About

I'm Mike Pope. I live in the Seattle area. I've been a technical writer and editor for over 35 years. I'm interested in software, language, music, movies, books, motorcycles, travel, and ... well, lots of stuff.

Read more ...

Blog Search


(Supports AND)

Feed

Subscribe to the RSS feed for this blog.

See this post for info on full versus truncated feeds.

Quote

There is an inherent and pervasive bias in pure-text communication which makes statements intended to be good-humoured sound sophomoric, makes statements which were intended to be friendly sound smarmy, makes statements which were intended to be enthusiastic sound brash, makes statements intended to be helpful sound condescending, makes statements which were intended to be precise and accurate sound brusque and pedantic, makes statements which were intended to be positive sound neutral, and makes statements which were intended to be neutral seem downright hostile. [...] Writing is hard.

Eric Lippert



Navigation





<May 2024>
SMTWTFS
2829301234
567891011
12131415161718
19202122232425
2627282930311
2345678

Categories

  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  
  RSS  

Contact Me

Email me

Blog Statistics

Dates
First entry - 6/27/2003
Most recent entry - 11/30/2023

Totals
Posts - 2652
Comments - 2675
Hits - 2,665,089

Averages
Entries/day - 0.35
Comments/entry - 1.01
Hits/day - 349

Updated every 30 minutes. Last: 1:53 PM Pacific


  11:17 PM

I was just visiting the Linguistic Society of America's Web site, where they have a feature named Ask a Linguist. I went to browse their questions, and got the following error. (Detail here, click to see full screen.)



Wow, how many sins are commited here? Let us enumerate:
  • Exposing the path, which gives us a nice picture of the server folder structure.
  • Possibly (?) exposing the name of the server (ling0406).
  • Exposing the SQL query, which tells us the schema for the SQL table in question.
  • Exposing a stack trace, which tells me among other things that they're using an Oracle server.
Did I miss any?

Almost needless to say, you shouldn't show this kind of stuff to users. It's ugly. And more to the point, this is good information for those famous malicious users. See (again) Steve Friedl's writeup of how he cracked a site with SQL injection, and for which one task was to guess about the schema of SQL tables.

In ASP.NET, you should always set customErrors in the Web.config file to remoteOnly. That way you can see error information when testing on localhost, but no errors (and certainly nothing this, um, informative) are displayed to users. Something like this:

<customErrors mode="RemoteOnly" defaultRedirect="SiteError.aspx" />

[categories]   ,

|