Can a single machine really saturate a Raspberry Pi web server in 2026? (slowloris/slow HTTP debate)
Hi everyone, I’m not a security expert, my main interests lie elsewhere, but I think I know enough to hold my own in a discussion with a friend.
Today a debate came up with him about the possible attacks that could target a home server (a typical Raspberry Pi) hosting a single and light HTML page.
My take is that in 2026, with the average resources a Raspberry Pi now has (usually 4–8GB of RAM), it’s no longer realistic for a single machine to pull off a resource-exhaustion attack (things like Slowloris or other slow-HTTP techniques). He disagreed, claiming it’s still possible, and said there are other methods too, though he didn’t explain how.
I’d like your opinion on whether what I said is wrong or not. Either way, it’ll be another chance for me to learn something.