Log level 'error' should mean that something needs to be fixed • Hacker News Board

Re: Log level 'error' should mean that something needs to be fixed

#311

Post by awesome_dude » Tue, Dec 23, 2025, 11:28 PM UTC

lelanthran wrote: post #309

awesome_dude wrote: post #308

Earlier quoted context omitted.

2. Verbose Error Messages: When Your Application Talks Too Much Verbose error messages represent another common misconfiguration that gifts critical information to attackers. When applications encounter errors, they often generate detailed messages intended for developers. In production environments, these messages can reveal: Technical infrastructure details: Database types, versions, server configurations File path…

First, I disagree that "user emails can be brute-forced" is a serious security issue. I mean, sure, it's a security issue, but on a scale of 1-10, with 1 being "security issue, we'll fix in next point release" and 10 being "All-hands until this emergency patch goes out, and we keep the system offline while fixing it", this is definitely a 1. Secondly, this barely counts as a security issue; some systems I worked on r…

> First, I disagree that "user emails can be brute-forced" is a serious security issue. > I mean, sure, it's a security issue, but on a scale of 1-10, with 1 being "security issue, we'll fix in next point release" and 10 being "All-hands until this emergency patch goes out, and we keep the system offline while fixing it", this is definitely a 1.

Jesus no.

Aside from this now being an argument on semantics, someone enumerating every customer/user account you have is serious.

It opens the door for privacy leaks, targeted attacks (like password attempts, phishing, or account lockouts)

If you don't want to take that seriously, thank you for your honesty, I will ensure that I never have an account on any service you work on.

Re: Log level 'error' should mean that something needs to be fixed

#312

Post by lelanthran » Wed, Dec 24, 2025, 11:12 AM UTC

awesome_dude wrote: post #311

lelanthran wrote: post #309

Earlier quoted context omitted.

First, I disagree that "user emails can be brute-forced" is a serious security issue. I mean, sure, it's a security issue, but on a scale of 1-10, with 1 being "security issue, we'll fix in next point release" and 10 being "All-hands until this emergency patch goes out, and we keep the system offline while fixing it", this is definitely a 1. Secondly, this barely counts as a security issue; some systems I worked on r…

> First, I disagree that "user emails can be brute-forced" is a serious security issue. > I mean, sure, it's a security issue, but on a scale of 1-10, with 1 being "security issue, we'll fix in next point release" and 10 being "All-hands until this emergency patch goes out, and we keep the system offline while fixing it", this is definitely a 1. Jesus no. Aside from this now being an argument on semantics, someone en…

> If you don't want to take that seriously, thank you for your honesty, I will ensure that I never have an account on any service you work on.

That's fine; you already have multiple accounts on various providers that can be trivially massaged by a client into providing proof of life of an email address.

Microsoft, OpenAI, Anthropic, Oracle, Amazon; I tried them all now, and they let you enumerate emails trivially by clicking "signup" and then informing you if you choose an email that is already registered.

> Jesus no.

You haven't really has thought this through as thoroughly as you think you have - email enumeration is still, at the tail end of 2025, possible across all major sites, providers, etc.

Re: Log level 'error' should mean that something needs to be fixed

#313

Post by rr808 » Fri, Dec 26, 2025, 10:30 AM UTC

buggjenrmf wrote: post #251

rr808 wrote: post #225

Earlier quoted context omitted.

Still quite like the windows log approach which (if logged) stores the template as just the id, with the values, saving lots of storage as well eg 123, foo, bar. You can concatenate in the reader.

So, it costs perf every time it’s read, instead of when it’s written (once). And of course has a lot of overhead to store metadata. Bad design. As usual.

No, the size is a fraction of a text file, much faster to write and read. The only difference is you can't grep like text.