And a rule that denies everything blocks all vulnerabilities entirely.
replyA false positive from a conservative evaluation of a query parameter or header value is one thing, conceivably understandable. A false positive due to the content of a blog post is something else altogether.
This is a strawman, especially if like the parent claims this was improving security for one of the most popular website backends ever.
replyRules like this might very well have had incredible positive impact on ten of thousands of websites at the cost of some weird debugging sessions for dozens of programmers (made up numbers obviously).
Look, any WAF that blocks a document like
reply <!DOCTYPE html>
<html lang="en">
<body>
<p>/etc/hosts is a file on Unix hosts</p>
> is pretty clearly broken
replyagree
> And you can't meaningfully measure product metrics like impact for fundamentally broken products
disagree