on free tier
There's no single rate limiting strategy that works. You need layers. IP, user, account, behavior, and external DDoS protection.