Re: Re: Expose php: on or off

Peter Brodersen wrote:

On Thu, 10 Nov 2005 14:08:29 -0500, in php.internals ilia@prohost.org (Ilia Alshanetsky) wrote:

I don't think it would reduce the number of attacks turning the version information off. But it would be more cumbersome to help people with php issues as the php version is not directly available.

This is simply not true, when a bug comes in we ask the user to specify the version, we don't go looking for their server and checking their version.

I wasn't thinking of php development but more general when people have trouble with their PHP code (posting in newsgroups, forums, irc, ...).

If someone asks me a PHP question on a newsgroup or forum, and I need to know their version, I ask them for it. If they don't know how, I tell them to run php -V This information would be completely useless in the newsgroup/forum use case because it's just as easy (if not easier) to ask them for it or get them to run PHP -V as it is to go hunt down their server and inspect the headers. Jasper