[ErroraBorealis]

The trusted layer7 attacks would obviously be a problem, but then again, who would know this system is in place without it being public information? We are thinking like we are trying to attack our own site. Who tries to see what kind of protection, besides cloudflare, is in place before attacking? Pretty much nobody, as there is no way to tell. People trying to get revenge are really the only problem IMO. More common for hacking sites who have a lot of competition or members who are assholes or sites that deserve the attacks anyway.

Off-Topic: Does anyway have any resources to learn IP-spoofing?