News for hackers. Stuff that matters.

A comment on Good Logging. Parent comment

Re:Good Logging by greggman3 on Friday July 24, 2020 @05:44AM (#23937553)
You forgot also making sure you aren't logging things you shouldn't log. Some are obvious maybe like passwords. Others might be less obvious like the title of every window on the user's desktop which Facebook Oculus logs. Those titles end up including every page of every website you've visited, the title of every document you've edited, and every video you've watched.
[ Parent | on HN ]
Re:Good Logging by wsargent on Saturday July 25, 2020 @01:37PM (#23950971)
Ideally the data should be filtered before it gets to logging in the first place, but if not, you can add another layer of defense by employing censors:

https://tersesystems.github.io/terse-logback/guide/censor/

Or you can use logstash-logback-encoder, which has masking:

https://github.com/logstash/logstash-logback-encoder#masking

[ Parent | on HN ]
Re:Good Logging by wsargent on Sunday July 26, 2020 @01:20PM (#23958527)
There's also Witchcraft Logging, which has the concept of "safe" parameters and is available in Go, Rust, and Clojure:

https://docs.rs/witchcraft-log/0.3.0/witchcraft_log/

[ Parent | on HN ]
Re:Good Logging by NetOpWibby on Friday July 24, 2020 @09:50PM (#23946248)
Is this a bug or a feature?
[ Parent | on HN ]