Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (athena.apache.org: 76.96.30.40 is neither permitted nor
 denied by domain of jim@jagunet.com)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
Subject: Re: server-status and privacy
From: Jim Jagielski <jim@jaguNET.com>
In-Reply-To: <AANLkTinAAGlXcvIjeaVjB8158Fg051udUo6lLxnsepVV@mail.gmail.com>
Date: Wed, 23 Jun 2010 11:49:04 -0400
Content-Transfer-Encoding: 7bit
Message-Id: <47E0A91D-C86D-4B2C-9B72-EF9FFEC20618@jaguNET.com>
References: <EDAE0D0A-2E9A-4C55-82D6-2C69FB12E400@jaguNET.com>
 <AANLkTinAAGlXcvIjeaVjB8158Fg051udUo6lLxnsepVV@mail.gmail.com>
To: dev@httpd.apache.org


On Jun 21, 2010, at 1:07 PM, Jeff Trawick wrote:

> On Mon, Jun 21, 2010 at 8:40 AM, Jim Jagielski <jim@jagunet.com> wrote:
>> There have been a few reports regarding how server-status "leaks"
>> info, mostly about our (the ASF's) open use of server-status and
>> how IP addresses are exposed.
>> 
>> I'm thinking about a patch that adjusts server-status/mod_status
>> to have a "public vs. private" setting... Public would be to
>> have IP addresses exposed as public info; private would be to
>> not expose 'em (keep 'em private).
> 
> use mod_sed or similar on apache.org to change the client IP address
> field to "?"
> 

True... so I'm guessing this means that the patch would
be unacceptable?