6 ms·

tptacek is using an appeal to authority given his standing as a security expert on this forum. That's the only reason his comment containing no justification is

tptacek is using an appeal to authority given his standing as a security expert on this forum. That's the only reason his comment containing no justification is being taken seriously.

evgen 8y ago
It is also being taken seriously because 1) he is correct, and 2) those of us who do this for a living are literally sick to fucking death of having to explain to management, developers, and sysadmins that there is no silver bullet that you can buy that will fix the mistakes you should have cleaned up five years ago. You still have to do the work. If you need to hear this ("reduce attack surface rather than spend time/money on monitoring attack surface") more than once you are beyond help and it is time for us to move on to people for whom there is at least a possibility that they won't be p0wned in the next 12 months.
- irundebian 8y ago
  This isn't a religious/esoteric forum here. Technical statements should be backed by proper reasons regardless of who is stating something. If you are sick to tell technical reasons then why bothering posting on HN?
  - lvh 8y ago
    Because there are people who are willing to believe that something is good or bad without needing to understand the rationale behind it? Most people making the case for WAFs aren't posting detailed rationales of why WAFs are a good way to spend your resources either. Example, same author: Cryptographic Right Answers. (Disclaimer: I work with tptacek.)
    - irundebian 8y ago
      That's whataboutism. I'm not interested in anyone who fails at giving proper arguments. Neither when tptacek is it or someone else. The sense of giving rational arguments lies not only in the persuasion of the parent poster but also on the information of anybody else who is reading. And simple "Don't do most of this." and "You almost certainly don't want to set up a WAF." are just crappy answers which are based on authority and therefore meaningless.
      - tptacek 8y ago
        You are being extremely rude. Nobody on this thread has been as personally abrasive as you have. If you have a technical argument to make, make it; nobody is going to call you names for doing that. Technical arguments, even those you don't feel are adequately supported with evidence, are not insults. But "whataboutism" and "appeals to authority" and "religion" and "arrogance" are insults, and speak to motives and intents, which are things you have no business bringing into this discussion. Stop.
        irundebian 8y ago
        My posts aren't meant to be rude. I feel very sorry if I hurt you or others feelings. I'm not making a point on your general credibility and technical statements - quite the opposite - but some your answers today just seemed to be ignorant for me (and probably some others). If you're giving a simple statement without background (just based on your opinion) and you're friendly asked for your information, then imo you should either don't answer or give back more information, but not just continuing giving answers without background. That's all, and that's not meant to be rude. Just my opinion on your way of posting today, as others have giving me today.
        c22 8y ago
        No one means to be rude. Rudeness is the byproduct of a lack of self awareness and concern for social mores. Gp (and others in this ridiculous subthread) are trying to give you pointers that will improve the quality of your interactions with this community, which is ironic given the comments that sparked this discussion.
  - stronglikedan 8y ago
    You're relatively new, but after a while, you get to learn the credibility of some HN'ers by their usernames. Often, you can click their username to find previous comments from the same user where they expounded on the technical details, particularly for subjects that come up here a lot. I don't blame them for not wanting to go into detail each and every time, especially when their reputation gives their comments credibility in place of details. I'd also like to add that you may want to work on the tone of your comments if you'd like to get enough karma to really participate in the community. Your comment history seems a bit confrontational and argumentative. There are better, friendlier ways to make the same points. I'll defer to the guidelines[0] to explain how you may improve your communication skills. [0]https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - irundebian 8y ago
      I'm quite aware of some credibility of some HN users. That doesn't give them the right to give arrogant or non-argument-backed answers. Besides that: There is no reason to base your argument on the age of my account.
      - stronglikedan 8y ago
        You may have missed my edit to my previous comment regarding the tone of your comments. I suggest you go back and check it out. (Yet another sign of the age of your account, which is most definitely relevant.)
        irundebian 8y ago
        Sure, thanks for your advice. But that's very unrelated to this topic here. Furthermore I don't see much value in karma points from random strangers and a need for building some strange internet personality who avoids conflicts to prevent a decrease in its karma points. I also don't see how I can even more participate in this community with more karma points.
        8y ago
SmellyGeekBoy 8y ago
Nope. I upvoted it before even seeing who wrote it. The advice is absolutely spot on. Harden your servers, don't just install a load of tools that look for intrusions after-the-fact and call it a day. I'm not sure why some people aren't getting it.
raverbashing 8y ago
It's not an appeal to authority when you're really an expert. Or you go to the doctor and expect him to justify your treatment down to the minor detail? You sound like you talk to your doctor about $overpriced_drug.
- irundebian 8y ago
  And still there are doctors who are prescribing homeopathy and other effect-less "medicine". It's just reasonable to ask for rational arguments. That's the whole point of the rants here.
srean 8y ago
Its not that he owes a justification or an explanation or that readers can legitimately feel entitled to one. Paid support is another matter.
tptacek 8y ago
If you think I'm wrong, rebut.
- peterwwillis 8y ago
  The fan boys came out to rep you, but they're wrong. First of all - it takes less than an hour to set up a WAF, and it doesn't worsen your security position. Not only is it free, it's fast and easy and will demonstrably be better than no security at all. Saying "don't put up a firewall because it isn't perfect" is stupid. You don't have to be a security guru to get that, which obviously several people have, or they wouldn't all be giving you crap about it. Securing your application long term is a complex, expensive, time consuming process. Suggesting that spending a couple months to be "serious about security" is somehow better than first taking one hour to do the most bare minimum effort is ridiculous. If I have a computer on the internet, I put a firewall up. Is it defense in depth? No. But that doesn't mean it won't stop the most basic, most common attacks, and it takes no time and no skill to apply it. I don't know what weird thing you have against WAFs other than apparently they aren't cool or sophisticated enough, but 1) they remove attack surface, 2) they filter the most common drive-bys, 3) they can be both passive and active, 4) they're free, 5) they're easy, 6) they're quick to deploy. How is it 2018 and I have to explain to you of all people that the web equivalent of iptables might be a good idea if you have zero security?
  - viraptor 8y ago
    > WAFs (...) 1) they remove attack surface They do what you configure them to do. Without knowledge of what's allowed and what's not, they're going to have either false positives or false negatives. And if you have that knowledge, you can fix those issues in the web app rather than hide them with the WAF. A lot of preconfigured WAFs will remove specific matches you don't care about anyway rather than attack surface. > 2) they filter the most common drive-bys Common as in known proxy or webapp exploits? If that's the case, why not patch them? (There's a reason to use WAF if you can't patch but that costs time/money to get right and test) > 3) they can be both passive and active I'm not even sure what passive WAF means... just logging? > 4) they're free Only for very small traffic. > 5) they're easy 6) they're quick to deploy. See point 1. If you can't put the right restrictions on the app, why do you think you can put them in WAF? If they're not in the app in the first place, why do you think this way is quicker? It's not a magic box will know your requirements. You need a proper setup or the only thing you achieve is removing obviously silly cgi-bin requests from your log files. I'm not even against WAFs. Just think the gain from them is been none and minimal if you reduce it to "turn it on, it's cheap and easy". It's really similar to iptables - you can turn it on, but why are you doing it? (On a server anyway) If you have a specific reason/route to protect - great. If not, make sure you bind non-public services to local interfaces and you don't need iptables.

