Hacker News Reader

I get the impression that often it isn't laziness but the concept that error details leak information to an attacker and are therefore a vulnerability.

I disagree with this view, but it definitely exists.

View on HN

In a message returned by a server to a client I suppose it's defensible. For writing to syslog, event log, a log file, etc, it's not.

Yeah, along those lines we have requirements on never logging PII, and not logging anything that potentially contains PII, such as folder names.

Maybe tokenise the PII part of the folder name when outputting it?

ie `$HOME`/.config/foo/stuff.cfg` rather than `/home/joebloggs/foo/stuff.cfg`?

Or have an encrypted data portion, so that the sensitive details can be revealed as-needed, and redaction occurs by rotating a key.

Obviously that depends on the messages being infrequent in production logging levels.

Reply on news.ycombinator.com