[icecap12]

As others have said, there are plenty of useful aspects to WAF technology. For my organization in particular, we have a lot of legacy junk floating around, and the WAF is an easy way to add a layer of protection to stuff nobody is working on anymore (keeping internet-facing systems up to date is another convo). As part of that legacy conversation, in addition to prevention of injection and other common web attacks, you get the added benefit of being able to add headers and upgrade TLS connections for old stuff to keep those pesky security scorecard reports off the CISOs desk. For most managed solutions, you can implement geo-blocking with a couple clicks. For the most part, a WAF is good for driveby stuff and zero-days. You have to look at it as just another part of a defense-in-depth strategy, and like any other control, if you put all your eggs in one basket it'll be a bad day. Definitely not snake-oil though.

[sk5t]

WAFs sound pretty darn good for simple, well-understood services with known good inputs. If every valid request to some half-forgotten Perl remnant in /cgi-bin looks like "path\?id=[0-9]{1,10}" then let that allow rule rip!