tptacek is using an appeal to authority given his standing as a security expert on this forum. That's the only reason his comment containing no justification is being taken seriously.

evgen 8y ago

It is also being taken seriously because 1) he is correct, and 2) those of us who do this for a living are literally sick to fucking death of having to explain to management, developers, and sysadmins that there is no silver bullet that you can buy that will fix the mistakes you should have cleaned up five years ago. You still have to do the work. If you need to hear this ("reduce attack surface rather than spend time/money on monitoring attack surface") more than once you are beyond help and it is time for us to move on to people for whom there is at least a possibility that they won't be p0wned in the next 12 months.

irundebian 8y ago
This isn't a religious/esoteric forum here. Technical statements should be backed by proper reasons regardless of who is stating something. If you are sick to tell technical reasons then why bothering posting on HN?
- lvh 8y ago
  Because there are people who are willing to believe that something is good or bad without needing to understand the rationale behind it? Most people making the case for WAFs aren't posting detailed rationales of why WAFs are a good way to spend your resources either. Example, same author: Cryptographic Right Answers. (Disclaimer: I work with tptacek.)
  - irundebian 8y ago
    That's whataboutism. I'm not interested in anyone who fails at giving proper arguments. Neither when tptacek is it or someone else. The sense of giving rational arguments lies not only in the persuasion of the parent poster but also on the information of anybody else who is reading. And simple "Don't do most of this." and "You almost certainly don't want to set up a WAF." are just crappy answers which are based on authority and therefore meaningless.
    - tptacek 8y ago
      You are being extremely rude. Nobody on this thread has been as personally abrasive as you have. If you have a technical argument to make, make it; nobody is going to call you names for doing that. Technical arguments, even those you don't feel are adequately supported with evidence, are not insults. But "whataboutism" and "appeals to authority" and "religion" and "arrogance" are insults, and speak to motives and intents, which are things you have no business bringing into this discussion. Stop.
      - irundebian 8y ago
        My posts aren't meant to be rude. I feel very sorry if I hurt you or others feelings. I'm not making a point on your general credibility and technical statements - quite the opposite - but some your answers today just seemed to be ignorant for me (and probably some others). If you're giving a simple statement without background (just based on your opinion) and you're friendly asked for your information, then imo you should either don't answer or give back more information, but not just continuing giving answers without background. That's all, and that's not meant to be rude. Just my opinion on your way of posting today, as others have giving me today.
        c22 8y ago
        No one means to be rude. Rudeness is the byproduct of a lack of self awareness and concern for social mores. Gp (and others in this ridiculous subthread) are trying to give you pointers that will improve the quality of your interactions with this community, which is ironic given the comments that sparked this discussion.
- stronglikedan 8y ago
  You're relatively new, but after a while, you get to learn the credibility of some HN'ers by their usernames. Often, you can click their username to find previous comments from the same user where they expounded on the technical details, particularly for subjects that come up here a lot. I don't blame them for not wanting to go into detail each and every time, especially when their reputation gives their comments credibility in place of details. I'd also like to add that you may want to work on the tone of your comments if you'd like to get enough karma to really participate in the community. Your comment history seems a bit confrontational and argumentative. There are better, friendlier ways to make the same points. I'll defer to the guidelines[0] to explain how you may improve your communication skills. [0]https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - irundebian 8y ago
    I'm quite aware of some credibility of some HN users. That doesn't give them the right to give arrogant or non-argument-backed answers. Besides that: There is no reason to base your argument on the age of my account.
    - stronglikedan 8y ago
      You may have missed my edit to my previous comment regarding the tone of your comments. I suggest you go back and check it out. (Yet another sign of the age of your account, which is most definitely relevant.)
      - irundebian 8y ago
        Sure, thanks for your advice. But that's very unrelated to this topic here. Furthermore I don't see much value in karma points from random strangers and a need for building some strange internet personality who avoids conflicts to prevent a decrease in its karma points. I also don't see how I can even more participate in this community with more karma points.
        8y ago

