7 ms·

A WAF will stop a lot of the stupid junk that a kid with a "how 2 hax0r" book can make work a disturbing amount of the time.

tptacek 9y ago
If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Don't waste time with this stuff.
- nxc18 9y ago
  I assume you are writing in an attempt to persuade. Your message is being lost/ignored as a result of your delivery. We want to understand your message, but you aren't giving enough background. I don't trust your message because there is no supporting background. If you're going to tell me to not do something, either: A) provide a compelling alternative (not doing $it is not a compelling alternative to $it in nearly all cases) B) explain in detail why you shouldn't do $it. Provide more details if asked. I want to believe what you are saying and be convinced by it, please help me. (Note: I'm not trying to be a dick, I've just known a lot of people who are perpetually ignored because of this communication style and take forever to learn that lesson because no one bothers to say anything)
  - tptacek 9y ago
    In this instance, I'm just interested in getting the right answer written down and moving on.
  - pvg 9y ago
    I'm not trying to be a dick You are succeeding without trying. You're essentially complaining some free advice does not fit your exact expectations and specifications. Which is fine, lots of free advice doesn't. Trying to pass this complaint off as some kind of favour to the person giving you free advice, though, is... less than great.
    - irundebian 9y ago
      No, tptacek just doesn't give proper answers here because he thinks he can afford it with his status here. He could have just left links to further links/literature.
      - pvg 9y ago
        There's nothing 'improper' about the answers, you just don't like how they're presented. As I said, that's a totally fair objection. It's just that nobody owes you free advice in the precise format you find acceptable. That's usually a feature of paid advice.
  - TeMPOraL 9y ago
    I think tptacek's implicit point is this: all the problems you're trying to address with the tools listed are the problems you shouldn't be having in the first place, so, to quote, "focus on removing attack surface, rather than continuously monitoring it".
  - anothergoogler 9y ago
    > We want Please speak for yourself alone. tptacek's comments in the thread are quite clear.
  - hueving 9y ago
    tptacek is using an appeal to authority given his standing as a security expert on this forum. That's the only reason his comment containing no justification is being taken seriously.
    - evgen 9y ago
      It is also being taken seriously because 1) he is correct, and 2) those of us who do this for a living are literally sick to fucking death of having to explain to management, developers, and sysadmins that there is no silver bullet that you can buy that will fix the mistakes you should have cleaned up five years ago. You still have to do the work. If you need to hear this ("reduce attack surface rather than spend time/money on monitoring attack surface") more than once you are beyond help and it is time for us to move on to people for whom there is at least a possibility that they won't be p0wned in the next 12 months.
      - irundebian 9y ago
        This isn't a religious/esoteric forum here. Technical statements should be backed by proper reasons regardless of who is stating something. If you are sick to tell technical reasons then why bothering posting on HN?
        lvh 9y ago
        Because there are people who are willing to believe that something is good or bad without needing to understand the rationale behind it? Most people making the case for WAFs aren't posting detailed rationales of why WAFs are a good way to spend your resources either. Example, same author: Cryptographic Right Answers. (Disclaimer: I work with tptacek.)
        irundebian 9y ago
        That's whataboutism. I'm not interested in anyone who fails at giving proper arguments. Neither when tptacek is it or someone else. The sense of giving rational arguments lies not only in the persuasion of the parent poster but also on the information of anybody else who is reading. And simple "Don't do most of this." and "You almost certainly don't want to set up a WAF." are just crappy answers which are based on authority and therefore meaningless.
  - wglb 9y ago
    I posted this elsewhere in the thread. To be convinced, read this frightening paper: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf
- Alex3917 9y ago
  > If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Is this advice assuming that it's devs who want the WAF, rather than ops or management? For devs clearly it's not what they should be focusing on. But saying something isn't worth doing because it shouldn't work is a terrible security principle.
  - tptacek 9y ago
    I wrote a longer comment here, but decided it wasn't helping. So, I'm just going to go with: no, if you're really building an application and care about application security, no, you shouldn't waste time setting up a WAF tool designed to help 10,000 employee insurance companies make sure their Wordpress marketing site isn't exposing some vulnerability from 3 years ago. Not wasting time with dumb stuff like this isn't "terrible security"; every dumb thing you do exacts a cost from good things you could be doing instead.
    - subcosmos 9y ago
      "Don't invest in a home security system because your windows should be completely shatterproof"
      - balls187 9y ago
        More like, "Don't invest in home security, because your most precious valuables are stored in a safety deposit box at a bank, and everything else is covered by home insurance."
      - pennaMan 9y ago
        "Don't invest in a home security system before you make sure your house has a door"
        subcosmos 9y ago
        Something tells me those taking objection to my comment are missing the point that I am criticizing the parent.... If your counterexample is just reinforcing the parents erroneous point that WAFs only protect against specific applications with known vulnerabilities, and that not all websites have "doors", then you are missing the point that many WAFs have detectors for fairly generic sql injection and path traversal techniques that could very well find problems with even custom application endpoints....
sebcat 9y ago
A WAF will also add an attack surface, just like anti-virus software before them. Company X, a content publisher, has a wordpress site with a bunch of plugins. They hear that the security record of such a setup is less than ideal. They buy a WAF solution to protect them. Company Y, also a content publisher in the same space, realizes that they don't need dynamically generated content. They don't need tons of JS. They start publishing static content and what little dynamic functionality they have is well-compartmentalized, with interactions to the outside world carefully audited. Company Y could also get a WAF, but why? It increases the attack surface, Company Y probably don't have the time/expertise to audit it, it is not clear what benefits it will have.

