Re: [us...@httpd] HTTP header fields

2010-12-07 Thread William A. Rowe Jr.
On 12/6/2010 12:50 PM, Eric Covener wrote: > > There hasn't been much discussion that the info should be hidden by default. Please consult the archives, that is discussion of a decision that will not die. - The official User-To-

Re: [us...@httpd] HTTP header fields

2010-12-06 Thread Eric Covener
On Mon, Dec 6, 2010 at 1:56 PM, J.Lance Wilkinson wrote: > Eric Covener wrote: >> >> On Mon, Dec 6, 2010 at 1:42 PM, Dave Stevens wrote: > >> >>> >>> Well, I hadn't, but it seems as if from a security point of view it might >>> not >>> be a bad idea. Is there any history or discussion on tha

Re: [us...@httpd] HTTP header fields

2010-12-06 Thread Jeffrey E Burgoyne
>But somebody with > more malicious intent could interpret and abuse based on what they see. > Perhaps, but my web server logs shows a very large number of hits attacking vulnerabilities across multiple OS and web server types which have no bearing on the server I am running. The fa

Re: [us...@httpd] HTTP header fields

2010-12-06 Thread J.Lance Wilkinson
Eric Covener wrote: On Mon, Dec 6, 2010 at 1:42 PM, Dave Stevens wrote: > Well, I hadn't, but it seems as if from a security point of view it might not be a bad idea. Is there any history or discussion on that? or perhaps a reference I can read up on? http://httpd.apache.org/docs/curren

Re: [us...@httpd] HTTP header fields

2010-12-06 Thread Eric Covener
On Mon, Dec 6, 2010 at 1:42 PM, Dave Stevens wrote: > Recently I had a note from a user of the apache site on my server that said in > part, "the title bar in my browser shows the software package, O/S and version > you run on your server. > > Have you thought about changing that?" > > Well, I had

[us...@httpd] HTTP header fields

2010-12-06 Thread Dave Stevens
Recently I had a note from a user of the apache site on my server that said in part, "the title bar in my browser shows the software package, O/S and version you run on your server. Have you thought about changing that?" Well, I hadn't, but it seems as if from a security point of view it migh