Under attack, this spam filter blocks clean links on purpose

transcript

Under attack, this spam filter starts blocking clean links. On purpose. And that's exactly the right call. Here's why.

GlobalForum checks every link against a Bloom filter of bad URLs. Any bit is 0? Definitely clean. It posts instantly. All bits are 1? Only a maybe. So the database double-checks. Found? Blocked. Not found? It was a false positive. It posts.

Now picture a crypto crash. Coordinated spam floods in. Ten times normal. About 23,000 checks a second, for hours. 25 million attack URLs. Even the rare maybes mean a lot of database checks.

The tempting move? Swap in a smaller, faster filter. But a Bloom filter can't shrink without a full rebuild. And a fresh one would let known threats through. False negatives.

So above 10,000 requests a second, emergency mode switches on. Same filter. But every hit is trusted. No database check. About 0 point 1 percent of clean links get blocked. And zero known threats get through. Below 7,000 a second, it switches back.

Under attack, trade a little accuracy for a lot of throughput. A few clean links blocked beats one known threat let through.

Full breakdown in the lecture.