From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-3.3 required=3.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 Received: from todd.t-8ch.de (todd.t-8ch.de [IPv6:2a01:4f8:c010:41de::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id 171B11F47C for ; Sun, 8 Jan 2023 20:02:39 +0000 (UTC) Authentication-Results: dcvr.yhbt.net; dkim=pass (1024-bit key; unprotected) header.d=t-8ch.de header.i=@t-8ch.de header.a=rsa-sha256 header.s=mail header.b=QcS08LN9; dkim-atps=neutral Date: Sun, 8 Jan 2023 20:02:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=t-8ch.de; s=mail; t=1673208155; bh=G2zt/yIPpSLwxoLzdVw9a/SSIbisvXMfMcmhPFa8pZg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=QcS08LN9SG+ftARYdMKiaYqOBJeD9A3rM7f8CfwTprneksrdM7v1n9KNKm5oG4FtK 1fSz/nrR1yMTTnMoikiVGgPTHs+vDxE26NWWNOcSdeS04ji0Re7PBO9YrH6Nhen//a dkXCGvmDlb+PiQZkVHyWXVLKDl03Bn2o8QnNxcVI= From: Thomas =?utf-8?Q?Wei=C3=9Fschuh?= To: Eric Wong Cc: meta@public-inbox.org Subject: Re: Add "generator" information to HTML pages Message-ID: <20230108200233.y2zqecm3ob47gsdd@snowball.t-8ch.de> References: <20230108190404.nghzrip46oh4wl3p@snowball.t-8ch.de> <20230108194738.M225235@dcvr> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20230108194738.M225235@dcvr> List-Id: Hi Eric, On Sun, Jan 08, 2023 at 07:47:38PM +0000, Eric Wong wrote: > Thomas Weißschuh wrote: > > Hi, > > > > it would be nice if public-inbox could extend the HTML pages it > > generates with the "generator" meta tag [0]. > > Especially the version would be useful. > > > > This would help users during debugging to see the specific version of > > public-inbox they are looking at. > > What would users be debugging? > Admins would be the only ones who care, I think... Since recently my mails to linux-kernel@vger.kernel.org that should end up on public-inbox on https://lore.kernel.org/lkml/ don't do so. They are accepted by the mail server on vger.kernel.org but never end up in the archives. I suspect some interactions between b4 which is used to generate the mails, the unicode characters in my name and public-inbox to be the culprit. This is what I wanted to reproduce locally, for which exact versions would have been nice. > Version info becomes worthless if an admin blocks/alters certain > endpoints via nginx/varnish or just editing the code. > > > For example: > > > > > > Some page > > > > > > I prefer to disclose as little information as possible in case > vulnerabilities are found. Alone, security by obscurity doesn't work, > but obscurity does make things more difficult for attackers > (same reason camouflage exists). > > I also don't like wasting memory+bandwidth on things most users > won't see or care about. This is especially true for stuff at > the beginnning of the output since that's most likely to succeed > in being transferred. Fair enough. The loading speed of public-inbox is really great, let's keep it that way. > > [0] https://html.spec.whatwg.org/multipage/semantics.html#meta-generator @Konstantin, if you read this: I'll send a proper bugreport to tools@linux.kernel.org soonish. Thanks, Thomas