You make it sound like mod_sec is a firewall, just blocking well-known ports, and all developers should simply adjust their application to use port 80 so they don't get blocked. It's not like that at all - the full rulesets are immensely complex, different on every host and changing all the time. How would you expect the developers to "adjust" for that? Can you specify exactly what they should do?
If this is a common application and frequently causes false positives then the rules should be changed to fix the problem. Ideally the rules should always be designed to differentiate between innocent use of an application and malicious exploitation of it, but of course this is extremely difficult to do (as with any kind of content-based filtering). Considering this I think mod_sec works remarkably well (a testament to the skill of the people writing the rules) but in practice it is and always will be imperfect, with both false positives and false negatives inevitable. As a host you can affect the likelihood of each by choosing the rulesets you use. Or, as I suggested before, you can take a reactive approach, disabling as necessary only those rules that trigger false positives.
There is one way developers could do what you ask: by encrypting all user input client-side before submitting it. So there'd be nothing for mod_sec to work on and you're guaranteed no false positives. Unfortunately you'd also be guaranteed no positives at all; since malicious inputs would go through exactly the same way this would make mod_sec completely useless. Better hope they aren't forced to go that way...
__________________
Chris <ClonePanel>
"Not everything that can be counted counts, and not everything that counts can be counted" - Albert Einstein
Linear Mode
