What kind of privacy leakage do stuff printed to stdout pose?

Question

1- When a program outputs to stdout, is that normally logged anywhere else?

2- When is it an issue to make a command verbose in printing to stdout instead of working quietly or redirecting to a file?

Answer 1

Output to stdout is not logged by default, However, it has been discovered that libvte (used in a number of graphical terminals, including gnome-terminal) stores output in a temporary file: http://www.climagic.com/bugreports/libvte-scrollback-written-to-disk.html

It is possible that other terminals emulators have or will store data in a file, so if the data is sensitive, you might want to warn the user depending on the terminal they use.

Answer 2

Printing to stdout is pretty safe, since it's not logged anywhere by default. The data will be lost when the console session dies, though bits might end up remnant in memory. Piping to a file is a different issue, since once it hits disk it might end up being left on slack sectors.

Keep in mind that the command itself will usually be logged into your bash history. You can clear this using history -c, or you can stop the command from being logged by prefixing it with a single space. Commands prefixed with a space aren't stored in your bash log, and aren't kept in your session's command history.

If you're really worried, just pipe it to /dev/null and it'll be immediately discarded.