5 ms·

> Why are you storing IP addresses in your logs? Both Apache and Nginx (and others?) log IP addresses by default. The expected result of this is that storing I

> Why are you storing IP addresses in your logs? Both Apache and Nginx (and others?) log IP addresses by default. The expected result of this is that storing IP addresses in server logs is widespread, useful for troubleshooting, and entirely normal.

geofft 9y ago
This seems like a very good reason to have a law about it: if the only reason you log IP addresses is that it's on by default and you haven't thought about the risks of storing it, you should think about it for your production servers. Otherwise it's purely a risk and has no benefit. (And the risk is to your users, not you, so it makes sense that a law would be needed to give your users the ability to complain about that needless risk.) If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.
- jimktrains2 9y ago
  What's the risk of storing an IP address. IP addresses aren't people and most people have a carrier natted or rotating address. The real question is what value does storing the IP address even hold?
  - hotwire 9y ago
    - You can identify trends and patterns in your traffic - You can figure out where in the world your traffic is coming from - It can be helpful in responding to security incidents
    - jimktrains2 9y ago
      - arbitrary user, session and request IDs - this can be done and then discard the address - how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?
  - alam2000 9y ago
    The IP address is like a temporary phone number. It could not pinpoint the person persistently but can be tracked down with the help of ISP. Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com https://www.ip2location.com
    - jimktrains2 9y ago
      It's not a phone number because it doesn't need to resolve back to anything in particular. With carrier grade nat for instance, it could be shared by many people. At best it's shared by a house. With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern. Geoinformation can also change daily. Figuring it out afterwards isn't reliable.
  - chopin 9y ago
    If it doesn't have value, why storing it then?

geofft 9y ago

This seems like a very good reason to have a law about it: if the only reason you log IP addresses is that it's on by default and you haven't thought about the risks of storing it, you should think about it for your production servers. Otherwise it's purely a risk and has no benefit. (And the risk is to your users, not you, so it makes sense that a law would be needed to give your users the ability to complain about that needless risk.) If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.

jimktrains2 9y ago
What's the risk of storing an IP address. IP addresses aren't people and most people have a carrier natted or rotating address. The real question is what value does storing the IP address even hold?
- hotwire 9y ago
  - You can identify trends and patterns in your traffic - You can figure out where in the world your traffic is coming from - It can be helpful in responding to security incidents
  - jimktrains2 9y ago
    - arbitrary user, session and request IDs - this can be done and then discard the address - how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?
- alam2000 9y ago
  The IP address is like a temporary phone number. It could not pinpoint the person persistently but can be tracked down with the help of ISP. Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com https://www.ip2location.com
  - jimktrains2 9y ago
    It's not a phone number because it doesn't need to resolve back to anything in particular. With carrier grade nat for instance, it could be shared by many people. At best it's shared by a house. With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern. Geoinformation can also change daily. Figuring it out afterwards isn't reliable.
- chopin 9y ago
  If it doesn't have value, why storing it then?