Ask HN: Do you use ASL to protect your web server?

We're in the market for a low cost and preferably open-source WAF to protect our marketing website that also allows customers to signup to our service. The only comprehensive solution I can find is ASL which includes a hardened kernel and many other features although it does seem targeted more at web hosting services. Does anyone have any experience with ASL or have you found modsecurity with the core/commercial ruleset sufficient?