llHTTPRequest...what are the possibilities?

Definately onboard with the "exponential delay" idea... cancelling requests is prone to cause some serious issues with perfectly legitimate items that simply get a lot of traffic.

I have an idea:

What if non-attached, in-world objects HTTP requests continue to originate from the simulator and are subject to throttling while scripts in attachments (which require an active agent) use the SL viewer to originate the request.

That way, attachment scripts need not be subject to throttling since they only originate from the computer of that particular user and not the simulator.

I'd still want blocking instead of delay beyond a certain point, both to keep people from running multiple scripts to get around it, and to let my script know there's a problem. Don't forget, that problem COULD be from another script run by the same user, and you don't know that...

So after the requests are taking more than a fraction of a second it'll llRezObject() a proxy containing 10 scripts that each make one request and llSay()s the result and let the next make another. After THAT gets to slow it llRez()es another...

Alternatively, it can get a block, then do its own exponential backoff and notify the user and he can take off the Hand Of Spam.

Just a thought, but another idea ergo strict throttling and exponential delays to HTTP requests. But if we're concerned about illegitimate uses (ie DOS attacks), would it make sense to have a script register a web-site before it can send requests to it?

The idea is fairly straight-forward, basically if you want to access www.haravikk.com, then you must first call llHTTPRegister("www.haravikk.com/sl.php", which could return a key or something.
What this will do is query that URL, and wait for a valid response, if the response is valid then you'll get a reply event declaring your script has registered successfully to the domain you queried (note the domain, not just the exact link specified).

It would have a fairly hefty, fixed delay, so would need to be used when starting your script, but the idea is that any repeated calls you're going to make are going to be the same domain or set of domains anyway. If you make too many failed register requests then the script will fail.

The only disadvantage really is web-browsing, however, for things like that you should be able to have scripts on your own server doing the call to google or whatever and outputting the response, so attempting to DOS attack a site would just bring yours down instead

Dunno, it probably has flaws, and I'm tired, but I figured I'd throw it out if it's a more viable alternative to give us less restrictive throttling if something exponential is harder to implement.