Should the version be hidden?

feature
1

I wonder if it is a good and consistent way to currently:

  • hide the nginx version information from replies in header, but
  • display the exact version and git patch level in html source code of Discourse

If someone has an automated tool searching for unpatched security issues, it is failry easy if the HTML source displays the version in the meta generator tag.

I would suggest to remove that information from anonymous requests at least, perhaps even from all non admin accesses.

4 Likes
2

I consider this “security by obscurity” which is no real kind of security at all. It’s better to focus efforts on techniques that actually improve security…

2 Likes
3

Sure, focus should be to have a secure system, not to hide the bugs.

I just wondered why the version of nginx gets hidden and the main app version not.

But then it might be even a question with the imap and smtp protocols if one should display those versions too or hide/change them.

4

it could be cause nginx is inside the docker container ?

1 Like