Timeline for Is it really Security Misconfiguration to show a version number?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 14, 2019 at 11:28 | comment | added | Tom | If you are easy target for script kiddies, then exposed version numbers are the least of your problems. I agree dev team should check for vulns, but you know what? They aren't security experts and you are. There is some sense in running scans instead of trusting the dev team on this. Ideally, you'd do both. | |
| Aug 14, 2019 at 7:34 | comment | added | Luc | "unless you never scan yourself, hiding [version numbers] is shooting yourself in the foot." Except there exists a development team that made the software. They know what version they used and can check it for vulnerabilities. Doing that is as uncommon as running vulnerability scans on yourself (almost nobody does either), but if you have to pick one, I would rather check the version numbers myself than expose them for everyone to see. Yes, targeted attackers will use other means to get the info, but that doesn't mean you want to make it easy for either them or the script kiddies. | |
| Aug 14, 2019 at 4:38 | history | answered | Tom | CC BY-SA 4.0 |