Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discouraging the use of web application firewalls

macchaffee.com

Post reply on HN
Print view View original

51–60 of 145 posts

Re: Discouraging the use of web application firewalls

#51

Post by hn_throwaway_99 »

hobs wrote: post #7
hn_throwaway_99 wrote: post #5

Hallelujah. Also, with many single-phase apps, WAFs don't make any sense - the HTML/CSS content is just served statically, so the potential vulnerabilities are in the API, which IMO is much easier to harden. Without going into too much of a tangent, this is one reason I'm a big fan of GraphQL. It's strong typing and support for custom scalar types means malformed content gets rejected before it even gets to your code…

Pretty much every SQL injection attack is going to need to be injecting single quotes with some uncompliant lack of parameterization someone put together. Simply using parameterized queries solves this problem, no amount of semicolons can escape it.

Yes, totally agree. There are many good SQL libraries now that used things like tagged templates (e.g. sql`SELECT * FROM foo WHERE bar = ${zed}`) that make it virtually impossible to not use parametrized queries.

But my primary point is that I still believe it makes sense to type string inputs as restrictively as possible, not just for SQL injections but also for other types of potential vulnerabilities. E.g. if you're taking a date string that you expect to be in YYYY-MM-DD format, it's best to type that string as such as furthest out as the edge as possible.

Re: Discouraging the use of web application firewalls

#52

Post by meepmorp »

ForkMeOnTinder wrote: post #37
Spivak wrote: post #26

Earlier quoted context omitted.

It's gotta be my favorite AWS service for this reason alone. It's almost useless but that's a feature not a bug. They knew exactly their market.

It pairs well with the checkbox in S3 that you can tick to enable encryption with no other changes to your application.

Hey, if someone breaks into an AWS data center and steals some s3 drives, you're totally in the clear.

Re: Discouraging the use of web application firewalls

#53

Post by likeclockwork »

jiggawatts wrote: post #9
theideaofcoffee wrote: post #2

People will stop deploying WAFs when the compliance standards are rewritten to not require them. They are prominent in lots of installations because the box ticking exercise of compliance frameworks, namely PCI or HIPAA, require a WAF-like component to reach compliance. It took long enough for them to be written in that now everyone knows they need one. It will be even longer for them to be phased out, and no one wit…

I call it magic security pixie dust. You sprinkle it on top of code riddled with SQL injections nobody could be bothered to avoid or fix, and now magically the code has a become secure! You’ll find it on the shelf next to auto-scaling cloud wizardry, which can similarly be used to fix the total absence of indexes in the database.

Security isn't a property of code, it is a property of a system.

Re: Discouraging the use of web application firewalls

#54

Post by threeseed »

SonOfLilit wrote: post #48
threeseed wrote: post #35

Earlier quoted context omitted.

1) WAF do far more than just prevent SQL injections. 2) Many companies don't own the software they run and so they can't guarantee that it is free of SQL injections or that the version of ORM libraries are secure. WAF protect against this. 3) Auto-scaling is just as much about high availability than performance. Database indexes do not help with the former.

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.

> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks

I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.

Re: Discouraging the use of web application firewalls

#55

Post by [deleted] »

zsoltkacsandi wrote: post #40

Here is my opinion: WAF is a tool, use it where it makes sense. Don’t use it where it doesn’t make sense. I’ve seen many use cases where deploying a WAF solution was completely reasonable and the problem couldn’t have been solved in the application code. And let’s not forget often you have to run applications that were written by other companies, and you still need an additional layer of security. —- These “stop usin…

[deleted]

Re: Discouraging the use of web application firewalls

#56

Post by Arrath »

kibwen wrote: post #18
briffle wrote: post #3

Earlier quoted context omitted.

We are still waiting on compliance standards to update their password change policies to reflect what most people have been saying for over a decade, that frequently changing passwords are a security risk..

NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...

I expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.

Re: Discouraging the use of web application firewalls

#57

Post by joshchaney »

I think WAF is really a bigger set of tools now (bot protection, IP reputation, L7 DDoS/rate limiting, API restrictions) than just signatures. Virtual patching is also incredibly important and there's really no other security tool that gives you the granularity to restrict something like the values of some param on a specific path of your app, but only when some cookie exists.

I don't think the performance concerns here are accurate. I think these days most people are using vendors own cloud infra (Akamai, Cloudflare, F5, Imperva, etc), but even if you are using WAF on-prem, F5 and Imperva sell purpose built hardware that have no problem handling tons of requests. Most WAF's also have weighted signatures these days and won't just fire on ${jndi. "${jndi" might give 5pts, while "org.apache.*" gives another 5, and maybe their threshold is set for 10 for blocking.

I have plenty of issues with WAF's and I would invest a lot more in developer training, but I think they still have their place.

Re: Discouraging the use of web application firewalls

#58

Post by nullindividual »

theideaofcoffee wrote: post #15
xyzzy123 wrote: post #14

Earlier quoted context omitted.

> People will stop deploying WAFs when the compliance standards are rewritten to not require them. Honestly AWS WAF is perfect for this. It's not a great WAF but it is ideal if you need "pretend to have a WAF" as a service so you can tick the box.

As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...

In my experience with SoX, the auditors are very junior fresh out of college. They check boxes and move on.

Re: Discouraging the use of web application firewalls

#59

Post by thestepafter »

tehalex wrote: post #50

Agree for our apps. However, for 3rd party code we run/host but don't really own I see value to a WAF. For example, we unfortunately run WordPress, and I don't have time to manually audit all of the stupid plugins people want to be installed beyond a checker for known vulnerabilities, so a WAF is some comfort/protection.

Agreed on the 3rd party code having a WAF.

What WAF solution are you using for WordPress?

Re: Discouraging the use of web application firewalls

#60

Post by verve_rat »

threeseed wrote: post #54
SonOfLilit wrote: post #48

Earlier quoted context omitted.

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.

> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.

Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article.

Maybe you should read it.

Post reply on HN