starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #314] Add server version to web ui #246

New issue

Closed

opened 2026-05-07 00:22:13 +02:00 by BreizhHardware · 6 comments

BreizhHardware commented

2026-05-07 00:22:13 +02:00

Owner

Originally created by @poblabs on GitHub (Jun 6, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/314

I had a thought today that it may be a good idea to show the server version somewhere. Maybe on the sidebar of the web ui?

Originally created by @poblabs on GitHub (Jun 6, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/314 I had a thought today that it may be a good idea to show the server version somewhere. Maybe on the sidebar of the web ui?

BreizhHardware

2026-05-07 00:22:13 +02:00

closed this issue
added the
web-app

question

enhancement

server
labels

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jun 7, 2022):

This is typically bad security practice, because in case there are security vulnerabilities, it makes it easy for an attacker to find vulnerable instances. What is the actual reasoning behind this? You want to make sure you're up to date? In that case, maybe set up unattended-upgrades or something similar for Docker?

@binwiederhier commented on GitHub (Jun 7, 2022): This is typically bad security practice, because in case there are security vulnerabilities, it makes it easy for an attacker to find vulnerable instances. What is the actual reasoning behind this? You want to make sure you're up to date? In that case, maybe set up `unattended-upgrades` or something similar for Docker?

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@poblabs commented on GitHub (Jun 8, 2022):

Good point and I had considered that before submitting the ticket. Yes just
a reference to always stay up to date. I'm currently not running this in
docker but rather as the standalone binary. Would it be possible maybe to
put the version once the binary starts up on console?

If not no worries.

On Tue, Jun 7, 2022, 7:44 PM Philipp C. Heckel @.***>
wrote:

This is typically bad security practice, because in case there are
security vulnerabilities, it makes it easy for an attacker to find
vulnerable instances. What is the actual reasoning behind this? You want to
make sure you're up to date? In that case, maybe set up
unattended-upgrades or something similar for Docker?

—
Reply to this email directly, view it on GitHub
https://github.com/binwiederhier/ntfy/issues/314#issuecomment-1149280074,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AA2SYZ3EXU3LSYIXTOSF63TVN7NGJANCNFSM5X7W63YQ
.
You are receiving this because you authored the thread.Message ID:
@.***>

@poblabs commented on GitHub (Jun 8, 2022): Good point and I had considered that before submitting the ticket. Yes just a reference to always stay up to date. I'm currently not running this in docker but rather as the standalone binary. Would it be possible maybe to put the version once the binary starts up on console? If not no worries. On Tue, Jun 7, 2022, 7:44 PM Philipp C. Heckel ***@***.***> wrote: > This is typically bad security practice, because in case there are > security vulnerabilities, it makes it easy for an attacker to find > vulnerable instances. What is the actual reasoning behind this? You want to > make sure you're up to date? In that case, maybe set up > unattended-upgrades or something similar for Docker? > > — > Reply to this email directly, view it on GitHub > <https://github.com/binwiederhier/ntfy/issues/314#issuecomment-1149280074>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AA2SYZ3EXU3LSYIXTOSF63TVN7NGJANCNFSM5X7W63YQ> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@Mikaela commented on GitHub (Jun 8, 2022):

I am not sure security by obscurity is that great practice and it may make clientside debugging/troublesholting more difficult if e.g. third party server by a friend gets used.

@Mikaela commented on GitHub (Jun 8, 2022): I am not sure security by obscurity is that great practice and it may make clientside debugging/troublesholting more difficult if e.g. third party server by a friend gets used.

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jun 8, 2022):

It is best practice and part of layered security. Apache and nginx and all the others have settings to hide the version number in their response headers.

I think @poblabs's problem is a different one and has been solved by packages (rpm/deb) or docker.

If y'all really feel strongly I can add it and make it configurable, but I don't really think it's necessary.

Adding it to the ntfy serve output though is not a problem.

https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens

https://httpd.apache.org/docs/2.4/mod/core.html#servertokens

@binwiederhier commented on GitHub (Jun 8, 2022): It is best practice and part of layered security. Apache and nginx and all the others have settings to hide the version number in their response headers. I think @poblabs's problem is a different one and has been solved by packages (rpm/deb) or docker. If y'all really feel strongly I can add it and make it configurable, but I don't really think it's necessary. Adding it to the `ntfy serve` output though is not a problem. https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens https://httpd.apache.org/docs/2.4/mod/core.html#servertokens

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@poblabs commented on GitHub (Jun 8, 2022):

Adding it to ntfy serve console output would work just fine. Thanks!

On Wed, Jun 8, 2022, 6:44 AM Philipp C. Heckel @.***>
wrote:

It is best practice and part of layered security. Apache and nginx and Lal
the others have settings to hide the version number in their response
headers.

I think @poblabs https://github.com/poblabs's problem is a different
one and has been solved by packages (rpm/deb) or docker.

If y'all really feel strongly I can add it and make it configurable, but I
don't really think it's necessary.

Adding it to the ntfy serve output though is not a problem.

—
Reply to this email directly, view it on GitHub
https://github.com/binwiederhier/ntfy/issues/314#issuecomment-1149755979,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AA2SYZ6FQT43NMPBWESBHL3VOB2RNANCNFSM5X7W63YQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

@poblabs commented on GitHub (Jun 8, 2022): Adding it to ntfy serve console output would work just fine. Thanks! On Wed, Jun 8, 2022, 6:44 AM Philipp C. Heckel ***@***.***> wrote: > It is best practice and part of layered security. Apache and nginx and Lal > the others have settings to hide the version number in their response > headers. > > I think @poblabs <https://github.com/poblabs>'s problem is a different > one and has been solved by packages (rpm/deb) or docker. > > If y'all really feel strongly I can add it and make it configurable, but I > don't really think it's necessary. > > Adding it to the ntfy serve output though is not a problem. > > — > Reply to this email directly, view it on GitHub > <https://github.com/binwiederhier/ntfy/issues/314#issuecomment-1149755979>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AA2SYZ6FQT43NMPBWESBHL3VOB2RNANCNFSM5X7W63YQ> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

BreizhHardware commented

2026-05-07 00:22:14 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jun 12, 2022):

Done as part of github.com/binwiederhier/ntfy@cf0f002bfa

$ ntfy serve                              
2022/06/12 11:49:09 INFO Listening on :2586[http] :1025[smtp], ntfy v1.25.2-next, log level is TRACE

@binwiederhier commented on GitHub (Jun 12, 2022): Done as part of https://github.com/binwiederhier/ntfy/commit/cf0f002bfa32eedb5ef4264a6c18ac3f2beecfa4 ``` $ ntfy serve 2022/06/12 11:49:09 INFO Listening on :2586[http] :1025[smtp], ntfy v1.25.2-next, log level is TRACE ```

BreizhHardware referenced this issue

2026-05-07 01:01:13 +02:00

[PR #246] [MERGED] WIP: iOS #1251