Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

wallarm.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#51

Post by elmigranto »

hkr_mag wrote: post #49
idank wrote: post #10

TLDR: proxy your traffic through a locally installed secret blackbox, after which it is "100% protected". Not found on the website: non-buzzwordy description of how this really works and what makes it better than the other gazillion security products. Show me an example of an attack you stopped. I realize the website isn't selling to engineers, but still.

Yeah! We would say the same if someone propose us to use this :) 1. We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. 2. Will run 3rd party audit of the code and share the report. 3. At some point, we'll open-source it. Ivan (wlrm) will come up with the examples of attacks soon.

What do you mean "come up"? You made a commercial product and don't have a single use case or user story to pitch?

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#52

Post by borski »

hkr_mag wrote: post #47
borski wrote: post #11

Wallarm looks like a fairly good WAF, and focused on developers / DevOps. We ( https://www.tinfoilsecurity.com ) have the same focus, but are focused on helping you find and fix the vulnerabilities rather than cloaking them / trying to catch them being exploited in real-time. "Detect anomalies and block attacks with no latency" seems hard to believe - minimal latency, maybe, but none? On the other hand, good luck to…

Borski — thanks for sharing this! I heard once about Tinfoil Security at BlackHat last year. Are in touch with the guys? We'd like to talk more with them.

I'm the cofounder and CTO, so...yes. :)

Feel free to shoot me a note at borski@tinfoilsecurity.com

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#53

Post by heartsucker »

BinaryIdiot wrote: post #20
burkaman wrote: post #13

Earlier quoted context omitted.

You mean for OS X? What other way is there to pronounce it?

Even when I worked for AppleCare many of us still said it that way. Apple had very strict guidelines and we could get in trouble if we said it in any way but "OS 10" but it's a very, very hard habit to break.

I have literally never heard it called OS Ten. Today I learned.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#54

Post by hkr_mag »

BinaryIdiot wrote: post #24

Normally the person showing off something with Show HN also comes into the comments but I haven't seen anything. Is this yours, hkr_mag? Even one of your competitors showed up in the comments... Some feedback (edited to add stuff twice): - The pricing is confusing. The front page shows me how to install it and run but then another page mentions a free trial? Is that's what I'm doing when I install via apt-get or run…

# Password and registration

Almost the whole team is almost paranoid about the passwords. But I totally agree that requirement for the password are not clear now. Will make it work smoother.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#55

Post by hkr_mag »

BinaryIdiot wrote: post #24

Normally the person showing off something with Show HN also comes into the comments but I haven't seen anything. Is this yours, hkr_mag? Even one of your competitors showed up in the comments... Some feedback (edited to add stuff twice): - The pricing is confusing. The front page shows me how to install it and run but then another page mentions a free trial? Is that's what I'm doing when I install via apt-get or run…

> Why do I have a "permissions":["admin"] in my profile? :)

Congratulations! :) You're admin of your company. You can add another admin who can deploy nodes or can add analyst guys who can only view data on attacks and vulnerabilities you have.

Does it seem weird that you have Admin status?

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#56

Post by hkr_mag »

BinaryIdiot wrote: post #24

Normally the person showing off something with Show HN also comes into the comments but I haven't seen anything. Is this yours, hkr_mag? Even one of your competitors showed up in the comments... Some feedback (edited to add stuff twice): - The pricing is confusing. The front page shows me how to install it and run but then another page mentions a free trial? Is that's what I'm doing when I install via apt-get or run…

- Seems too black-box-y to me. I'd like to see something more to the point. Then again I'm an engineer but typically for products like this I've found you need at least some engineer buy-in to sell it to a company.

Could you elaborate on this. What details do we need to add the website to make it less blackboxy? BTW, did you have a look at docs.wallarm.com?

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#58

Post by hkr_mag »

avtar wrote: post #17
borski wrote: post #11

Wallarm looks like a fairly good WAF, and focused on developers / DevOps. We ( https://www.tinfoilsecurity.com ) have the same focus, but are focused on helping you find and fix the vulnerabilities rather than cloaking them / trying to catch them being exploited in real-time. "Detect anomalies and block attacks with no latency" seems hard to believe - minimal latency, maybe, but none? On the other hand, good luck to…

http://modsecurity.org/ is an open source option with free and commercial rules. I remember reading that CloudFlare used ModSecurity at one point and then moved to their own WAF.

Mod_security is a good option proven with time. Especially, if you know how to "cook" it (read this book by Ivan Ristić to learn: https://www.feistyduck.com/books/modsecurity-handbook/).

But mod_security provide a very basic approach based on signatures (regular expressions) which: - very hard to maintain and tune, especially if you have applications with a lot of updates (if you don't tune you'll get false-positives); - they don't cover all the attacks; - it not that fast because you need to match each request to the signature database (it's possible to make fast though as CloudFlare did with LuaJIT and OpenResty).

There are no learning capabilities in mod_security, so you need to dedicate engineers time to tune it. There is a lack of analytics. It will detect thousands and millions of malicious request but never says which of them are targeting real vulnerabilities in your apps.

Anyway, mod_security is just another product. It's plain WAF, with a great community and good CRS (signature ruleset).

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#59

Post by hkr_mag »

idank wrote: post #10

TLDR: proxy your traffic through a locally installed secret blackbox, after which it is "100% protected". Not found on the website: non-buzzwordy description of how this really works and what makes it better than the other gazillion security products. Show me an example of an attack you stopped. I realize the website isn't selling to engineers, but still.

Just a few examples of the attacks that other security products can't catch.

1. A very complicated things going through XML/JSON APIs. Wallarm really parse XML, understand the structure and catch even complicated exploitation attempt like this:

-1 &a; &b; &c; &d; &e; &f; id=1

2. Every vector that exploits vulnerabilities over WebSockets. Some product doesn't support WebSocket at all. Some just proxy data without analysis of it. Wallarm detects malicious behaviour in WebSocket messages.

3. All the attacks with massive evasion techniques. We run thousands of tests to check if attacker can bypass attacks engine. Soon, we'll publish bug-bounty program and we'll pay money for those who will find by-passes.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#60

Post by sz4kerto »

hkr_mag wrote: post #59
idank wrote: post #10

TLDR: proxy your traffic through a locally installed secret blackbox, after which it is "100% protected". Not found on the website: non-buzzwordy description of how this really works and what makes it better than the other gazillion security products. Show me an example of an attack you stopped. I realize the website isn't selling to engineers, but still.

Just a few examples of the attacks that other security products can't catch. 1. A very complicated things going through XML/JSON APIs. Wallarm really parse XML, understand the structure and catch even complicated exploitation attempt like this: -1 &a; &b; &c; &d; &e; &f; id=1 2. Every vector that exploits vulnerabilities over WebSockets. Some product doesn't support WebSocket at all. Some just proxy data without anal…

Aren't you claiming that you don't need to terminate SSL?
Post reply on HN