<div class="gmail_quote">On Thu, Apr 2, 2009 at 9:31 AM, David Champion <span dir="ltr"><<a href="mailto:dave@dchamp.net">dave@dchamp.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
You've pretty much answered your own question. At the SANS PHP security<br>
class I was at this winter, they mentioned that any extra version info<br>
you give out can be used by attackers to help them find vulnerable<br>
servers to attack.<br>
<br>
I can't think of a good reason really to leave them on. There may be a<br>
RFC or something that says you're supposed to show it...<br>
<br>
-dc<br>
<br>
</blockquote></div><br>There is no RFC that I'm aware of that says you need to disclose the version. I believe that is really only used by companies like Netcraft that come out with those reports of how many sites are running Apache or IIS and how many are using PHP or Perl or <insert you langauge here>.<br>
<br>Just kind of a way to stand and be counted, but I'm sure they don't rely solely on the headers/version information for that data.<br><br clear="all"><br>-- <br>Jerry<br>