Bye, bye Blue.

It was a great 12 years. (Wow.)

How about that crew, eh?

[/random] permanent link

Security through obscurity is bad...

One of the arguments that seemed to have been made in favor of dropping the connection instead of sending a 400 Bad Request is that it provides too much information to the attackers. There are arguments against this that were made by others based on how it makes it harder for a client developer.

Well, you point me at a web server, I'm likely to be able to track down exactly what version of what web server and OS you are running even without any explicit information like what is sent in the Server header or the pointless mis-representation of what server you are using.

The only real defense is to have a secure server to begin with.

[/apache] permanent link