Be Aware of What's in Your Logs

There is something I wish more people understood about bug reports, diagnostic information, and the apparently innocent act of attaching a log file to a support request, and it is this: your logs may contain things you really, really do not want anyone else reading. I'm writing this because of a bug report I received recently, which came with a log file containing information I did not need to see, did not ask to see, and would have been perfectly happy going the rest of my life without ever seeing. I'm not going to identify the person who sent it, describe what was in it, or otherwise turn a perfectly understandable mistake into a public spectacle, because doing that to someone who was trying to help me fix my own software would be a spectacularly shitty thing to do. But the incident highlights something worth talking about, because I suspect an awful lot of people have absolutely no idea what they're handing over when they tick that little box labelled "Send logs," and the software they're using is rarely in any hurry to tell them. A Log File Is Not Necessarily Just a Log File When most people think of logs, they imagine a wall of boring technical gibberish: timestamps, error messages, stack traces, the occasional complaint about a missing file or something failing to initialise. Logs do contain those things. They can also contain an astonishing amount of information about what you were actually doing when the problem occurred, and depending on the application, its logging configuration, and the nature of the problem, that might include: Text displayed on your screen. Messages you sent or received. Usernames, email addresses, and account identifiers. File paths containing your real name or other identifying details. URLs, including query parameters and authentication tokens. The names of documents you had open. Clipboard contents. Information about other applications and services. Internal application state that was never meant for public consumption. Some applications log very little. Others log absolutely fucking everything, particularly once debugging is switched on, and you generally cannot tell which kind you're dealing with from the size of the file or the name of the feature. A file called debug.log sounds harmless enough, and that tells you precisely nothing about whether it is. A log is a record of whatever an application considered relevant at a particular moment, and what an application considers relevant and what you consider private are two …