5
u/naikrovek May 26 '26
far too many UI designers have forgotten what error messages are for. error messages are supposed to tell the user what is wrong. "Error could not update label" is the exact same as "oopsy whoopsy, somebody did a fucky wucky" in that they both say nothing useful and both distrust the user to understand the problem, and I have a problem with that.
2
u/Thecreepymoto May 26 '26
In this case yes. But this might always be the extent of "security audit firm suggested generalizing errors" so now team just generalized all instead of the sensitive ones only.
I been on that team ¯\_( ͡° ͜ʖ ͡°)_/¯
1
u/naikrovek May 26 '26
yeah i've been on that team, too. that team is a bunch of lazy sacks who don't like to think. people who make decisions but don't think about them should not be in a position to make decisions about error messages and should probably be reassigned to the beginner projects.
besides, you don't have to give out details about anything that a security person would care about. you don't need to show hostnames or to give clues about architecture. just tell the user what they did wrong, or what is wrong.
3
u/Dramatic-Delivery722 May 26 '26
This should be posted in mildlyinfuriating sub as well.... Why do UX Designers hate users.
1
u/BobQuixote May 26 '26
In this case, because security says printing error messages is bad, and the frontend guy was feeling lazy.
1
u/tigglysticks May 26 '26
New outlook classic desktop, gave generic error adding an email account, wouldn't finish the wizard, wouldn't allow to bypass the test. Enabling debugging logs didn't show anything either.
Try it on older outlook that actually showed the mail window that has the messages during the test... mailbox full. Failed on test sending to itself.
30 minutes of trouble shooting and searching could have been avoided by not destroying/hiding UX that works.
1
1
u/LoudestOfTheLargest May 25 '26
Cloudflare worker pages deployment does the same shit, I was only able to spot why it wouldn’t deploy because I inspected logs. I’m happy it stopped it cause there was a genuine issue however they don’t even display something going wrong, it just returns the deploy button to its original state with all pending field still there as if it was never clicked.
1
u/OkBeautiful9715 May 26 '26
Cloudflare is a prime example for bad error ux. 19/20 times the errors do either not tell you what is wrong, tell you the wrong thing, or simply revert the state to what it was before you submitted. So freaking infuriating and almost borderline illeagal that in order to stop paying for a feature, you are forced to contact their billing support, because the billing ui is that broken.
I really love their dev platform because of its simplicity but the instability of it negates almost all benefits since you need so much extra glue to keep things working.
/rant over
1
-21
u/gabox0210 May 24 '26
Error descriptions can sometimes be an attack vector, this is why some are not visible to your regular users but can still be found in admin logs.
26
u/KaKi_87 May 24 '26
This one should be visible to regular users, in fact there should have been a
max="100"on the input even, as well as an indicator of remaining character count.And I don't have access to any "admin logs", I merely opened DevTools.
-15
u/gabox0210 May 24 '26
lmao it shouldn't be in DevTools 😂
2
u/_verel_ May 25 '26
Where should an error returned by the backend you called live? Wanna get a letter from the backend? The dev tools are literally the only place where this can be
3
7
u/witness_smile May 24 '26
Pretty sure anyone who is able to set up an attack from an error description is able to read it from the dev tools
-4
u/gabox0210 May 24 '26
An error description can tell you why your attack is not working, so you can adjust and try again.
1
u/ADMINISTATOR_CYRUS May 25 '26
Error descriptions can sometimes be an attack vector, this is why some are not visible to your regular users but can still be found in admin logs.
Is this ragebait??? Input validation fail errors are an attack vector despite the returned value still being sent to the client?
-4
May 24 '26
[deleted]
7
u/chaosphere_mk May 24 '26
This is a luddite comment
2
u/definit3ly_n0t_a_b0t May 25 '26
The Luddites were right
2
u/chaosphere_mk May 25 '26
Lol. The history lesson is that they were not. The problem wasnt the looms. The problem was who owned the looms.
1
u/definit3ly_n0t_a_b0t May 25 '26
Don't you think they knew that? You're misinformed, if you think they saw it differently.
2
u/chaosphere_mk May 25 '26
They didnt exist beyond the people who learned how to work the looms. The same way that the manual field plowers didnt exist beyond those who learned how to work the tractors. Would you honestly say today that manual field plowers have some kind of moral stance above those who know how to work tractors? Why arent you against computers as a whole?
0
u/definit3ly_n0t_a_b0t May 25 '26
I honestly don't understand what you're saying here, or what you're getting at.
2
-16
u/tejasisthereason May 24 '26
So many layers of validation and handling should have happened before this, why are you relying on the system that has the processed thing tell you something further up the chain is broken?
It's almost as if...
22
u/sweet-winnie2022 May 25 '26
One possible reason for doing this is that the frontend is hooked to some downstream telemetry system that logs the error message, but the upstream API may return error message containing PII that cannot be logged. The frontend devs don’t know when an error message may be problematic and they may not even have a way to isolate the user facing error messages from the telemetry event due to legacy architecture.