{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/227","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/227/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/227/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/227/events","html_url":"https://github.com/letsencrypt/boulder/issues/227","id":81064823,"number":227,"title":"VA should use a queue for processing challenges","user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/letsencrypt/boulder/milestones/3","html_url":"https://github.com/letsencrypt/boulder/milestones/Defer","labels_url":"https://api.github.com/repos/letsencrypt/boulder/milestones/3/labels","id":1071288,"number":3,"title":"Defer","description":"Deferred tasks","creator":{"login":"jcjones","id":518542,"avatar_url":"https://avatars.githubusercontent.com/u/518542?v=3","gravatar_id":"","url":"https://api.github.com/users/jcjones","html_url":"https://github.com/jcjones","followers_url":"https://api.github.com/users/jcjones/followers","following_url":"https://api.github.com/users/jcjones/following{/other_user}","gists_url":"https://api.github.com/users/jcjones/gists{/gist_id}","starred_url":"https://api.github.com/users/jcjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcjones/subscriptions","organizations_url":"https://api.github.com/users/jcjones/orgs","repos_url":"https://api.github.com/users/jcjones/repos","events_url":"https://api.github.com/users/jcjones/events{/privacy}","received_events_url":"https://api.github.com/users/jcjones/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":0,"state":"open","created_at":"2015-04-16T20:22:03Z","updated_at":"2015-05-26T17:56:35Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2015-05-26T17:42:35Z","updated_at":"2015-05-27T00:20:24Z","closed_at":null,"body":"This will allow rate limiting outbound connections by IP or hostname."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/105702649","html_url":"https://github.com/letsencrypt/boulder/issues/227#issuecomment-105702649","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/227","id":105702649,"user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T00:20:24Z","updated_at":"2015-05-27T00:20:24Z","body":"To be clear, I'm not talking about rate limiting by the IP of the client request, but the IP of the resolved hostname. The former probably should live in the client; The latter probably should live in the VA, since the WFE shouldn't be resolving hostnames in challenges.\r\n\r\nWe need the latter because it would be easy to use clients on N different IP addresses to create thousands of challenges against unique domains that all resolve to the same IP address.\r\n\r\nThis is probably low-ish priority since, at first, we're not likely to be big enough to cause serious load issues to a site attacked in such a way."}}