<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">It may or may not be pure security theatre (personally, I’d tend to agree with you on that), but ‘round these parts then
not publishing the versions of external software components used is pretty high up on standard checklists for securing systems (and is low-hanging fruit for anyone to check, so shows up pretty quickly), so being able to configure it out would save plenty of
hassle.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Ed<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> MapServer-dev [mailto:mapserver-dev-bounces@lists.osgeo.org]
<b>Im Auftrag von </b>michael.smith.erdc@gmail.com<br>
<b>Gesendet:</b> Mittwoch, 16. </span><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Februar 2022 12:37<br>
<b>An:</b> Tom Kralidis <tomkralidis@gmail.com><br>
<b>Cc:</b> MapServer Dev Mailing List <mapserver-dev@lists.osgeo.org><br>
<b>Betreff:</b> Re: [mapserver-dev] Dropping Version Output?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Also, I’d say that any perceived extra security by not having this info in the response is not really security, just security theatre. <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-GB">Keep it in.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB">Michael Smith<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB">US Army Corps<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-GB">On Feb 16, 2022, at 6:34 AM, Tom Kralidis <</span><a href="mailto:tomkralidis@gmail.com"><span lang="EN-GB">tomkralidis@gmail.com</span></a><span lang="EN-GB">> wrote:<o:p></o:p></span></p>
</blockquote>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-GB"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-GB">I would suggest keeping at least the version somewhere in the responses (i.e. current behaviour, or<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB">move to an HTTP header). For scenarios where users do not have access to the deployment environment,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB">this information is critical.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB">..Tom<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-GB">On Tue, Feb 15, 2022 at 8:49 PM Steve Lime <</span><a href="mailto:sdlime@gmail.com"><span lang="EN-GB">sdlime@gmail.com</span></a><span lang="EN-GB">> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-GB">What do folks think about dropping the version output from MapServer?
</span>That is, output like:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt"></td>
</tr>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"><span lang="EN-GB" style="color:black"><!-- MapServer version 7.6.4 OUTPUT=PNG OUTPUT=JPEG SUPPORTS=PROJ SUPPORTS=AGG SUPPORTS=FREETYPE SUPPORTS=CAIRO SUPPORTS=ICONV SUPPORTS=WMS_SERVER SUPPORTS=WMS_CLIENT SUPPORTS=WFS_SERVER SUPPORTS=WCS_SERVER
SUPPORTS=GEOS SUPPORTS=POINT_Z_M SUPPORTS=PBF INPUT=JPEG INPUT=POSTGIS INPUT=OGR INPUT=GDAL INPUT=SHAPEFILE --><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-GB">I'm not sure that advertising version and supported components makes sense anymore. Might be able to make it tunable via the config file but I'm not sure that's even necessary.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-GB">--Steve<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-GB">_______________________________________________<br>
MapServer-dev mailing list<br>
</span><a href="mailto:MapServer-dev@lists.osgeo.org" target="_blank"><span lang="EN-GB">MapServer-dev@lists.osgeo.org</span></a><span lang="EN-GB"><br>
</span><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank"><span lang="EN-GB">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</span></a><span lang="EN-GB"><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-GB">_______________________________________________<br>
MapServer-dev mailing list<br>
</span><a href="mailto:MapServer-dev@lists.osgeo.org"><span lang="EN-GB">MapServer-dev@lists.osgeo.org</span></a><span lang="EN-GB"><br>
</span><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev"><span lang="EN-GB">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</span></a><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</blockquote>
</div>
</div>
</body>
</html>