Google App Engine and ddos.xml
===

My understanding is that the only way to really mitigate a DDoS attack is to automate the process of blacklisting IP addresses/ranges.

Google App Engine (GAE) allows you to configure and upload a `ddos.xml` file and specify IP addresses/ranges to blacklist at any given time.

Obviously, if my web app is under a well-orchestrated DDoS attack, the IP addresses/ranges that will be attacking me will be constantly changing.

How often does GAE allow me to update `ddos.xml`? How long does it take the changes to go into effect? I ask because I'm devising an `AutoBlacklister` system that inspects the IP addresses that it believes to be the attackers, and will update `ddos.xml` dynamically. If there are more than 100 attackers (GAE restricts you to 100 address/ranges) then only the Top 100 "worst offenders" will be on the list.

But, if `ddos.xml` can only be updated with a certain periodicity (like once a day, etc.), and if it takes too long (more than a few minutes!) to take effect,then this system is pretty much useless against a **real** DDoS.

Also, this question assumes there's a way to automate the uploading of `ddos.xml`: is there? I would *imagine* there's a secure URL I could upload the file to with something like `HttpClient`, but with GAE, you never know what terms/restrictions you're going to face! Thanks in advance!