News for hackers. Stuff that matters.

A comment on No Easter Eggs in Curl. Parent comment

Re:No Easter Eggs in Curl by teh_klev on Monday December 06, 2021 @06:02PM (#29466895)
Not sure why you're being downvoted. Your question is reasonable and any attacker worth their salt will fire a full arsenal of all the CVE's at your environment regardless of version.

Hiding version numbers etc is an example of "Security through obscurity" and is a weak defence strategy:

https://en.wikipedia.org/wiki/Security_through_obscurity

[ Parent | on HN ]
Re:No Easter Eggs in Curl by stevenhuang on Tuesday December 07, 2021 @12:55AM (#29469451)
An attacker worth their salt will most definitely not fire all their CVEs at risk of crashing the target process or leaving it in an undefined state.

And your second point is debatable. See defense in depth.

[ Parent | on HN ]