SN Sam Newman On The Pragmatic Engineer

“Would I use that as defense against a distributed denial of service attack? No, because then your distributed denial of service attack becomes a distributed denial of cash attack.”

The Pragmatic Engineer · Hands-On Engineering Podcasts · October 2026

“Would I use that as defense against a distributed denial of service attack? No, because then your distributed denial of service attack becomes a distributed denial of cash attack.” — Sam Newman, The Pragmatic Engineer

Newman is talking about automatic scaling in the cloud. He says it suits a startup hit by a sudden wave of real customers, since you can scale up for the peak and back down after. Against an attack, the same mechanism leaves you with no service and a large bill.

Transcript

The Pragmatic Engineer
Gergely Orosz

like, I think we're talking about like solving it with when you have same resources, but then we get into things like scaling. Like, can you scale horizontally, add more resources? Because there's two sides of this, right? Like whenever you have it, and so what point can you do that? Or are you going to face a bottleneck because you still have a central whatever? But

Speaker 4

like that's

Sam Newman

a great example of where sometimes mitigations work and sometimes they don't. So an example of something like your product is successful, if you're a startup or whatever, and you suddenly got successful, that success comes like a wave, right? The wave of success hits you and then a lot of it recedes. You'll get a thousand customers in and maybe you'll keep a hundred, maybe, right? That's just how things work. So you need to be up during the peak, but then you probably can shrink down again to keep the costs low. So if you've built your application to have some dynamic scalability in it, and if you're on the public cloud or similar place where you can spin up and spin down, that's a viable mechanism, right? Okay, we can scale up to handle this and that's fine. Would I use that as defense against a distributed denial of service attack? No, because then your distributed denial of service attack becomes a distributed denial of cash attack, right? You go from to no Only having no service, but also now no money because you hit spinning up, you know, nodes on your Kubernetes cluster and Amazon just keep taking the money. It's great.

Gergely Orosz

Yep.

Sam Newman

And you still can't keep up. So that's a perfectly valid mechanism for some things, but you kind of have to know the context in which to say you can't just scale yourself out of trouble.

Gergely Orosz

I think we're going back to a lot of times as like as an engineer, you want to know about the business. You want to know what creates a value, what creates revenue, what is important for the company versus what is not. And then where we want to maybe invest to with our infrastructure, with our reliability, or is this where it doesn't matter and it's not worth doing? It's

Speaker names from our own diarization · position estimated from where the line sits in the episode

More from The Pragmatic Engineer