# rate-limiting Rate limiting is a computing and networking technique that controls how many operations or requests can be performed within a given time to prevent system overload and mitigate denial-of-service attacks. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Rate-limit downstream APIs with separate Task Queues DevFeed: [Rate-limit downstream APIs with separate Task Queues]() Original publisher: [Read original article]() Author: Cecil Phillip Published: 2026-05-25T00:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [rate-limiting](), [API](), [Concurrency](), [configuration]() Tags: [apis](), [concurrency](), [configuration](), [queues](), [rate-limiting](), [service](), [temporal-concepts]() ### AI overview This tutorial explains how to use separate Temporal Task Queues with global and optional per-Worker rate limits, plus concurrency limits, to keep Activities within downstream API quotas and help prevent 429 errors and account issues. ### Source excerpt Stop hitting 429s on downstream APIs. Use rate-limited Temporal Task Queues to keep Activities under SendGrid, Stripe, and OpenAI quotas. ## Replay '26: My introduction to Temporal DevFeed: [Replay '26: My introduction to Temporal]() Original publisher: [Read original article]() Author: Jap Singh Published: 2026-05-21T00:00:00Z Content type: opinion Language: en Sources: [Temporal Blog]() Topics: [Development](), [Hackathon](), [Artificial Intelligence](), [rate-limiting](), [Orchestration](), [Go Language](), [Java](), [Python]() Tags: [ai](), [company](), [conference](), [experience](), [hackathon](), [orchestration](), [rate-limiting](), [software](), [temporal-voices](), [vibe-coding]() ### AI overview A new Temporal employee recounts attending Replay '26 during their first week at the company. The article highlights developer discussions about AI-heavy workflows, rate limiting, enterprise use cases, clinical-trial monitoring, and workshops in Java, Go, and Python. ### Source excerpt Jap Singh joined Temporal and found himself at Replay '26 in his first week. His experience changed his view on the company. ## SSH Port 22: Custom Ports, Port Forwarding Security, and Production SSH Hardening DevFeed: [SSH Port 22: Custom Ports, Port Forwarding Security, and Production SSH Hardening]() Original publisher: [Read original article]() Author: info@goteleport.com (Matt Keib) Published: 2026-05-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Security](), [OpenSSH](), [ssh](), [Authentication](), [rate-limiting](), [Authorization](), [configuration]() Tags: [configuration](), [hardening](), [port](), [rate-limiting](), [security](), [server](), [ssh](), [tcp](), [tcp-handshake]() ### AI overview This article explains that SSH port 22 is a historical TCP entry point with no inherent cryptographic or authentication significance. It covers port forwarding risks, cryptographic and authentication configuration, rate limiting, and production SSH hardening. ### Source excerpt Learn about SSH port 22, its limitations, port forwarding security, and how to harden production SSH. ## Agentic AI removes human safeguards from enterprise data feedback loops DevFeed: [Agentic AI removes human safeguards from enterprise data feedback loops]() Original publisher: [Read original article]() Author: flashdba Published: 2026-04-20T22:04:35Z Content type: opinion Language: en Sources: [flashdba]() Topics: [Artificial Intelligence](), [data-architecture](), [data-engineering](), [rate-limiting](), [audit trail]() Tags: [agentic](), [agentic-ai](), [ai](), [audit-trail](), [cloud](), [data-architecture](), [data-engineering](), [databases](), [databases-and-agentic-ai](), [inferencing](), [performance](), [rate-limiting]() ### AI overview This opinion article argues that enterprise data architectures traditionally relied on human involvement as an implicit safeguard. Delays, approvals and handoffs helped absorb errors, create audit points and limit the speed of changes. Agentic AI can close the feedback loop at machine speed, potentially removing those protections along with the human decision point. ### Source excerpt Classic enterprise data architecture had an implicit safeguard built into it. The human in the loop provided error absorption, audit accretion and natural rate-limiting - none of which were ever specified. Agentic AI removes the human. It removes all of those protections simultaneously. ## How AI firewalls protect production applications from prompt injection, data leakage, and excessive usage DevFeed: [How AI firewalls protect production applications from prompt injection, data leakage, and excessive usage]() Original publisher: [Read original article]() Author: Alex Ewerlöf Published: 2026-03-15T23:51:29Z Content type: tutorial Language: en Sources: [Alex Ewerlof Notes]() Topics: [Firewall](), [Security](), [prompt injection](), [LLMs](), [rate-limiting](), [pii]() Tags: [architecture](), [firewall](), [llms](), [pii](), [prompt-injection](), [rate-limiting](), [security]() ### AI overview This tutorial explains AI firewalls, or AI gateways, as reverse proxies with AI-focused inspection between an application backend and an inference provider. It covers ingress attacks such as prompt injection, egress risks including PII and secrets, rate limiting to control costs, latency considerations, implementation trade-offs, and layered defenses. ### Source excerpt How to protect your AI application in production against new classes of attacks ## hybrid quota-linear rate limiter DevFeed: [hybrid quota-linear rate limiter]() Original publisher: [Read original article]() Published: 2026-01-13T00:12:01Z Content type: article Language: en Sources: [Tony Finch's blog]() Topics: [rate-limiting](), [Algorithms]() Tags: [algorithm](), [quotas](), [rate-limiting]() ### AI overview The article explores a hybrid quota-linear rate limiter intended to enforce request quotas more precisely within a time window while limiting storage costs and avoiding bursty client behavior. It compares linear rate limiting with fixed-window quota resets and notes trade-offs, including throttling response time and burstiness. ### Source excerpt A while back I wrote about the linear rate limit algorithms leaky bucket and GCRA. Since then I have been vexed by how common it is to implement rate limiting using complicated and wasteful algorithms (for example). But linear (and exponential) rate limiters have a disadvantage: they can be slow to throttle clients whose request rate is above the limit but not super fast. And I just realised that this disadvantage can be unacceptable in some situations, when it's imperative that no more than some quota of requests is accepted within a window of time. In this article I'll explore a way to enforce rate limit quotas more precisely, without undue storage costs, and without encouraging clients to oscillate between bursts and pauses. However I'm not sure it's a good idea. linear reaction time fixed window quota resets hybrid quota-linear algorithm discussion opinion linear reaction time How many requests does a linear rate limiter allow before throttling? The parameters for a rate limiter are: q, the permitted quota of requests w, the accounting time window So the maximum permitted rate is q/w. Let's consider a client whose rate is some multiple a > 1 of the permitted rate (a for abuse factor) c = a * q/w I'll model the rate limiter as a token bucket which starts off with q tokens at time 0. The bucket accumulates tokens at the permitted rate and the client consumes them at its request rate. (It is capped at q tokens but we can ignore that detail when a > 1.) b(t) = q + t*q/w - t*a*q/w The time taken for n requests is t(n) = n/c = (n*w) / (a*q) After n requests the bucket contains b(n) = q + n/a - n The rate limter throttles the client when the bucket is empty. b(t) = 0 = q + t * (1 - a) * q/w 0 = 1 - t * (a - 1) / w t = w / (a - 1) b(n) = 0 = q + n * (1/a - 1) 0 = q - n * (a - 1) / a n = q * a / (a - 1) For example, if the client is running at twice the permitted rate, a=2, they will be allowed q*2 requests within w seconds before they are throttled. That's a bit slow. T ## Proxy inverso con Nginx: guía práctica DevFeed: [Proxy inverso con Nginx: guía práctica]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-09T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [nginx](), [proxy](), [rate-limiting](), [let's encrypt](), [rhel](), [SELinux]() Tags: [let-s-encrypt](), [nginx](), [proxy](), [rate-limiting](), [rhel](), [selinux](), [ssl]() ### AI overview A practical Spanish-language guide to using Nginx as a reverse proxy. It covers routing traffic to internal applications, HTTPS with Let's Encrypt, load balancing, upload and proxy timeout settings, request-rate limiting, gzip compression, security headers, and the 502 issue associated with SELinux on RHEL. ### Source excerpt Nginx como proxy inverso: subidas de archivos grandes, timeouts, rate limiting, gzip y el clásico 502 por SELinux en RHEL. ## Building a Transparent Keyserver DevFeed: [Building a Transparent Keyserver]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2025-12-19T14:03:18Z Content type: tutorial Language: en Sources: [Filippo Valsorda]() Topics: [systems](), [rate-limiting](), [Go Language](), [Server](), [SQLite](), [Authentication](), [Tooling](), [Command-line interface]() Tags: [api](), [authentication](), [building](), [cli](), [go](), [privacy](), [rate-limiting](), [server](), [sqlite](), [tooling](), [transparency-log]() ### AI overview This tutorial builds a centralized