2 ms·
I disagree that the WAF situation is comparable. The curl report (incorrectly) describes missing bounds checks leading to buffer overflows. If the curl projec
by Retr0id 2y ago
I disagree that the WAF situation is comparable.
The curl report (incorrectly) describes missing bounds checks leading to buffer overflows.
If the curl project said "buffer overflows are ok because our code gets compiled with ASLR and NX", then that would be comparable to saying SQLi and XSS are non-issues due to a WAF. Fortunately, that's not what they said.
- kstrauser 2y agoIt was an example, an analogy, an illustration. We’re not dependent on our WAF any more than curl is dependent on ASLR and NX. We (and curl) use those things in addition to good coding practices so they all work together to create as secure of a product as our respective teams can manage.