Top all-time · #1066
Imperva
Company blog · imperva.com/blogsecurity
Imperva is the company blog at imperva.com, writing about security. Since 2010, 63 different Hacker News readers have linked it 85 times, most often “Analyzing top four flaws in HTTP/2.0 [pdf]”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Imperva provides complete cyber security by protecting what really matters most—your data and applications—whether on-premises or in the cloud.
Most-linked posts?
- Analyzing top four flaws in HTTP/2.0 [pdf]4 people · 4 mentions · first linked 2016-08-03
- Imperva Security Update3 people · 3 mentions · first linked 2019-08-27
- When Bandwidth Doesn’t Last2 people · 2 mentions · first linked 2020-06-01
- /resources/reports/2023-Imperva-Bad-Bot-Report.pdf2 people · 2 mentions · first linked 2023-05-14
- Python and Go Top the Chart of 2019’s Most Popular Hacking Tools2 people · 2 mentions · first linked 2020-06-06
- Delivery and Execution of Malicious Executables Through SQL Commands2 people · 2 mentions · first linked 2018-02-27
- HTML5 Feature Used to Trick Chinese Mobile Users into Joining Latest DDoS Attack2 people · 2 mentions · first linked 2019-04-11
- Remote File Inclusion (RFI) – Detecting the Undetectable2 people · 2 mentions · first linked 2020-03-29
- /blog/node2shell-from-brotli-data-to-remote-code-execution/2 people · 2 mentions · first linked 2026-10-23
What Hacker News says?
The arms race would intensify, and detecting/blocking/deceiving scrapers might become a lucrative field. It already is. There are entire companies, like Distil Networks, who exist solely to protect companies from bots/scrapers/etc. Actually, looks like Distil got acquired and are now part of Imperva, but anyway, the idea is the same. This is definitely an existing field. https://www.imperva.com/products/bot-manageme…
Comment linking /products/bot-management/
on “Congrats! Web scraping is legal! (US precedent)”Submitted A picture got my PostgreSQL database to start mining Monero as a story · 459 points
HN discussionSometimes it's less about the size of the payload and more about # of requests. Especially when targeting the application layer. Read more here: https://www.imperva.com/blog/gbps-pps-rps-ddos-attacks/#:~:t...
Comment linking /blog/gbps-pps-rps-ddos-attacks/
on “Ukraine calls on hacker underground to defend against Russia”Submitted A Picture Got My Postgres Database to Start Mining Monero (2018) as a story · 34 points
HN discussionhttps://www.imperva.com/blog/rediswannamine-new-redis-nsa-po...
Comment linking /blog/rediswannamine-new-redis-nsa-powered-cryptojacking-attack/
on “Redis Turns 10 – How it started with a single post on Hacker News”Submitted The Catch 22 of Base64: Attacker Dilemma from a Defender Point of View as a story · 15 points
HN discussionOn point 1: Facebook are going to be forced into this by law. The EU is introducing a major piece of regulation, entering into effect in late May. The 'right to be forgotten' is an important part of this[1]. It's possible this will become the de facto standard worldwide as a result. The penalties for non compliance: "In the case of non-compliance with key provisions of the GDPR, regulators have the authority to levy…
Comment linking /blog/2017/03/gdpr-series-part-4-penalties-non-compliance/
on “Zuckerberg on Cambridge Analytica situation”Submitted Analyzing top four flaws in HTTP/2.0 [pdf] as a story · 15 points
HN discussion"By accessing this Site, you acknowledge that you have read, understand, and agree to abide by the terms described herein." < https://www.imperva.com/legal/website-terms-of-use/ > Many, many, many hits for this or similar language: < https://duckduckgo.com/?q=%22By+accessing+this+Site%2C+you+a... > Mind: just because it's written doesn't mean it's enforceable , but to argue that what you've just denied isn't a widel…
Comment linking /legal/website-terms-of-use/
on “Amazon's AI crawler is making my Git server unstable”Submitted Imperva Security Update as a story · 11 points
HN discussionCorrect, here is part 1 and 2: https://www.imperva.com/blog/2018/02/database-attacks-sql-ob... https://www.imperva.com/blog/2018/02/deep-dive-database-atta...
