Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Unless "table does not exist" does take precisely the same time as “access denied” you still leak the same information by replacing the latter.

For logged in users I would prefer logging with explicit error messages. Like that you can tell if someone is poking around or was hacked. And still get clear error messages.



Sure, if "table does not exist" actually means that, which it does not. It means you have no access to such a table if it exists or not




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: