Ask HN: How does Hacker News avoid (successful) DDoS attacks?

Hacker News has an API¹ that doesn't require authentication and doesn't have a rate limit. Naively, that seems like a perfect recipe for DDoS attacks. Yet HN is typically a very reliable site. So what's the secret?

Fn 1: https://github.com/HackerNews/API