I'd be really curious to see best practices for smaller startups. We've never been hit with a DDOS, but bot attacks seem pretty commonplace. I'd love to see the open source community come together to create some mitigation strategies, though I admit I don't know what they would entail.