tptacek 9y ago

If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Don't waste time with this stuff.

nxc18 9y ago
I assume you are writing in an attempt to persuade. Your message is being lost/ignored as a result of your delivery. We want to understand your message, but you aren't giving enough background. I don't trust your message because there is no supporting background. If you're going to tell me to not do something, either: A) provide a compelling alternative (not doing $it is not a compelling alternative to $it in nearly all cases) B) explain in detail why you shouldn't do $it. Provide more details if asked. I want to believe what you are saying and be convinced by it, please help me. (Note: I'm not trying to be a dick, I've just known a lot of people who are perpetually ignored because of this communication style and take forever to learn that lesson because no one bothers to say anything)
- tptacek 9y ago
  In this instance, I'm just interested in getting the right answer written down and moving on.
- pvg 9y ago
  I'm not trying to be a dick You are succeeding without trying. You're essentially complaining some free advice does not fit your exact expectations and specifications. Which is fine, lots of free advice doesn't. Trying to pass this complaint off as some kind of favour to the person giving you free advice, though, is... less than great.
  - irundebian 9y ago
    No, tptacek just doesn't give proper answers here because he thinks he can afford it with his status here. He could have just left links to further links/literature.
    - pvg 9y ago
      There's nothing 'improper' about the answers, you just don't like how they're presented. As I said, that's a totally fair objection. It's just that nobody owes you free advice in the precise format you find acceptable. That's usually a feature of paid advice.
- TeMPOraL 9y ago
  I think tptacek's implicit point is this: all the problems you're trying to address with the tools listed are the problems you shouldn't be having in the first place, so, to quote, "focus on removing attack surface, rather than continuously monitoring it".
- anothergoogler 9y ago
  > We want Please speak for yourself alone. tptacek's comments in the thread are quite clear.
- hueving 9y ago
  tptacek is using an appeal to authority given his standing as a security expert on this forum. That's the only reason his comment containing no justification is being taken seriously.
  - evgen 9y ago
    It is also being taken seriously because 1) he is correct, and 2) those of us who do this for a living are literally sick to fucking death of having to explain to management, developers, and sysadmins that there is no silver bullet that you can buy that will fix the mistakes you should have cleaned up five years ago. You still have to do the work. If you need to hear this ("reduce attack surface rather than spend time/money on monitoring attack surface") more than once you are beyond help and it is time for us to move on to people for whom there is at least a possibility that they won't be p0wned in the next 12 months.
    - irundebian 9y ago
      This isn't a religious/esoteric forum here. Technical statements should be backed by proper reasons regardless of who is stating something. If you are sick to tell technical reasons then why bothering posting on HN?
      - lvh 9y ago
        Because there are people who are willing to believe that something is good or bad without needing to understand the rationale behind it? Most people making the case for WAFs aren't posting detailed rationales of why WAFs are a good way to spend your resources either. Example, same author: Cryptographic Right Answers. (Disclaimer: I work with tptacek.)
        irundebian 9y ago
        That's whataboutism. I'm not interested in anyone who fails at giving proper arguments. Neither when tptacek is it or someone else. The sense of giving rational arguments lies not only in the persuasion of the parent poster but also on the information of anybody else who is reading. And simple "Don't do most of this." and "You almost certainly don't want to set up a WAF." are just crappy answers which are based on authority and therefore meaningless.
- wglb 9y ago
  I posted this elsewhere in the thread. To be convinced, read this frightening paper: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf
Alex3917 9y ago
> If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Is this advice assuming that it's devs who want the WAF, rather than ops or management? For devs clearly it's not what they should be focusing on. But saying something isn't worth doing because it shouldn't work is a terrible security principle.
- tptacek 9y ago
  I wrote a longer comment here, but decided it wasn't helping. So, I'm just going to go with: no, if you're really building an application and care about application security, no, you shouldn't waste time setting up a WAF tool designed to help 10,000 employee insurance companies make sure their Wordpress marketing site isn't exposing some vulnerability from 3 years ago. Not wasting time with dumb stuff like this isn't "terrible security"; every dumb thing you do exacts a cost from good things you could be doing instead.
  - subcosmos 9y ago
    "Don't invest in a home security system because your windows should be completely shatterproof"
    - balls187 9y ago
      More like, "Don't invest in home security, because your most precious valuables are stored in a safety deposit box at a bank, and everything else is covered by home insurance."
    - pennaMan 9y ago
      "Don't invest in a home security system before you make sure your house has a door"
      - subcosmos 9y ago
        Something tells me those taking objection to my comment are missing the point that I am criticizing the parent.... If your counterexample is just reinforcing the parents erroneous point that WAFs only protect against specific applications with known vulnerabilities, and that not all websites have "doors", then you are missing the point that many WAFs have detectors for fairly generic sql injection and path traversal techniques that could very well find problems with even custom application endpoints....

sebcat 9y ago

A WAF will also add an attack surface, just like anti-virus software before them. Company X, a content publisher, has a wordpress site with a bunch of plugins. They hear that the security record of such a setup is less than ideal. They buy a WAF solution to protect them. Company Y, also a content publisher in the same space, realizes that they don't need dynamically generated content. They don't need tons of JS. They start publishing static content and what little dynamic functionality they have is well-compartmentalized, with interactions to the outside world carefully audited. Company Y could also get a WAF, but why? It increases the attack surface, Company Y probably don't have the time/expertise to audit it, it is not clear what benefits it will have.