Article:  |
Introducing mod_security | |
| Subject: | bad application design shouldn't drive new development | |
| Date: | 2003-12-01 01:02:04 | |
| From: | anonymous2 | |
|
While this seems like a nice tool which might have some good uses, the example that is given in the beginning is a very bad one. It is based on the fact that an application has a way to tunnel SQL statements to the DB. It is badly designed. One should fix/redesign the app instead of building something around it.
|
||
Showing messages 1 through 1 of 1.
-
bad application design shouldn't drive new development
2003-12-01 02:00:43 Ivan Ristic |
[View]
I agree completely. One should always try to fix/enhance the application and not rely on other security layers, such as mod_security, for protection. I see mod_security as a protection layer operated by people other than original software developers. From their point of view, software is a black box. Their task is to do everything they can to minimize the risk of a security breach. The example you mentioned is, unfortunate as that may be, a representative of a quality of the code widely available today.
