32 ms·

With the rapidly increasing number of websites and applications that feel "an error occurred" is an acceptable error message, I'm glad someone is pointing out t

by burnte 2y ago

With the rapidly increasing number of websites and applications that feel "an error occurred" is an acceptable error message, I'm glad someone is pointing out that failures should contain actionable information, but I'm also greatly saddened this is needed. I truly do not understand how anyone, much less developers, needs to be told that the content of an error message is important. It really boggles my mind. How is it not obvious to the point of pain that you need to know WHY something failed, not only that it failed?

tichiian 2y ago
There are reasons for not reporting detailed errors to the user. For websites, security is a big one. Detailed error messages can lead to information exfiltration, exploits, fingerprinting and generally bad things. Long error messages in some network protocols enable amplification attacks. For general applications, there are commercial reasons. You don't want to enable your users too much, they should be incentivized to buy your pricey platinum premium package after all. Therefore an opaque error message, maybe with some error code but no text and no information, is necessary: The user will need to call support and get the error code decoded and be told in hour-long, tedious and expensive support calls how to fix the error. Actually actionable errors are what makes your company go bankcrupt, especially if you do freemium or OSS+support business models.
- burnte 2y ago
  While this is true, I don't think you truly missed my point. This is just being pedantic for the sake of it.
  - tichiian 2y ago
    You are right in that the world would be a better place with more useful and actionable error messages. But: > How is it not obvious to the point of pain that you need to know WHY something failed, not only that it failed? This is obvious to everyone, at least after encountering the first few errors. But that makes it the perfect thing to upsell, to milk your existing customers with a pricier plan. One instance is e.g. Microsoft selling access to their customers' logs to those same customers: https://www.theregister.com/2023/07/20/under_cisa_spressures_collaboration_microsoft/ https://www.theregister.com/2023/07/20/under_cisa_spressures... (they backpedalled after it blew up spectacularly). No, I don't like it. Yes, I hate those Ferengi. Changing how things are for the better not only requires recognizing the immediate problems but also why the problem is persisted, and who is to blame for it.
simiones 2y ago
For a website, if the cause of the error is something internal to the server (a bug or other temporary condition), what could possibly be gained by telling the user the reason why this failed? "An error occured, try again later" is the only actionable information you can possibly give them, if they have no access on your server to fix your bug.
- burnte 2y ago
  How do I know if it's an internal error or if I did something wrong? And yes, showing users the internal errors is useful as they can report the issue with the error message, saving developers time in searching.
  - clintonb 2y ago
    Input validation is a separate thing. If a user provides bad input, yes, the server should return an appropriate error code and human-friendly message. _Lacking_ sufficient validation is a problem that could result in an internal server error that could be resolved by changing inputs, but the validation doesn’t exist so the server cannot inform you of this.

by burnte 2y ago

tichiian 2y ago

There are reasons for not reporting detailed errors to the user. For websites, security is a big one. Detailed error messages can lead to information exfiltration, exploits, fingerprinting and generally bad things. Long error messages in some network protocols enable amplification attacks. For general applications, there are commercial reasons. You don't want to enable your users too much, they should be incentivized to buy your pricey platinum premium package after all. Therefore an opaque error message, maybe with some error code but no text and no information, is necessary: The user will need to call support and get the error code decoded and be told in hour-long, tedious and expensive support calls how to fix the error. Actually actionable errors are what makes your company go bankcrupt, especially if you do freemium or OSS+support business models.

burnte 2y ago
While this is true, I don't think you truly missed my point. This is just being pedantic for the sake of it.
- tichiian 2y ago
  You are right in that the world would be a better place with more useful and actionable error messages. But: > How is it not obvious to the point of pain that you need to know WHY something failed, not only that it failed? This is obvious to everyone, at least after encountering the first few errors. But that makes it the perfect thing to upsell, to milk your existing customers with a pricier plan. One instance is e.g. Microsoft selling access to their customers' logs to those same customers: https://www.theregister.com/2023/07/20/under_cisa_spressures_collaboration_microsoft/ https://www.theregister.com/2023/07/20/under_cisa_spressures... (they backpedalled after it blew up spectacularly). No, I don't like it. Yes, I hate those Ferengi. Changing how things are for the better not only requires recognizing the immediate problems but also why the problem is persisted, and who is to blame for it.

simiones 2y ago

For a website, if the cause of the error is something internal to the server (a bug or other temporary condition), what could possibly be gained by telling the user the reason why this failed? "An error occured, try again later" is the only actionable information you can possibly give them, if they have no access on your server to fix your bug.

burnte 2y ago
How do I know if it's an internal error or if I did something wrong? And yes, showing users the internal errors is useful as they can report the issue with the error message, saving developers time in searching.
- clintonb 2y ago
  Input validation is a separate thing. If a user provides bad input, yes, the server should return an appropriate error code and human-friendly message. _Lacking_ sufficient validation is a problem that could result in an internal server error that could be resolved by changing inputs, but the validation doesn’t exist so the server cannot inform you of this.