Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Actually it's not a subset. Even if the app is open source, what you gain from this error is: username, installation path, resource limits. All of those add something you don't know from the code itself. All can be useful when trying (respectively) injections / bruteforce auth, path traversal / secrets access, denial of service.

Also line numbers can help you identify the deployed version.

Also optional table prefixes which are deployment-specific.



You're right, I was wrong; leaving the grandparent post just for context for your response, otherwise I'd delete it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: