Yes, but you can say that about any web server info that exists and it's more security by obscurity IMO.
Sites that really don't want to expose that they are using PHP use .html, turn off errors and turn expose_php off. I think we should leave it up to the user to do so.


Andi

At 10:52 PM 12/27/2004 -0500, Ilia Alshanetsky wrote:
Andi Gutmans wrote:
Ilia,
Wasting bandwidth/cpu? Come on...
This feature is actually very important to keep on by default. It very much drives Netcraft numbers (actually it seems MS copied this from us a few years ago).
These numbers are used on php.net and other PHP advocacy web sites.
Please discuss such significant changes on internals@ before you commit them.

Aside from being pointless, it also is a handy tool for anyone trying to discover exploitable PHP servers before expanding resources towards trying to compromise that server.


Ilia

-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php



Reply via email to