3 ms·

And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually san

by patrec 6y ago

And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. There is no way in hell that something that basically takes arbitrary input without any context and says "oh, well, this looks a bit too much like an SQL fragment for my liking, let's corrupt it a bit, lest some piece of garbage downstream tries to string interpolate executable code together with it and it'll end in tears" will not, in some cases, cause other problems, maybe even security-relevant ones. It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. If software vendors would face liability claims as other engineering professions do, this would be fixed overnight. As things are, I'm 100% sure you are wrong and there are countless places that do know they have exploits and just slap Cloudflare on top as a bandaid.

seanwilson 6y ago
> And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. I haven't commented about how effective WAF is or if you should use it or not, so you're on a soapbox attacking a strawman here. > It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. I think relying on nobody to make mistakes (because you tried to scare them not to or otherwise) is awful advice in general. Even frameworks you rely on to create safe SQL queries can have exploits as well so you need to consider human error at several layers. Expect human error and plan your processes around it.

by patrec 6y ago

seanwilson 6y ago

> And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. I haven't commented about how effective WAF is or if you should use it or not, so you're on a soapbox attacking a strawman here. > It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. I think relying on nobody to make mistakes (because you tried to scare them not to or otherwise) is awful advice in general. Even frameworks you rely on to create safe SQL queries can have exploits as well so you need to consider human error at several layers. Expect human error and plan your processes around it.