4 ms·
I'm a believer in not hiding things and logging the whole problem all the way to the end consumer: http://test.rupy.se/?id=2 http://test.rupy.se/?id=2 Because
by bullen 5y ago
I'm a believer in not hiding things and logging the whole problem all the way to the end consumer:
http://test.rupy.se/?id=2 http://test.rupy.se/?id=2
Because when you develop things you are the end consumer.
- IshKebab 5y agoAlso, consumers may not understand backtraces but they generally understand how to Google them or ask other people what they mean, or tell you about them. Technical errors are way better than just "I'm sorry we couldn't process that right now."
- chakkepolja 5y agoThis is probably a dumb question, but isn't a backtrace likely to reveal some sensitive information from a security perspective?
- IshKebab 5y agoPossibly, though I would say that is a little paranoid. But anyway I was really using "backtrace" as a synonym for "technical details that users don't understand". Not very clear, sorry!
- karlerss 5y agoThis is considered a critical security vulnerability. [0] [0] https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration https://owasp.org/www-project-top-ten/2017/A6_2017-Security_...
- bullen 5y agoNot if it's open-source. Security by obfuscation is generally not a good option if you can avoid it.
- karlerss 5y agoIf there are other vulnerabilities present, stack traces can be forced to dump all sorts of data like env variables and network information and maybe someone else's personal information. I strongly urge everyone to hide their stack traces in production. This will reduce your application's attack surface.
- tester34 5y ago>Security by obfuscation is generally not a good option if you can avoid it. Of course, but obscurity increases security