If I understand your post correctly, it sounds like you are working for a startup where people consistently work 9 or 8 hour days (or less). As someone who has worked as a developer for 15 years (in both startups and large companies) and who has also started my own successful company and grown it to a market leader, let me share my opinion on how startups work. Remember that the vast majority of startups fail. To make a startup successful, you need either:

(a) An incredible amount of pure dumb luck and good timing (very rare)
(b) A little bit of luck PLUS an incredible amount of hard work and dedication

If you go to the owner of your startup and say "We will work harder if you pay us more", that indicates that you don't have the intrinsic drive needed to make a startup successful. If on the other hand you go to the owner and say: "Listen, we are going to work as hard as humanly possible to make this successful. We'll work all nighters, 18 hour days, whatever -- we will do what it takes on a consistent basis, making sure that we don't get so burned out that we're making bad decisions or doing poor quality work. In return, we expect to have ownership in this company [aka stock options or even better, a straight grant of common stock if you can negotiate it], to be compensated well, and to have a productive work environment. We don't need rules on minimum hours per day -- in fact if you need these rules to make people work harder, we probably have the wrong people on the team."

If you're not willing to get on board with that, you don't have what it takes to make a startup successful and you should seek work elsewhere. If the owner of the company is not willing to get on board with that, then HE (or she) does not have what it takes to make a startup successful and you should seek work elsewhere.

Cheers

OpenBSD's pf firewall has some options that can help mitigate the "single attacker, single source IP" version of this attack. Of course if the attackers decide to spread the attack out over multiple source IPs like a DDoS, this becomes much harder to deal with until Apache has a patch.

Filter rules that create state entries can specify various options to control the behavior of the resulting state entry. The following options are available:

max number

Limit the maximum number of state entries the rule can create to
number.
If the maximum is reached, packets that would normally create state
fail to match this rule until the number of existing states decreases
below the limit.

no state

Prevents the rule from automatically creating a state entry.

source-track

This option enables the tracking of number of states created per
source IP address.

The total number of source IP addresses tracked globally can be
controlled via the

src-nodes runtime option.

max-src-nodes number

When the source-track option is used,
max-src-nodes will limit the number of source IP addresses that
can simultaneously create state.
This option can only be used with source-track rule.

max-src-states number

When the source-track option is used,
max-src-states will limit the number of simultaneous state
entries that can be created per source IP address.
The scope of this limit (i.e., states created by this rule only or
states created by all rules that use source-track) is dependent
on the source-track option specified.