Detection of Gemini server software

[Stephane Bortzmeyer]

On Tue, Jun 29, 2021 at 08:43:25AM -0400,
 Jason McBrayer <jmcbray at carcosa.net> wrote 
 a message of 20 lines which said:

> I know it's considered good practice not to leak any information you
> don't need to. But as you also suggest, I'm not sure if
> fingerprinting server implementations is really that sensitive
> information.

My experience with HTTP is that the vast majority of attacks are
blind, just testing various exploits without any regard to the server
software (I see a lot of IIS exploits used against my Apache server
and of course a lot of Wordpress exploits against a static site). It
makes sense (from the point of view of the attacker) since it is
faster to just try the exploit rather than finding out if the exploit
may work. Also, it avoids false positives (Debian packages
security-patched but with an old version number).

Like many simple security advices, this one is useless.