keyserver for looking up age public keys. It applies transparency-log technology to help keep the operator accountable and prevent surreptitious injection of malicious keys while protecting user privacy. The implementation uses a Go server, SQLite database, APIs, email authentication, a CAPTCHA, and a Go CLI. ### Source excerpt We apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning. ## How to Configure Leaky Bucket, GCRA, and Exponential Rate Limiters DevFeed: [How to Configure Leaky Bucket, GCRA, and Exponential Rate Limiters]() Original publisher: [Read original article]() Published: 2025-09-14T03:30:44Z Content type: tutorial Language: en Sources: [Tony Finch's blog]() Topics: [rate-limiting](), [client](), [HTTP](), [email](), [Server]() Tags: [client](), [email](), [http](), [rate-limiting](), [servers]() ### AI overview This article explains how to configure leaky bucket, GCRA, and exponential rate limiters using a limit and a period. It describes average rates, burst sizes, forgetting behavior, and an email-server example for detecting spam. ### Source excerpt Last year I wrote a pair of articles about ratelimiting: GCRA: leaky buckets without the buckets exponential rate limiting Recently, Chris "cks" Siebenmann has been working on ratelimiting HTTP bots that are hammering his blog. His articles prompted me to write some clarifications, plus a few practical anecdotes about ratelimiting email. mea culpa The main reason I wrote the GCRA article was to explain GCRA better without the standard obfuscatory terminology, and to compare GCRA with a non-stupid version of the leaky bucket algorithm. It wasn't written with my old exponential ratelimiting in mind, so I didn't match up the vocabulary. In the exponential ratelimiting article I tried to explain how the different terms correspond to the same ideas, but I botched it by trying to be too abstract. So let's try again. parameters It's simplest to configure these ratelimiters (leaky bucket, GCRA, exponential) with two parameters: limit period The maximum permitted average rate is calculated from these parameters by dividing them: rate = limit / period The period is the time over which client behaviour is averaged, which is also how long it takes for the ratelimiter to forget past behaviour. In my GCRA article I called it the window. Linear ratelimiters (leaky bucket and GCRA) are 100% forgetful after one period; the exponential ratelimiter is 67% forgetful. The limit does double duty: as well as setting the maximum average rate (measured in requests per period) it sets the maximum size (measured in requests) of a fast burst of requests following a sufficiently long quiet gap. how bursty You can increase or decrease the burst limit - while keeping the average rate limit the same - by increasing or decreasing both the limit and the period. For example, I might set limit = 600 requests per period = 1 hour. If I want to allow the same average rate, but with a smaller burst size, I might set limit = 10 requests per period = 1 minute. anecdote When I was looking after email servers ## Introducing Action Push Native DevFeed: [Introducing Action Push Native]() Original publisher: [Read original article]() Author: Jacopo Beschi Published: 2025-08-18T17:00:00Z Content type: release Language: en Sources: [37signals Dev]() Topics: [Rails](), [notifications](), [push-notification](), [Mobile](), [rate-limiting](), [HTTP](), [Amazon Web Services]() Tags: [aws](), [http](), [mobile](), [notifications](), [push-notification](), [push-notifications](), [rails](), [rate-limiting]() ### AI overview 37signals introduces Action Push Native, an open-source Rails gem for sending push notifications directly through Apple Push Notification service and Google Firebase Cloud Messaging. The gem supports retries, rate limiting, and automatic removal of inactive devices. ### Source excerpt A Rails gem for sending push notifications to mobile platforms. ## Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway DevFeed: [Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway]() Original publisher: [Read original article]() Author: Julián Duque Published: 2024-07-29T18:00:00Z Content type: tutorial Language: en Sources: [Heroku]() Topics: [gateway](), [Heroku](), [API](), [Deployment](), [Security](), [Microservice](), [Cloud](), [Authentication](), [Authorization](), [Encryption](), [rate-limiting](), [Latency]() Tags: [api](), [api-gateway](), [api-security](), [apis](), [app-architecture](), [authentication](), [authorization](), [cloud](), [deployment](), [developer-tools](), [encryption](), [engineering](), [heroku](), [integration](), [integrations](), [latency](), [microservices](), [rate-limiting](), [salesforce](), [security]() ### AI overview A tutorial on deploying