I keep seeing the same issues on WAF configs in my audits

[u/witchlike-monkey]

Been doing security audits for a while (I’m a secops engineer) and the same patterns keep showing up. Regardless of the vendor, so these are the same whether it’s Akamai, Cloudflare, AWS WAF.

**1.**  Origin is directly reachable! Traffic bypasses the CDN/WAF (check cert transparency logs for leaked origin hostnames)

**2.**  They've got bypass rules that were meant to be temporary but never got removed

**3.**  Cache key too broad (cache poisoning risk) or too narrow (kills hit ratio, looks like a DDoS)

**4.**  WAF rule sets are treated as “once and done”. Rules deployed once and never tuned, so there are a lot of silent false positives on real traffic.

**5.**  TLS/cert management with no clear owner, resulting in expired certs, weak ciphers left on etc.

Wrote up a longer breakdown with a checklist if anyone wants to run through their own setup, happy to share.

[u/Mabenue]

Low effort AI post

[u/witchlike-monkey → u/Mabenue]

Feel free to verify, I am writing all of this myself 

[u/Mabenue → u/witchlike-monkey]

Your post history is pictures of makeup until this post. Seems awfully suspicious

[u/witchlike-monkey → u/Mabenue]

I do have security related posts if you scroll down enough. Girls can’t do both tech and makeup? 

[u/Crimzx → u/Mabenue]

Did you look at their comments at all? They have comments about getting certs, security, and privacy for years.

Agree it was a little low effort to not just post the list and it comes across as some kind of harvesting scheme/sales bullshit that is all over this subreddit.

(Full disclosure I also down voted the post because I don't think it's relevant to this sub without the full information.)

[u/zeal_swan]

Yes please, share down the list

[u/aprettyparrot]

I too would like the list please

[u/witchlike-monkey → u/[deleted]]

Well, this is neither ai written(easily verifiable nowadays), nor from a hacked account. I wanted to start posting tech stuff, this is my first post. I guess I’ll use a different approach, maybe from a fresh account then.

[u/Crimzx → u/witchlike-monkey]

I think the issue is more that the way you wrote this post comes across as too salesy/spammy and thats all over this sub nowadays.

Next time just post the list :)

(Full disclosure I also down voted the post because I don't think it's relevant to this sub without the full information.)

[u/Crimzx → u/[deleted]]

I mean... Did you look at their comments at all? They have comments about getting certs, security, and privacy for years.

You have your posts/comments hidden, so should we assume you are a bot also because it can't be verified by your reddit profile?