Comment 2 for bug 205996

It's been argued by others in the past, but I honestly don't see how full ServerTokens are a security risk. If you prefer not to show them, you can change it, but most bots out there don't look for what extensions you may be running before they attempt to attack you.

And, honestly, most attack vectors are through broken applications (like PHP web forums, for instance), and if you have the application running, it's pretty obvious that you're also using the language underlying that application in some form or another.