Yeah but serving traffic from an application server directly is probably even worse in plethora of other failure modes. EDIT: and yes I understand that you sho

Yeah but serving traffic from an application server directly is probably even worse in plethora of other failure modes. EDIT: and yes I understand that you should use http/2 on the LB and http/2 on the backend to get the best of both worlds. EDIT2: anyway my opinion is that the general reaction to a security discovery like this one shouldn't be "let's stop using this tech immediately" but "let's get this patched ASAP"