4 ms·

In a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense. In the situation I hope many people are in, whe

In a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense. In the situation I hope many people are in, where they have a production application they own that they can quicky continuously deploy to - what's the WAF for?

ownagefool 7y ago
There's a concept that you should use several products in highly secure environments. For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like https://github.com/nbs-system/naxsi https://github.com/nbs-system/naxsi. The way, neither just a PHP bug nor a lua bug should defeat you. In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation. But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.
- tptacek 7y ago
  This is usually a better way to get multiple single points of failure than it is to get a more resilient system.
- ownagefool 7y ago
  True @tptacek, but we're talking about systems where you'd rather the system fail closed than leak anything. Not something one would really normally consider for their uber for hedgehogs app. Personally, I'm not really a big fan of the baseline for the guidence being behind closed doors, I prefer to be able to read said validation, but the guidence does exist and is parroted around the industry occasionally.
  - pvg 7y ago
    You can click on the timestamp of a comment and reply to it there so you don't have to @ people like a barbarian.
    - posix_me_less 7y ago
      You can give the usability information about this website without calling a group of people barbarians.
      - pvg 7y ago
        I jokingly compared a single person to a barbarian without calling anyone a barbarian, like a barbarian.
        arpa 7y ago
        Then again, we are in discussion regarding PHP, so someone's bound to point out we're a bunch of neanthardal barbarians just because of that. So it could have been just a kneejerk reaction.

ownagefool 7y ago

There's a concept that you should use several products in highly secure environments. For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like https://github.com/nbs-system/naxsi https://github.com/nbs-system/naxsi. The way, neither just a PHP bug nor a lua bug should defeat you. In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation. But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.

tptacek 7y ago
This is usually a better way to get multiple single points of failure than it is to get a more resilient system.
ownagefool 7y ago
True @tptacek, but we're talking about systems where you'd rather the system fail closed than leak anything. Not something one would really normally consider for their uber for hedgehogs app. Personally, I'm not really a big fan of the baseline for the guidence being behind closed doors, I prefer to be able to read said validation, but the guidence does exist and is parroted around the industry occasionally.
- pvg 7y ago
  You can click on the timestamp of a comment and reply to it there so you don't have to @ people like a barbarian.
  - posix_me_less 7y ago
    You can give the usability information about this website without calling a group of people barbarians.
    - pvg 7y ago
      I jokingly compared a single person to a barbarian without calling anyone a barbarian, like a barbarian.
      - arpa 7y ago
        Then again, we are in discussion regarding PHP, so someone's bound to point out we're a bunch of neanthardal barbarians just because of that. So it could have been just a kneejerk reaction.