3 ms·

You are advocating for security by obscurity. Which is a "deterrent" not a solution. Version numbers help people get support and know when/where versions are f

by lbotos 7y ago

You are advocating for security by obscurity. Which is a "deterrent" not a solution. Version numbers help people get support and know when/where versions are fixed and if they are patched/updated. A solution is running up to date software, and encouraging developers to release security fixes and for admins to care.

shakna 7y ago
Version numbers can still be handed to people without having to appear in every single request. It is a deterrent, and not a solution. But it does prevent the clouds of botnets from labeling you as definitely vulnerable and attacking you the moment a new 0-day gets purchased. The speed of attacks can outpace your speed of your upgrade process. Security-in-depth should always be the way forward. This is just another tickbox you can use.
- RandomTisk 7y ago
  I agree, it's more like a "sane default".
big_chungus 7y ago
I'm not advocating for using it as a sole defense, I'm saying it can cut down on log noise and won't hurt. Relying on security by obscurity is stupid; reducing the amount of information available to an attacker is smart.
aaron695 7y ago
> Which is a "deterrent" not a solution. How on earth did we get to a place where deterrents where somehow looked down on? Deterrents are the basis of order at every level of society. Nothing is a 'solution', everything is a deterrent. How obscurity go put into this meme, is interesting, but at the end of the day has to die. > admins to care. Admins how know their stuff enough to kill metadata that most admins are to lazy to fix, care.
newnewpdro 7y ago
They're doing nothing of the sort. All software will have bugs. There's no good reason to accurately broadcast to the world what specific version you're running of anything, ever. It's not advocating leaving your production systems to rot with ancient software because you've hidden the versions. You still need to stay vigilant. But the reality is, 0-days happen, and not all bugs being exploited are reported/fixed. Keep the version hidden, or hell, broadcast a completely different software/version altogether.

by lbotos 7y ago

shakna 7y ago

Version numbers can still be handed to people without having to appear in every single request. It is a deterrent, and not a solution. But it does prevent the clouds of botnets from labeling you as definitely vulnerable and attacking you the moment a new 0-day gets purchased. The speed of attacks can outpace your speed of your upgrade process. Security-in-depth should always be the way forward. This is just another tickbox you can use.

RandomTisk 7y ago
I agree, it's more like a "sane default".

big_chungus 7y ago

I'm not advocating for using it as a sole defense, I'm saying it can cut down on log noise and won't hurt. Relying on security by obscurity is stupid; reducing the amount of information available to an attacker is smart.

aaron695 7y ago

> Which is a "deterrent" not a solution. How on earth did we get to a place where deterrents where somehow looked down on? Deterrents are the basis of order at every level of society. Nothing is a 'solution', everything is a deterrent. How obscurity go put into this meme, is interesting, but at the end of the day has to die. > admins to care. Admins how know their stuff enough to kill metadata that most admins are to lazy to fix, care.

newnewpdro 7y ago

They're doing nothing of the sort. All software will have bugs. There's no good reason to accurately broadcast to the world what specific version you're running of anything, ever. It's not advocating leaving your production systems to rot with ancient software because you've hidden the versions. You still need to stay vigilant. But the reality is, 0-days happen, and not all bugs being exploited are reported/fixed. Keep the version hidden, or hell, broadcast a completely different software/version altogether.