I feel like I was reading this from Marcus Ranum in 2005 in the famous article "Six dumbest ideas in computer security"[1] where he wrote about just running a custom webserver that accepts only correctly specified requests, instead of Apache and a filter set of bad-request-blockers and a default-permit firewall and etc.

That article makes good re-reading in the "Penetrate and Patch" section now, in the days of AI exploits popping up faster and faster.

[1] https://www.ranum.com/security/computer_security/editorials/...