Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
From: Jim Jagielski <jim@jaguNET.com>
Message-Id: <200401131435.i0DEZJC05346@devsys.jaguNET.com>
Subject: Re: Proposal: Allow ServerTokens to specify Server header completely
To: dev@httpd.apache.org
Date: Tue, 13 Jan 2004 09:35:15 -0500 (EST)
Reply-To: jim@jaguNET.com
In-Reply-To: <no.id> from "Ivan Ristic" at Jan 13, 2004 02:25:36 PM
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Ivan Ristic wrote:
> 
> 
> > As Lars said (and I agree), it has nothing to do with security. Why do you
> > provide such a "feature" then?
> 
>    Because I believe that changing the signature prevents some
>    automated tools from attacking the server.
> 
>    So, the signature
>    does matter.
> 

Without a doubt. Look at how many exploits grep on not only
the "name" of the server but also the version. 

I didn't propose this to create (yet another) heated discussion,
simply to suggest that we take ServerTokens to its logical
conclusion based on some requests I've seen. :)
-- 
===========================================================================
   Jim Jagielski   [|]   jim@jaguNET.com   [|]   http://www.jaguNET.com/
      "A society that will trade a little liberty for a little order
             will lose both and deserve neither" - T.Jefferson