4 ms·
I think of WAFs as an extra safety net. Defense in depth. The author complained about the performance cost of WAFs in general, but not all WAFs have be structu
by allanrbo 3y ago
I think of WAFs as an extra safety net. Defense in depth.
The author complained about the performance cost of WAFs in general, but not all WAFs have be structured like ModSecurity. They could for example be based on something like https://github.com/intel/hyperscan https://github.com/intel/hyperscan and perf is at a very different level.
- VWWHFSfQ 3y agoOr even do what what CloudFlare did [1] and transpile all the slow ModSecurity rules to Lua and deploy OpenResty at the edge. Run them in nginx+luajit. [1] https://blog.cloudflare.com/cloudflares-new-waf-compiling-to-lua/ https://blog.cloudflare.com/cloudflares-new-waf-compiling-to...
- lmm 3y ago> I think of WAFs as an extra safety net. Defense in depth. The WAF itself is a complex codebase written in a performance-critical domain, so they're generally implemented in memory-unsafe languages. If the services behind the WAF are implemented at all competently, you're probably increasing the attack surface by more by adding the WAF than you're saving.