<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 3/21/22 00:11, Greg Troxel wrote:<br>
</div>
<blockquote type="cite" cite="mid:rmizglk5l62.fsf@s1.lexort.com">
<pre class="moz-quote-pre" wrap="">
Roger Price <a class="moz-txt-link-rfc2396E" href="mailto:roger@rogerprice.org"><roger@rogerprice.org></a> writes:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I received the following comment from the Independent Submissions Editor (ISE):
The command VER is hazardous because it encourages exploiting of
implementation peculiarities that are not well documented in a
protocol. The best example of such a failure is the browser version
field in HTTP. A complete disaster. You should warn against use of
this command, or even better, deprecate it.
I was not aware of the disaster in the browser version field, but I
will warn against use of VER, and deprecate it, if you agree.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I am quite aware of it, but I haven't seen it called out like this. The
basic issue is that we now have a culture of web servers serving N
different versions of pages based on the User-Agent field, instead of
coding to standards and expecting clients to meet standards. "Disaster"
might be a slightly strong word, but it isn't at all confused.
So a good question is whether it's necessary. Perhaps it's just a
management plane concept, but for SMTP the two sides don't specify
their software or protocol versions.</pre>
</blockquote>
<p>At times I like to play devil's advocate:</p>
<p><br>
</p>
Connected to outlook-com.olc.protection.outlook.com..<br>
Escape character is '^]'.<br>
220 VE1EUR03FT022.mail.protection.outlook.com <font color="#ff0000">Microsoft
ESMTP MAIL Service</font> ready at Sun, 20 Mar 2022 22:20:44 +0000<br>
<p>|_ssl-date: 2022-03-20T22:22:21+00:00; 0s from scanner time.<br>
Service Info: Host: AM5EUR02FT049.mail.protection.outlook.com; <font
color="#ff0000">OS: Windows; CPE: cpe:/o:microsoft:windows</font><br>
<br>
<br>
</p>
<p>I am too lazy to check but I am willing to bet a beer that
somewhere over there there is an Exchange server<br>
</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:rmizglk5l62.fsf@s1.lexort.com">
<pre class="moz-quote-pre" wrap="">
In general, a fair question is "What if we deleted this? If we wouldn't
have trouble, why are we keeping it?"
</pre>
</blockquote>
Connected to dell30-5x.<br>
<p>Escape character is '^]'.<br>
ver<br>
Network UPS Tools upsd 2.7.4 - <a class="moz-txt-link-freetext" href="http://www.networkupstools.org/">http://www.networkupstools.org/</a><br>
quit<br>
</p>
<p>I for one do not see much trouble in advertising the version of
nut and its website. But I am also the person who used lighttpd
for 15 years and made it advertise itself as MS IIS and exim
advertised as MS Exchange, just for the fun of seeing failed
exploits in the logs</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>