Honestly, I think it actually makes some sense this way around. To me, in JS “==” is kinda “is like” while “===” is “is exactly”. Or, put another way, “equals” versus idk, “more-equals”. I mean, “===” is a much stronger check of equivalence than normal “==”, so I think it deserves to be the one with the extra “=”

Identity. “A is literally B” instead of “A equals B”. This is necessary here in JS because if A is the string “-1” and B is the integer -1, JS evaluates A==B as true because reasons

DDOS is a pretty brute-force attack, so it isn’t typically relying on a vulnerability per se. Pretty much the only way to mitigate it is to have large enough infrastructure that you can detect and filter out its gobs of spammy traffic, which no Lemmy instances (at least at the moment) can really practically have. They could potentially use a service like CloudFlare, which does have that infrastructure in place, but that can be expensive. I’d imagine CloudFlare (or a competitor) is probably the best solution they can go with, at least in the short-term.