4 hours later…
12:41 PM
@PythonForEver I would say the answers are mixed ... @schroeder even requested "citation needed".
I think it largly depends on the WAF you are using, and how it is being used. If you are using a third party cloud service as a WAF ... it could be a liability. If you are slapping on WAF on your unsecure product as a bandaid ... it could be a liability. If you are hosting a well known community based WAF on your own infrastructure as an additional layer of security on your already secure api ... it could be useful.
I think it largly depends on the WAF you are using, and how it is being used. If you are using a third party cloud service as a WAF ... it could be a liability. If you are slapping on WAF on your unsecure product as a bandaid ... it could be a liability. If you are hosting a well known community based WAF on your own infrastructure as an additional layer of security on your already secure api ... it could be useful.
By only exposing the 1x api call to login ... everything else gives a 404 till you have a valid token from your login.
I would also say context is important ... if someone was hosting an 6 year old instance of wordpress and slapping on a third party SAS WAF ... I would laugh them out of the room.
If someone wrote their own API for something, locked it down as hard as they could ... and then added an Apache / Nginx reverse proxy server w/ an up to date version of [ModSecurity ](https://modsecurity.org) running ... I would pay attention.
If someone wrote their own API for something, locked it down as hard as they could ... and then added an Apache / Nginx reverse proxy server w/ an up to date version of [ModSecurity ](https://modsecurity.org) running ... I would pay attention.
1:09 PM
@CaffeineAddiction ModSecurity is quite interesting.
My WAF will be used as an extra layer of security, not as a bandaid.
My WAF will be used as an extra layer of security, not as a bandaid.
3 hours later…
« first day (5025 days earlier) ← previous day next day → last day (57 days later) »