Skip to main content
Information Security

Return to Question

replaced http://programmers.stackexchange.com/ with https://softwareengineering.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

In relation to my question on programmers.stackexchange.commy question on programmers.stackexchange.com.

Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our application passed through says it is. I disagree. I don't see how that could help an attacker in any way.

Of course, there is the principle of "tell as little as possible", but that has to be balanced with common sense too, and I think that there is greater benefit of having that information easily available than risk of having it abused.

Have there been any studies about this? Any evidence at all that would suggest that this is a security risk? Or is this an overzealos application of the above principle?

In relation to my question on programmers.stackexchange.com.

Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our application passed through says it is. I disagree. I don't see how that could help an attacker in any way.

Of course, there is the principle of "tell as little as possible", but that has to be balanced with common sense too, and I think that there is greater benefit of having that information easily available than risk of having it abused.

Have there been any studies about this? Any evidence at all that would suggest that this is a security risk? Or is this an overzealos application of the above principle?

In relation to my question on programmers.stackexchange.com.

Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our application passed through says it is. I disagree. I don't see how that could help an attacker in any way.

Of course, there is the principle of "tell as little as possible", but that has to be balanced with common sense too, and I think that there is greater benefit of having that information easily available than risk of having it abused.

Have there been any studies about this? Any evidence at all that would suggest that this is a security risk? Or is this an overzealos application of the above principle?

Tweeted twitter.com/#!/StackSecurity/status/239603284841730048
Source Link
Vilx-
Vilx-
  • 1.1k
  • 2
  • 8
  • 17

Is a stack trace of a server application a vulnerability?

In relation to my question on programmers.stackexchange.com.

Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our application passed through says it is. I disagree. I don't see how that could help an attacker in any way.

Of course, there is the principle of "tell as little as possible", but that has to be balanced with common sense too, and I think that there is greater benefit of having that information easily available than risk of having it abused.

Have there been any studies about this? Any evidence at all that would suggest that this is a security risk? Or is this an overzealos application of the above principle?