On Fri, Feb 20, 2009 at 4:48 PM, Nuno Magalhães <span dir="ltr"><<a href="mailto:nunomagalhaes@eu.ipp.pt">nunomagalhaes@eu.ipp.pt</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">> Personally I think that even switching off server_tokens is wrong<br>
> way to go. It doesn't give you extra security but instead false<br>
> sense of it<br>
<br>
</div>It doesn't secure anything per se, but it's harder for people to<br>
figure out which webserver is running and thus harder to find exploits<br>
for said server.</blockquote><div><br>HTTP fingerprinting is a very low wall. If someone seriously capable is attempting to exploit you, spoofing or removing your server string won't matter in the least as they will employ fingerprinting techniques. I'm just gonna leave this here... <a href="http://www.net-square.com/httprint/httprint_paper.html">http://www.net-square.com/httprint/httprint_paper.html</a><br>
<br>-Merlin<br></div></div><br>