3 ms·
An example of what he calls "Enumerating Badness" and "Default Permit" is seen today in web application firewalls (WAFs) that try to block XSS payloads. It conc
by ademarre 12y ago
An example of what he calls "Enumerating Badness" and "Default Permit" is seen today in web application firewalls (WAFs) that try to block XSS payloads. It conceals the real problem, which is a vulnerability in the web app itself, and it's a tall order to expect the WAF to capture 100% of XSS payloads.
- w8rbt 12y agoTraditional host anti-virus software is another good example of 'enumerating badness'. It's certainly hard to keep-up when you take this approach.