Removing version information makes it more difficult for an unskilled automated attack on a server, which is what most of the attacks are.

That's my point: For an attack I just send my php 4.1 patchlevel nnn specific script I just bought to 200.000 webservers on some it will work. This is indeed the majority of attempts I'm seeing. So it would break only attacks which do a switch on version specific information. My guess is that it would nor lower the number of attempts nor the success rate, a target will be found anyway, version information or not.

I would guess that scripts which bail out humbly in absence of version information are not in the majority, but I could be wrong.

Obscuring the version number just means that Joe Blackhat has to run through 10 exploits to try to get a hit, rather than just 1. The time difference is likely insignificant.

All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.

Joe Blackhat isn't running the exploits - Sam Scriptkiddie is.

> All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.

Then the sys admin needs replacing.

Creating more work for those that automate system attacks is a good thing.

Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.