You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Jim Jagielski <ji...@jaguNET.com> on 1998/05/28 17:30:11 UTC
1.3b8
Since it looks like 1.3b8 will be released, I'm going to add the
minimal code require to disable the Server: header totally if set
via the ServerTokens directive...
Unless, of course, this is vetoed... This is close enough to a feature
that I want feedback 1st.
--
===========================================================================
Jim Jagielski ||| jim@jaguNET.com ||| http://www.jaguNET.com/
"That's no ordinary rabbit... that's the most foul,
cruel and bad-tempered rodent you ever laid eyes on"
Re: 1.3b8
Posted by Brian Behlendorf <br...@hyperreal.org>.
I agree. I think it's due payback for the hard work we put in that we know
how widely Apache is being used.
Brian
At 10:13 AM 5/28/98 -0700, Dean Gaudet wrote:
>I'd rather not have that. I rather like the very minimal advertising we
>get from having a Server: header on all our servers... except for those of
>folks clueful enough to edit source anyhow.
>
>Dean
>
>On Thu, 28 May 1998, Jim Jagielski wrote:
>
>> Since it looks like 1.3b8 will be released, I'm going to add the
>> minimal code require to disable the Server: header totally if set
>> via the ServerTokens directive...
>>
>> Unless, of course, this is vetoed... This is close enough to a feature
>> that I want feedback 1st.
>> --
>> ===========================================================================
>> Jim Jagielski ||| jim@jaguNET.com ||| http://www.jaguNET.com/
>> "That's no ordinary rabbit... that's the most foul,
>> cruel and bad-tempered rodent you ever laid eyes on"
>>
>
>
--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
pure chewing satisfaction brian@apache.org
brian@hyperreal.org
Re: 1.3b8
Posted by Rodent of Unusual Size <Ke...@Golux.Com>.
Marc Slemko wrote:
>
> On Thu, 28 May 1998, Dean Gaudet wrote:
>
> > Look up the definition of SHOULD please. We are fully compliant.
>
> No, we are "conditionally compliant" as opposed to "unconditionally
> compliant". I'm not sure what definition "fully" has.
Thank you; that's what I meant.
> In any case, I think there are other SHOULDs we don't do.
Doubtless - but this one was obvious and I wanted to mention it -
so I did.
#ken P-)}
Ken Coar <http://Web.Golux.Com/coar/>
Apache Group member <http://www.apache.org/>
"Apache Server for Dummies" <http://Web.Golux.Com/coar/ASFD/>
Re: 1.3b8
Posted by Marc Slemko <ma...@worldgate.com>.
On Thu, 28 May 1998, Dean Gaudet wrote:
> Look up the definition of SHOULD please. We are fully compliant.
No, we are "conditionally compliant" as opposed to "unconditionally
compliant". I'm not sure what definition "fully" has.
In any case, I think there are other SHOULDs we don't do.
>
> Dean
>
> On Thu, 28 May 1998, Rodent of Unusual Size wrote:
>
> > Dean Gaudet wrote:
> > >
> > > I'd rather not have that. I rather like the very minimal
> > > advertising we get from having a Server: header on all our
> > > servers... except for those of folks clueful enough to edit
> > > source anyhow.
> >
> > We probably shouldn't call ourselves "fully HTTP/1.1 compliant,"
> > then, since being able to turn off the Server header field emission
> > is a SHOULD. From RFC 2068:
> >
> > >14.39 Server
> > > Note: Revealing the specific software version of the server may
> > > allow the server machine to become more vulnerable to attacks
> > > against software that is known to contain security holes. Server
> > > implementers are encouraged to make this field a configurable
> > > option.
> >
> > >15.4 Transfer of Sensitive Information
> > > Revealing the specific software version of the server may allow
> > > the server machine to become more vulnerable to attacks against
> > > software that is known to contain security holes. Implementers
> > > SHOULD make the Server header field a configurable option.
