3 ms·
Log libraries and the tendency to open holes in things
- Mountain_Skies 5y agoRan into this a lot when going AppSec. We were very careful to secure PCI and PII in transit and at rest only to have it pop up all over the place in logs. Most developers and PMs didn't see it as a problem as "logs are only for our use". The issues had to be bubbled up quite a ways before the message was sent out from a high enough authority to get it theoretically stopped. Still had problems with some groups claiming "it's ok, we have those files secured" or claiming lack of resources to fix the problem. I'm pretty sure we self-attested that we were PCI compliant and probably said the same about securing PII, which would have been pretty much true if not for the log files all over the place.