You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, it is possible to pick between -v (default) and -s with the silent: [bool] parameter in the workflow config. Both of these options don't fit my needs:
--verbose/ -v logs a lot of information to the publically available workflow runs, that I do not want to be available including the domain of the webhook_url that I (as suggested in README.md) explicitly used a secret for. Also the resolved IP address is logged. This opens the door for DDoS attacks and makes hacking the machine one step easier.
--silent/ -s doesn't log anything (but I think this is obvious 😄), not even the response code.
Not specifying either -v or -s does log a minimal amount of output which would be enough for me to debug most issues, but little enough to not compromise on privacy.
Example output (on windows, but it should be similar on alpine): curl: (22) The requested URL returned error: 403 Forbidden. That's all.
I think the best way to address this issue is to add another option verbose: [bool] similar to silent: [bool].
Once again (as in #20), I do believe this new log level should be the default, but your opinion and that of other users might vary. Depending on your opinion the default value could be verbose: true or verbose: false.
Having the new log level as the default would also make fixing #22 way less critical.
The text was updated successfully, but these errors were encountered:
Adds a new log level between `--verbose` and `--silent`.
Defaults to the new log level. Added new option `verbose` that
re-enables verbose output (previous default) if set to `true`.
This allows easier debugging without entirely compromising on privacy
and security (domain, IP addresses etc.). For more details see distributhor#21.
This also reduces the propability of replay attacks as mentioned in distributhor#22,
as the signatures are no longer logged by default.
Uh oh!
There was an error while loading. Please reload this page.
I'd like to have another log level between
--verbose
/-v
and--silent
/-s
.Currently, it is possible to pick between
-v
(default) and-s
with thesilent: [bool]
parameter in the workflow config. Both of these options don't fit my needs:--verbose
/-v
logs a lot of information to the publically available workflow runs, that I do not want to be available including the domain of thewebhook_url
that I (as suggested inREADME.md
) explicitly used a secret for. Also the resolved IP address is logged. This opens the door for DDoS attacks and makes hacking the machine one step easier.--silent
/-s
doesn't log anything (but I think this is obvious 😄), not even the response code.Not specifying either
-v
or-s
does log a minimal amount of output which would be enough for me to debug most issues, but little enough to not compromise on privacy.Example output (on windows, but it should be similar on alpine):
curl: (22) The requested URL returned error: 403 Forbidden
. That's all.I think the best way to address this issue is to add another option
verbose: [bool]
similar tosilent: [bool]
.Once again (as in #20), I do believe this new log level should be the default, but your opinion and that of other users might vary. Depending on your opinion the default value could be
verbose: true
orverbose: false
.Having the new log level as the default would also make fixing #22 way less critical.
The text was updated successfully, but these errors were encountered: