Re: Worst Error Message?

On 31 Jul 2011, at 17:46, Rafael Heise wrote:

> In my opinion, as a network administrator, I don't want to show to my end users why the user shouldn't commit anything in the repository.

In my opinion as a Subversion user, that sucks. I think I'll switch to Mercurial. Oh, no wait, the Subversion team agreed with me and changed the message.

> Because as Les Mikesell said, the message could show someway to workaround and allow the user to commit something without permission.

If there *is* a work around, that is a security fail anyway. I hope, for your employers sake, you do not rely on security through obscurity.

> I think the current message, 403-forbidden is a excellent message because when the end user sees this message, the user needs to call me and ask why is not possible to commit, and then I can explain that the folder, for that user, is only for read.

I think it is a terrible message, because, if I see "403 forbidden" I call the network admin to find out why the web server is broken. If I see "You do not have permission to commit to $URL" I call the configuration manager to apply to join the list of committers.

Notwithstanding that the "403 forbidden" exposes a detail of implementation that you think could lead to a work around.

> If he/she need to commit something to that folder, the user need to talk with someone who has permission. Or ask for the administrator to change the permissions.

So where's the harm in telling them that in their native language rather than expecting them to understand HTTP response codes?

> I guess a lot of users gets confuse about the sides, and as a lot of people are both (user and administrator) they just think the messages should show in the client-side "what is wrong" to fix it in the server, but the messages are not to the client-side know how to fix in the server but just to let the users know that they CAN NOT commit anything because they have no permission, just it.
>

If a user is not meant to have permission to commit stuff to the repository, they certainly shouldn't have the necessary admin rights on the server to fix the problem.
Received on 2011-07-31 22:42:13 CEST