1) It provides a plethora of information to potential hackers as they can see literally every incoming request and can find admin pages and such.
2) Exposes every visitor's IP and the URL they're visiting to everyone. If more sites did this people's browsing history day-to-day would be exposed.
Also as someone mentioned above, this is clearly a bad configuration issue -- this page is supposed to be password protected or IP restricted (to localhost by default in Apache). At the very least, the visitor IPs need to be masked.
1) Every piece of code on that box is open source. Security-through-obscurity hoping people won't find your admin pages is senseless.
2) There are far more effective ways of tracking users' browsing history than trying to scrape extremely ephemeral data like what you can find on the Apache status page. As someone mentioned, even the Apache project themselves leave this open.
Comments
1) It provides a plethora of information to potential hackers as they can see literally every incoming request and can find admin pages and such.
2) Exposes every visitor's IP and the URL they're visiting to everyone. If more sites did this people's browsing history day-to-day would be exposed.
Also as someone mentioned above, this is clearly a bad configuration issue -- this page is supposed to be password protected or IP restricted (to localhost by default in Apache). At the very least, the visitor IPs need to be masked.
1) Every piece of code on that box is open source. Security-through-obscurity hoping people won't find your admin pages is senseless.
2) There are far more effective ways of tracking users' browsing history than trying to scrape extremely ephemeral data like what you can find on the Apache status page. As someone mentioned, even the Apache project themselves leave this open.
He said IP restricted or password protected. That's not "security through obscurity".
And he is responding to the "finding admin pages or urls".
Actually, he said "admin pages and such".