Why We're Beating Modsecurity
Posted2 months agoActive2 months ago
github.comTechstory
supportivepositive
Debate
20/100
WafModsecurityCybersecurity
Key topics
Waf
Modsecurity
Cybersecurity
The post showcases RhinoWAF, an alternative to Modsecurity, and receives positive feedback from the community, with discussions around its features and potential applications.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
N/A
Peak period
2
1-2h
Avg / period
1.7
Key moments
- 01Story posted
Oct 29, 2025 at 5:58 PM EDT
2 months ago
Step 01 - 02First comment
Oct 29, 2025 at 5:58 PM EDT
0s after posting
Step 02 - 03Peak activity
2 comments in 1-2h
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 29, 2025 at 8:55 PM EDT
2 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45753629Type: storyLast synced: 11/17/2025, 8:09:03 AM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
Does RhinoWAF support ModSecurity SecLang rulesets like OWASP CRS? Is there a SecLang to RhinoWAF JSON converter?
Shouldn't eBPF be fast at sorting and running rules?
What are good metrics for evaluating WAFs?
coraza: https://github.com/corazawaf/coraza
bunkerweb: https://github.com/bunkerity/bunkerweb
SafeLine: https://github.com/chaitin/SafeLine
RhinoWAF: https://github.com/1rhino2/RhinoWAF
gh topic: waf: https://github.com/topics/waf
awesome-WAF: https://github.com/0xInfection/Awesome-WAF
TPR: True Positive Rate (Detection Rate), TNT: True Negative Rate, FPR: False Positive Rate ("ROC Curve")
Accuracy = TP + TN / # Requests
Latency / Detection Time as percentiles
Throughput: response time in ms given requests per second
Time to Virtual Patch, and CI/CD rule deployment integration
DDoS Response Time: How quickly does the WAF mitigate a Layer 7 (application) DDoS attack?
... Rule Management Overhead: MTTT: Mean Time To Tune, Policy Complexity; CI/CD, SIEM/SOAR integration; https://gemini.google.com/share/0d2d1c53bfb0
awesome-ebpf > Kernel docs, examples, "eBPF/XDP hardware offload to SmartNICs", Go libraries: https://github.com/zoidyzoidzoid/awesome-ebpf#go-libraries
/? ebpf waf site:github.com https://www.google.com/search?q=+ebpf+waf+site%3Agithub.com
harporoeder/ebpfsnitch: "Linux Application Level Firewall based on eBPF and NFQUEUE" https://github.com/harporoeder/ebpfsnitch
ebpf-security/ebpf-https: "eBPF-https is an open source web application firewall (WAF)" https://github.com/ebpf-security/ebpf-https
cilium/cilium: https://github.com/cilium/cilium :
> Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode. It is L7-protocol aware and can enforce network policies on L3-L7 using an identity based security model that is decoupled from network addressing.
Just to clarify, we are not a company of any sorts, simply people willing to help.