Add server version to web ui

[poblabs]

I had a thought today that it may be a good idea to show the server version somewhere. Maybe on the sidebar of the web ui?

[binwiederhier]

This is typically bad security practice, because in case there are security vulnerabilities, it makes it easy for an attacker to find vulnerable instances. What is the actual reasoning behind this? You want to make sure you're up to date? In that case, maybe set up unattended-upgrades or something similar for Docker?

[poblabs]

Good point and I had considered that before submitting the ticket. Yes just a reference to always stay up to date. I'm currently not running this in docker but rather as the standalone binary. Would it be possible maybe to put the version once the binary starts up on console? If not no worries.

…

On Tue, Jun 7, 2022, 7:44 PM Philipp C. Heckel ***@***.***> wrote: This is typically bad security practice, because in case there are security vulnerabilities, it makes it easy for an attacker to find vulnerable instances. What is the actual reasoning behind this? You want to make sure you're up to date? In that case, maybe set up unattended-upgrades or something similar for Docker? — Reply to this email directly, view it on GitHub <#314 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA2SYZ3EXU3LSYIXTOSF63TVN7NGJANCNFSM5X7W63YQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Mikaela]

I am not sure security by obscurity is that great practice and it may make clientside debugging/troublesholting more difficult if e.g. third party server by a friend gets used.

[binwiederhier]

It is best practice and part of layered security. Apache and nginx and all the others have settings to hide the version number in their response headers.

I think @poblabs's problem is a different one and has been solved by packages (rpm/deb) or docker.

If y'all really feel strongly I can add it and make it configurable, but I don't really think it's necessary.

Adding it to the ntfy serve output though is not a problem.

https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens

https://httpd.apache.org/docs/2.4/mod/core.html#servertokens

[poblabs]

Adding it to ntfy serve console output would work just fine. Thanks!

…

On Wed, Jun 8, 2022, 6:44 AM Philipp C. Heckel ***@***.***> wrote: It is best practice and part of layered security. Apache and nginx and Lal the others have settings to hide the version number in their response headers. I think @poblabs <https://github.com/poblabs>'s problem is a different one and has been solved by packages (rpm/deb) or docker. If y'all really feel strongly I can add it and make it configurable, but I don't really think it's necessary. Adding it to the ntfy serve output though is not a problem. — Reply to this email directly, view it on GitHub <#314 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA2SYZ6FQT43NMPBWESBHL3VOB2RNANCNFSM5X7W63YQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[binwiederhier]

Done as part of cf0f002

$ ntfy serve                              
2022/06/12 11:49:09 INFO Listening on :2586[http] :1025[smtp], ntfy v1.25.2-next, log level is TRACE