How useful is the default configuration of ModSecurity for a generic web application?

Scenario:

ModSecurity with a “default” or “generic” configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown), for which specific ru… Continue reading How useful is the default configuration of ModSecurity for a generic web application?

How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?

Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your system tries to “call home”. S… Continue reading How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?

How should security patches be managed in public versioning systems (like Github, etc.)?

There’s a thing I don’t understand. I found a project on Github. Looking at the list of commits, you can see stuff like “fixed XSS in file whatever, etc”. But that commit is part of a long list of commits that were made after… Continue reading How should security patches be managed in public versioning systems (like Github, etc.)?

How do I keep a live WordPress up-to-date quickly without risking to break stuff? [on hold]

This question was originally about finding timely and reliable security advisories for Wordpress, but it was considered off-topic and by the way it was also definitely an XY problem. So I will explain the real problem I am se… Continue reading How do I keep a live WordPress up-to-date quickly without risking to break stuff? [on hold]