Comment linking /blog/2018/02/deep-dive-database-attacks-part-ii-delivery-execution-malicious-executables-sql-commands-sql-server/
on “A picture got my PostgreSQL database to start mining Monero”Submitted HTTP/2: Faster and better than HTTP 1.1, but is it more secure? [pdf] as a story · 6 points
HN discussionDon't pay, they have deleted your data and you're not getting it back. This non targeted attack has been running since 2017 and is pretty well documented now, nobody ever reported getting their data back after paying. ALWAYS read for existing documentation about an attack you have been victim of, should be one of the first thing you do, especially prior to pay. https://www.imperva.com/blog/ransomware-attacks-on-mysq…
Comment linking /blog/ransomware-attacks-on-mysql-and-mongodb/
on “Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage”Submitted Implementing Privacy in a Real World Application as a story · 5 points
HN discussionGoing a bit further, it seems like there's a grain of truth here, HTTP/2 has a stream priority dependency mechanism [1] and this report [2] from Imperva describes an actual Dependency Cycle DoS in the nghttp implementation. Unfortunately that's where it seems to end... I'm not that familiar with QUIC and HTTP/2, but I think the closest it gets is that the GitHub repo exists and has a `class QuicConnection` [3]. Beyo…
Comment linking /docs/imperva_hii_http2.pdf
on “Curl: We still have not seen a valid security report done with AI help”Submitted Analysis of 1,019 Phishing Kits as a story · 4 points
HN discussionImperva, a Thales company | Data Scientist for Bot Detection | Hiring 2 candidates | Vancouver, Canada | Hybrid We are looking for talented, experienced Data Scientists who are ever curious about data problems and eager to write code to get those problems solved. Members of this team creatively find problems as well as solve them. Much of the work is analyzing detection mechanisms and bot behaviors, making advances…
Comment linking /company/careers/position/?p=job/ofXgufwG
on “Ask HN: Who is hiring? (September 2024)”Submitted Imperva Security Update as a story · 4 points
HN discussionImperva/Prevoty | Redwood Shores, CA or Los Angeles, CA | Software Engineer | Full-time, permanent | https://www.prevoty.com/ https://www.imperva.com/ Prevoty is looking for a talented Senior Software Engineers to join our Java team. As a Senior Software Engineer, you will play a central role in the design and development of our Java products. The ideal candidate will have a passion for development, a drive to fully…
Comment linking /
on “Ask HN: Who is hiring? (December 2018)”Submitted Python and Go Top the Chart of 2019’s Most Popular Hacking Tools as a story · 3 points
HN discussionImperva, a Thales company | Data Scientist for Bot Detection | Hiring 2 candidates | Vancouver, Canada | Hybrid We are looking for talented, experienced Data Scientists who are ever curious about data problems and eager to write code to get those problems solved. Members of this team creatively find problems as well as solve them. Much of the work is analyzing detection mechanisms and bot behaviors, making advances…
Comment linking /company/careers/position/?p=job/ofXgufwG
on “Ask HN: Who is hiring? (October 2024)”Submitted Uncovering the security issues of shared scooter services as a story · 3 points
HN discussionIn the case of the font foundry my client was licensing from, ‣ You were not allowed to self-host the font files, and had to load them directly from the hosting URL provided by the font foundry ‣ There was no explicit reporting involved. Every time the font resource was downloaded from their server, the foundry counted that as a licensed pageview. ‣ The foundry used cache control headers[1] on the response, so that…
Comment linking /blog/how-incapsula-client-classification-challenges-bots/
on “Helvetica Now Variable”Submitted Python Happens to Be Most Hackers’ Weapon of Choice as a story · 3 points
HN discussionDdos tools usually use amplification, instead of sending 1:1 bytes (that is u sending 1 byte and receive 1 byte as answer) They may query a database instead which a 30 byte search query results in couple thousand bytes of results + the load on the database It would be expensive to just use raw network power to overwhelm a web service(u would need more bandwidth than the host) Meanwhile with amplification u only need…
Comment linking /learn/ddos/dns-amplification/
on “Some idiot is using your tool to mass scan our network”Submitted A Deep Dive into Database Attacks [Part I]: SQL Obfuscation as a story · 3 points
HN discussionYes, direct competitors on the Enterprise space. On the low/mid end, only https://Imperva.com and http://Sucuri.net compete with CloudFlare.
Comment linking /
on “Google, Microsoft, Qualcomm and Baidu Announce Joint Investment in CloudFlare”Submitted Database as a Service malware as a story · 3 points
HN discussionMissing from the article: Node2Shell https://www.imperva.com/blog/node2shell-from-brotli-data-to-...
Comment linking /blog/node2shell-from-brotli-data-to-remote-code-execution/
on “Is this the new cyber normal?”Submitted Imperva Takes on its Largest Recorded ATO Attack on a Single Company as a story · 2 points
HN discussion
