Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: BunkerWeb – the open-source and cloud-native WAF

docs.bunkerweb.io

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#21

Post by chrismorgan »

bnkty wrote: post #18
chrismorgan wrote: post #7

Your site talks of BunkerWeb PRO, which is, by the sound of it, not open source. But I have no idea what is actually different about it: https://panel.bunkerweb.io/knowledgebase/105/What-is-BunkerW... flatly doesn’t answer the question: “additional features and services responding to professional needs” is impressively vague.

Features with a crown icon are PRO, you will find full list of free and PRO features here : https://docs.bunkerweb.io/latest/features/

Might I suggest at the very least linking to that from https://panel.bunkerweb.io/knowledgebase/105/What-is-BunkerW... and https://panel.bunkerweb.io/store/bunkerweb-pro.

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#22

Post by ivanr »

mac-chaffee wrote: post #14
lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

I'd generally confirm that suspicion: https://www.macchaffee.com/blog/2023/wafs/ WAFs have a few valid uses in my opinion: "virtual patching" and the ability to create custom rules such as blocking/challenging/rate limiting obviously bad traffic. But the giant rulesets are actively harmful IMO. "Defense in depth" is not a valid justification for doing something actively harmful to both your users and the time budget…

+1 Absolutely. (Source: Original author of ModSecurity.)

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#23

Post by mmarian »

mac-chaffee wrote: post #14
lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

I'd generally confirm that suspicion: https://www.macchaffee.com/blog/2023/wafs/ WAFs have a few valid uses in my opinion: "virtual patching" and the ability to create custom rules such as blocking/challenging/rate limiting obviously bad traffic. But the giant rulesets are actively harmful IMO. "Defense in depth" is not a valid justification for doing something actively harmful to both your users and the time budget…

Just wanted to say that it's a great blog post, thanks for writing it!

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#24

Post by ethan_smith »

lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

WAFs aren't bullshit but have limitations - they're effective against known attack patterns (SQLi, XSS) but can be bypassed with sophisticated techniques. They're best as one layer in a defense-in-depth strategy, not a complete security solution.

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#25

Post by josephcsible »

lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

You are correct. Actual security needs to be inherently part of the application; you can't get it just by slapping something in front of it. And the way most WAFs work is basically just a fancier version of what https://thedailywtf.com/articles/Injection_Rejection does, which is horrifically bad on sites where people try to discuss HTML or SQL.

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#27

Post by doublerebel »

lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

A properly configured WAF is arguably necessary to maintain SLAs on an API available on the web. Bad actors will hammer any open API endlessly unless the API shows signs of defense. This can affect connection latency for good users and cost for the business. Why would you ever bother processing (and cause server and database load and charges) for a million bogus login or search requests if the WAF can handle it automatically and basically for free?

Most bad actors are looking for easy targets and will move on when seeing minimal defenses. If we want to continue enjoying an open and accessible internet where any client that speaks the protocol can connect, then WAFs are an integral part of maintaining that public service.

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#29

Post by SkyPuncher »

AgentMatrixAI wrote: post #28

What % of cloudflare's protection can this provide? I've been looking at bunkerweb + anubis as alternative to cloudflare tunnel (im actually not sure if this provides WAF)

This isn't really comparable to any of the SaaS based products.

While this offers many of the same technical capabilities as Cloudflare, a lot of Cloudflare's value is in having high-level, aggregate insight into threats.

Re: Show HN: BunkerWeb – the open-source and cloud-native WAF

#30

Post by ozim »

lta wrote: post #5

I'm still strongly suspecting this whole WAF thing is mostly complete bullshit intended for projects doing security works mostly from spreadsheets. Could someone with a proper background in security confirm or invalidate my suspicion ?

Well not entirely because you always want defense in depth. Let’s say you are running 20 apps and 10 of them have security vulnerabilities like RCE.

Testing and deploying patches takes time probably you cannot just update 10 apps at once with single click.

Deploying WAF rule should cover that.

Post reply on HN