3 ms·
As someone who is a penetration tester, I can assure you that this is a TERRIBLE idea. Look up "CWE-200". While you are correct that this might help someone fix
by hekkle 5mo ago
As someone who is a penetration tester, I can assure you that this is a TERRIBLE idea. Look up "CWE-200". While you are correct that this might help someone fix an issue, I can assure you it will help MANY more people to understand the technology stack you are working with and allow them to exploit unpatched vulnerabilities in your tech stack.
- magicalhippo 5mo agoAnd all these years I was told security through obscurity wasn't a thing... I work on desktop applications. Tech stack is visible to anyone who can see the error message. If you got a web-based SaaS sure I understand your position, but then you spit all that good stuff into a log and have the error message include the relevant log ids so support can easily find it. If something bad happens while loading a file, include the filename in the logs, and so on.
- hekkle 5mo agoYou're right, this is more for web applications than for desktop applications.