@stefano i would rephrase: stop deploying negative filter wafs, use positive filters like for any proper firewall one would do.
other than that, the blog is spot on!