[sebazzz]

> While waiting for the patch, a WAF can quickly block all requests to the /setup endpoint.

So can IIS request filtering or whatever exists in Nagios. Right on the webserver.

[JoeSpaghettio]

depends on the org. The appsec team, may not have access to the webserver in production atleast not quickly. But will have access to modify a WAF they own.

[wiml]

I suppose from that perspective WAFs exist simply because of Conway's law.

[threeseed]

Many applications these days don't have web servers in front of them.