> >
> > Personally, I'd rather be fully compliant and give our users
> > the ability to turn it off altogether (how many are going to?) than
> > have my ego stroked by the count of servers out there. Although
> > it's a close call.. :->
> >
> > #ken P-)}
> >
> > Ken Coar <http://Web.Golux.Com/coar/>
> > Apache Group member <http://www.apache.org/>
> > "Apache Server for Dummies" <http://Web.Golux.Com/coar/ASFD/>
> >
>
Re: 1.3b8
Posted by Dean Gaudet <dg...@arctic.org>.
Look up the definition of SHOULD please. We are fully compliant.
Dean
On Thu, 28 May 1998, Rodent of Unusual Size wrote:
> Dean Gaudet wrote:
> >
> > I'd rather not have that. I rather like the very minimal
> > advertising we get from having a Server: header on all our
> > servers... except for those of folks clueful enough to edit
> > source anyhow.
>
> We probably shouldn't call ourselves "fully HTTP/1.1 compliant,"
> then, since being able to turn off the Server header field emission
> is a SHOULD. From RFC 2068:
>
> >14.39 Server
> > Note: Revealing the specific software version of the server may
> > allow the server machine to become more vulnerable to attacks
> > against software that is known to contain security holes. Server
> > implementers are encouraged to make this field a configurable
> > option.
>
> >15.4 Transfer of Sensitive Information
> > Revealing the specific software version of the server may allow
> > the server machine to become more vulnerable to attacks against
> > software that is known to contain security holes. Implementers
> > SHOULD make the Server header field a configurable option.
>
> Personally, I'd rather be fully compliant and give our users
> the ability to turn it off altogether (how many are going to?) than
> have my ego stroked by the count of servers out there. Although
> it's a close call.. :->
>
> #ken P-)}
>
> Ken Coar <http://Web.Golux.Com/coar/>
> Apache Group member <http://www.apache.org/>
> "Apache Server for Dummies" <http://Web.Golux.Com/coar/ASFD/>
>
Re: 1.3b8
Posted by Rodent of Unusual Size <Ke...@Golux.Com>.
Dean Gaudet wrote:
>
> I'd rather not have that. I rather like the very minimal
> advertising we get from having a Server: header on all our
> servers... except for those of folks clueful enough to edit
> source anyhow.
We probably shouldn't call ourselves "fully HTTP/1.1 compliant,"
then, since being able to turn off the Server header field emission
is a SHOULD. From RFC 2068:
>14.39 Server
> Note: Revealing the specific software version of the server may
> allow the server machine to become more vulnerable to attacks
> against software that is known to contain security holes. Server
> implementers are encouraged to make this field a configurable
> option.
>15.4 Transfer of Sensitive Information
> Revealing the specific software version of the server may allow
> the server machine to become more vulnerable to attacks against
> software that is known to contain security holes. Implementers
> SHOULD make the Server header field a configurable option.
Personally, I'd rather be fully compliant and give our users
the ability to turn it off altogether (how many are going to?) than
have my ego stroked by the count of servers out there. Although
it's a close call.. :->
#ken P-)}
Ken Coar <http://Web.Golux.Com/coar/>
Apache Group member <http://www.apache.org/>
"Apache Server for Dummies" <http://Web.Golux.Com/coar/ASFD/>
Re: 1.3b8
Posted by Dean Gaudet <dg...@arctic.org>.
I'd rather not have that. I rather like the very minimal advertising we
get from having a Server: header on all our servers... except for those of
folks clueful enough to edit source anyhow.
Dean
On Thu, 28 May 1998, Jim Jagielski wrote:
> Since it looks like 1.3b8 will be released, I'm going to add the
> minimal code require to disable the Server: header totally if set
> via the ServerTokens directive...
>
> Unless, of course, this is vetoed... This is close enough to a feature
> that I want feedback 1st.
> --
> ===========================================================================
> Jim Jagielski ||| jim@jaguNET.com ||| http://www.jaguNET.com/
> "That's no ordinary rabbit... that's the most foul,
> cruel and bad-tempered rodent you ever laid eyes on"
>