# Show Discourse version on the /about page
**URL:** https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205
**Category:** Feature
**Created:** [4. April 2015 um 18:35 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205 "2015-04-04T18:35:05Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Benno](https://meta.discourse.org/u/Benno)
#### Post date: [4. April 2015 um 18:35 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/1 "2015-04-04T18:35:05Z")
I don’t think the Discourse version is show anywhere (except to the admin on the Dashboard), why not add it to the /about page?
I’m currently researching Discourse usage and would be interested to see which version site admins are running.
To a normal user this would let them know which forum software is being used.
---
### Author:  [@lidel](https://meta.discourse.org/u/lidel)
#### Post date: [4. April 2015 um 18:41 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/2 "2015-04-04T18:41:11Z")
I guess it would not hurt, especially when Discourse already provides its version in HTML’s ``:
```html
```
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [4. April 2015 um 20:56 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/3 "2015-04-04T20:56:15Z")
I don’t think, this is a good idea.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [4. April 2015 um 20:56 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/4 "2015-04-04T20:56:55Z")
It’s fine, if the version number is in the meta tags, there’s no difference between that and putting it on the about page.
---
### Author:  [@lidel](https://meta.discourse.org/u/lidel)
#### Post date: [5. April 2015 um 12:04 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/5 "2015-04-05T12:04:28Z")
I’ve seen some administrators disable software version numbers in HTTP responses, others go further and recompile Apache to identify as Microsoft’s IIS or Nginx to pretend to be Apache [sic].
This is a part of something known as
> **[Security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity)**
>
> In security engineering, security through obscurity is the practice of concealing the details or mechanisms of a system to enhance its security. This approach relies on the principle of hiding something in plain sight, akin to a magician's sleight of hand or the use of camouflage. It diverges from traditional security methods, such as physical locks, and is more about obscuring information or characteristics to deter potential threats. Examples of this practice include disguising sensitive inform...
It gives no protection against directed attacks, but usually mitigate a big chunk of automated threats performed by inexperienced/unmotivated adversaries.
I guess @terraboss’ concern is that script-kiddies would crawl the web and look for a specific Discourse versions with known vulnerability and execute an exploit if version is low enough (unpatched installations).
This was/is the [main concern for phpBB installations](http://www.cvedetails.com/vulnerability-list/vendor_id-1529/Phpbb.html).
In this context it would be beneficial to add an option to `/admin` that controls displaying Discourse version (in `` and `/about`).
That being said, we probably want to follow example of Nginx and others and keep it enabled by default (version visible).
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [5. April 2015 um 14:08 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/6 "2015-04-05T14:08:52Z")
> [@lidel](#):
>
> I guess @terraboss’ concern is that script-kiddies would crawl the web and look for a specific Discourse versions with known vulnerability and execute an exploit if version is low enough (unpatched installations). This was/is the main concern for phpBB installations.In this context it would be beneficial to add an option to /admin that controls displaying Discourse version (in \ and /about).
Indeed. That’s exactly my concern. Real hackers are able to exploit any (web) application. But today, in my experience, we have to deal more and more with bored scipt kiddys and low secured default setups. Discourse is currently in beta state but it’s pretty well maintained. I’m running daily upgrades.
As long as most admins would do the same, there is no need for security through obscurity.
That’s just my opinion. There are even more settings (dns, firewall, ssl, database, login, kvm, …) to get a secure system, And backups won’t be bad at all. 😉
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [5. April 2015 um 15:17 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/7 "2015-04-05T15:17:47Z")
The Discourse version is included in all HTML responses, though. So this wouldn’t be revealing anything extra.
---
### Author:  [@ColdSun](https://meta.discourse.org/u/ColdSun)
#### Post date: [5. April 2015 um 19:23 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/8 "2015-04-05T19:23:37Z")
Having the discourse version in HTML responses is actually quite different than stating it in an about page. Individuals looking to specify specific versions of vulnerable software tend to look for a specific string of text on a page via a search engine. If this information were present on the about page, you could quickly generate a list of tons of sites running softwave y, version x.z.
A response in the header? Not so much.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [5. April 2015 um 19:32 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/9 "2015-04-05T19:32:15Z")
The /about content isn’t visible to search engines, you would need to parse /about.json.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [6. April 2015 um 23:27 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/10 "2015-04-06T23:27:12Z")
Besides, its open source software you can easily fingerprint JS/CSS payloads and get a rather accurate payload → version map.
---
### Author:  [@JMichaelTX](https://meta.discourse.org/u/JMichaelTX)
#### Post date: [28. Oktober 2017 um 01:05 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/11 "2017-10-28T01:05:32Z")
> [@Benno](#):
>
> I’m currently researching Discourse usage and would be interested to see which version site admins are running.
> To a normal user this would let them know which forum software is being used.
This may not help the average (whatever that is) user, but here’s a simple JavaScript that will get the Discourse version:
```javascript
verStr = document.querySelector('meta[name="generator"]').content.match(/\w+[]+[\d\.]+/)[0];
verStr
```
You could run this script from several tools:
- AppleScript
- JavaScript for Automation (JXA)
- Keyboard Maestro
- Browser bookmarklet
- others?
I’ve tested it only in Chrome, so I can’t vouch for other browsers, but it should work in Safari.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [11. Mai 2024 um 19:17 UTC](https://meta.discourse.org/t/show-discourse-version-on-the-about-page/27205/12 "2024-05-11T19:17:16Z")