SmellyGeekBoy 8y ago

Nope. I upvoted it before even seeing who wrote it. The advice is absolutely spot on. Harden your servers, don't just install a load of tools that look for intrusions after-the-fact and call it a day. I'm not sure why some people aren't getting it.

raverbashing 8y ago

It's not an appeal to authority when you're really an expert. Or you go to the doctor and expect him to justify your treatment down to the minor detail? You sound like you talk to your doctor about $overpriced_drug.

irundebian 8y ago
And still there are doctors who are prescribing homeopathy and other effect-less "medicine". It's just reasonable to ask for rational arguments. That's the whole point of the rants here.

srean 8y ago

Its not that he owes a justification or an explanation or that readers can legitimately feel entitled to one. Paid support is another matter.

tptacek 8y ago

If you think I'm wrong, rebut.

peterwwillis 8y ago
The fan boys came out to rep you, but they're wrong. First of all - it takes less than an hour to set up a WAF, and it doesn't worsen your security position. Not only is it free, it's fast and easy and will demonstrably be better than no security at all. Saying "don't put up a firewall because it isn't perfect" is stupid. You don't have to be a security guru to get that, which obviously several people have, or they wouldn't all be giving you crap about it. Securing your application long term is a complex, expensive, time consuming process. Suggesting that spending a couple months to be "serious about security" is somehow better than first taking one hour to do the most bare minimum effort is ridiculous. If I have a computer on the internet, I put a firewall up. Is it defense in depth? No. But that doesn't mean it won't stop the most basic, most common attacks, and it takes no time and no skill to apply it. I don't know what weird thing you have against WAFs other than apparently they aren't cool or sophisticated enough, but 1) they remove attack surface, 2) they filter the most common drive-bys, 3) they can be both passive and active, 4) they're free, 5) they're easy, 6) they're quick to deploy. How is it 2018 and I have to explain to you of all people that the web equivalent of iptables might be a good idea if you have zero security?
- viraptor 8y ago
  > WAFs (...) 1) they remove attack surface They do what you configure them to do. Without knowledge of what's allowed and what's not, they're going to have either false positives or false negatives. And if you have that knowledge, you can fix those issues in the web app rather than hide them with the WAF. A lot of preconfigured WAFs will remove specific matches you don't care about anyway rather than attack surface. > 2) they filter the most common drive-bys Common as in known proxy or webapp exploits? If that's the case, why not patch them? (There's a reason to use WAF if you can't patch but that costs time/money to get right and test) > 3) they can be both passive and active I'm not even sure what passive WAF means... just logging? > 4) they're free Only for very small traffic. > 5) they're easy 6) they're quick to deploy. See point 1. If you can't put the right restrictions on the app, why do you think you can put them in WAF? If they're not in the app in the first place, why do you think this way is quicker? It's not a magic box will know your requirements. You need a proper setup or the only thing you achieve is removing obviously silly cgi-bin requests from your log files. I'm not even against WAFs. Just think the gain from them is been none and minimal if you reduce it to "turn it on, it's cheap and easy". It's really similar to iptables - you can turn it on, but why are you doing it? (On a server anyway) If you have a specific reason/route to protect - great. If not, make sure you bind non-public services to local interfaces and you don't need iptables.