Comment by bgc
12 hours ago
I wonder how well Cloudflare et al defend against the class of “nobody could still possibly be using this” vulnerabilities.
12 hours ago
I wonder how well Cloudflare et al defend against the class of “nobody could still possibly be using this” vulnerabilities.
Not sure - Akamai seem to roll out defenses against most new attacks, and Akamai isn't a new company so presumably they've been doing it for a while? Never dug too deeply into the WAF settings so maybe it's possible to turn them on or off.
Cloudflare likes to block anything that looks like code even if an application is not vulnerable, so I'd imagine it would stop some beginner attacks. (most likely not nearly all possible attacks though)
Yeah a few years ago I got a bug report from someone in the business about getting a weird error when trying to update some text. Turns out they were trying to add (*) as a disclaimer at the end of something and Akamai was just giving a blank 403 because it looked to much like SQL.