3 ms·
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities. Even companies that
by bradley13 3y ago
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities.
Even companies that take testing seriously rarely test for security problems. This needs to change.
- joemazerino 3y agoInjection attacks holding a top place means the adoption of memory-safe languages is working.
- bradley13 3y agoNo. Injection attacks have held the top place for literally decades. They are kindergarten level: validate your inputs. Lazy or incompetent developers still fail to do so.
- RajT88 3y agoInjection attacks AFAIK have held the top place since forever. It is why people keep buying WAF's.
- nanocode 3y agoOn the other hand, WAFs are another kind of security theater. They won't stop any determined attacker. Usually you just need to change your payload to make it work. Unless you tweak the rules a lot, to the point where you could encode then in your application as well (for example "user_id" field in the POST data must consist only of decimal numbers)
- RajT88 3y agoCounterpoint: Just because they won't stop any determined attacker, doesn't mean they don't have value. Stopping casual attackers is one talking point, but still not the real value. In my opinion, the real value is making you look less like "low-hanging fruit" to automated scans - throwing a bunch of 403's makes you less likely for a follow-up after an automated scan. I actually have a side project when I get the time to try and prove it statistically using a honeypot. I would bet the overall volume of attacks is lower with WAF enabled, and inversely correlates with the 403's thrown. Just my 2 cents.