Hiding the version information is but a piece of the puzzle. It won’t save a server from a persistent attacker. However, hiding the server software, and the software version, makes it harder for “drive-by” attackers to discover that your server is vulnerable. They don’t generally want to spend the time to test the universe of known compromises to server software, but if they know they only need to test for vulnerabilities to Subversion 1.7.X, then you’ve got their attention.
Hiding that information slows the drive-by attackers down, much like having a safe will do the same. In some cases the extra time nudges attackers towards looking for easier targets. Eric On Dec 16, 2017, at 3:35 AM, Branko Čibej <br...@apache.org> wrote: On 15.12.2017 20:10, Matt Simmons wrote: Many documents relating to information security compliance require blocking visible software version information. Interesting documents. I'd have expected them to require all software to be patched to fix all known security bugs. I thought the "security by obscurity" mantra had been debunked, but apparently not ... -- Brane On Fri, Dec 15, 2017 at 10:46 AM Nico Kadel-Garcia <nka...@gmail.com <mailto:nka...@gmail.com <nka...@gmail.com>>> wrote: Why would you want to hide this? On Fri, Dec 15, 2017 at 10:54 AM, Dave Huang <k...@azeotrope.org <mailto:k...@azeotrope.org <k...@azeotrope.org>>> wrote: On Dec 15, 2017, at 9:15, Dhanushka Parakrama <parakrama1...@gmail.com <mailto:parakrama1...@gmail.com <parakrama1...@gmail.com>>> wrote: Hi All Is there any configuration where i can hide the subversion version details .Please see copied image <image.png> -- "Today, vegetables... Tomorrow, the world!"
