3 ms·
It's better to have one place to look for diagnostic information. This sort of just-in-time masking seems optimal to me.
by fiddlerwoaroof 3y ago
It's better to have one place to look for diagnostic information. This sort of just-in-time masking seems optimal to me.
- bastawhiz 3y agoDiagnostic information shouldn't contain secrets. If you need access to that, there are mechanisms to access it.
- fiddlerwoaroof 3y agoThis is overly general: whether or not secrets should be in diagnostic information depends on what you’re trying to diagnose. I’ve written PAM modules, for example, and logging TOTP secrets and passwords was absolutely essential for development purposes, even if I eventually deleted the relevant code for production.