Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by bullen | Hacker News Reader

Full thread

bullen·

I'm a believer in not hiding things and logging the whole problem all the way to the end consumer:

http://test.rupy.se/?id=2

Because when you develop things you are the end consumer.

View on HN

This is considered a critical security vulnerability. [0]

[0] https://owasp.org/www-project-top-ten/2017/A6_2017-Security_...

Not if it's open-source.

Security by obfuscation is generally not a good option if you can avoid it.

If there are other vulnerabilities present, stack traces can be forced to dump all sorts of data like env variables and network information and maybe someone else's personal information.

I strongly urge everyone to hide their stack traces in production. This will reduce your application's attack surface.

>Security by obfuscation is generally not a good option if you can avoid it.

Of course, but obscurity increases security

Also, consumers may not understand backtraces but they generally understand how to Google them or ask other people what they mean, or tell you about them.

Technical errors are way better than just "I'm sorry we couldn't process that right now."

This is probably a dumb question, but isn't a backtrace likely to reveal some sensitive information from a security perspective?

Possibly, though I would say that is a little paranoid.

But anyway I was really using "backtrace" as a synonym for "technical details that users don't understand". Not very clear, sorry!

Reply on news.ycombinator.com