5 ms·

What "fallacy"? I'm actually horrified that several high profile companies are proudly advertising using this abomination on https://www.cloudflare.com/waf/ htt

by patrec 6y ago

What "fallacy"? I'm actually horrified that several high profile companies are proudly advertising using this abomination on https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/. I really do not want to use the product of a company that thinks it's a good idea to "protect" their software by paying someone to put something in front of it that strips out all input that "looks too much like SQL". This is a bit like a food manufacturer paying someone to add antibiotics to their products because their hygiene processes are so terrible they suspect some E. coli might slip in from time to time. Unlike say the insane sing-and-dance-de-jour you have to perform to make sure your server sets the right set of security related HTTP headers, SQL injection attacks, despite their prevalence, are a completely bogus problem. I'd go so far and say if you have an SQL Injection attack, the solution is to fire someone and review your processes and not to pay a third party to corrupt data coming in and cross your fingers and hope that they do so in a way that will hopefully both protect you from your engineering incompetence and not mess up genuine requests too much.

deleted 6y ago
[deleted]
seanwilson 6y ago
> I'd go so far and say if you have an SQL Injection attack, the solution is to fire someone and review your processes and not to pay a third party to corrupt data coming in The fallacy you're making is proposing a false dilemma. You can review your processes AND layer defences on top. You don't have to pick between one or the other. Whether Cloudflare is a worthwhile defence is not what I'm commenting on though, although surely the whole point of it is that it gives you some protection when you don't know you have an SQL injection exploit. I can't imagine anyone knows they have exploits and is using Cloudflare as a solution/bandaid.
- patrec 6y ago
  And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. There is no way in hell that something that basically takes arbitrary input without any context and says "oh, well, this looks a bit too much like an SQL fragment for my liking, let's corrupt it a bit, lest some piece of garbage downstream tries to string interpolate executable code together with it and it'll end in tears" will not, in some cases, cause other problems, maybe even security-relevant ones. It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. If software vendors would face liability claims as other engineering professions do, this would be fixed overnight. As things are, I'm 100% sure you are wrong and there are countless places that do know they have exploits and just slap Cloudflare on top as a bandaid.
  - seanwilson 6y ago
    > And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. I haven't commented about how effective WAF is or if you should use it or not, so you're on a soapbox attacking a strawman here. > It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. I think relying on nobody to make mistakes (because you tried to scare them not to or otherwise) is awful advice in general. Even frameworks you rely on to create safe SQL queries can have exploits as well so you need to consider human error at several layers. Expect human error and plan your processes around it.
rasz 6y ago
>This is a bit like a food manufacturer paying someone to add antibiotics to their products because their hygiene processes are so terrible they suspect some E. coli might slip in from time to time. and apparently FDA being paid in free Tshirts for testing food safety

by patrec 6y ago

deleted 6y ago

[deleted]

seanwilson 6y ago

> I'd go so far and say if you have an SQL Injection attack, the solution is to fire someone and review your processes and not to pay a third party to corrupt data coming in The fallacy you're making is proposing a false dilemma. You can review your processes AND layer defences on top. You don't have to pick between one or the other. Whether Cloudflare is a worthwhile defence is not what I'm commenting on though, although surely the whole point of it is that it gives you some protection when you don't know you have an SQL injection exploit. I can't imagine anyone knows they have exploits and is using Cloudflare as a solution/bandaid.

patrec 6y ago
And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. There is no way in hell that something that basically takes arbitrary input without any context and says "oh, well, this looks a bit too much like an SQL fragment for my liking, let's corrupt it a bit, lest some piece of garbage downstream tries to string interpolate executable code together with it and it'll end in tears" will not, in some cases, cause other problems, maybe even security-relevant ones. It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. If software vendors would face liability claims as other engineering professions do, this would be fixed overnight. As things are, I'm 100% sure you are wrong and there are countless places that do know they have exploits and just slap Cloudflare on top as a bandaid.
- seanwilson 6y ago
  > And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. I haven't commented about how effective WAF is or if you should use it or not, so you're on a soapbox attacking a strawman here. > It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. I think relying on nobody to make mistakes (because you tried to scare them not to or otherwise) is awful advice in general. Even frameworks you rely on to create safe SQL queries can have exploits as well so you need to consider human error at several layers. Expect human error and plan your processes around it.

rasz 6y ago

>This is a bit like a food manufacturer paying someone to add antibiotics to their products because their hygiene processes are so terrible they suspect some E. coli might slip in from time to time. and apparently FDA being paid in free Tshirts for testing food safety