Andrew Howe - Insights from the load balancer experts

Andrew Howe

was Technical Author/Architect

Andrew Howe

From a diverse background including point of sale IT support and homelessness support, Andrew joined Loadbalancer.org to further his passion for Linux and free and open-source software. Outside of work, Andrew can be found at the annual FOSDEM free and open-source software event in Brussels, and is also a fan of left field cinema, classic synth-pop/disco music, and tabletop role-playing.

Blog > Author > Andrew Howe

Why you shouldn't lose sleep over the commercial end-of-life of ModSecurity

13 June 2023 • 5 mins

Why you shouldn't lose sleep over the commercial end-of-life of ModSecurity

The ModSecurity web application firewall (WAF) engine is set to go end-of-life (EOL) on 1 July 2024.

Three scenarios for implementing time-based security and content switching on your load balancer

26 May 2023 • 10 mins

Three scenarios for implementing time-based security and content switching on your load balancer

It can sometimes be useful to make load balancing decisions based on the time and date. This allows you to conditionally refuse or redirect connections based on the time they're received.

application security padlock and laptop keyboard

24 February 2023 • 4 mins

Report back from the OWASP Core Rule Set Community Summit and OWASP Global AppSec 2023: The WAF conundrum

I had the privilege of speaking in Dublin at this year's OWASP Core Rule Set Community Summit before then attending OWASP Global AppSec immediately afterwards.

Handling large requests with a Web Application Firewall (WAF) while avoiding Denial of Service (DoS) attacks

9 June 2022 • 7 mins

Handling large requests with a Web Application Firewall (WAF) while avoiding Denial of Service (DoS) attacks

Sometimes, we need to pass unusually large HTTP requests through our WAF stack.

Achieving unrivaled performance with media and video streaming on demand

28 February 2022 • 4 mins

Achieving unrivaled performance with media and video streaming on demand

For the uninitiated, layer 4 DR mode is a high performance load balancing method available on our appliances. It works by having all response traffic flow from the servers straight back to the clients.

ModSecurity DoS vulnerability (CVE-2021-42717)

21 January 2022 • 3 mins

ModSecurity DoS vulnerability (CVE-2021-42717)

All WAF vendors and services using ModSecurity are affected by this vulnerability (unless they have the vulnerable piece of code disabled, by chance).

Simplifying web application security with the Core Rule Set v3

17 January 2022 • 7 mins

Simplifying web application security with the Core Rule Set v3

A WAF isn't a magic bullet, but, as part of a defense in depth strategy, a properly configured WAF should catch and stop common, everyday attacks.

The importance of outreach: Introducing students to load balancing

6 January 2022 • 2 mins

The importance of outreach: Introducing students to load balancing

A recent visit to Southampton Solent University.

Extending ModSecurity: How to add completely custom WAF functionality

13 August 2021 • 12 mins

Extending ModSecurity: How to add completely custom WAF functionality

In this example, I’m going to add a new transformation function to ModSecurity to calculate the Scrabble score of a variable. This will allow us to block HTTP requests containing query string parameters with a Scrabble score above a chosen threshold.

Announcing CVE-2021-35368: OWASP ModSecurity Core Rule Set Bypass

30 June 2021 • 3 mins

Announcing CVE-2021-35368: OWASP ModSecurity Core Rule Set Bypass

In early June 2021, I identified a request body bypass vulnerability in the OWASP ModSecurity Core Rule Set (CRS). Loadbalancer.org appliances themselves are unaffected.

ModSecurity and the Case of the Never Decreasing Variables

6 January 2021 • 10 mins

ModSecurity and the Case of the Never Decreasing Variables

In the world of web application security, it can be invaluable to consider a user's behaviour across the entire duration of their web app session.

Layer 4 vs Layer 7 load balancing - we still love DSR, but…

21 May 2020 • 3 mins

Layer 4 vs Layer 7 load balancing - we still love DSR, but…

Direct server return, direct routing - no matter what you call it, using DSR maximises the throughput of return traffic and allows for near endless scalability. Here's why we still love it.

Security through geography: blocking traffic by country, continent, or IP address using ModSecurity

3 December 2019 • 6 mins

Security through geography: blocking traffic by country, continent, or IP address using ModSecurity

Imagine you’re running a business and you often see malicious-looking web traffic from the other side of the globe hitting your website.

SACK Panic: What is it, and is it actually time to panic?

20 June 2019 • 2 mins

SACK Panic: What is it, and is it actually time to panic?

Four closely related vulnerabilities regarding TCP handling in the Linux and FreeBSD kernels were publicly disclosed on 17 June 2019.

15 years later, we still love DSR

Direct Server Return

20 December 2018 • 2 mins

15 years later, we still love DSR

For the uninitiated, Direct Server Return is a clever trick which entails directly routing packets to the chosen real server.