curl-users
Re: Too revealing user-agent field?
From: Tim Tassonis <timtas_at_cubic.ch>
Date: Wed, 13 Jun 2007 16:44:26 +0200
Date: Wed, 13 Jun 2007 16:44:26 +0200
Hi Daniel
Daniel Stenberg wrote:
> Is it?
>
> At least one FreeBSD user seems to think so:
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=112555
>
> Any opinions on this here?
>
I like the User-Agent string to contain this much info, and standard
Apache basically does the same, including information about mod_php,
mod_ssl, mod_perl and all.
I would stay as as verbose as now and leave it to the hardening/security
review guys to fix this gaping security hole by specifying "-A
whatever", or putting
User-Agent: whatever
into .curlrc
We don't want to get them out of business, do we?
Tim
Received on 2007-06-13