Re: Error message suggestion

On Thu, Jun 29, 2006 at 04:52:09PM -0700, Tim Freedom wrote:
> As you can see there is no mention of a password.  It would have
> been ideal to see something akin to 'pr-edit: access denied -
> password rejected' or similar, no ?

In short, "No."  Whether the original editor of the gnatsd daemon
intended it or not, it was the right decision NOT to mention whether
the password or the account name was incorrect.  Doing so is to give a
brute-force attacker more information than is necessary.

> I'm sure there are other errors that are just as ambiguous which
> ought to get looked into again (just a thought).

I agree with you there.  The command-line tools could use some
error-reporting and user interface rationalization.

-- 
Chad Walstrom <[email protected]>           http://www.wookimus.net/
           assert(expired(knowledge)); /* core dump */