MuleSoft Anypoint Flex Gateway on Heroku to expose private APIs and microservices. It describes the gateway's API management, security, traffic management, rate limiting, and scalability capabilities, with possible integration with Salesforce. ### Source excerpt In today's fast-paced digital world, companies are looking for ways to expose their APIs and microservices to the internet while enhancing their overall API security. MuleSoft Anypoint Flex Gateway is a powerful solution that solves this problem. Let's walk through deploying the Anypoint Flex Gateway on Heroku in a few straightforward steps. You'll learn how [...] The post Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway appeared first on Heroku. ## Load Testing for Expected Increases in Traffic with Vegeta DevFeed: [Load Testing for Expected Increases in Traffic with Vegeta]() Original publisher: [Read original article]() Author: Reid Knight was a Software Engineer Published: 2017-12-21T13:00:00Z Content type: tutorial Language: en Sources: [Curalate]() Topics: [Testing](), [API](), [Caching](), [rate-limiting]() Tags: [api](), [caching](), [load-testing](), [rate-limiting](), [testing](), [vegeta]() ### AI overview This article explains how Curalate plans and performs load testing for predictable increases in service and API traffic, including holiday peaks. It discusses dependencies, caching, staging versus production environments, rate limiting, and expected load across services. ### Source excerpt At Curalate, our service and API traffic is fairly tightly coupled to e-commerce traffic, so any increase is reasonably predictable. We expect an increase in request rate towards the beginning of November each year, with traffic peaking at 10x our steady rate on Black Friday and Cyber Monday. Why Load Test? Curalate works directly with retail brands to drive traffic to their sites. The holiday shopping period is the most important time of the year for most of them, and we need to ensure that our experiences continue to operate at a high standard throughout. More generally, though, load testing is critical for services and APIs, especially in cases where load is expected to increase. It uncovers potential points of failure, during business hours, and hopefully prevents people from needing to wake up at 2 a.m. on a weekend. Creating a Test Plan In cases of expected load increases, it's important to understand as much as possible before diving into it. There are a few questions to ask: Is there any data available so I can understand the expected load? Is it a yearly increase - are previous years a good indication? If it's a brand new launch, what are the expectations? What are the hard and soft dependencies of the service or API that I'm testing? What sort of caching is in place? Does a 10x increase on my service cause a 10x increase on everything downstream, as well? Should we test against the active production environment, or is it feasible to spin up a staging environment with the same scaling behavior? Depending on the breadth of dependencies, it may not be possible to spin up a new duplicated environment. If I test against production, how can I ensure I don't negatively affect live traffic? Am I expecting an increase in load across services? If there are any core dependencies, what does the combined load look like at peak? How much of a buffer do I provide against the expected peak? Does my service have any rate limiting that I need to bypass or keep in mind? How ## Android Nougat and rate limiting of notification updates DevFeed: [Android Nougat and rate limiting of notification updates]() Original publisher: [Read original article]() Author: Saket Narayan Published: 2017-08-28T11:23:55Z Content type: article Language: en Sources: [Saket Narayan]() Topics: [Android](), [rate-limiting](), [notifications](), [RxJava]() Tags: [android](), [notifications](), [nougat](), [rate-limiting](), [rxjava]() ### AI overview The article explains why progress notifications for image downloads can stop reaching 100% on Android Nougat and later. It attributes the behavior to Android notification-update rate limiting, which was reduced in Nougat, and describes using RxJava to throttle updates to about five per second. The author notes that the limit applies per package and that the issue is not fully solved. ### Source excerpt While working on a feature for downloading images in my app, I ran into a strange issue where progress notifications were never reaching 100%. Knowing that the framework is usually not wrong, I started suspecting my own skills (as usual). To make matters worse, nobody was able to reproduce the issue in a sample project I shared with other [...] The post Android Nougat and rate limiting of notification updates appeared first on Saket Narayan.