A recent incident on WDQS show that our throttling is not aggressive enough. The current throttling starts tracking users only once they make a request which takes more than 10 seconds to complete. This does not prevent a single user from generating enough short request to overload the system. We should reduce this threshold (or even remove it entirely), without changing the current limits.

For the record, the current limits are:

• 60 seconds of processing time per minute (peak at 120 seconds)
• 30 errors per minute (peak at 60)