Hacker News Reader

It is not that easy as using the AWS WAF with default rules for our application led to many valid requests and IPs being blocked. You need to know what is being blocked and verify at first or you will in some cases be losing customers.

View on HN

Your best plan is to start with all the rules in count mode. Let that sit for awhile and analyze anything that was counted. As you feel good about it, slowly start to move things into block.

Problem is when you get owned during that window and get slammed for not blocking sooner.

Then you block sooner and get slammed for blocking too soon.

Repeat for 1000 web services.

Yeah. Sadly the WAF can't solve organizational problems.

Reply on news.ycombinator.com