It was due to 4chan's success with CF that I chose it for the projects I was the lead system architect for.

Even if they gave lead time, how many hosts will update it? Especially the fly-by-night budget VPS providers

Anyone dealing with production code should do this, in my opinion. Hope for the best but plan for the worst.

Every defense system has its limitations. There's a truism that if brute force doesn't work, you aren't using enough of it and I think that applies to running a DDOS attack.