Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove last digits of IP in server logging (default) #578

Closed
wants to merge 2 commits into from

Conversation

ann0see
Copy link
Member

@ann0see ann0see commented Sep 6, 2020

My proposal in #576 (comment)
To be discussed.

@pljones
Copy link
Collaborator

pljones commented Sep 7, 2020

Sorry, I strongly object to having this information removed. If I'm providing a public service and someone chooses to use it, they choose to expose their IP address.

@pljones
Copy link
Collaborator

pljones commented Sep 7, 2020

It's also a potential security flaw, as it anonymises clients, enabling DDoS attacks more easily.

I can't see that it provides any benefits at all.

@atsampson
Copy link
Contributor

I also don't think this is a good idea - it's not effective anonymisation, and it just makes the server operator's life harder. Better to document that the logs contain addresses and you should treat them like logs from any other server, i.e. use something like logrotate to manage retention.

@ann0see
Copy link
Member Author

ann0see commented Sep 8, 2020

What does @corrados think? Should it be closed or should the default behavior be changed to "show full IPs in log except if server is started with e.g. —anonymizeip“?

I strongly believe that there should be a way in jamulus that anonymizes IPs. It does not have to be the default setting. Adding it would be more easy for the server admin to decide also if he can’t compile jamulus himself

@corrados
Copy link
Contributor

corrados commented Sep 8, 2020

I actually agree with the others. I think the IP address is an essential part of the server operation. If a user does not want to see and log any IP address, he can run the server headless with std-out piped to the null device and do not use the logging feature.

@ann0see
Copy link
Member Author

ann0see commented Sep 8, 2020

Ok. If you think that’s ok like this, I‘ll close the PR (although I don’t see a problem with opt in to hide IP). If it comes up again, the code is still there.

@ann0see ann0see closed this Sep 8, 2020
@ann0see ann0see deleted the master branch January 9, 2021 21:36
@ann0see ann0see restored the master branch January 9, 2021 21:36
@ann0see ann0see deleted the master branch January 10, 2021 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants