Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the bottom of the page.

What are the security risks/implications, if any, of "advertising" this information? It is better not to reveal that the web server is Apache, and that I used Python and jQuery, for example?

share|improve this question

2 Answers

up vote 3 down vote

Not really. There are dozens of websites which can reveal this information. And anyone who wants to hurt you will be able to determine what they need to know. Keeping your stack patched up with the latest security fixes is what's important. The components of the stack can be easily sniffed out.

share|improve this answer
"The components of the stack can be easily sniffed out." - So once the administrator takes the time to disable server tokens and otherwise apply basic hardening techniques, how do you propose the components will be sniffed out? – danlefree♦ Nov 13 '12 at 12:17
The question concerned whether advertising the technologies used to build the site will--all other things being equal--lessen the security of the site; it won't. By all means, take steps to harden your site. But, even if server tokens are turned off, a hacker can just go down the list of common servers and common exploits for each. What percentage of sites run on Apache or IIS? Quite a large percentage of them. Not my forte, but I would assume throwing everything against the wall and seeing what sticks is as common, when it comes to server exploits, if not more so, that surgical precision. – jamesnotjim Nov 17 '12 at 4:53
up vote 2 down vote

Showing which technologies you use won't put you at anymore of a security risk. Most hackers will be probing your server to determine it's web server. That's pretty easy to figure out using a number of tools. jQuery you can't hide it's client side and in the source of your web pages. Python is probably detected based on the file extensions just as php files are. Rather than wasting time on worrying about security based on logos you put on your website you should focus on building a better app and improving it. If you want it to be secure use PHPIDS along with other log file monitors on your servers. Keep your software up to date and only have services running which you absolutely need. Then cross your fingers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.