Hacker News Reader

> While waiting for the patch, a WAF can quickly block all requests to the /setup endpoint.

So can IIS request filtering or whatever exists in Nagios. Right on the webserver.

depends on the org. The appsec team, may not have access to the webserver in production atleast not quickly. But will have access to modify a WAF they own.

I suppose from that perspective WAFs exist simply because of Conway's law.

Many applications these days don't have web servers in front of them.

Reply on news.ycombinator.com