# Should the version be hidden?

**URL:** https://meta.discourse.org/t/should-the-version-be-hidden/206333
**Category:** Feature
**Created:** [October 18, 2021, 11:31am UTC](https://meta.discourse.org/t/should-the-version-be-hidden/206333 "2021-10-18T11:31:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Kai\_Kretschmann](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kai_kretschmann/32/235943_2.png) [@Kai\_Kretschmann](https://meta.discourse.org/u/Kai_Kretschmann)
#### Post date: [October 18, 2021, 11:31am UTC](https://meta.discourse.org/t/should-the-version-be-hidden/206333/1 "2021-10-18T11:31:11Z")

</div>

I wonder if it is a good and consistent way to currently:

- hide the nginx version information from replies in header, but
- display the exact version and git patch level in html source code of Discourse

If someone has an automated tool searching for unpatched security issues, it is failry easy if the HTML source displays the version in the meta generator tag.

I would suggest to remove that information from anonymous requests at least, perhaps even from all non admin accesses.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 23, 2021, 5:50am UTC](https://meta.discourse.org/t/should-the-version-be-hidden/206333/2 "2021-10-23T05:50:46Z")

</div>

I consider this “security by obscurity” which is no real kind of security at all. It’s better to focus efforts on techniques that actually improve security..

---

<div class="post-metadata">

### Author: ![Kai\_Kretschmann](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kai_kretschmann/32/235943_2.png) [@Kai\_Kretschmann](https://meta.discourse.org/u/Kai_Kretschmann)
#### Post date: [October 25, 2021, 5:37am UTC](https://meta.discourse.org/t/should-the-version-be-hidden/206333/3 "2021-10-25T05:37:19Z")

</div>

Sure, focus should be to have a secure system, not to hide the bugs.

I just wondered why the version of nginx gets hidden and the main app version not.

But then it might be even a question with the imap and smtp protocols if one should display those versions too or hide/change them.

---

<div class="post-metadata">

### Author: ![IAmGav](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/iamgav/32/235598_2.png) [@IAmGav](https://meta.discourse.org/u/IAmGav)
#### Post date: [October 25, 2021, 5:50pm UTC](https://meta.discourse.org/t/should-the-version-be-hidden/206333/4 "2021-10-25T17:50:57Z")

</div>

> [@Kai\_Kretschmann](#):
>
> version of nginx gets hidden

it could be cause nginx is inside the docker container ?