버전을 숨겨야 하나요?

기여 기능
1

I wonder if it is a good and consistent way to currently:

  • hide the nginx version information from replies in header, but
  • display the exact version and git patch level in html source code of Discourse

If someone has an automated tool searching for unpatched security issues, it is failry easy if the HTML source displays the version in the meta generator tag.

I would suggest to remove that information from anonymous requests at least, perhaps even from all non admin accesses.

4개의 좋아요
2

I consider this “security by obscurity” which is no real kind of security at all. It’s better to focus efforts on techniques that actually improve security..

2개의 좋아요
3

Sure, focus should be to have a secure system, not to hide the bugs.

I just wondered why the version of nginx gets hidden and the main app version not.

But then it might be even a question with the imap and smtp protocols if one should display those versions too or hide/change them.

4

it could be cause nginx is inside the docker container ?

1개의 좋아요