Hacker News Reader

Comment by Etheryte | Hacker News Reader

While I see the point the author is trying to make, I'm not really sure I agree. Most users don't even read error messages, never mind logs. At best, logs are something they need for compliance, for most, the concept doesn't exist at all. I do agree that the logs should help you understand what went wrong and why, but in that regard the principle is the same for both sysadmins and developers and I don't really see the difference?

View on HN

In my sysadmin work I curse every developer who makes me fire up strace, tcpdump, procmon, Wireshark, etc, because they couldn't be bothered to actually say what file couldn't be found, what TCP connection failed to be established. etc.

I get the impression that often it isn't laziness but the concept that error details leak information to an attacker and are therefore a vulnerability.

I disagree with this view, but it definitely exists.

In a message returned by a server to a client I suppose it's defensible. For writing to syslog, event log, a log file, etc, it's not.

Yeah, along those lines we have requirements on never logging PII, and not logging anything that potentially contains PII, such as folder names.

Maybe tokenise the PII part of the folder name when outputting it?

ie `$HOME`/.config/foo/stuff.cfg` rather than `/home/joebloggs/foo/stuff.cfg`?

Or have an encrypted data portion, so that the sensitive details can be revealed as-needed, and redaction occurs by rotating a key.

Obviously that depends on the messages being infrequent in production logging levels.

Sysadmins needs logs that tell them what action they can do fix it. Developers need logs that tell them what a system is doing.

Generally a sysadmin needs to know "is there an action I can do to correct this" where as a dev has the power to alter source code and thus needs to know what and where the system is doing things.

> Most users don't even read error messages, never mind logs.

Yes, see all the questions on StackOverflow with people posting their error message without reading it, like “I got an error that says ‘fail! please install package xyz!’, what should I do?!?”.

That question is more likely how do I install, not what to install.

I think that's being very generous. If you've ever been in tech support, you'll be amazed at how often you'll be asked what to do when it tells me to do X.

If they don't know how to do X, then they should be able to look up how to do X. If it's something like install 3rd party library, then that's not the first party's responsibility. Especially OSS for different arch/distros. They are all different. Look up the 3rd party's repo and figure it out.

But no, it's contact support straight away.

I've worked in tech support. I get that 25-50% of the cases appear to be "read the docs to me." But the majority of those is because docs are poorly written, are overwhelming for new users, or they don't understand them and won't admit that directly.

on friday i got 2 calls saying "my phone is no longer showing me my emails, please fix" when the error message they received was roughly "please reenter your password to continue using outlook".

on wednesday i got a call saying "the CRM wont let me input this note, please fix" when the error message was "you have included an invalid character, '□' found in description. remove invalid characters and resubmit".

> but in that regard the principle is the same for both sysadmins and developers and I don't really see the difference?

No, it's very different: developers generally want to know about things they control, so they want detailed debugging info about a program's internal state that could have caused a malfunction. Sysadmins don't care about that (they're fine with coalescing all the errors that developers care about under a general "internal error"), and they care about what in the program environment could have triggered the bug, so that they may entirely avoid it or at least deploy workarounds to sidestep the bug.

> Most users don't even read error messages, never mind logs.

They don't need to. The log message is so helpdesk have something actionable, or so it can be copy pasted into google to find people with similar problem maybe having solution.

Oddly enough though, my journey into computers was greatly assisted by my curiosity at random log files that were being dumped to my desktop constantly.

Reply on news.ycombinator.com