I've been writing a kind of a web-server (without any SQL db, interpreted languages). So, one rather serious man had looked at it, he said like: "there's no problem to crash it... simply by DDoSing...". I agreed with him, but...
That's what I want to ask: which part of protection should be written directly inside code of server. I mean, I do not try to write a net filter (there are some special programs for that, written by professional secure-specialists, as netfilter/iptables ect.), I just try to write well-protected web-server.
So, which kind of web-attack protection should and which shouldn't be inside web-server?
(first thing, I should do - buffer overload protection... That's all I can imagine now...)